The 7 open Dependabot alerts matched versions still pinned in yarn.lock. `yarn up -R` moves pbkdf2, source-map-js, http-cache-semantics and ajv to fixed versions within range. serialize-javascript came through copy-webpack-plugin 11 (^6); copy-webpack-plugin 14 asks for ^7.0.3 and resolves 7.1.2. Its use here is `patterns: [{ from: 'public' }]`; the chrome and firefox build zips are byte-identical before and after (41 files each, sha256).
Left: elliptic 6.6.1, for which no fixed version exists (via browserify-sign / create-ecdh).
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3 in the root and in every
workspace package (they still asked for 0.84.3)
- tsconfig.base target ES2022, the @pezkuwi/dev default; it carries
the ErrorOptions type for `cause`
- rethrown errors carry the original as `cause`; rejections are
normalised to Error
- page/messaging: the typed subscriber is called directly, not as
`Function`
- chrome mock: constant results through Promise.resolve
- useLedger: drop a construction every branch below repeated
- InputWithLabel: onKeyDown instead of the deprecated onKeyPress
- Account: toggleActions + 1 instead of a pre-increment of a parameter
- optional chains where a guard tested the same value
- specs: mount<React.Component> so the wrappers are not `any`-typed
- AccountsStore.set keeps its async override of KeyringStore.set:
BaseStore.set handles its own failure, so it never rejects
- extension-chains keeps its ChainProperties assertion: the package's
own build does not load the type augmentation
- the existing React Compiler findings (37, react-hooks rules only)
are recorded in eslint-suppressions.json; a new one fails lint
Raising the @pezkuwi dependency floors to ^14.0.26 and ^16.5.37 also
rewrote the peerDependencies of extension-dapp, extension-inject,
extension-chains and extension-compat-metamask, which were "*" (as they
are upstream). A peer range is a requirement on the dApp's own
@pezkuwi/api and util; narrowing it would make npm refuse to install
these packages next to an api release from before 16.5.37. They are "*"
again.
- extension-dapp and extension-inject had the manifest the build writes
into build/ committed as their source manifest (main
./build/cjs/index.js, an exports map into ./build/). They are back in
the source form of the upstream manifests; the build generates those
fields itself.
- Dependencies between the packages were workspace:*, and the build
copies them into the published manifest as they are:
@pezkuwi/extension-base 0.62.19 on npm depends on
"@pezkuwi/extension-chains": "workspace:*" and cannot be installed.
They are exact versions, as upstream has them; yarn still links the
workspaces.
- @pezkuwi/* common dependencies ^14.0.26 and api dependencies ^16.5.37.
These carry wasm-crypto 7.5.20, where ed25519, secp256k1, derivation
and bip39 are implemented; 7.5.18 shipped them as "not yet
implemented" stubs. The root resolutions that forced 14.0.25, 16.5.36
and wasm-crypto 7.5.18 onto the tree are removed; every @pezkuwi
package resolves to a single version without them.
- @pezkuwi/dev ^0.85.12.
- One version for everything: the packages were at 0.62.20, the
extension package at 0.62.23, the root at 0.62.24 and the browser
manifests at 0.62.26. All are 0.62.27, above every version on npm and
in the stores.
pr-any.yml ran lint, test and build with continue-on-error: true, so every
PR showed success while main had 41 lint errors and 19 of 61 tests failing.
The flag is removed and the failures are fixed:
- TypeScript 5.5.4 -> 5.9. @pezkuwi/util and friends ship declarations
with Uint8Array<ArrayBufferLike>, which 5.5 cannot read, so every such
value was typed `any` here (the 16 wrapBytes errors). The pin dates from
a styled-components declaration problem that went away with the move
back to styled-components 5; build and lint pass on 5.9.
- State.ts: the stored security log is parsed through a function that
returns an empty log for anything that is not a JSON array, instead of
letting `any` flow on; fire-and-forget logging uses .catch(console.error)
like the rest of the codebase; object keys sorted.
- buildHierarchy.spec.ts: a rename had replaced the genesis hashes with
0x..01 / 0x..02, which resolve to no network name, so sorting by network
had nothing to sort on. The test now takes two real entries from
chains.ts by name.
- scripts/*.cjs is in the lint project (it failed to parse); header and
key order fixed in postbuild-cleanup.cjs.
- temp_ff_validate/ (43 build files) and pezkuwi-chrome-0.62.22.zip were
committed by accident in f5495f7; removed and ignored.
16 of the 19 failing tests are not fixed here: they fail because
@pezkuwi/wasm-crypto 7.5.18 stubs ed25519, secp256k1 and sr25519
derivation. With the 7.5.19 build from pezkuwi-wasm#2 installed locally,
lint is clean and all 61 tests pass. Until 7.5.19 is published and
picked up here, those 16 stay red on this PR, which is the point.
Clears the Dependabot alerts that can be fixed inside the ranges the
packages already declare, and drops one dependency nothing used.
- Transitive bumps within declared ranges: axios, bn.js, undici, tar,
postcss, minimatch, picomatch, brace-expansion, fast-uri, js-yaml,
lodash, ws, ip-address, node-forge, follow-redirects, form-data,
http-proxy-middleware, launch-editor, nanoid, qs, rollup, shell-quote,
websocket-driver, flatted, colord, json5, browserslist.
- styled-components 6.3.8 -> 6.5.3 (pulled by @pezkuwi/react-identicon and
react-qr); 6.5 no longer pins postcss 8.4.49.
- Remove extract-loader from packages/extension: no webpack config or
source references it, and it was the only path to babel 6,
babel-traverse and browserslist 3.
What ships changes in two modules only. Built before and after, with
build paths normalised: content.js is byte-identical; page.js and
background.js differ in bn.js (5.2.2 -> 5.2.3); extension.js differs in
bn.js and axios (1.13.4 -> 1.20.0, reached only through
@zondax/ledger-substrate). Every other difference is the minifier
renaming identifiers. No @pezkuwi/* package, wasm-crypto or bip39 code
changes.
Left for a change in @pezkuwi/dev, where they come from: webpack-dev-server
4 and what it pulls (webpack-dev-middleware, qs 6.14, uuid 8, node-forge),
got 9 via gh-release, serialize-javascript 6 via terser-webpack-plugin,
minimatch 9.0.3 via @typescript-eslint 6. All build or local-dev tooling.
elliptic has no patched release; it arrives through crypto-browserify,
the webpack crypto fallback.
lint and test give the same result before and after this change; both
were already failing on main (41 lint errors, 19 of 61 tests), hidden by
continue-on-error in pr-any.yml.
Fixed race condition where message handlers could process requests
before cryptoWaitReady() and keyring.loadAll() completed.
Now all message handlers wait for initialization before processing,
which fixes the seed creation failure on first account creation.
- Fix Chrome/Firefox zip build scripts to copy manifest to build folder
- Update all @pezkuwi packages to latest stable versions (API 16.5.36, Common 14.0.25)
- Update version to 0.62.20 in package.json and manifests
- Fix Firefox manifest strict_min_version from 142.0 to 109.0
- Update @pezkuwi/api packages to ^16.5.11
- Update @pezkuwi/dev to ^0.85.7
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update @pezkuwi/react-identicon, ui-shared, ui-settings, ui-keyring, react-qr to ^3.17.1
- Fix westendMetadata → zagrosMetadata imports in test files
- Remove backward compatibility for polkadot/substrate themes in Identicon.tsx
- Add proper Network[] type annotation to legerChains.ts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
