x-randomvalues read one export from react-native, NativeModules, and
took its types from the deprecated @types/react-native, which depends
on react-native itself: react-native 0.83, metro 0.83 and with them
image-size (open advisory, fixed only in 2.x, which metro 0.83 does not
accept). The two native modules it looks for are now declared in
src/react-native-modules.d.ts; the casts to RNExt are gone and each
module is checked before use. The published react-native.d.ts does not
reference react-native, and react-native/metro leave the dependency
tree.
braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.
Lockfile only. 89 open Dependabot alerts; each vulnerable range was checked against yarn.lock and `yarn up -R` moved every package with a fix inside its dependents' ranges (tar, axios, form-data, shell-quote, fast-uri, brace-expansion, ...); terser-webpack-plugin 5.6 drops serialize-javascript.
Left, with no fix inside range: sprintf-js 1.0.3 (no fixed version exists; via argparse 1 / js-yaml 3) and image-size 1.2.1 (fixed in 2.0.3; metro 0.83 asks for ^1.0.2).
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3
- rethrown errors carry the original as `cause` (hw-ledger, address decode)
- optional chain in isEthereumAddress, includes() in bip39 validation
- logger calls the lazy formatter through a typed function
- x-global: an assertion to the type the value already has removed,
with the comment and directive that explained it
- type-only re-exports of modules that emit no JavaScript
- disable directives renamed for the new rule names, or removed where
the rule no longer reports
Nothing proposes updates to the workflow actions: several still declare
the Node 20 runtime, which runners already force to Node 24 with a warning
on every run. Dependabot now checks them monthly and groups all action
updates into one pull request.
The deno step mapped every package to https://deno.land/x/pezkuwi/..., which
never existed (nor does @pezkuwi on JSR): it was red on every run, hidden by
continue-on-error. Decided 2026-10-07: no Deno build. The src/mod.ts entry
points (imported by nothing else, and the switch that makes the build emit
build-deno/), the import maps, the deno script and the CI step are removed.
The npm packages are unchanged; Deno users can import them as npm:.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
formatDecimal split digits with /(\d+?)(?=(\d{3})+(?!\d)|$)/g, whose
lookahead rescans the rest of a digit run at every position: quadratic in
the run's length (CodeQL js/polynomial-redos, high; inherited unchanged
from upstream). 20k digits took 258 ms, 200k about 25 s.
A loop now finds the same groups: within each digit run a group ends where
the digits left are a positive multiple of three, or at the end of the
string. Identical output to the pattern on 210,000 random inputs plus the
edge cases (letters around digits, short runs, negatives); 200k digits take
7 ms. The new spec case for a 60k-digit number fails on the old code.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- continue-on-error came with the upstream template: lint, build and test
have been red here while every pull request read as passing (12 test
failures and 603 lint errors before this branch). fail-fast: false keeps
each step running when another fails.
- after build, scripts/check-built-manifests.py checks the package.json in
every build/ directory, the file npm receives (the January 2026 ./cjs/cjs
fault, and the wasm 7.5.19 one).
- auto-approve/auto-merge (upstream author's actions, merge on a '-auto'
label once checks reported) are removed, as in pezkuwi-apps.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- main/module/types/exports/browser/react-native/sideEffects back to the
upstream source form (they held the build's rewritten copies)
- @pezkuwi/dev ^0.85.12; util-crypto on @pezkuwi/wasm-crypto and wasm-util
^7.5.20 (the first complete wasm-crypto) and on @noble/curves ^1.9.7 and
@noble/hashes ^1.8.0, the versions whose current APIs it now uses
- resolutions: only typescript, as upstream; the pins that held the whole
tree to wasm 7.5.17 are gone
- every package at 14.0.26 (npm had 14.0.25, this tree said 14.0.22/23), with
the internal dependencies at the same version
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
test-bizinikiwi.mjs was a one-off check from the 14.0.25 release, referenced
nowhere, and failed lint (outside the TypeScript project).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The sr25519 cases verified upstream's vectors, signed under the substrate
context, which this package does not accept: four cases failed whenever the
suite ran. New vectors come from fixed seeds named in the spec and verify
in both implementations (scure-sr25519 and the wasm Rust one); the upstream
signature stays as a case that must not verify.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The registry gave the mainnet relay prefix 0, PZW and 10 decimals and Zagros
prefix 2 and ZGS, with genesis hashes from chains since relaunched; the nodes
report ss58Format 42, HEZ and 12 decimals. Today a lookup by genesis fails
and apps fall back to 42, so addresses come out right by accident; with a
current genesis they would have been formatted with prefix 0.
- pezkuwi and zagros: prefix 42, HEZ, 12 decimals (decided 2026-10-07; the
relaunched mainnet keeps them)
- Zagros genesis is the live one; the mainnet has none until its relaunch,
since a stale hash identifies a chain that no longer exists
- the PezkuwiChain entry (prefix 1453, PZC) and the dicle genesis describe
no chain and are removed
The spec now holds the real data: the Pezkuwi networks report 42/HEZ/12, a
prefix is shared only at 42 (upstream's one-network-per-prefix rule cannot
hold when the chains share the generic format), no two networks claim one
genesis. Red with the mainnet back at prefix 0.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The ranges ^1.3 resolve to @noble/curves 1.9 and @noble/hashes 1.8 for
everyone who installs this package, and those mark the calls used here
deprecated: the sha256/sha512/blake2b module paths, ProjectivePoint,
toRawBytes, px/py, Signature.fromCompact.
- hashes from @noble/hashes/sha2 and @noble/hashes/blake2
- secp256k1.Point with toBytes(true) for compression
- expand reads the affine x/y (toAffine) instead of the projective fields
- recover builds the signature with Signature.fromBytes(sig, 'compact') and
returns toBytes() (compressed, as toRawBytes() did). Its method form of
recoverPublicKey stays, with the reason on the line: the replacement is not
in @noble/curves 1.9's types, and 2.x, which types it, is ESM-only.
The minimum versions rise with this (package.json, next commit).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
On TypeScript 5.5 (upstream's) require('@pezkuwi/util') in this CommonJS
shim reported an error the directive silenced; on 5.9, which this tree
resolves, the line is clean and the unused directive fails the build.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The renamed chains (dicle, pezkuwi, pezkuwichain, zagros) were inserted where
their predecessors stood, which sort-keys rejects. The 57 entries are
unchanged; only their order is.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Import order and stray blank lines left by the scure-sr25519 swap, plus the
2026 headers of these files. eslint --fix output; no code changes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The header rule takes the current year as the end of the range, as upstream's
does; 581 sources still ended at 2025, which failed lint. Lint never ran to
completion here, so this went unseen.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
19c8d69 (2026-01-11) and later commits added the build's output to every
package directory: 1484 .js/.d.ts files under cjs/ and at the package roots,
plus 14 copies of LICENSE (identical to the root one, which the build copies
into each package itself). Upstream keeps none of it. With the source
manifests pointing at them, imports resolved to this stale output instead of
src, and a JavaScript-checking build (@pezkuwi/dev 0.85.12) reads them as
inputs (TS5055).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The root resolutions pointed @pezkuwi/scure-sr25519 at
portal:/home/mamostehp/pezkuwi-wasm/packages/scure-sr25519, a directory
that only existed on the machine 14.0.25 was published from. Everywhere
else `yarn install` stops with "Manifest not found", so this repository
could not be installed, built or tested, and the PR workflow had never run.
util-crypto already asks for ^0.2.1, which is on npm; its lib/ is identical
to packages/scure-sr25519 in pezkuwi-wasm (same "bizinikiwi" signing
context). Dropping the resolution resolves it there.
With this, install, lint and test run. They are not green yet: 161 of
3014 tests fail, most of them on @pezkuwi/wasm-crypto 7.5.17 stubs
(secp256k1, ed25519, scrypt, bip39Generate "not yet implemented"), which
pezkuwi-wasm#2 fixes as 7.5.19. That, the remaining failures and the
continue-on-error in pr-any.yml follow once 7.5.19 is published.
- Author: Dijital Kurdistan Tech Institute <dev@pezkuwichain.io>
- Fixed Uint8Array type errors in test files
- Added @types/react-native devDependency for x-randomvalues
- Added @pezkuwi/hw-ledger devDependency for networks tests
- Added @pezkuwi/x-randomvalues devDependency for util tests
- Updated all internal dependencies to 14.0.12
