Repository navigation
chore: 2026 Q4 stack upgrade - #2550
Draft
lionellbriones wants to merge 6 commits into
Draft
lionellbriones wants to merge 6 commits into
lionellbriones wants to merge 6 commits into
Conversation
Product review stays on package source, tests, and demos, and Dependabot waits three days before opening npm and Actions updates. Co-authored-by: Cursor <cursoragent@cursor.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Auth and the controller packages stay on their current releases until those stack upgrades publish. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
- ci.yml: validate on Node 24.22.0 and 26 (harden, lint, build, typecheck, tests, pack dry run), changeset status on pull requests, and a master-only deploy job that needs validate. Deploy actions are pinned to commit SHAs. - release-pr.yml: workflow_dispatch changesets release pull request on master. It does not publish. - security-code-scanner.yml: MetaMask security code scanner at v2.1.1. Co-authored-by: Cursor <cursoragent@cursor.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if: github.ref == 'refs/heads/master' | ||
| uses: jakejarvis/s3-sync-action@master | ||
| - name: Sync vue app new to S3 | ||
| uses: jakejarvis/s3-sync-action@7ed8b112447abb09f1da74f3466e4194fc7a6311 # master |
- Raise direct ranges in the root and both packages to the newest same-major release older than the 3-day window, including peer floors. - Hold @x402/evm, @x402/fetch, and @x402/svm at 2.28, the last line that accepts @solana/kit 6. - Refresh package-lock.json on npm 12. Apply in-range audit fixes to transitive packages. Remaining alerts are recorded in the PR. - Annotate defaultWagmiConfig as Config in the React and Vue wagmi constants so the declaration build passes with the newer wagmi types. Co-authored-by: Cursor <cursoragent@cursor.com>
- Drop root devDependencies no source or script uses: @solana/kit, cross-env, dotenv, ox, vite, and vitest. vite-plus already pins the vite and vitest versions. - Drop the Linux optionalDependencies block. The packages that need those binaries still declare them. - Drop modal dependencies the Vite+ build no longer loads: copy-to-clipboard, the Rollup, Babel, and webpack loaders, live-server, and the duplicate vite and vitest entries. - Drop the @babel/runtime peer from both packages and note it in the changeset. - Delete the Rollup configs and packages/modal/babel.config.js. - Remove the react and react-dom overrides. The lockfile resolves 19.3.1 without them. Co-authored-by: Cursor <cursoragent@cursor.com>
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
Apply the 2026 Q4 stack policy to
@web3auth/modaland@web3auth/no-modal. Engines are Node>=24.22.0and npm>=12. Both packages publish the Vite+ build fromdist/lib.esmanddist/lib.cjs, with types atdist/lib.cjs/index.d.ts.This stays a draft.
@web3auth/authand the controllers stack releases are not published yet, and lint, typecheck, and the browser tests do not pass on this branch.Jira Link
Description
Majors taken:
@toruslabs/http-helpers10,eccrypto8,loglevel-sentry10,metadata-helpers9,session-manager6,secure-pub-sub5,@toruslabs/torus-scripts9.0.1,@toruslabs/config5, TypeScript 7.0.2,@types/node26,vite-plus1.5.0.Majors not taken:
@web3auth/authstays^11.8.1until EMBED-595 publishes a stack release.@toruslabs/base-controllersand@toruslabs/ethereum-controllersstay on 9 until EMBED-596.fetch-node-detailsis not a direct dependency.@x402/evm,@x402/fetch, and@x402/svmstay on 2.28 because 2.29 requires@solana/kit8.The packages no longer declare an
@babel/runtimepeer.Scanners:
.github/workflows/security-code-scanner.ymlruns the MetaMask scanner atbecb242930b3cc271c26da0280050db9c157e291(v2.1.1). CodeQL stays on the default setup. KICS and Trivy are not added. The Wiz sensor stays. The Vue demo deploy still uses AWS access keys, not a role.npm auditafter the dependency cleanup: 45 issues, 0 critical, 8 high, 20 moderate, 17 low. The 8 high issues are@x402/*(held at 2.28) and@base-org/accountwith@coinbase/cdp-sdk,zod, andabitype. Demo lockfile alerts were left open on purpose.release-pr.ymlcan open a pull request only after the repository setting that lets GitHub Actions create pull requests is turned on. This token cannot change that setting. Publish stays manual frommasterafter that release pull request merges.release-packagesis not run.How has this been tested?
Checked on Node 24.22.1 (npm 12.2.0) and Node 26.13.0 (npm 12.2.0), each from
npm ci.vue-demi,protobufjs,tiny-secp256k1, andfseventsare blocked. NoallowScriptsfield was added.harden check: exit 1 on both. Onlyn_scriptsfails. Moderate is 3 of 3.npm run lint: exit 2 on both. Formatting fails, thendemo/vue-app-new/eslint.config.mjs:5has a syntax error that is already onmaster. Not formatted in this pull request.npm run build: exit 0 on both.packages/no-modaland 125 inpackages/modalon both Node versions.npm run typecheckstops at no-modal. The fixes are on draft pull request 2551 and are not merged here.npm run test: exit 1 on both.@web3auth/modalfails to loadtest/loginModal.ui.test.tsxandtest/modalManager.test.tsin Chrome, Firefox, and Safari becauseBufferis undefined (bufferis externalized for the browser).vp runreports 0 of 2 packages successful. The no-modal suite does not print a finished summary.Packed tarballs from
npm pack --workspaces --dry-runincludedist/lib.cjsanddist/lib.esmfor both packages, includingdist/lib.cjs/index.js,dist/lib.esm/index.js, anddist/lib.cjs/index.d.ts.requireof the CommonJS entry andimportof the ESM entry succeed for.,./react, and./vueon both packages. Loading the ESM file by path prints Node'sMODULE_TYPELESS_PACKAGE_JSONwarning because these packages do not set"type": "module". The modal ESM bundle has.w3a-parent-container, no@layer, the injected style element, and"use client".demo/vue-app-new:npm ciexits 0.npm run buildexits 2 duringvue-tsc(28 errors, includingRefvalues used as plain values andbaseAccountConnectorused as a value). Vite did not run.demo/nextjs-ssr-app:npm cifails becausepackage-lock.jsonis out of sync (viem@2.57.19and related packages are missing).next builddid not run.Not done: the Create React App demo was not migrated, and the other Vite demos were not rebuilt.
Screenshots (if appropriate)
None. This change does not touch UI.
Types of changes
Checklist