chore(deps): bump @aastar/sdk 0.39.4 → 0.43.0 (CC-40/CC-41, unblock CC-33) - #432
Open
jhfnetboy wants to merge 3 commits into
Open
chore(deps): bump @aastar/sdk 0.39.4 → 0.43.0 (CC-40/CC-41, unblock CC-33)#432jhfnetboy wants to merge 3 commits into
jhfnetboy wants to merge 3 commits into
Conversation
… readiness (6-repo roster complete) DVT (repo:dvt) posted its production-ready table (v1.11.0), completing the 6-repo roster (yaaa/kms/airaccount-contract/sp/dvt/sdk) on coordination task CC-30. - dvt row: ⏳ pending → ✅ (testnet green: BLS sign/agg/verify + owner-gate fail-closed 0xa0cf00cf + CC-22 KMS+DVT co-run + dvt1/2/3 Sepolia live; mainnet blockers CC-32 DK2 armv7 script / G5 DEFAULT_DVT_NODES / #106) - airaccount-contract bump v0.27.0 → v0.28.0 (release prep + mainnet deploy script skeleton #184 + verify 4 core contracts #185 + CC-27 rename landed) - cross-repo dependency matrix: dvt row filled (no more `?`) - added testnet→observe→mainnet release gantt; testnet release gate now all-green Claude-Session: https://claude.ai/code/session_01RajETCvboSvhadpqMbekNx
DVT posted DK2 armv7 DVT-only deploy script done (PR #206, cross-pack e2e verified → armv7l bundle). Flip the readiness DK2 row 🔴→✅ and the mainnet-gate line accordingly (board-arrival install, not paper). Claude-Session: https://claude.ai/code/session_01RajETCvboSvhadpqMbekNx
…C-33) Surgical lockfile bump (version/resolved/integrity + both workspace range refs); runtime deps unchanged (@simplewebauthn/browser + axios), viem stays root-overridden at 2.47.6 (satisfies 0.43.0 peer >=2.43.0 <3). No lockfile trimming (19437 lines unchanged). 0.43.0 roots out the 0.42.0 /operator child_process → browser-bundle regression (CC-41/CC-42); YAAA was on 0.39.4 so never shipped it, but the operator/DVT wizard pages import /operator broadly and are now build-verified clean. Also clears the 0.41.0 floor for CC-33 xPNTs credibility API and the ^0.43.0 floor for CC-40 node-onboarding-portal integration. CC-45 (airaccount v0.28.0 canonical addresses, SDK PR #314) is not in 0.43.0 and awaits the next SDK release — a second bump then. Gates: npm ci clean · backend type-check/build/41 tests · frontend type-check/build · browser bundle no child_process leak. Claude-Session: https://claude.ai/code/session_01RajETCvboSvhadpqMbekNx
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
clestons
approved these changes
Jul 14, 2026
clestons
left a comment
clestons
left a comment
There was a problem hiding this comment.
APPROVE — pure dependency bump, no PK round.
@aastar/sdk ^0.39.4 → ^0.43.0 across both package.jsons + lockfile, plus PRODUCTION_READINESS.md roster updates. No source/logic changes to challenge. Assuming CI (build + type-check against the new SDK surface) is green, safe to land to unblock CC-33.
— clestons (Opus review)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bump
@aastar/sdk^0.39.4 → ^0.43.0across both workspaces (aastarbackend +aastar-frontend).Surgical lockfile bump — only
version/resolved/integrityon the singlenode_modules/@aastar/sdkblock + the two workspace range refs. Runtime deps unchanged (@simplewebauthn/browser+axios);viemstays root-overridden at2.47.6(satisfies 0.43.0 peer>=2.43.0 <3). No lockfile trimming (19437 lines unchanged),npm ciclean.Why (coordination context)
YAAA was stuck on 0.39.4 while several coordination tasks need higher versions. This one bump clears three of them:
/operatorchild_process→ browser-bundle regression (CC-42). YAAA never shipped 0.42.0, but the operator/DVT wizard pages import/operatorbroadly and are now build-verified clean.^0.43.0(+kmsPopSigner). Version gate now cleared; portal integration itself is follow-up frontend work.0.41.0floor for the xPNTs credibility read API.CC-45 (airaccount v0.28.0 canonical addresses, SDK PR #314) is not in 0.43.0 — it awaits the next SDK release, then a second bump. YAAA reads those addresses from
@aastar/sdk/corecanonical (no hardcoding), so that will flow through on the follow-up bump with zero source changes.Verification
npm ciclean (installs 0.43.0 from the surgically-edited lockfile, no trimming)type-check✅ ·build✅ · 41/41 unit tests ✅type-check✅ ·build✅/operator,/operator/dvt-register,/operator/manage/*prerender clean; nochild_process/node-builtin leak in build outputPure dependency bump — no source code changes.
https://claude.ai/code/session_01RajETCvboSvhadpqMbekNx