Skip to content

chore(deps): bump the frontend-dependencies group across 1 directory with 15 updates - #280

Merged
David1984TK merged 3 commits into
mainfrom
dependabot/npm_and_yarn/bimex-frontend/frontend-dependencies-f917d51210
Jul 28, 2026
Merged

chore(deps): bump the frontend-dependencies group across 1 directory with 15 updates#280
David1984TK merged 3 commits into
mainfrom
dependabot/npm_and_yarn/bimex-frontend/frontend-dependencies-f917d51210

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the frontend-dependencies group with 15 updates in the /bimex-frontend directory:

Package From To
@sentry/react 10.65.0 10.68.0
@stellar/stellar-sdk 16.0.1 16.1.0
@supabase/supabase-js 2.110.2 2.110.9
lucide-react 1.24.0 1.27.0
passkey-kit 0.12.1 0.14.0
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
react-i18next 17.0.9 17.0.11
@playwright/test 1.61.1 1.62.0
@testing-library/jest-dom 6.9.1 7.0.0
@vitejs/plugin-react 6.0.3 6.0.4
eslint 10.7.0 10.8.0
globals 17.7.0 17.8.0
jsdom 29.1.1 30.0.0
vite 8.1.4 8.1.5

Updates @sentry/react from 10.65.0 to 10.68.0

Release notes

Sourced from @​sentry/react's releases.

10.68.0

  • feat(cloudflare): Add @​sentry/cloudflare/vite orchestrion plugin (#21967)
  • feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)
  • feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)
  • feat(server-utils): Allow integrations to be part of marker (#22094)
  • feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)
  • feat(server-utils): Warn when bundler config has instrumented module in external (#22379)
  • feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)
  • feat(v10): Add url.full and url.path to http.server spans (#22533)
  • feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)
  • feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)
  • feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)
  • feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)
  • feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)
  • feat(v10/core): Add instrumentStateGraph API (#22491)
  • feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)
  • feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)
  • feat(v10/react-router): Make instrumentation API the default (#22525)
  • fix(cloudflare,deno,node): Align types of vercelai (#22343)
  • fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)
  • fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)
  • fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)
  • fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)
  • fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)
  • fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)
  • fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)
  • chore: Add external contributor to CHANGELOG.md (#22342)
  • chore: Add external contributor to CHANGELOG.md (#22405)
  • chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)
  • chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)
  • chore(size-limit): weekly auto-bump (#22182)
  • ci(v10): Add v10 to build and license-compliance branch filters (#22499)
  • feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)
  • ref(server-utils): Remove unneeded orchestrion config (#22384)
  • ref(server-utils): Small fastify cleanup (#22385)
  • test: Remove unnecessary test waits (#22383)
  • test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)
  • test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @​psh4607 and @​trinitiwowka. Thank you for your contributions!

Bundle size 📦

| Path | Size |

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

10.68.0

  • feat(cloudflare): Add @​sentry/cloudflare/vite orchestrion plugin (#21967)
  • feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)
  • feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)
  • feat(server-utils): Allow integrations to be part of marker (#22094)
  • feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)
  • feat(server-utils): Warn when bundler config has instrumented module in external (#22379)
  • feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)
  • feat(v10): Add url.full and url.path to http.server spans (#22533)
  • feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)
  • feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)
  • feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)
  • feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)
  • feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)
  • feat(v10/core): Add instrumentStateGraph API (#22491)
  • feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)
  • feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)
  • feat(v10/react-router): Make instrumentation API the default (#22525)
  • fix(cloudflare,deno,node): Align types of vercelai (#22343)
  • fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)
  • fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)
  • fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)
  • fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)
  • fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)
  • fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)
  • fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)
  • chore: Add external contributor to CHANGELOG.md (#22342)
  • chore: Add external contributor to CHANGELOG.md (#22405)
  • chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)
  • chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)
  • chore(size-limit): weekly auto-bump (#22182)
  • ci(v10): Add v10 to build and license-compliance branch filters (#22499)
  • feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)
  • ref(server-utils): Remove unneeded orchestrion config (#22384)
  • ref(server-utils): Small fastify cleanup (#22385)
  • test: Remove unnecessary test waits (#22383)
  • test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)
  • test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @​psh4607 and @​trinitiwowka. Thank you for your contributions!

10.67.0

... (truncated)

Commits
  • b4396c3 release: 10.68.0
  • be21e8c meta(changelog): Update changelog for 10.68.0 (#22566)
  • fb0987f feat(v10): Add http.route attribute to http.server spans with parameteriz...
  • f7bd901 feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)
  • ed3a8c8 feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)
  • 20227f9 feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)
  • 3e5625e feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)
  • d924551 test(v10/cloudflare): Add Vite-build support to the integration-test runner (...
  • 11fed03 feat(v10/cloudflare): Read wrangler config and resolve the Sentry options mod...
  • a540764 feat(v10): Add url.full and url.path to http.server spans (#22533)
  • Additional commits viewable in compare view

Updates @stellar/stellar-sdk from 16.0.1 to 16.1.0

Release notes

Sourced from @​stellar/stellar-sdk's releases.

v16.1.0

v16.1.0

Added

  • inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).
  • checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).
  • Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).
  • rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).
  • rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).
  • rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).
  • contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).
  • ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).
  • Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).
  • TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

  • HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).
  • contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).
  • rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).
  • The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

  • Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).
  • Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).
  • contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).
  • Spec.nativeToScVal no longer misclassifies plain objects that have a constructor key, and handles null-prototype objects (Object.create(null)) (#1485).

Contributors

Full Changelog: stellar/js-stellar-sdk@v16.0.1...v16.1.0

Changelog

Sourced from @​stellar/stellar-sdk's changelog.

v16.1.0

Added

  • inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).
  • checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).
  • Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).
  • rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).
  • rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).
  • rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).
  • contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).
  • ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).
  • Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).
  • TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

  • HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).
  • contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).
  • rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).
  • The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

  • Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).
  • Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).
  • contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).
  • Spec.nativeToScVal no longer misclassifies plain objects that have a constructor key, and handles null-prototype objects (Object.create(null)) (#1485).
Commits
  • 62830ba Release v16.1.0 (#1560)
  • 74886fa Bump the all-actions group with 3 updates (#1552)
  • 3233637 Add inspectAuthEntry and checkAuthEntryReadiness for decoding Soroban auth en...
  • 0d6b7a9 Tx failed error (#1526)
  • 63671cc Single-source guide code as tested snippets injected at docs build time (#1522)
  • 8c6de2e Handle scSpecTypeVal in Spec.nativeToScVal for raw JS types (#1485)
  • bbb8107 Bump lint-staged from 15.5.2 to 17.0.8 (#1510)
  • 44d5003 Bump the all-actions group across 1 directory with 9 updates (#1508)
  • cb23d75 add socket tier 1 reachability analysis (#1476)
  • becb237 Add SEP-53 message signing/verification to Keypair (#1513)
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.110.2 to 2.110.9

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.110.9

2.110.9 (2026-07-27)

🩹 Fixes

  • auth: downgrade stale refresh token console noise (#2559)
  • realtime: preserve presence refs (#2566)
  • repo: override sharp to >=0.35.0 to clear libvips advisory (#2548)
  • repo: populate symbols in sdk-compliance so capabilities are verifiable (#2547)
  • repo: bump postcss, babel, next to clear audit advisories (#2561)

❤️ Thank You

v2.110.9-canary.3

2.110.9-canary.3 (2026-07-27)

🩹 Fixes

  • realtime: preserve presence refs (#2566)

❤️ Thank You

v2.110.9-canary.2

2.110.9-canary.2 (2026-07-27)

🩹 Fixes

  • auth: downgrade stale refresh token console noise (#2559)
  • repo: bump postcss, babel, next to clear audit advisories (#2561)

❤️ Thank You

v2.110.9-canary.1

2.110.9-canary.1 (2026-07-23)

This was a version bump only, there were no code changes.

v2.110.9-canary.0

2.110.9-canary.0 (2026-07-22)

🩹 Fixes

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.110.9 (2026-07-27)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.8 (2026-07-21)

🩹 Fixes

  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

2.110.7 (2026-07-16)

🩹 Fixes

  • realtime: trigger set auth on INITIAL_SESSION event (#2531)

❤️ Thank You

2.110.6 (2026-07-15)

🩹 Fixes

  • supabase: warn instead of throw for unrecognized sb_ API key subtypes (#2526)

❤️ Thank You

2.110.5 (2026-07-14)

🩹 Fixes

  • supabase: avoid edge runtime warning (#2522)

❤️ Thank You

2.110.4 (2026-07-14)

🩹 Fixes

  • functions: stop sending API key in Authorization header for function calls (#2511)

... (truncated)

Commits
  • fc2e61e chore(repo): bump postcss override and fix playwright 1.62 tsconfig failure (...
  • 22050de chore(release): version 2.110.8 changelogs (#2546)
  • 01dbb53 fix(supabase): skip Node warning in Deno (#2541)
  • 150b00c chore(release): version 2.110.7 changelogs (#2533)
  • 130fa11 fix(realtime): trigger set auth on INITIAL_SESSION event (#2531)
  • c90b1cd chore(release): version 2.110.6 changelogs (#2527)
  • c23e1ab fix(supabase): warn instead of throw for unrecognized sb_ API key subtypes (#...
  • 8af3c3a chore(release): version 2.110.5 changelogs (#2524)
  • 25da097 chore(release): version 2.110.4 changelogs (#2523)
  • dafa7f5 fix(supabase): avoid edge runtime warning (#2522)
  • Additional commits viewable in compare view

Updates lucide-react from 1.24.0 to 1.27.0

Release notes

Sourced from lucide-react's releases.

Version 1.27.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

Version 1.26.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

Version 1.25.0

What's Changed

... (truncated)

Commits

Updates passkey-kit from 0.12.1 to 0.14.0

Release notes

Sourced from passkey-kit's releases.

v0.13.1 — live keyless Mercury discovery

Live signer discovery via Mercury's hosted, keyless passkey-indexer — plus removal of the paths that no longer earn their keep. No contract change; bindings (passkey-kit-sdk 0.7.3, sac-sdk 0.4.3) and the canonical WASM 84924c53… are unchanged.

Highlights

  • Keyless Mercury discovery, live on both networks. MercuryIndexer queries Mercury's public passkey-indexer REST API (https://{testnet,mainnet}.mercurydata.app/rest/passkey-indexer) — no JWT/API key — with full history across both signer generations (legacy ("sw_v1", …) tuples and the v1 #[contractevent]s). It returns fully-decoded signers mapped straight onto WalletSigner. New MercuryIndexer.forNetwork() / mercuryPasskeyIndexerUrl() / MERCURY_PASSKEY_INDEXER_URLS.
  • MercuryIndexer is now browser-safe — exported from the main passkey-kit entry (it holds no secret), so you can call it directly from the browser with no proxy.
  • Demo calls Mercury directly — the old indexer-proxy indirection and backend toggle are gone.
  • Hardening preserved — with an rpc, evicted temporary signers are flagged and reverse-lookup candidates are confirmed on-chain before being trusted.

Breaking (pre-1.0)

  • StellarIndexerBackend / StellarIndexerConfig / indexerForConfig removed (mainnet-only, never had a live testnet path; Mercury now covers both networks). SignerIndexer has one implementation.
  • IndexedSigner type removed — PasskeyServer.getSigners returns WalletSigner[].
  • MercuryIndexer moved from passkey-kit/server to the main passkey-kit entry.
  • MercuryConfig collapsed to an optional { url? } (defaults to the network's hosted endpoint); projectName/jwt/apiKey and the interim zephyrExecuteConfirmed gate are gone.
  • The zephyr/ self-host indexer program was removed.

See the CHANGELOG and migration guide.

Changelog

Sourced from passkey-kit's changelog.

0.14.0 — 2026-07-14

Robustness, validation, and test-coverage improvements across the contract, SDK, and relayer-proxy. All changes are forward-only. Bindings package passkey-kit-sdk is bumped to 0.8.0. Breaking: updateSecp256r1 drops its publicKey parameter (updateSecp256r1(keyId, limits, store, expiration?)).

Contract

  • Rebuilt canonical WASM. The smart-wallet contract's canonical testnet hash is now fdefad64b96837147e1c333e51f537b696eab925e9f147e63d597c04e3c903f0 (sample-policy 801b68fabf9f8746b10bfbc6d3da1b41462db0a38364ab8139d32dec3676ef39), superseding 84924c53… from 0.13.0/0.13.1 — see docs/deployments-testnet-2026-07-11.md for the re-pinned manifest and upload transactions. Bindings (passkey-kit-sdk) are regenerated from the new WASM.
  • New contract error codes, mirrored in CONTRACT_ERROR_REGISTRY: LastAdminSigner = 103 (removing or demoting the wallet's last durable admin signer is rejected — add or promote a replacement admin first), LastSigner = 104 (any operation that would leave the wallet without a durable — Persistent, non-expiring — signer is rejected, enforced at construction, removal, and update-demotion, so at least one signer that cannot evict or expire always exists), and AuthenticatorDataTooLarge = 126 (authenticatorData capped at 1024 bytes). Policy invocations now run only after every other requirement of a signer's limits has passed, so a losing auth candidate never invokes a state-committing policy; a rejecting policy does not block its own removal.

SDK

  • V2 address-bound signing. signAuthEntry now upgrades V1 address credentials to V2 (toAddressBoundCredentials) before hashing and refuses to sign any non-address-bound entry — the CAP-0071-02 V2 preimage binds the wallet address into every signed payload, and there is no V1 signing path. A regression test pins that two wallets produce different payload hashes for a byte-identical address-free invocation, and that the signed payload equals the stellar-sdk's own buildAuthorizationEntryPreimage V2 hash.
  • updateSecp256r1 no longer accepts a publicKey. Breaking: updateSecp256r1(keyId, publicKey, limits, store, expiration?) → updateSecp256r1(keyId, limits, store, expiration?). update_signer replaces the whole on-chain signer value, so the kit now treats the ledger as the single source of truth for key material: it re-reads the authoritative public key on-chain and throws SignerNotFoundError if the signer is not found.
  • connectWallet no longer treats RPC transport errors as not-found. The derived-address instance read distinguishes an authoritative not-found (falls through to storage/indexer) from a transport error (429/5xx/timeout — propagates), so a flaky RPC never reroutes wallet resolution. New contractInstanceExists helper in rpc-data.
  • Reverse lookup fails closed. MercuryIndexer.findWallets now throws IndexerError(INDEXER_NOT_CONFIGURED) when candidates exist but no confirmation route does (no rpc, and hardening derivation only covers Secp256r1 keys) — unconfirmed indexer rows are never returned. Previously they were returned unfiltered when neither rpc nor hardening was configured.
  • Failed verifyWasmHash disconnects. A connectWallet({ verifyWasmHash: true }) mismatch now clears wallet/keyId before throwing, so a subsequent sign cannot operate on the rejected contract.
  • Input validation. compactSignature validates the DER structure (tags, short-form lengths that exactly span the buffer, r/s in [1, n-1]) before any offset is read. extractPublicKeyFromAttestation verifies the COSE prefix/labels and bounds in place instead of trusting fixed offsets, and rejects any extracted key that is not a point on the P-256 curve — a wallet deployed from a mangled key could never verify a signature; new isOnP256Curve export. validateExpiration accepts the contract's full u64 UNIX-seconds range instead of capping at u32.

0.13.1 — 2026-07-13

Indexing — live Mercury discovery

Rewires the MercuryIndexer onto Mercury's hosted, keyless passkey-indexer, now live on both networks. This resolves the "indexer live-query pending a decision" limitation noted in 0.13.0. No contract change — the bindings (passkey-kit-sdk 0.7.3, sac-sdk 0.4.3) and the canonical WASM hash 84924c53… are unchanged.

  • Keyless hosted endpoint. MercuryIndexer now queries Mercury's public passkey-indexer REST API (https://{testnet,mainnet}.mercurydata.app/rest/passkey-indexer, GET /api/wallet/:id + /api/lookup/*) — no JWT / API key. It covers testnet and mainnet with full history across both signer generations (legacy ("sw_v1", …) tuples and the v1 #[contractevent]s). The endpoint returns fully-decoded signers, so the client maps JSON straight onto WalletSigner with no XDR round-trip. New MercuryIndexer.forNetwork(config, networkPassphrase) resolves the base URL per network (returns null off testnet/mainnet); new mercuryPasskeyIndexerUrl(passphrase) helper + MERCURY_PASSKEY_INDEXER_URLS constant.
  • MercuryIndexer is now browser-safe. Because the endpoint is keyless, MercuryIndexer (+ MercuryIndexerConfig, mercuryPasskeyIndexerUrl, MERCURY_PASSKEY_INDEXER_URLS) is exported from the main passkey-kit entry instead of passkey-kit/server — call it directly from the browser, no proxy. The demo now does exactly this (the indexer-proxy indirection is gone).
  • Stellar Indexer backend removed. StellarIndexerBackend (Creit Tech, POST /v1/contract-data) is dropped along with indexerForConfig: it was mainnet-only and never had a live testnet path, and Mercury now covers both networks keylessly. SignerIndexer has one implementation.
  • Hardening preserved. With an rpc, temporary signers are still confirmed on-chain (evicted TTL entries flagged status: "evicted" — the indexer can't observe eviction), and reverse-lookup candidates are still confirmed by deterministic derivation or on-chain signer presence before being trusted (#598 F3/F6, audit H2).
  • PasskeyServer consolidation. getSigners / getContractId now delegate to a single MercuryIndexer — the duplicated POST /zephyr/execute client is gone. getSigners returns WalletSigner[].
  • zephyr/ removed. The self-hosted Zephyr indexer program and its docs are dropped; Mercury's hosted indexer replaces it entirely.

[!IMPORTANT] Breaking (pre-1.0). StellarIndexerBackend / StellarIndexerConfig / indexerForConfig and the IndexedSigner type are removed (PasskeyServer.getSigners now returns WalletSigner[]). MercuryIndexer moved from passkey-kit/server to the main passkey-kit entry. MercuryConfig collapses to an optional { url? } (defaults to the network's hosted endpoint); MercuryConfig/MercuryIndexerConfig no longer take projectName / jwt / apiKey, and the interim zephyrExecuteConfirmed gate is gone.

0.13.0 — 2026-07-12

[!NOTE] Version. The v1 overhaul ships as passkey-kit@0.13.0 (minor bump from 0.12.1, forward-only). The reworked contract stamps binver = 1.0.0 in its metadata. Per-component versions below are the source of truth; npm view is authoritative for what is published. This tag is the reference for the canonical v1 contract WASM hash 84924c53a413318df2ce753e30de53ec651404c916d30e861718ad155c94b319 (see docs/deployments-testnet-2026-07-11.md).

Component Version
passkey-kit (SDK) 0.12.1 → 0.13.0
passkey-kit-sdk (bindings) regenerated from canonical v1 WASM
sac-sdk (bindings) regenerated
smart-wallet (contract) binver 1.0.0, soroban-sdk 27.0.0
sample-policy (contract) soroban-sdk 27.0.0

[!IMPORTANT] Compatibility: breaking, forward-only — there is no compatibility layer with 0.12.x. The on-chain contract, its wire events, its error codes, the signer model, the SDK's public API, and the package's shape all changed. See docs/migration-v1.md for a complete migration guide with Before/After examples, a removed-exports list, and an A/B gap ana...

Description has been truncated

@dependabot
chore(deps): bump the frontend-dependencies group across 1 directory …
61f0a7f 
…with 15 updates

Bumps the frontend-dependencies group with 15 updates in the /bimex-frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.65.0` | `10.68.0` |
| [@stellar/stellar-sdk](https://github.com/stellar/js-stellar-sdk) | `16.0.1` | `16.1.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.110.2` | `2.110.9` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.24.0` | `1.27.0` |
| [passkey-kit](https://github.com/kalepail/passkey-kit) | `0.12.1` | `0.14.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.9` | `17.0.11` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.0` |
| [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.9.1` | `7.0.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.3` | `6.0.4` |
| [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.8.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.7.0` | `17.8.0` |
| [jsdom](https://github.com/jsdom/jsdom) | `29.1.1` | `30.0.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.4` | `8.1.5` |



Updates `@sentry/react` from 10.65.0 to 10.68.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.68.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.65.0...10.68.0)

Updates `@stellar/stellar-sdk` from 16.0.1 to 16.1.0
- [Release notes](https://github.com/stellar/js-stellar-sdk/releases)
- [Changelog](https://github.com/stellar/js-stellar-sdk/blob/main/CHANGELOG.md)
- [Commits](stellar/js-stellar-sdk@v16.0.1...v16.1.0)

Updates `@supabase/supabase-js` from 2.110.2 to 2.110.9
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.110.9/packages/core/supabase-js)

Updates `lucide-react` from 1.24.0 to 1.27.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.27.0/packages/lucide-react)

Updates `passkey-kit` from 0.12.1 to 0.14.0
- [Release notes](https://github.com/kalepail/passkey-kit/releases)
- [Changelog](https://github.com/kalepail/passkey-kit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/kalepail/passkey-kit/commits)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `react-i18next` from 17.0.9 to 17.0.11
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.9...v17.0.11)

Updates `@playwright/test` from 1.61.1 to 1.62.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.0)

Updates `@testing-library/jest-dom` from 6.9.1 to 7.0.0
- [Release notes](https://github.com/testing-library/jest-dom/releases)
- [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md)
- [Commits](testing-library/jest-dom@v6.9.1...v7.0.0)

Updates `@vitejs/plugin-react` from 6.0.3 to 6.0.4
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.4/packages/plugin-react)

Updates `eslint` from 10.7.0 to 10.8.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.7.0...v10.8.0)

Updates `globals` from 17.7.0 to 17.8.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.7.0...v17.8.0)

Updates `jsdom` from 29.1.1 to 30.0.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v29.1.1...v30.0.0)

Updates `vite` from 8.1.4 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

---
updated-dependencies:
- dependency-name: "@sentry/react"
  dependency-version: 10.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@stellar/stellar-sdk"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.110.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: lucide-react
  dependency-version: 1.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: passkey-kit
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: react-i18next
  dependency-version: 17.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.62.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@testing-library/jest-dom"
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: frontend-dependencies
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: eslint
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: globals
  dependency-version: 17.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: jsdom
  dependency-version: 30.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: frontend-dependencies
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the frontend Cambios en la interfaz de usuario label Jul 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from David1984TK as a code owner July 27, 2026 20:18
@dependabot dependabot Bot added the frontend Cambios en la interfaz de usuario label Jul 27, 2026
@vercel

vercel Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
bimex-frontend Ready Ready Preview, Comment Jul 28, 2026 6:03pm

@David1984TK

David1984TK commented Jul 27, 2026

Copy link
Copy Markdown
Owner

No mergeable así: Frontend React falla real, no es el ruido de siempre. Los 14 archivos de test ni siquiera arrancan:

Error: [vitest-pool]: Failed to start forks worker for test files ...
Caused by: TypeError: webidl.util.markAsUncloneable is not a function

Es el bump de jsdom ^29.1.1 → ^30.0.0 (major) — la versión de vitest fijada en el repo (^4.1.10, sin bump en este PR) no es compatible con la API interna de jsdom 30 todavía. Playwright E2E también quedó en rojo (15 min, probablemente colgado esperando el build/servidor que nunca queda sano).

También viene @testing-library/jest-dom ^6.9.1 → ^7.0.0 (major) y passkey-kit ^0.12.1 → ^0.14.0 empaquetados en el mismo grupo — con 15 deps agrupadas no se puede aislar cuál más está en juego, pero jsdom 30 es la causa confirmada del fallo de arranque.

Antes de mergear: bajar jsdom de vuelta a ^29.x (o subir vitest a una versión que soporte jsdom 30, si existe) y volver a correr CI. No mergear el bump agrupado completo mientras el suite de tests no arranque.

@David1984TK
fix(deps): pin jsdom to ^29.1.1, incompatible with vitest 4.1.10
33627a1 
jsdom 30 breaks vitest's jsdom pool at startup:
TypeError: webidl.util.markAsUncloneable is not a function
All 14 test files failed to even start. Keeps the other 14 dependency
bumps from this group; only jsdom is held back until vitest supports
jsdom 30. 135/135 frontend tests green.
@David1984TK
fix(deps): pin passkey-kit to ^0.12.1, 0.14.0 breaks app boot
9a1a11f 
passkey-kit 0.14.0 throws eagerly at module-load time when
VITE_PASSKEY_WASM_HASH isn't set:

  ConfigurationError: walletWasmHash is required
    at new PasskeyKit(...) — bimex-frontend/src/stellar/contrato.js

Since contrato.js is imported at the top of App.jsx, this crashes the
entire app before React ever mounts (confirmed locally: dist/ builds
fine, but #root stays empty — reproduced the exact CI failure where
23/25 Playwright specs failed with "element(s) not found", not just
the couple of pre-existing "Filtros" flakes). Holding this dependency
back until the wasm hash requirement is handled, alongside the jsdom
pin from the previous commit. 135/135 vitest tests green, app renders
fully in a local build+preview check.
David1984TK
David1984TK approved these changes Jul 28, 2026
View reviewed changes

@David1984TK David1984TK left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI real en verde: 135/135 tests vitest, Playwright completo (25/25). Confirmé y corregí 2 bugs reales que este bump agrupado introducía: jsdom 30 rompía el arranque de vitest, y passkey-kit 0.14.0 tira ConfigurationError al cargar el módulo si falta VITE_PASSKEY_WASM_HASH, matando el render completo de React (reproducido local: build ok pero #root vacío). Ambos quedaron pineados a la versión anterior; el resto de los 13 bumps se mantiene. Aprobado.

@David1984TK
David1984TK merged commit c8dbd21 into main Jul 28, 2026
9 checks passed
@David1984TK
David1984TK deleted the dependabot/npm_and_yarn/bimex-frontend/frontend-dependencies-f917d51210 branch July 28, 2026 18:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@David1984TK David1984TK David1984TK approved these changes

Assignees

No one assigned

Labels

frontend Cambios en la interfaz de usuario

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@David1984TK