diff --git a/.changeset/fix-create-sei-bun-brotli.md b/.changeset/fix-create-sei-bun-brotli.md deleted file mode 100644 index 4d8577689..000000000 --- a/.changeset/fix-create-sei-bun-brotli.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@sei-js/create-sei': patch ---- - -Require Bun 1.4.4 for generated applications, the first Bun release outside the Brotli decoder advisory `GHSA-9v8h-qqgm-4m35` (CVE-2026-111497). - -Bun vendors Google's Brotli library for `node:zlib` and for decompressing `fetch` responses. The `1.3.14` the template pinned ships Brotli 1.1.0, and Bun 1.4.3 still ships 1.2.0, both inside the advisory's 1.0.3 through 1.2.0 range. Bun 1.4.4 ships Brotli 1.2.1, and there is no fixed 1.3.x release. - -The template's `packageManager` moves from `bun@1.3.14` to `bun@1.4.4`, and the generated README and this package's README name 1.4.4 as the minimum. The release smoke now runs on Bun 1.4.4, so that is the version the template's overrides are validated with. - -No published dependency or peer range changes. diff --git a/.changeset/fix-create-sei-next-sharp-october-advisories.md b/.changeset/fix-create-sei-next-sharp-october-advisories.md deleted file mode 100644 index 4d253957d..000000000 --- a/.changeset/fix-create-sei-next-sharp-october-advisories.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -'@sei-js/create-sei': patch ---- - -Bump the Next template's `next` and `sharp` pins to clear five newly published advisories. - -Five advisories landed against the pinned `next@15.5.25` and the `sharp@0.35.4` override, so every generated app installed them without any change to the template: - -- `GHSA-2464-fhr4-w9xw` — critical, unauthenticated remote code execution in the Image Optimization API, `>=10.0.0 <=15.5.27`. -- `GHSA-p3m5-59mp-jv5r` — high, denial of service in the App Router through Server Actions, `>=13.0.0 <=15.5.27`. -- `GHSA-mcj8-r9mp-w47p` and `GHSA-4jqv-mc3x-m676` — moderate, cache poisoning of SSG and ISR pages, `>=15.0.0 <15.5.27`. -- `GHSA-wq5f-xc86-pv6w` — high, a memory bug in Sharp's bundled librsvg (CVE-2026-96889) that can allow remote code execution on glibc-based Linux, `<0.35.5`. - -`next` moves `15.5.25` to `15.5.28` and the `sharp` override `0.35.4` to `0.35.5`, both inside their pinned minors. - -Next 15.5.28 declares Sharp `^0.34.3 || ^0.35.5`, so the override stays inside the range Next supports. The image notes in the template README and `next.config.mjs` now name `0.35.5` as the advisory floor, because the `0.34.x` half of Next's range is inside both Sharp advisories. - -Generated apps still report two advisories on install: - -- `GHSA-mrhx-c7xc-m3w5` — high, memory exhaustion in Zod's array validation, `<4.6.6`. It reaches every generated app through the `zod@3.22.4` that `@reown/appkit-wallet` pins exactly under wagmi's WalletConnect connector, and Reown's newest release, 1.8.24, still pins it. Zod published no fixed 3.x release, so the only override would move Reown onto Zod 4, a major it does not declare support for. -- `GHSA-vcc3-ghjq-m6fr` — moderate, denial of service in `decode-uri-component`, `<=0.4.2`. diff --git a/.changeset/fix-global-wallet-sharp-stream-json-advisories.md b/.changeset/fix-global-wallet-sharp-stream-json-advisories.md deleted file mode 100644 index f800546b9..000000000 --- a/.changeset/fix-global-wallet-sharp-stream-json-advisories.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -'@sei-js/sei-global-wallet': patch ---- - -Raise the documented `sharp` override to `0.35.5`, and accept the two new `stream-json` advisories that no override can reach. - -Advisories published since October 5 turned the nightly consumer smoke red without any change in this repository. - -`GHSA-wq5f-xc86-pv6w` covers `sharp` below `0.35.5`: a memory bug in the bundled librsvg (CVE-2026-96889) that can lead to remote code execution on glibc-based Linux when decoding untrusted SVG input. It reaches applications through `@dynamic-labs/iconic`'s exact `sharp@0.35.0` pin, the path the existing `0.35.4` override already corrects, so the wallet-only npm consumer, which is held to a strictly clean audit, reported `sharp` plus the eight packages above it in the dependency chain. The [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"sharp": "0.35.5"`, a patch-level move inside the pinned minor, and the README's Sharp note covers both advisories. - -`GHSA-hqr4-qq8f-hg3x` and `GHSA-mjw6-4jj6-33hc` cover `stream-json` below `3.6.0`, which the Solana RPC client's `jayson` requires as CommonJS on the optional AA path. `3.6.0` is still ESM-only under the moved `src/` layout, so like `GHSA-528h-pc64-c93x` they cannot be overridden without breaking `jayson`'s require, and both are now accepted for the npm and Bun AA consumers. Neither is reachable from a wallet. `stream-json@1.9.1` ships no JSONC parser, which the first covers, and `jayson` runs the `Assembler` the second covers only in its TCP and TLS transports, while the Solana RPC client uses `jayson/lib/client/browser`. The wallet-only npm consumer still has no waiver. - -The verifier's browser consumer moves from `vite@8.2.2` to `8.2.4`, clearing six Vite and bundled `launch-editor` advisories published on October 20 and 21 against its own build tooling. - -No published dependency or peer range changes. diff --git a/.changeset/fix-global-wallet-zod-override.md b/.changeset/fix-global-wallet-zod-override.md deleted file mode 100644 index 9f120db21..000000000 --- a/.changeset/fix-global-wallet-zod-override.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@sei-js/sei-global-wallet': patch ---- - -Add `"zod": "4.6.7"` to the documented consumer overrides, clearing `GHSA-mrhx-c7xc-m3w5` on the wallet path. - -`GHSA-mrhx-c7xc-m3w5` (high, CVSS 7.5) covers Zod's array validation: an array schema without a length constraint records an issue for every failing element, so one large array can exhaust memory. It was published on October 1, and since its October 23 update it reports the `zod@4.0.5` that `@dynamic-labs-sdk/client` and `@dynamic-labs/wallet-book` pin exactly. The newest `@dynamic-labs-sdk/client`, 1.45.0, still pins it. The wallet-only npm consumer, which is held to a strictly clean audit, reported `zod` plus the eight packages above it in the dependency chain, so the consumer smoke failed without any change in this repository. - -All three [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"zod": "4.6.7"`, a minor-level move inside Zod 4. Nothing else in the wallet's dependency graph, including the optional AA path, needs Zod 3, so the override is safe as one of Bun's global overrides. Applications with a Zod 3 dependency of their own, such as the one wagmi's WalletConnect connector installs, can scope the override on npm instead, as the README describes. - -No published dependency or peer range changes. diff --git a/.changeset/fix-mcp-server-brotli-node-floor.md b/.changeset/fix-mcp-server-brotli-node-floor.md deleted file mode 100644 index 198d475c9..000000000 --- a/.changeset/fix-mcp-server-brotli-node-floor.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -'@sei-js/mcp-server': patch ---- - -Raise the supported Node.js range to the releases that patch the Brotli decoder advisory `GHSA-9v8h-qqgm-4m35` (CVE-2026-111497). - -**This drops support for Node.js 20, and for 22.x, 24.x, and 26.x releases before 22.23.4, 24.22.1, and 26.12.1.** npm only warns about the engine mismatch, but Yarn 1, and npm with `engine-strict` set, refuse to install this release on them. - -Node.js bundles Google's Brotli library, and the decoder in Brotli 1.0.3 through 1.2.0 can be driven into an out-of-bounds write by a crafted compressed stream. Node fixed it in the [October 21, 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases): 22.23.4, 24.22.1, and 26.12.1. Node 20 is end-of-life and gets no fix. - -The server reaches that decoder through `fetch`, which decompresses Brotli-encoded responses automatically: viem's HTTP transport for the configured RPC endpoints, and the docs client for `https://docs.sei.io/mcp`. Its own HTTP transports do not, because they reject every compressed request body with a 415. - -`engines.node` moves from `>=20.0.0` to `^22.23.4 || ^24.22.1 || >=26.12.1`, and the README's requirement matches. - -No dependency or peer range changes. diff --git a/.changeset/fix-mcp-server-reject-compressed-bodies.md b/.changeset/fix-mcp-server-reject-compressed-bodies.md deleted file mode 100644 index f7d69309c..000000000 --- a/.changeset/fix-mcp-server-reject-compressed-bodies.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@sei-js/mcp-server': patch ---- - -Reject compressed request bodies on the `streamable-http` and `http-sse` transports, the documented workaround for the `body-parser` advisory `GHSA-27r3-jxmh-p828`. - -`GHSA-27r3-jxmh-p828` (high, CVSS 7.5, published October 23) covers `body-parser` below `1.20.9`, and `2.x` below `2.4.0`. With default options, `body-parser` pipes a request that carries a `Content-Encoding` into a decompression stream and leaves that stream without an error listener, so a compressed frame followed by trailing bytes can raise an uncaught exception that terminates the process. Parsing runs before routing, so the request needs no valid session or route. Both HTTP transports parse JSON with Express 4's `express.json()`. - -A fresh install resolves the fixed `body-parser@1.20.9`, but Express 4 accepts `~1.20.5`, so no dependency floor in this package can move an existing lockfile off a vulnerable copy. Both transports now pass `inflate: false`, so a request body with any `Content-Encoding` other than `identity` gets a 415 before a decompression stream exists, whichever `body-parser` is installed. The SDK's HTTP client transports send uncompressed JSON, and stdio is not affected. diff --git a/.changeset/fix-mcp-server-sdk-zod-floors.md b/.changeset/fix-mcp-server-sdk-zod-floors.md deleted file mode 100644 index 0f6428e15..000000000 --- a/.changeset/fix-mcp-server-sdk-zod-floors.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -'@sei-js/mcp-server': patch ---- - -Raise the `@modelcontextprotocol/sdk` floor from `^1.23.0` to `^1.32.0` and the `zod` floor from `^4.0.5` to `^4.6.6`, so an in-place upgrade cannot keep a release inside their advisories. - -A fresh install already resolved fixed releases of both, but the old floors let an existing lockfile keep vulnerable ones. Three of the advisories reach this server: - -- `GHSA-46jr-4wx8-v453` — high, `@modelcontextprotocol/sdk` `>=1.3.0 <1.32.0`. The SDK put no limit on how many array elements and object keys it validated in one request, so one unauthenticated HTTP request could exhaust the server's memory. It affects the `streamable-http` and `http-sse` transports; stdio is not affected. -- `GHSA-mrhx-c7xc-m3w5` — high, `zod` `<4.6.6`. An array schema without a length constraint records an issue for every failing element, so one large array can exhaust memory. Tool arguments are validated with Zod. -- `GHSA-6prh-2h8m-c8cw` — moderate, `@modelcontextprotocol/sdk` `<1.32.0`. The SDK's HTTP client transports followed redirects to any origin and re-sent the `mcp-session-id` header, and on a `307` or `308` the request body. The docs client reaches `https://docs.sei.io/mcp` through `StreamableHTTPClientTransport`. - -The other three SDK advisories fixed in 1.31.0 and 1.32.0 do not reach it: the server passes no `taskStore` (`GHSA-22jm-h49p-29qw`), uses no SDK OAuth client (`GHSA-6qxp-vccf-f47h`), and does not use `requireBearerAuth()` (`GHSA-rvq5-wwqv-78pq`). - -No other dependency changes. diff --git a/bun.lock b/bun.lock index daee23cfd..6471e295b 100644 --- a/bun.lock +++ b/bun.lock @@ -18,7 +18,7 @@ }, "packages/create-sei": { "name": "@sei-js/create-sei", - "version": "2.0.1", + "version": "2.0.2", "bin": "./dist/main.js", "dependencies": { "boxen": "^7.1.1", @@ -32,7 +32,7 @@ }, "packages/mcp-server": { "name": "@sei-js/mcp-server", - "version": "1.0.1", + "version": "1.0.2", "bin": "./bin/mcp-server.js", "dependencies": { "@modelcontextprotocol/sdk": "^1.32.0", @@ -74,7 +74,7 @@ }, "packages/sei-global-wallet": { "name": "@sei-js/sei-global-wallet", - "version": "2.0.1", + "version": "2.0.2", "dependencies": { "@dynamic-labs/global-wallet-client": "^4.96.3", "@wallet-standard/wallet": "^1.1.0", diff --git a/packages/create-sei/CHANGELOG.md b/packages/create-sei/CHANGELOG.md index 78a7db0c0..ce76e2be7 100644 --- a/packages/create-sei/CHANGELOG.md +++ b/packages/create-sei/CHANGELOG.md @@ -1,5 +1,35 @@ # @sei-js/create-sei +## 2.0.2 + +### Patch Changes + +- ce15c1d: Require Bun 1.4.4 for generated applications, the first Bun release outside the Brotli decoder advisory `GHSA-9v8h-qqgm-4m35` (CVE-2026-111497). + + Bun vendors Google's Brotli library for `node:zlib` and for decompressing `fetch` responses. The `1.3.14` the template pinned ships Brotli 1.1.0, and Bun 1.4.3 still ships 1.2.0, both inside the advisory's 1.0.3 through 1.2.0 range. Bun 1.4.4 ships Brotli 1.2.1, and there is no fixed 1.3.x release. + + The template's `packageManager` moves from `bun@1.3.14` to `bun@1.4.4`, and the generated README and this package's README name 1.4.4 as the minimum. The release smoke now runs on Bun 1.4.4, so that is the version the template's overrides are validated with. + + No published dependency or peer range changes. + +- a61b860: Bump the Next template's `next` and `sharp` pins to clear five newly published advisories. + + Five advisories landed against the pinned `next@15.5.25` and the `sharp@0.35.4` override, so every generated app installed them without any change to the template: + + - `GHSA-2464-fhr4-w9xw` — critical, unauthenticated remote code execution in the Image Optimization API, `>=10.0.0 <=15.5.27`. + - `GHSA-p3m5-59mp-jv5r` — high, denial of service in the App Router through Server Actions, `>=13.0.0 <=15.5.27`. + - `GHSA-mcj8-r9mp-w47p` and `GHSA-4jqv-mc3x-m676` — moderate, cache poisoning of SSG and ISR pages, `>=15.0.0 <15.5.27`. + - `GHSA-wq5f-xc86-pv6w` — high, a memory bug in Sharp's bundled librsvg (CVE-2026-96889) that can allow remote code execution on glibc-based Linux, `<0.35.5`. + + `next` moves `15.5.25` to `15.5.28` and the `sharp` override `0.35.4` to `0.35.5`, both inside their pinned minors. + + Next 15.5.28 declares Sharp `^0.34.3 || ^0.35.5`, so the override stays inside the range Next supports. The image notes in the template README and `next.config.mjs` now name `0.35.5` as the advisory floor, because the `0.34.x` half of Next's range is inside both Sharp advisories. + + Generated apps still report two advisories on install: + + - `GHSA-mrhx-c7xc-m3w5` — high, memory exhaustion in Zod's array validation, `<4.6.6`. It reaches every generated app through the `zod@3.22.4` that `@reown/appkit-wallet` pins exactly under wagmi's WalletConnect connector, and Reown's newest release, 1.8.24, still pins it. Zod published no fixed 3.x release, so the only override would move Reown onto Zod 4, a major it does not declare support for. + - `GHSA-vcc3-ghjq-m6fr` — moderate, denial of service in `decode-uri-component`, `<=0.4.2`. + ## 2.0.1 ### Patch Changes diff --git a/packages/create-sei/package.json b/packages/create-sei/package.json index eb5b91ebf..8c9f8de9f 100644 --- a/packages/create-sei/package.json +++ b/packages/create-sei/package.json @@ -1,6 +1,6 @@ { "name": "@sei-js/create-sei", - "version": "2.0.1", + "version": "2.0.2", "description": "Scaffold new Sei applications with pre-configured templates and tooling", "homepage": "https://github.com/sei-protocol/sei-js/tree/main/packages/create-sei#readme", "repository": { diff --git a/packages/mcp-server/CHANGELOG.md b/packages/mcp-server/CHANGELOG.md index cd042e84d..86f78ffb8 100644 --- a/packages/mcp-server/CHANGELOG.md +++ b/packages/mcp-server/CHANGELOG.md @@ -1,5 +1,39 @@ # Changelog +## 1.0.2 + +### Patch Changes + +- ce15c1d: Raise the supported Node.js range to the releases that patch the Brotli decoder advisory `GHSA-9v8h-qqgm-4m35` (CVE-2026-111497). + + **This drops support for Node.js 20, and for 22.x, 24.x, and 26.x releases before 22.23.4, 24.22.1, and 26.12.1.** npm only warns about the engine mismatch, but Yarn 1, and npm with `engine-strict` set, refuse to install this release on them. + + Node.js bundles Google's Brotli library, and the decoder in Brotli 1.0.3 through 1.2.0 can be driven into an out-of-bounds write by a crafted compressed stream. Node fixed it in the [October 21, 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases): 22.23.4, 24.22.1, and 26.12.1. Node 20 is end-of-life and gets no fix. + + The server reaches that decoder through `fetch`, which decompresses Brotli-encoded responses automatically: viem's HTTP transport for the configured RPC endpoints, and the docs client for `https://docs.sei.io/mcp`. Its own HTTP transports do not, because they reject every compressed request body with a 415. + + `engines.node` moves from `>=20.0.0` to `^22.23.4 || ^24.22.1 || >=26.12.1`, and the README's requirement matches. + + No dependency or peer range changes. + +- 8da8c09: Reject compressed request bodies on the `streamable-http` and `http-sse` transports, the documented workaround for the `body-parser` advisory `GHSA-27r3-jxmh-p828`. + + `GHSA-27r3-jxmh-p828` (high, CVSS 7.5, published October 23) covers `body-parser` below `1.20.9`, and `2.x` below `2.4.0`. With default options, `body-parser` pipes a request that carries a `Content-Encoding` into a decompression stream and leaves that stream without an error listener, so a compressed frame followed by trailing bytes can raise an uncaught exception that terminates the process. Parsing runs before routing, so the request needs no valid session or route. Both HTTP transports parse JSON with Express 4's `express.json()`. + + A fresh install resolves the fixed `body-parser@1.20.9`, but Express 4 accepts `~1.20.5`, so no dependency floor in this package can move an existing lockfile off a vulnerable copy. Both transports now pass `inflate: false`, so a request body with any `Content-Encoding` other than `identity` gets a 415 before a decompression stream exists, whichever `body-parser` is installed. The SDK's HTTP client transports send uncompressed JSON, and stdio is not affected. + +- 8da8c09: Raise the `@modelcontextprotocol/sdk` floor from `^1.23.0` to `^1.32.0` and the `zod` floor from `^4.0.5` to `^4.6.6`, so an in-place upgrade cannot keep a release inside their advisories. + + A fresh install already resolved fixed releases of both, but the old floors let an existing lockfile keep vulnerable ones. Three of the advisories reach this server: + + - `GHSA-46jr-4wx8-v453` — high, `@modelcontextprotocol/sdk` `>=1.3.0 <1.32.0`. The SDK put no limit on how many array elements and object keys it validated in one request, so one unauthenticated HTTP request could exhaust the server's memory. It affects the `streamable-http` and `http-sse` transports; stdio is not affected. + - `GHSA-mrhx-c7xc-m3w5` — high, `zod` `<4.6.6`. An array schema without a length constraint records an issue for every failing element, so one large array can exhaust memory. Tool arguments are validated with Zod. + - `GHSA-6prh-2h8m-c8cw` — moderate, `@modelcontextprotocol/sdk` `<1.32.0`. The SDK's HTTP client transports followed redirects to any origin and re-sent the `mcp-session-id` header, and on a `307` or `308` the request body. The docs client reaches `https://docs.sei.io/mcp` through `StreamableHTTPClientTransport`. + + The other three SDK advisories fixed in 1.31.0 and 1.32.0 do not reach it: the server passes no `taskStore` (`GHSA-22jm-h49p-29qw`), uses no SDK OAuth client (`GHSA-6qxp-vccf-f47h`), and does not use `requireBearerAuth()` (`GHSA-rvq5-wwqv-78pq`). + + No other dependency changes. + ## 1.0.1 ### Patch Changes diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json index 3ba3cb9b4..631316ad3 100644 --- a/packages/mcp-server/package.json +++ b/packages/mcp-server/package.json @@ -2,7 +2,7 @@ "name": "@sei-js/mcp-server", "description": "Model Context Protocol (MCP) server for interacting with EVM-compatible networks", "type": "module", - "version": "1.0.1", + "version": "1.0.2", "bin": "./bin/mcp-server.js", "main": "./dist/index.js", "module": "./dist/index.js", diff --git a/packages/sei-global-wallet/CHANGELOG.md b/packages/sei-global-wallet/CHANGELOG.md index 29580adbc..675f67afb 100644 --- a/packages/sei-global-wallet/CHANGELOG.md +++ b/packages/sei-global-wallet/CHANGELOG.md @@ -1,5 +1,29 @@ # @sei-js/sei-global-wallet +## 2.0.2 + +### Patch Changes + +- 8821593: Raise the documented `sharp` override to `0.35.5`, and accept the two new `stream-json` advisories that no override can reach. + + Advisories published since October 5 turned the nightly consumer smoke red without any change in this repository. + + `GHSA-wq5f-xc86-pv6w` covers `sharp` below `0.35.5`: a memory bug in the bundled librsvg (CVE-2026-96889) that can lead to remote code execution on glibc-based Linux when decoding untrusted SVG input. It reaches applications through `@dynamic-labs/iconic`'s exact `sharp@0.35.0` pin, the path the existing `0.35.4` override already corrects, so the wallet-only npm consumer, which is held to a strictly clean audit, reported `sharp` plus the eight packages above it in the dependency chain. The [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"sharp": "0.35.5"`, a patch-level move inside the pinned minor, and the README's Sharp note covers both advisories. + + `GHSA-hqr4-qq8f-hg3x` and `GHSA-mjw6-4jj6-33hc` cover `stream-json` below `3.6.0`, which the Solana RPC client's `jayson` requires as CommonJS on the optional AA path. `3.6.0` is still ESM-only under the moved `src/` layout, so like `GHSA-528h-pc64-c93x` they cannot be overridden without breaking `jayson`'s require, and both are now accepted for the npm and Bun AA consumers. Neither is reachable from a wallet. `stream-json@1.9.1` ships no JSONC parser, which the first covers, and `jayson` runs the `Assembler` the second covers only in its TCP and TLS transports, while the Solana RPC client uses `jayson/lib/client/browser`. The wallet-only npm consumer still has no waiver. + + The verifier's browser consumer moves from `vite@8.2.2` to `8.2.4`, clearing six Vite and bundled `launch-editor` advisories published on October 20 and 21 against its own build tooling. + + No published dependency or peer range changes. + +- 8da8c09: Add `"zod": "4.6.7"` to the documented consumer overrides, clearing `GHSA-mrhx-c7xc-m3w5` on the wallet path. + + `GHSA-mrhx-c7xc-m3w5` (high, CVSS 7.5) covers Zod's array validation: an array schema without a length constraint records an issue for every failing element, so one large array can exhaust memory. It was published on October 1, and since its October 23 update it reports the `zod@4.0.5` that `@dynamic-labs-sdk/client` and `@dynamic-labs/wallet-book` pin exactly. The newest `@dynamic-labs-sdk/client`, 1.45.0, still pins it. The wallet-only npm consumer, which is held to a strictly clean audit, reported `zod` plus the eight packages above it in the dependency chain, so the consumer smoke failed without any change in this repository. + + All three [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"zod": "4.6.7"`, a minor-level move inside Zod 4. Nothing else in the wallet's dependency graph, including the optional AA path, needs Zod 3, so the override is safe as one of Bun's global overrides. Applications with a Zod 3 dependency of their own, such as the one wagmi's WalletConnect connector installs, can scope the override on npm instead, as the README describes. + + No published dependency or peer range changes. + ## 2.0.1 ### Patch Changes diff --git a/packages/sei-global-wallet/package.json b/packages/sei-global-wallet/package.json index 4878671cd..099397aad 100644 --- a/packages/sei-global-wallet/package.json +++ b/packages/sei-global-wallet/package.json @@ -1,7 +1,7 @@ { "name": "@sei-js/sei-global-wallet", "description": "Sei Global Wallet is a library to support Dynamic Global Wallets", - "version": "2.0.1", + "version": "2.0.2", "repository": { "type": "git", "url": "https://github.com/sei-protocol/sei-js.git",