sprintf-js, fast-xml-parser and image-size all came from the
react-native 0.73 dev dependency (its CLI 12 and metro 0.80); none has
a fix those versions accept. react-native 0.87 no longer depends on the
CLI and uses metro 0.87. vue-identicon builds against vue 3 now; at run
time it already supports both 2 and 3 (adaptVNodeAttrs) and its peer
range stays >= 2.7. The vue 2 advisory is fixed only in vue 3.
braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.
Lockfile only. 71 open Dependabot alerts; each vulnerable range was checked against yarn.lock and `yarn up -R` moved every package with a fix inside its dependents' ranges; terser-webpack-plugin 5.6 drops serialize-javascript and styled-components 6.5 no longer pins postcss 8.4.49.
Left, with no fix inside range: sprintf-js 1.0.3 (no fixed version exists), fast-xml-parser 4.5.7 (fixed in 5.7; the React Native CLI 12 used by reactnative-identicon asks for ^4), vue 2.7.16 (fixed only in vue 3; vue-identicon's dev dependency).
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3
- react-qr Display: the frames follow the value's content (xxhash), are
reset while rendering instead of in an effect, and the frame timer is
keyed on the frame set. Before, a value that went from one frame to
several never started animating; Display.spec covers single,
multi, single-to-multi and unmount. tsconfig build/spec know *.spec.tsx.
- optional calls instead of guard expressions (ScanAddress, stores)
- KeyringOptions as a Record; type assertions the receiver already
accepts removed (Settings, vue-identicon)
- disable directives narrowed to the rules that still report
It was deleted in January, which left `yarn install --immutable` in the
PR workflow with nothing to hold to and every install resolving the
tree afresh. It is the lockfile from before the deletion, updated for
the dependency changes that follow and deduplicated so that each
@pezkuwi package resolves to one version (util-crypto 14.0.26 with
wasm-crypto 7.5.20; the old entries pulled in wasm-crypto 7.5.4 and
networks 14.0.1 next to them).
- Change UITHEME_DEFAULT from 'polkadot'/'substrate' to 'light'
- Update UITHEMES options to use 'dark'/'light' values
- Update ICONS to use 'pezkuwi'/'bizinikiwi' branding
- Add isPezkuwi check for domain detection
- Bump ui-settings version to 3.16.9
* chore: upgrade deps
* fix: correct capitalization of "Overview" in README
* fix: correct capitalization of "overview" in README
* fix: update typescript version in package.json and yarn.lock
* fix: downgrade typescript version to 5.5.4
Satoshi Qazi Muhammed