"Fork Locally" ran the selected chain in the browser through
@acala-network/chopsticks-core, which brings its own @polkadot stack
(types, rpc-provider, util-crypto 13 and 14) and @polkadot/wasm-crypto
7.5.4 with the crate versions pezkuwi-wasm 7.5.21 moved off. The app
shipped that second wasm twice, next to ours, for a developer tool;
chopsticks itself stays available from the command line.
Gone: the button, the overlay, the "Local" mock-account modal and the
chopsticks account group, the fork path in the API context, and their
69 locale strings. Mock accounts a fork left in a browser's keyring are
address-only; they now show with the test accounts.
yarn.lock: 32 @polkadot and 2 @acala-network entries -> 0.
@pezkuwi/dev 0.86.6 passes --experimental-test-module-mocks through to
node and gives the browser env jsdom's own events, the DOM node
hierarchy and the layout observers. The test scripts pass the flag, and
the five integration specs that were excluded while they depended on
jest.mock (Accounts, Create, Contacts, Bounties, AccountSidebar) run
again.
`yarn test` excluded every ^page- and ^react- spec, and test:all (the
nightly) is disabled, so 21 of the 25 specs ran nowhere and had broken
unnoticed. The exclusions now name only the integration specs still
built on jest.mock (Accounts, Create, Contacts, Bounties, the account
sidebar) and the two that hang (Modal, Popup), plus the .slow. ones;
13 spec files run instead of 1 (137 tests). @pezkuwi/dev 0.86.5 brings
the dev-test fix toEqual(expect.arrayContaining(...)) needs.
- yarn.lock refreshed within existing ranges for the open advisories.
- copy-webpack-plugin 11 -> 14 (serialize-javascript 7) and
terser-webpack-plugin 5.6: build:www output is identical except four
chunks where terser now emits `a ?? b` for `null == a ? b : a`.
- testcontainers (page-addresses, test-support) and devtron were never
imported: removed (undici, @fastify/busboy, highlight.js went with
them).
- The crypto-browserify webpack fallback was dead: build:www is
byte-identical without it, so the fallback and the dependency are gone
and a future `crypto` import fails the build instead of shipping a
polyfill.
- braces resolves to @pezkuwi/braces 3.0.4, which limits nesting depth
(CVE-2026-93687; no upstream release).
- dev ^0.86.4 at the root and in packages/apps; directives renamed by
pezkuwi-dev-migrate-eslint10.
- eslint --fix with the 0.86.4 config; one fix broke syntax
(typescript-eslint prefer-optional-chain turned
`(isStarted && onStart) && onStart()` into `(isStarted && onStart?.();`
in TxButton) and is corrected by hand.
- The remaining findings fixed rather than disabled: optional chains
(each suggestion reviewed), `cause` on rethrown errors, `if` instead of
`a && promise` in effects, parallel instead of sequential awaits in
Promise.all, Error rejections, no `delete` on arrays (the storage query
cache is a Map; an upload's file list no longer keeps a hole), no
`[object Object]` stringification (TFunction's second argument is text
or options), dead code removed (referenda's never-shown expand button,
react-query's unused CoreDescriptor).
- react-router 6.30.6 / @remix-run/router 1.23.4 (open redirect, XSS advisories)
- styled-components 6.5.3, which brings postcss 8.5.28
- query-string 9.5.1 for decode-uri-component 0.5.0; parse() is the only API
used and is unchanged
- in-range lockfile refresh
Bundle compared against the live build of 570586b: vendor chunks and the
loader change; the one page chunk that differs only renumbers the
query-string module. Tests 89/89, lint and type check green.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Satoshi Qazi Muhammed