The 7 open Dependabot alerts matched versions still pinned in yarn.lock. `yarn up -R` moves pbkdf2, source-map-js, http-cache-semantics and ajv to fixed versions within range. serialize-javascript came through copy-webpack-plugin 11 (^6); copy-webpack-plugin 14 asks for ^7.0.3 and resolves 7.1.2. Its use here is `patterns: [{ from: 'public' }]`; the chrome and firefox build zips are byte-identical before and after (41 files each, sha256).
Left: elliptic 6.6.1, for which no fixed version exists (via browserify-sign / create-ecdh).
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3 in the root and in every
workspace package (they still asked for 0.84.3)
- tsconfig.base target ES2022, the @pezkuwi/dev default; it carries
the ErrorOptions type for `cause`
- rethrown errors carry the original as `cause`; rejections are
normalised to Error
- page/messaging: the typed subscriber is called directly, not as
`Function`
- chrome mock: constant results through Promise.resolve
- useLedger: drop a construction every branch below repeated
- InputWithLabel: onKeyDown instead of the deprecated onKeyPress
- Account: toggleActions + 1 instead of a pre-increment of a parameter
- optional chains where a guard tested the same value
- specs: mount<React.Component> so the wrappers are not `any`-typed
- AccountsStore.set keeps its async override of KeyringStore.set:
BaseStore.set handles its own failure, so it never rejects
- extension-chains keeps its ChainProperties assertion: the package's
own build does not load the type augmentation
- the existing React Compiler findings (37, react-hooks rules only)
are recorded in eslint-suppressions.json; a new one fails lint
- extension-dapp and extension-inject had the manifest the build writes
into build/ committed as their source manifest (main
./build/cjs/index.js, an exports map into ./build/). They are back in
the source form of the upstream manifests; the build generates those
fields itself.
- Dependencies between the packages were workspace:*, and the build
copies them into the published manifest as they are:
@pezkuwi/extension-base 0.62.19 on npm depends on
"@pezkuwi/extension-chains": "workspace:*" and cannot be installed.
They are exact versions, as upstream has them; yarn still links the
workspaces.
- @pezkuwi/* common dependencies ^14.0.26 and api dependencies ^16.5.37.
These carry wasm-crypto 7.5.20, where ed25519, secp256k1, derivation
and bip39 are implemented; 7.5.18 shipped them as "not yet
implemented" stubs. The root resolutions that forced 14.0.25, 16.5.36
and wasm-crypto 7.5.18 onto the tree are removed; every @pezkuwi
package resolves to a single version without them.
- @pezkuwi/dev ^0.85.12.
- One version for everything: the packages were at 0.62.20, the
extension package at 0.62.23, the root at 0.62.24 and the browser
manifests at 0.62.26. All are 0.62.27, above every version on npm and
in the stores.
The diff step rebuilds the extension from master-ff-src.zip (the source
archive AMO reviews) and compares the result with our build. It had never
worked, which the removed continue-on-error was hiding:
- The source zip left out .yarn/releases (yarnPath points there, so yarn
could not start in the unpacked source) and scripts/ (build:ff runs
scripts/postbuild-cleanup.cjs). Both are now included.
- diff.sh used `[ a || b ]`, which is not valid test syntax, and piped
`diff -qr` into `sort`, so the check exited 0 whatever diff found. It now
goes by diff's own exit status; with a file altered it fails.
- With those fixed, the builds still differed: webpack inlined
import.meta.url from @pezkuwi/* packageInfo.js as the absolute file://
path of the build machine, which also put our build directory into the
published extension. DefinePlugin now gives it a fixed value; it is only
shown in duplicate-version warnings.
Also fail-fast: false on the matrix. Without continue-on-error, the first
red step cancelled the others, so their results were lost.
Checked locally with node_modules as locked: "Builds are identical".
Clears the Dependabot alerts that can be fixed inside the ranges the
packages already declare, and drops one dependency nothing used.
- Transitive bumps within declared ranges: axios, bn.js, undici, tar,
postcss, minimatch, picomatch, brace-expansion, fast-uri, js-yaml,
lodash, ws, ip-address, node-forge, follow-redirects, form-data,
http-proxy-middleware, launch-editor, nanoid, qs, rollup, shell-quote,
websocket-driver, flatted, colord, json5, browserslist.
- styled-components 6.3.8 -> 6.5.3 (pulled by @pezkuwi/react-identicon and
react-qr); 6.5 no longer pins postcss 8.4.49.
- Remove extract-loader from packages/extension: no webpack config or
source references it, and it was the only path to babel 6,
babel-traverse and browserslist 3.
What ships changes in two modules only. Built before and after, with
build paths normalised: content.js is byte-identical; page.js and
background.js differ in bn.js (5.2.2 -> 5.2.3); extension.js differs in
bn.js and axios (1.13.4 -> 1.20.0, reached only through
@zondax/ledger-substrate). Every other difference is the minifier
renaming identifiers. No @pezkuwi/* package, wasm-crypto or bip39 code
changes.
Left for a change in @pezkuwi/dev, where they come from: webpack-dev-server
4 and what it pulls (webpack-dev-middleware, qs 6.14, uuid 8, node-forge),
got 9 via gh-release, serialize-javascript 6 via terser-webpack-plugin,
minimatch 9.0.3 via @typescript-eslint 6. All build or local-dev tooling.
elliptic has no patched release; it arrives through crypto-browserify,
the webpack crypto fallback.
lint and test give the same result before and after this change; both
were already failing on main (41 lint errors, 19 of 61 tests), hidden by
continue-on-error in pr-any.yml.
- Change postMessage targetOrigin from '*' to window.location.origin
- Add pendingAuthUrls Set to prevent authorization race conditions
- Remove from pending set on auth completion/rejection/deletion
Fixed race condition where message handlers could process requests
before cryptoWaitReady() and keyring.loadAll() completed.
Now all message handlers wait for initialization before processing,
which fixes the seed creation failure on first account creation.
- Add AuthorizeCall signed extension support for PezkuwiChain
- Update extension name to "pezkuwi{.js} extension"
- Update version to 0.62.21
- Fix signing for transactions that require custom signed extensions
- Add scripts/postbuild-cleanup.cjs to remove unsafe Function patterns
- Add lint:extension script for web-ext validation
- Fix manifest_firefox.json strict_min_version to 112.0
- Reduces web-ext warnings from 14 to 10
- Update version to 0.62.20 in package.json and manifests
- Fix Firefox manifest strict_min_version from 142.0 to 109.0
- Update @pezkuwi/api packages to ^16.5.11
- Update @pezkuwi/dev to ^0.85.7
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- New Firefox extension ID for AMO
- Fixed data_collection_permissions for Mozilla compliance
- Updated webpack config for ES2022 target
- Added firefox-postprocess.sh script
- Bumped all packages to 0.62.18
Chrome and Firefox manifests were missing the required version field,
causing extension loading failures.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update all copyright headers from 2025 to 2026
- Fix @polkadot references to @pezkuwi in config files
- Fix eslint.config.js import path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update Identicon.tsx to use pezkuwi theme instead of jdenticon fallback
- Update Ledger app references from Polkadot to Pezkuwi
- Update translation file for Ledger text
