The 7 open Dependabot alerts matched versions still pinned in yarn.lock. `yarn up -R` moves pbkdf2, source-map-js, http-cache-semantics and ajv to fixed versions within range. serialize-javascript came through copy-webpack-plugin 11 (^6); copy-webpack-plugin 14 asks for ^7.0.3 and resolves 7.1.2. Its use here is `patterns: [{ from: 'public' }]`; the chrome and firefox build zips are byte-identical before and after (41 files each, sha256).
Left: elliptic 6.6.1, for which no fixed version exists (via browserify-sign / create-ecdh).
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3 in the root and in every
workspace package (they still asked for 0.84.3)
- tsconfig.base target ES2022, the @pezkuwi/dev default; it carries
the ErrorOptions type for `cause`
- rethrown errors carry the original as `cause`; rejections are
normalised to Error
- page/messaging: the typed subscriber is called directly, not as
`Function`
- chrome mock: constant results through Promise.resolve
- useLedger: drop a construction every branch below repeated
- InputWithLabel: onKeyDown instead of the deprecated onKeyPress
- Account: toggleActions + 1 instead of a pre-increment of a parameter
- optional chains where a guard tested the same value
- specs: mount<React.Component> so the wrappers are not `any`-typed
- AccountsStore.set keeps its async override of KeyringStore.set:
BaseStore.set handles its own failure, so it never rejects
- extension-chains keeps its ChainProperties assertion: the package's
own build does not load the type augmentation
- the existing React Compiler findings (37, react-hooks rules only)
are recorded in eslint-suppressions.json; a new one fails lint
Nothing proposes updates to the workflow actions: several still declare
the Node 20 runtime, which runners already force to Node 24 with a warning
on every run. Dependabot now checks them monthly and groups all action
updates into one pull request.
Raising the @pezkuwi dependency floors to ^14.0.26 and ^16.5.37 also
rewrote the peerDependencies of extension-dapp, extension-inject,
extension-chains and extension-compat-metamask, which were "*" (as they
are upstream). A peer range is a requirement on the dApp's own
@pezkuwi/api and util; narrowing it would make npm refuse to install
these packages next to an api release from before 16.5.37. They are "*"
again.
The scripts it made executable are run as `sh ./scripts/diff.sh` and
`node scripts/postbuild-cleanup.cjs`; the mode change only left the
tree dirty, and the new tree check fails on that.
- pr-any: after each step the tree must be unchanged (yarn lint runs
eslint --fix, yarn build rewrites packageInfo.ts), and after build
scripts/check-built-manifests.py checks the package.json of each
package in scripts/published-packages.txt: entry points exist, no
./build/ or ./cjs/cjs/ paths, no workspace: ranges.
- push-main bumped the patch version on every push, pushed that commit
to main as a bot, and copied the zips as root to 37.60.230.9, a host
that has been retired; js.pezkuwichain.io no longer serves them and
the extension is distributed through the stores. It now builds,
checks the manifests and keeps the Chrome and Firefox packages as
artifacts of the commit. The version is set in the release PR.
- The auto-approve and auto-merge bots are removed.
- ff-diff/, the output of yarn diff, is ignored by git and eslint.
mnemonicGenerate was forced onto the JavaScript path because
wasm-crypto 7.5.18 had no bip39Generate. 7.5.20 has it: 1000 phrases of
12 to 24 words generated through wasm were all valid and distinct, and
wasm and JavaScript derive the same mini secret from each. The call is
back to the upstream form, which uses wasm when it is ready.
- extension-dapp and extension-inject had the manifest the build writes
into build/ committed as their source manifest (main
./build/cjs/index.js, an exports map into ./build/). They are back in
the source form of the upstream manifests; the build generates those
fields itself.
- Dependencies between the packages were workspace:*, and the build
copies them into the published manifest as they are:
@pezkuwi/extension-base 0.62.19 on npm depends on
"@pezkuwi/extension-chains": "workspace:*" and cannot be installed.
They are exact versions, as upstream has them; yarn still links the
workspaces.
- @pezkuwi/* common dependencies ^14.0.26 and api dependencies ^16.5.37.
These carry wasm-crypto 7.5.20, where ed25519, secp256k1, derivation
and bip39 are implemented; 7.5.18 shipped them as "not yet
implemented" stubs. The root resolutions that forced 14.0.25, 16.5.36
and wasm-crypto 7.5.18 onto the tree are removed; every @pezkuwi
package resolves to a single version without them.
- @pezkuwi/dev ^0.85.12.
- One version for everything: the packages were at 0.62.20, the
extension package at 0.62.23, the root at 0.62.24 and the browser
manifests at 0.62.26. All are 0.62.27, above every version on npm and
in the stores.
The diff step rebuilds the extension from master-ff-src.zip (the source
archive AMO reviews) and compares the result with our build. It had never
worked, which the removed continue-on-error was hiding:
- The source zip left out .yarn/releases (yarnPath points there, so yarn
could not start in the unpacked source) and scripts/ (build:ff runs
scripts/postbuild-cleanup.cjs). Both are now included.
- diff.sh used `[ a || b ]`, which is not valid test syntax, and piped
`diff -qr` into `sort`, so the check exited 0 whatever diff found. It now
goes by diff's own exit status; with a file altered it fails.
- With those fixed, the builds still differed: webpack inlined
import.meta.url from @pezkuwi/* packageInfo.js as the absolute file://
path of the build machine, which also put our build directory into the
published extension. DefinePlugin now gives it a fixed value; it is only
shown in duplicate-version warnings.
Also fail-fast: false on the matrix. Without continue-on-error, the first
red step cancelled the others, so their results were lost.
Checked locally with node_modules as locked: "Builds are identical".
pr-any.yml ran lint, test and build with continue-on-error: true, so every
PR showed success while main had 41 lint errors and 19 of 61 tests failing.
The flag is removed and the failures are fixed:
- TypeScript 5.5.4 -> 5.9. @pezkuwi/util and friends ship declarations
with Uint8Array<ArrayBufferLike>, which 5.5 cannot read, so every such
value was typed `any` here (the 16 wrapBytes errors). The pin dates from
a styled-components declaration problem that went away with the move
back to styled-components 5; build and lint pass on 5.9.
- State.ts: the stored security log is parsed through a function that
returns an empty log for anything that is not a JSON array, instead of
letting `any` flow on; fire-and-forget logging uses .catch(console.error)
like the rest of the codebase; object keys sorted.
- buildHierarchy.spec.ts: a rename had replaced the genesis hashes with
0x..01 / 0x..02, which resolve to no network name, so sorting by network
had nothing to sort on. The test now takes two real entries from
chains.ts by name.
- scripts/*.cjs is in the lint project (it failed to parse); header and
key order fixed in postbuild-cleanup.cjs.
- temp_ff_validate/ (43 build files) and pezkuwi-chrome-0.62.22.zip were
committed by accident in f5495f7; removed and ignored.
16 of the 19 failing tests are not fixed here: they fail because
@pezkuwi/wasm-crypto 7.5.18 stubs ed25519, secp256k1 and sr25519
derivation. With the 7.5.19 build from pezkuwi-wasm#2 installed locally,
lint is clean and all 61 tests pass. Until 7.5.19 is published and
picked up here, those 16 stay red on this PR, which is the point.
Clears the Dependabot alerts that can be fixed inside the ranges the
packages already declare, and drops one dependency nothing used.
- Transitive bumps within declared ranges: axios, bn.js, undici, tar,
postcss, minimatch, picomatch, brace-expansion, fast-uri, js-yaml,
lodash, ws, ip-address, node-forge, follow-redirects, form-data,
http-proxy-middleware, launch-editor, nanoid, qs, rollup, shell-quote,
websocket-driver, flatted, colord, json5, browserslist.
- styled-components 6.3.8 -> 6.5.3 (pulled by @pezkuwi/react-identicon and
react-qr); 6.5 no longer pins postcss 8.4.49.
- Remove extract-loader from packages/extension: no webpack config or
source references it, and it was the only path to babel 6,
babel-traverse and browserslist 3.
What ships changes in two modules only. Built before and after, with
build paths normalised: content.js is byte-identical; page.js and
background.js differ in bn.js (5.2.2 -> 5.2.3); extension.js differs in
bn.js and axios (1.13.4 -> 1.20.0, reached only through
@zondax/ledger-substrate). Every other difference is the minifier
renaming identifiers. No @pezkuwi/* package, wasm-crypto or bip39 code
changes.
Left for a change in @pezkuwi/dev, where they come from: webpack-dev-server
4 and what it pulls (webpack-dev-middleware, qs 6.14, uuid 8, node-forge),
got 9 via gh-release, serialize-javascript 6 via terser-webpack-plugin,
minimatch 9.0.3 via @typescript-eslint 6. All build or local-dev tooling.
elliptic has no patched release; it arrives through crypto-browserify,
the webpack crypto fallback.
lint and test give the same result before and after this change; both
were already failing on main (41 lint errors, 19 of 61 tests), hidden by
continue-on-error in pr-any.yml.
- Change postMessage targetOrigin from '*' to window.location.origin
- Add pendingAuthUrls Set to prevent authorization race conditions
- Remove from pending set on auth completion/rejection/deletion
Fixed race condition where message handlers could process requests
before cryptoWaitReady() and keyring.loadAll() completed.
Now all message handlers wait for initialization before processing,
which fixes the seed creation failure on first account creation.
The ui-settings LANGUAGE_DEFAULT is 'default' but no locale folder exists for it.
This caused i18n to fail loading translations, breaking the entire UI including
wallet creation screen (showed <unknown> instead of text).
Fix normalizes 'default' language to 'en' in the i18n Backend.
Added PEZKUWI_USER_EXTENSIONS with AuthorizeCall to the signing request
registry. This ensures proper transaction signing for PezkuwiChain
networks even when chain metadata is not available.
Without this fix, transactions fail with "bad signature" errors
because the AuthorizeCall extension is not properly included in
the signed payload.
All genesis hashes now from live chains:
- PezkuwiChain: 0xbb4a61ab0c4b8c12f5eab71d0c86c482e03a275ecdafee678dea712474d33d75
- Asset Hub: 0x00d0e1d0581c3cd5c5768652d52f4520184018b44f56a2ae1e0dc9d65c00c948
- People Chain: 0x58269e9c184f721e0309332d90cafc410df1519a5dc27a5fd9b3bf5fd2d129f8
- Zagros Testnet: 0x96eb58af1bb7288115b5e4ff1590422533e749293f231974536dc6672417d06f
- Add AuthorizeCall signed extension support for PezkuwiChain
- Update extension name to "pezkuwi{.js} extension"
- Update version to 0.62.21
- Fix signing for transactions that require custom signed extensions
- Fix Chrome/Firefox zip build scripts to copy manifest to build folder
- Update all @pezkuwi packages to latest stable versions (API 16.5.36, Common 14.0.25)
- Add scripts/postbuild-cleanup.cjs to remove unsafe Function patterns
- Add lint:extension script for web-ext validation
- Fix manifest_firefox.json strict_min_version to 112.0
- Reduces web-ext warnings from 14 to 10
- Update version to 0.62.20 in package.json and manifests
- Fix Firefox manifest strict_min_version from 142.0 to 109.0
- Update @pezkuwi/api packages to ^16.5.11
- Update @pezkuwi/dev to ^0.85.7
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
