The resolutions held the whole tree on wasm-crypto 7.5.17, util-crypto
14.0.25, api 16.5.36, ui 3.17.2 and extension-dapp 0.62.20, the
releases where ed25519, secp256k1, derivation and bip39 were not
implemented in wasm-crypto. Every @pezkuwi pin moves to the release
that has them: common 14.0.26, wasm 7.5.20, api 16.5.37, ui 3.17.3 and
extension 0.62.27; @pezkuwi/dev ^0.85.12. After `yarn dedupe` each
@pezkuwi package resolves to a single version.
Every 6.x release is inside both open advisories, so no 6.x update closes
them: GHSA-wrjc-x8rr-h8h6 (open redirect via a backslash in <Link> and
useNavigate) and GHSA-337j-9hxr-rhxg (SSR hydration; not reachable here,
this is a client-only HashRouter app). 7.18 in library mode keeps every API
the app imports (Routes, Route, Link, NavLink, Navigate, useLocation,
useParams, HashRouter, MemoryRouter) and bundles @remix-run/router.
The one behaviour v7 changes, relative links under splat routes, does not
occur: no route path ends in '*', tab links are absolute (basePath) and the
top level picks the page from location.pathname.
Measured: 17 routes opened in Chromium against the live 6.x build and this
build give the same URL, active tab, tab count and tab-click target, with no
page errors. Tests 89/89, lint and type check green.
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Update @pezkuwi/react-identicon to ^3.17.1
- Update @pezkuwi/react-qr to ^3.17.1
- Update @pezkuwi/ui-keyring to ^3.17.1
- Update @pezkuwi/ui-settings to ^3.17.1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Satoshi Qazi Muhammed