- The static metadata in @pezkuwi/types-support predates the rename and
only knows Pallet* names, while the app (and the test-support creation
helpers) use PezpalletBountiesBountyStatus, PezpalletAllianceCid, ...
createAugmentedApi now also registers the @pezkuwi/types-augment
lookup definitions, and createLookupRegistry gives specs a plain
registry that knows them.
- calculateBountyBond: the description had been rewritten from
"Kusama" (24 bytes) to "Dicle" (23 bytes) with the expected bond left
for 24; now "Pezkuwi network UI Bounty" (25 bytes) and its value.
- page-alliance had no tsconfig.spec.json, so its spec was never
type-checked; added, and specs are excluded from its build config.
- yarn.lock refreshed within existing ranges for the open advisories.
- copy-webpack-plugin 11 -> 14 (serialize-javascript 7) and
terser-webpack-plugin 5.6: build:www output is identical except four
chunks where terser now emits `a ?? b` for `null == a ? b : a`.
- testcontainers (page-addresses, test-support) and devtron were never
imported: removed (undici, @fastify/busboy, highlight.js went with
them).
- The crypto-browserify webpack fallback was dead: build:www is
byte-identical without it, so the fallback and the dependency are gone
and a future `crypto` import fails the build instead of shipping a
polyfill.
- braces resolves to @pezkuwi/braces 3.0.4, which limits nesting depth
(CVE-2026-93687; no upstream release).
The resolutions held the whole tree on wasm-crypto 7.5.17, util-crypto
14.0.25, api 16.5.36, ui 3.17.2 and extension-dapp 0.62.20, the
releases where ed25519, secp256k1, derivation and bip39 were not
implemented in wasm-crypto. Every @pezkuwi pin moves to the release
that has them: common 14.0.26, wasm 7.5.20, api 16.5.37, ui 3.17.3 and
extension 0.62.27; @pezkuwi/dev ^0.85.12. After `yarn dedupe` each
@pezkuwi package resolves to a single version.
Satoshi Qazi Muhammed