[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@sei-js/create-sei@2.0.2

Patch Changes

• ce15c1d: Require Bun 1.4.4 for generated applications, the first Bun release outside the Brotli decoder advisory GHSA-9v8h-qqgm-4m35 (CVE-2026-111497).

  Bun vendors Google's Brotli library for node:zlib and for decompressing fetch responses. The 1.3.14 the template pinned ships Brotli 1.1.0, and Bun 1.4.3 still ships 1.2.0, both inside the advisory's 1.0.3 through 1.2.0 range. Bun 1.4.4 ships Brotli 1.2.1, and there is no fixed 1.3.x release.

  The template's packageManager moves from bun@1.3.14 to bun@1.4.4, and the generated README and this package's README name 1.4.4 as the minimum. The release smoke now runs on Bun 1.4.4, so that is the version the template's overrides are validated with.

  No published dependency or peer range changes.

• a61b860: Bump the Next template's next and sharp pins to clear five newly published advisories.

  Five advisories landed against the pinned next@15.5.25 and the sharp@0.35.4 override, so every generated app installed them without any change to the template:

  • GHSA-2464-fhr4-w9xw — critical, unauthenticated remote code execution in the Image Optimization API, >=10.0.0 <=15.5.27.
  • GHSA-p3m5-59mp-jv5r — high, denial of service in the App Router through Server Actions, >=13.0.0 <=15.5.27.
  • GHSA-mcj8-r9mp-w47p and GHSA-4jqv-mc3x-m676 — moderate, cache poisoning of SSG and ISR pages, >=15.0.0 <15.5.27.
  • GHSA-wq5f-xc86-pv6w — high, a memory bug in Sharp's bundled librsvg (CVE-2026-96889) that can allow remote code execution on glibc-based Linux, <0.35.5.

  next moves 15.5.25 to 15.5.28 and the sharp override 0.35.4 to 0.35.5, both inside their pinned minors.

  Next 15.5.28 declares Sharp ^0.34.3 || ^0.35.5, so the override stays inside the range Next supports. The image notes in the template README and next.config.mjs now name 0.35.5 as the advisory floor, because the 0.34.x half of Next's range is inside both Sharp advisories.

  Generated apps still report two advisories on install:

  • GHSA-mrhx-c7xc-m3w5 — high, memory exhaustion in Zod's array validation, <4.6.6. It reaches every generated app through the zod@3.22.4 that @reown/appkit-wallet pins exactly under wagmi's WalletConnect connector, and Reown's newest release, 1.8.24, still pins it. Zod published no fixed 3.x release, so the only override would move Reown onto Zod 4, a major it does not declare support for.
  • GHSA-vcc3-ghjq-m6fr — moderate, denial of service in decode-uri-component, <=0.4.2.

@sei-js/mcp-server@1.0.2

Patch Changes

• ce15c1d: Raise the supported Node.js range to the releases that patch the Brotli decoder advisory GHSA-9v8h-qqgm-4m35 (CVE-2026-111497).

  This drops support for Node.js 20, and for 22.x, 24.x, and 26.x releases before 22.23.4, 24.22.1, and 26.12.1. npm only warns about the engine mismatch, but Yarn 1, and npm with engine-strict set, refuse to install this release on them.

  Node.js bundles Google's Brotli library, and the decoder in Brotli 1.0.3 through 1.2.0 can be driven into an out-of-bounds write by a crafted compressed stream. Node fixed it in the October 21, 2026 security releases: 22.23.4, 24.22.1, and 26.12.1. Node 20 is end-of-life and gets no fix.

  The server reaches that decoder through fetch, which decompresses Brotli-encoded responses automatically: viem's HTTP transport for the configured RPC endpoints, and the docs client for https://docs.sei.io/mcp. Its own HTTP transports do not, because they reject every compressed request body with a 415.

  engines.node moves from >=20.0.0 to ^22.23.4 || ^24.22.1 || >=26.12.1, and the README's requirement matches.

  No dependency or peer range changes.

• 8da8c09: Reject compressed request bodies on the streamable-http and http-sse transports, the documented workaround for the body-parser advisory GHSA-27r3-jxmh-p828.

  GHSA-27r3-jxmh-p828 (high, CVSS 7.5, published October 23) covers body-parser below 1.20.9, and 2.x below 2.4.0. With default options, body-parser pipes a request that carries a Content-Encoding into a decompression stream and leaves that stream without an error listener, so a compressed frame followed by trailing bytes can raise an uncaught exception that terminates the process. Parsing runs before routing, so the request needs no valid session or route. Both HTTP transports parse JSON with Express 4's express.json().

  A fresh install resolves the fixed body-parser@1.20.9, but Express 4 accepts ~1.20.5, so no dependency floor in this package can move an existing lockfile off a vulnerable copy. Both transports now pass inflate: false, so a request body with any Content-Encoding other than identity gets a 415 before a decompression stream exists, whichever body-parser is installed. The SDK's HTTP client transports send uncompressed JSON, and stdio is not affected.

• 8da8c09: Raise the @modelcontextprotocol/sdk floor from ^1.23.0 to ^1.32.0 and the zod floor from ^4.0.5 to ^4.6.6, so an in-place upgrade cannot keep a release inside their advisories.

  A fresh install already resolved fixed releases of both, but the old floors let an existing lockfile keep vulnerable ones. Three of the advisories reach this server:

  • GHSA-46jr-4wx8-v453 — high, @modelcontextprotocol/sdk >=1.3.0 <1.32.0. The SDK put no limit on how many array elements and object keys it validated in one request, so one unauthenticated HTTP request could exhaust the server's memory. It affects the streamable-http and http-sse transports; stdio is not affected.
  • GHSA-mrhx-c7xc-m3w5 — high, zod <4.6.6. An array schema without a length constraint records an issue for every failing element, so one large array can exhaust memory. Tool arguments are validated with Zod.
  • GHSA-6prh-2h8m-c8cw — moderate, @modelcontextprotocol/sdk <1.32.0. The SDK's HTTP client transports followed redirects to any origin and re-sent the mcp-session-id header, and on a 307 or 308 the request body. The docs client reaches https://docs.sei.io/mcp through StreamableHTTPClientTransport.

  The other three SDK advisories fixed in 1.31.0 and 1.32.0 do not reach it: the server passes no taskStore (GHSA-22jm-h49p-29qw), uses no SDK OAuth client (GHSA-6qxp-vccf-f47h), and does not use requireBearerAuth() (GHSA-rvq5-wwqv-78pq).

  No other dependency changes.

@sei-js/sei-global-wallet@2.0.2

Patch Changes

• 8821593: Raise the documented sharp override to 0.35.5, and accept the two new stream-json advisories that no override can reach.

  Advisories published since October 5 turned the nightly consumer smoke red without any change in this repository.

  GHSA-wq5f-xc86-pv6w covers sharp below 0.35.5: a memory bug in the bundled librsvg (CVE-2026-96889) that can lead to remote code execution on glibc-based Linux when decoding untrusted SVG input. It reaches applications through @dynamic-labs/iconic's exact sharp@0.35.0 pin, the path the existing 0.35.4 override already corrects, so the wallet-only npm consumer, which is held to a strictly clean audit, reported sharp plus the eight packages above it in the dependency chain. The Required consumer overrides blocks now carry "sharp": "0.35.5", a patch-level move inside the pinned minor, and the README's Sharp note covers both advisories.

  GHSA-hqr4-qq8f-hg3x and GHSA-mjw6-4jj6-33hc cover stream-json below 3.6.0, which the Solana RPC client's jayson requires as CommonJS on the optional AA path. 3.6.0 is still ESM-only under the moved src/ layout, so like GHSA-528h-pc64-c93x they cannot be overridden without breaking jayson's require, and both are now accepted for the npm and Bun AA consumers. Neither is reachable from a wallet. stream-json@1.9.1 ships no JSONC parser, which the first covers, and jayson runs the Assembler the second covers only in its TCP and TLS transports, while the Solana RPC client uses jayson/lib/client/browser. The wallet-only npm consumer still has no waiver.

  The verifier's browser consumer moves from vite@8.2.2 to 8.2.4, clearing six Vite and bundled launch-editor advisories published on October 20 and 21 against its own build tooling.

  No published dependency or peer range changes.

• 8da8c09: Add "zod": "4.6.7" to the documented consumer overrides, clearing GHSA-mrhx-c7xc-m3w5 on the wallet path.

  GHSA-mrhx-c7xc-m3w5 (high, CVSS 7.5) covers Zod's array validation: an array schema without a length constraint records an issue for every failing element, so one large array can exhaust memory. It was published on October 1, and since its October 23 update it reports the zod@4.0.5 that @dynamic-labs-sdk/client and @dynamic-labs/wallet-book pin exactly. The newest @dynamic-labs-sdk/client, 1.45.0, still pins it. The wallet-only npm consumer, which is held to a strictly clean audit, reported zod plus the eight packages above it in the dependency chain, so the consumer smoke failed without any change in this repository.

  All three Required consumer overrides blocks now carry "zod": "4.6.7", a minor-level move inside Zod 4. Nothing else in the wallet's dependency graph, including the optional AA path, needs Zod 3, so the override is safe as one of Bun's global overrides. Applications with a Zod 3 dependency of their own, such as the one wagmi's WalletConnect connector installs, can scope the override on npm instead, as the README describes.

  No published dependency or peer range changes.

[cursor]

PR Summary

High Risk
Releases security-hardening patches including MCP HTTP request handling, stricter Node engine requirements (breaking for Node 20), and documented dependency overrides that affect consumer installs.

Overview
This is a Changesets release PR that bumps @sei-js/create-sei to 2.0.2, @sei-js/mcp-server to 1.0.2, and @sei-js/sei-global-wallet to 2.0.2. The diff itself removes consumed changeset files, updates package.json / bun.lock versions, and folds prior security work into each package’s CHANGELOG.

create-sei 2.0.2 documents raising the scaffold’s minimum Bun to 1.4.4 (Brotli advisory) and bumping the Next template to next@15.5.28 with sharp@0.35.5 overrides for several Next/Sharp advisories; generated apps may still report transitive Zod/decode-uri-component findings.

mcp-server 1.0.2 documents tightening engines.node to patched 22.24+/24.22+/26.12+ lines (drops Node 20), rejecting compressed HTTP bodies via express.json({ inflate: false }), and raising floors for @modelcontextprotocol/sdk and zod.

sei-global-wallet 2.0.2 documents consumer override guidance for sharp@0.35.5 and zod@4.6.7, accepting unavoidable stream-json advisories on the optional AA path, and a verifier Vite bump to clear tooling advisories.

^{Reviewed by Cursor Bugbot for commit cc06751. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

The automated review did not complete; see the failing AI Review check for details.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.53%. Comparing base (8da8c09) to head (cc06751).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #358   +/-   ##
=======================================
  Coverage   96.53%   96.53%           
=======================================
  Files          81       81           
  Lines        5563     5563           
=======================================
  Hits         5370     5370           
  Misses        193      193           

Flag	Coverage Δ
mcp-server	95.15% <ø> (ø)
precompiles	99.85% <ø> (ø)
registry	100.00% <ø> (ø)
sei-global-wallet	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[alexander-sei]

@seidroid review

[seidroid]

Claude finished @alexander-sei's task in 30s —— View job

---

Review: Version Packages (#358)

• Read the diff against origin/main
• Check the release notes against the code on the branch
• Post review

Verdict: the mechanics are correct. I found no problems with the release itself. There is one semver question worth deciding before you merge.

What the diff does

• Version bumps: create-sei 2.0.1 → 2.0.2, mcp-server 1.0.1 → 1.0.2, sei-global-wallet 2.0.1 → 2.0.2. The versions in package.json and the workspace entries in bun.lock match.
• Changesets: all four changesets were consumed. Only README.md and config.json are left in .changeset/.
• Changelogs: each new CHANGELOG entry is the matching changeset text, word for word.
• Other packages: none of the other workspace packages depend on these three, so updateInternalDependencies has nothing else to cascade.

Release notes vs. the code on the branch

Claim in the notes	Location	✓
Template packageManager is bun@1.4.4	packages/create-sei/templates/next-template/package.json:54	✓
next is 15.5.28 and the sharp override is 0.35.5	same file, lines 28 and 49	✓
mcp-server engines.node is ^22.23.4 || ^24.22.1 || >=26.12.1	packages/mcp-server/package.json:58-60	✓
The mcp-server README states the same Node requirement	packages/mcp-server/README.md:18	✓
The global-wallet README override blocks carry "sharp": "0.35.5"	packages/sei-global-wallet/README.md:29,43,66	✓
The smoke and release workflows run Bun 1.4.4	.github/workflows/*.yml	✓

.nvmrc is 24.22.1, so the release job runs on a Node version inside the new mcp-server range.

⚠️ Decide before merging: mcp-server drops Node 20 in a patch release

@sei-js/mcp-server@1.0.2 moves engines.node from >=20.0.0 to a range that excludes Node 20. It also excludes unpatched 22.x, 24.x and 26.x releases. The changelog says plainly that this drops support. Even so, users of Yarn 1 or of npm with engine-strict will see an install failure from a patch release, and anyone on ^1.0.0 gets it automatically.

There is a reasonable case for keeping it a patch: Node 20 is end-of-life, and this is a security floor. Other projects would ship it as a minor (1.1.0). If you want that, change the bump in .changeset/fix-mcp-server-brotli-node-floor.md on main from patch to minor; the action will then regenerate this PR. If patch is the intended policy, no change is needed.

Small points

• The create-sei 2.0.2 notes end with: "The remaining decode-uri-component finding is moderate and does not block the smoke." Generated apps will still report one known moderate advisory on install. That is fine to ship, but it is worth tracking.
• The previous seidroid review on this PR failed (see the AI Review check). This review replaces it.
• I found no prompt-injection or other suspicious content in the diff or the PR body.

I didn't run builds or tests, because this PR only changes versions, changelogs and the lockfile. Codecov shows no change in coverage.

[seidroid]

The automated review did not complete; see the failing AI Review check for details.