braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.
Lockfile only. The 4 open Dependabot alerts matched versions still pinned in yarn.lock. `yarn up -R` moves http-cache-semantics to a fixed version within range; terser-webpack-plugin 5.6 no longer depends on serialize-javascript. After: 0 matching.
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3; disable directives renamed
for the new rule names, or removed where the rule no longer reports
- rethrown errors carry the original as `cause` (13 sites)
- optional chains where a guard expression tested the same value
- Init: the registry cache settles with the creator's own promise,
dropping the entry in finally(), instead of re-wrapping it
- Combinator: a typed call instead of `Function`
- checkTypes.manual: synchronous checks run outside Promise.all
- sortValues, createTypeUnsafe: initial values that were never read
- typegen util: load docs.js for its side effect (it registers the
`docs` Handlebars partial) now that its types are re-exported
type-only
- MockProvider keeps its Header assertion: the package's own build
does not load api-augment, so createType returns a plain Codec there
- Decorate keeps `delete queue[i]`: the hole marks a fired queue and
later indexes must not shift
Carries the tx generator fix (struct and enum arguments keep their object
input) on top of 16.5.38. All packages and their exact internal pins move
to 16.5.39.
Carries the typegen fix for types that contain an account (a0b19f4) and the
api-augment regenerated with it; nothing else changed since 16.5.37
(2a35891). All packages and their exact internal pins move to 16.5.38.
- @pezkuwi/typegen requires handlebars ^4.7.9; 4.7.8 and earlier are
affected by the open handlebars advisories
- yarn.lock: tar, ip-address, brace-expansion, fast-uri, js-yaml,
node-forge, postcss, lodash, ws and the other flagged transitive
packages resolve to patched releases within their declared ranges
The flagged packages still on an affected version are reached only
through the @pezkuwi/dev tool chain (webpack-dev-server 4, eslint 8,
gh-release), which pins their major versions; they are development
tools and are not part of any published package.
The packages/*/package.json files were the manifests the build writes
into build/, committed back over the source ones: exports maps of
thousands of entries pointing at ./cjs/* files, main at ./cjs/index.js,
module and types set. pezkuwi-dev-build-ts generates those fields
itself; in the source they pointed at files that only existed because
build output had been committed too. main, module, types, exports,
browser, react-native and sideEffects are back in the source form of
the upstream manifests; every other field is unchanged.
- @pezkuwi/* common dependencies 14.0.25 -> 14.0.26 (wasm-crypto 7.5.20
underneath, with working ed25519 and secp256k1)
- the root resolutions forcing common 14.0.25 and wasm 7.5.4 onto the
whole tree are removed; only the typescript pin remains
- @pezkuwi/dev, dev-test and dev-ts ^0.85.12
- the deno script is removed
- version 16.5.37
Root resolutions were pinned to 14.0.11, preventing yarn from
resolving to the latest published versions. Updated resolutions
and all package.json dependencies to 14.0.25 which includes
native bizinikiwi signing context via @pezkuwi/scure-sr25519.
- Published from build/ directories for correct npm structure
- Updated common dependencies to 14.0.25
- Added AuthorizeCall signed extension support
- All packages now have index.js at root level
- Update genesis hash to mainnet value
- Remove npmAuthToken from .yarnrc.yml (use GitHub Secrets instead)
- Add pezsp_* and pezframe_* path support in PortableRegistry
Satoshi Qazi Muhammed