chore: 2026 Q4 stack upgrade

.changeset/config.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.0.3/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [["@web3auth/modal", "@web3auth/no-modal"]],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "master",
+  "updateInternalDependencies": "patch",
+  "ignore": [],
+  "privatePackages": {
+    "version": false,
+    "tag": false
+  }
+}

.changeset/embed-597-stack-upgrade.md

@@ -0,0 +1,6 @@
+---
+"@web3auth/modal": major
+"@web3auth/no-modal": major
+---
+
+Require Node 24.22 and publish the Vite+ build from dist/lib.esm and dist/lib.cjs. Type declarations now live at dist/lib.cjs/index.d.ts. The packages no longer declare an `@babel/runtime` peer.

.github/CODEOWNERS

@@ -19,10 +19,9 @@
 *                               @Web3Auth/Web3Auth-Admins
 
 # Product code
-packages/                       @Web3Auth/Web3Auth-Product
-test/                           @Web3Auth/Web3Auth-Product
+packages/*/src/                 @Web3Auth/Web3Auth-Product
+packages/*/test/                @Web3Auth/Web3Auth-Product
+demo/                           @Web3Auth/Web3Auth-Product
 
 # Most restrictive — last match wins
 .github/CODEOWNERS              @Web3Auth/Web3Auth-Admins
-packages/**/package.json        @Web3Auth/Web3Auth-Admins
-package.json                    @Web3Auth/Web3Auth-Admins

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,7 @@
+## Motivation and Context
+
+<!-- Why is this change required? What problem does it solve? -->
+
 ## Jira Link
 
 <!-- Link to the Jira ticket (if applicable) -->

.github/dependabot.yml

@@ -5,3 +5,12 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 10
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3

.github/workflows/ci.yml

@@ -1,12 +1,19 @@
 name: Build & Release
 
-on: [push]
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
-  build:
+  validate:
     strategy:
       matrix:
-        node: ["24.x"]
+        node: ["24.22.0", "26"]
         os: [ubuntu-latest]
 
     runs-on: ${{ matrix.os }}
@@ -17,31 +24,106 @@ jobs:
         with:
           enabled: ${{ vars.WIZ_SENSOR_ENABLED }}
           token: ${{ secrets.WIZ_SENSOR_TOKEN }}
+
       - name: Check out Git repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up node
-        uses: actions/setup-node@v6
+      - name: Use Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
 
+      - name: Use npm 12
+        run: npm install --global npm@12.2.0
+
       - name: Install dependencies
         run: npm ci
 
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium firefox webkit
+      - name: Harden check
+        run: npm exec --no -- harden check --package-manager npm
+
+      - name: Check format and lint
+        run: npm run lint
 
       - name: Build
         run: npm run build
 
+      - name: Check TypeScript projects
+        run: npm run typecheck
+
+      - name: Install Playwright browsers
+        run: npm exec --no -- playwright install --with-deps chromium firefox webkit
+
       - name: Test
         run: npm run test
 
-      # Set the credentials from repository settings/secrets
+      - name: Pack dry run
+        run: npm pack --workspaces --dry-run --json
+
+  release-notes:
+    if: github.event_name == 'pull_request' && !startsWith(github.head_ref, 'changeset-release/') && !startsWith(github.head_ref, 'dependabot/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Use Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: "24.22.0"
+          cache: "npm"
+
+      - name: Use npm 12
+        run: npm install --global npm@12.2.0
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check release notes
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          git fetch --no-tags origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"
+          npm exec --no -- changeset status --since="origin/${BASE_REF}"
+
+  deploy:
+    needs: validate
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Wiz sensor
+        uses: Web3Auth/.github/.github/actions/wiz-sensor@545f7c255313f85d38a02dc36c4ad01387d03149 # v1.0.0
+        with:
+          enabled: ${{ vars.WIZ_SENSOR_ENABLED }}
+          token: ${{ secrets.WIZ_SENSOR_TOKEN }}
+
+      - name: Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Use Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: "24.22.0"
+          cache: "npm"
+
+      - name: Use npm 12
+        run: npm install --global npm@12.2.0
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
       - name: Configure AWS credentials
-        if: github.ref == 'refs/heads/master'
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -58,22 +140,17 @@ jobs:
           VITE_APP_SOLANA_DEVNET_RPC: ${{ secrets.SOLANA_DEVNET_RPC }}
           VITE_APP_PIMLICO_API_KEY: ${{ secrets.PIMLICO_API_KEY }}
 
-        # Copy the files from build folder to the S3 bucket
-        # Upload to S3
-      - name: sync vue app new s3
-        if: github.ref == 'refs/heads/master'
-        uses: jakejarvis/s3-sync-action@master
+      - name: Sync vue app new to S3
+        uses: jakejarvis/s3-sync-action@7ed8b112447abb09f1da74f3466e4194fc7a6311 # master
         env:
           SOURCE_DIR: "./demo/vue-app-new/dist"
           AWS_REGION: "us-east-1"
           AWS_S3_BUCKET: "demo-sdk.web3auth.io"
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
-        # Invalidate Cloudfront (this action)
-      - name: invalidate vue app new s3
-        if: github.ref == 'refs/heads/master'
-        uses: chaitanyapotti/cloudfront-update-distribution@v5
+      - name: Invalidate vue app new CloudFront
+        uses: chaitanyapotti/cloudfront-update-distribution@b120c0220453e292a43e5563f008f8e9e52858d6 # v5
         with:
           cloudfront-distribution-id: ${{ secrets.AWS_CLOUDFRONT_NEW_DEMO_APP_DISTRIBUTION_ID }}
           cloudfront-invalidation-path: "/*"

.github/workflows/release-pr.yml

@@ -0,0 +1,44 @@
+name: Create release pull request
+
+# Opens or updates the release pull request. It does not publish.
+# Publish by hand from master after that pull request merges.
+# The repository must allow GitHub Actions to create pull requests.
+# A pull request opened with GITHUB_TOKEN does not start other workflows.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-pr
+  cancel-in-progress: false
+
+jobs:
+  release-pr:
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: "24.22.0"
+      - name: Install npm 12
+        run: npm install --global npm@12.2.0
+      - name: Install dependencies
+        run: npm ci
+      # The GitHub API commit mode signs the release commit, which master requires.
+      - name: Create or update the release pull request
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
+        with:
+          version-script: npm run version-packages
+          commit-message: "chore: release packages"
+          pr-title: "chore: release packages"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security-code-scanner.yml

@@ -0,0 +1,27 @@
+name: Security code scanner
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security-scan:
+    uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@becb242930b3cc271c26da0280050db9c157e291 # v2.1.1
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    with:
+      scanner-ref: becb242930b3cc271c26da0280050db9c157e291 # v2.1.1
+      paths-ignored: |
+        **/node_modules/**
+        **/dist/**
+        **/build/**
+        **/coverage/**

.gitignore

@@ -49,7 +49,6 @@ typings/
 
 # Optional npm cache directory
 .npm
-.npmrc
 
 # Optional eslint cache
 .eslintcache
@@ -112,5 +111,4 @@ dist
 yalc.lock
 types
 build/
-
-.npmrc
+.vue-templates-oxlintrc.json

.npmrc

@@ -0,0 +1,4 @@
+min-release-age=3
+allow-git=none
+allow-remote=none
+allow-scripts-pin=true

.nvmrc

@@ -1 +1 @@
->=24.x
+26

demo/vite-react-app-sfa/vite.config.mts

@@ -1,4 +1,4 @@
-import { defineConfig } from "vite";
+import { defineConfig } from "vite-plus";
 import react from "@vitejs/plugin-react";
 import { resolve } from "node:path";
 

demo/vite-react-app-solana/vite.config.mts

@@ -1,4 +1,4 @@
-import { defineConfig } from "vite";
+import { defineConfig } from "vite-plus";
 import react from "@vitejs/plugin-react";
 
 export default defineConfig({

demo/vue-app-new/vite.config.mts

@@ -2,14 +2,16 @@ import { resolve } from "node:path";
 
 import tailwindcss from "@tailwindcss/vite";
 import vue from "@vitejs/plugin-vue";
-import { defineConfig, loadEnv } from "vite";
+import { defineConfig, loadEnv } from "vite-plus";
 
 // https://vitejs.dev/config/
 export default defineConfig(({ mode }) => {
-  const { VITE_APP_INFURA_PROJECT_KEY, VITE_APP_SOLANA_MAINNET_RPC, VITE_APP_SOLANA_TESTNET_RPC, VITE_APP_SOLANA_DEVNET_RPC } = loadEnv(
-    mode,
-    process.cwd()
-  );
+  const {
+    VITE_APP_INFURA_PROJECT_KEY,
+    VITE_APP_SOLANA_MAINNET_RPC,
+    VITE_APP_SOLANA_TESTNET_RPC,
+    VITE_APP_SOLANA_DEVNET_RPC,
+  } = loadEnv(mode, process.cwd());
 
   return {
     mode,

demo/wagmi-react-app/vite.config.mts

@@ -1,6 +1,6 @@
 import react from "@vitejs/plugin-react";
 import { resolve } from "node:path";
-import { defineConfig } from "vite";
+import { defineConfig } from "vite-plus";
 
 export default defineConfig({
   plugins: [react()],