The 7 open Dependabot alerts matched versions still pinned in yarn.lock. `yarn up -R` moves pbkdf2, source-map-js, http-cache-semantics and ajv to fixed versions within range. serialize-javascript came through copy-webpack-plugin 11 (^6); copy-webpack-plugin 14 asks for ^7.0.3 and resolves 7.1.2. Its use here is `patterns: [{ from: 'public' }]`; the chrome and firefox build zips are byte-identical before and after (41 files each, sha256).
Left: elliptic 6.6.1, for which no fixed version exists (via browserify-sign / create-ecdh).
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3 in the root and in every
workspace package (they still asked for 0.84.3)
- tsconfig.base target ES2022, the @pezkuwi/dev default; it carries
the ErrorOptions type for `cause`
- rethrown errors carry the original as `cause`; rejections are
normalised to Error
- page/messaging: the typed subscriber is called directly, not as
`Function`
- chrome mock: constant results through Promise.resolve
- useLedger: drop a construction every branch below repeated
- InputWithLabel: onKeyDown instead of the deprecated onKeyPress
- Account: toggleActions + 1 instead of a pre-increment of a parameter
- optional chains where a guard tested the same value
- specs: mount<React.Component> so the wrappers are not `any`-typed
- AccountsStore.set keeps its async override of KeyringStore.set:
BaseStore.set handles its own failure, so it never rejects
- extension-chains keeps its ChainProperties assertion: the package's
own build does not load the type augmentation
- the existing React Compiler findings (37, react-hooks rules only)
are recorded in eslint-suppressions.json; a new one fails lint
- extension-dapp and extension-inject had the manifest the build writes
into build/ committed as their source manifest (main
./build/cjs/index.js, an exports map into ./build/). They are back in
the source form of the upstream manifests; the build generates those
fields itself.
- Dependencies between the packages were workspace:*, and the build
copies them into the published manifest as they are:
@pezkuwi/extension-base 0.62.19 on npm depends on
"@pezkuwi/extension-chains": "workspace:*" and cannot be installed.
They are exact versions, as upstream has them; yarn still links the
workspaces.
- @pezkuwi/* common dependencies ^14.0.26 and api dependencies ^16.5.37.
These carry wasm-crypto 7.5.20, where ed25519, secp256k1, derivation
and bip39 are implemented; 7.5.18 shipped them as "not yet
implemented" stubs. The root resolutions that forced 14.0.25, 16.5.36
and wasm-crypto 7.5.18 onto the tree are removed; every @pezkuwi
package resolves to a single version without them.
- @pezkuwi/dev ^0.85.12.
- One version for everything: the packages were at 0.62.20, the
extension package at 0.62.23, the root at 0.62.24 and the browser
manifests at 0.62.26. All are 0.62.27, above every version on npm and
in the stores.
Clears the Dependabot alerts that can be fixed inside the ranges the
packages already declare, and drops one dependency nothing used.
- Transitive bumps within declared ranges: axios, bn.js, undici, tar,
postcss, minimatch, picomatch, brace-expansion, fast-uri, js-yaml,
lodash, ws, ip-address, node-forge, follow-redirects, form-data,
http-proxy-middleware, launch-editor, nanoid, qs, rollup, shell-quote,
websocket-driver, flatted, colord, json5, browserslist.
- styled-components 6.3.8 -> 6.5.3 (pulled by @pezkuwi/react-identicon and
react-qr); 6.5 no longer pins postcss 8.4.49.
- Remove extract-loader from packages/extension: no webpack config or
source references it, and it was the only path to babel 6,
babel-traverse and browserslist 3.
What ships changes in two modules only. Built before and after, with
build paths normalised: content.js is byte-identical; page.js and
background.js differ in bn.js (5.2.2 -> 5.2.3); extension.js differs in
bn.js and axios (1.13.4 -> 1.20.0, reached only through
@zondax/ledger-substrate). Every other difference is the minifier
renaming identifiers. No @pezkuwi/* package, wasm-crypto or bip39 code
changes.
Left for a change in @pezkuwi/dev, where they come from: webpack-dev-server
4 and what it pulls (webpack-dev-middleware, qs 6.14, uuid 8, node-forge),
got 9 via gh-release, serialize-javascript 6 via terser-webpack-plugin,
minimatch 9.0.3 via @typescript-eslint 6. All build or local-dev tooling.
elliptic has no patched release; it arrives through crypto-browserify,
the webpack crypto fallback.
lint and test give the same result before and after this change; both
were already failing on main (41 lint errors, 19 of 61 tests), hidden by
continue-on-error in pr-any.yml.
Fixed race condition where message handlers could process requests
before cryptoWaitReady() and keyring.loadAll() completed.
Now all message handlers wait for initialization before processing,
which fixes the seed creation failure on first account creation.
- Add AuthorizeCall signed extension support for PezkuwiChain
- Update extension name to "pezkuwi{.js} extension"
- Update version to 0.62.21
- Fix signing for transactions that require custom signed extensions
- New Firefox extension ID for AMO
- Fixed data_collection_permissions for Mozilla compliance
- Updated webpack config for ES2022 target
- Added firefox-postprocess.sh script
- Bumped all packages to 0.62.18
Satoshi Qazi Muhammed