chore(deps): bump the frontend-dependencies group in /bimex-frontend with 3 updates

[dependabot]

Bumps the frontend-dependencies group in /bimex-frontend with 3 updates: @supabase/supabase-js, passkey-kit and jsdom.

Updates @supabase/supabase-js from 2.110.9 to 2.111.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.111.0

2.111.0 (2026-07-28)

🚀 Features

• auth: store PKCE verifiers in per-flow slots to survive overlapping flows (#2569)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.111.0-canary.0

2.111.0-canary.0 (2026-07-28)

🚀 Features

• auth: store PKCE verifiers in per-flow slots to survive overlapping flows (#2569)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

• 18b5bb2 chore(release): version 2.110.9 changelogs (#2567)
• See full diff in compare view

Updates passkey-kit from 0.12.1 to 0.14.0

Release notes

Sourced from passkey-kit's releases.

v0.13.1 — live keyless Mercury discovery

Live signer discovery via Mercury's hosted, keyless passkey-indexer — plus removal of the paths that no longer earn their keep. No contract change; bindings (passkey-kit-sdk 0.7.3, sac-sdk 0.4.3) and the canonical WASM 84924c53… are unchanged.

Highlights

• Keyless Mercury discovery, live on both networks. MercuryIndexer queries Mercury's public passkey-indexer REST API (https://{testnet,mainnet}.mercurydata.app/rest/passkey-indexer) — no JWT/API key — with full history across both signer generations (legacy ("sw_v1", …) tuples and the v1 #[contractevent]s). It returns fully-decoded signers mapped straight onto WalletSigner. New MercuryIndexer.forNetwork() / mercuryPasskeyIndexerUrl() / MERCURY_PASSKEY_INDEXER_URLS.
• MercuryIndexer is now browser-safe — exported from the main passkey-kit entry (it holds no secret), so you can call it directly from the browser with no proxy.
• Demo calls Mercury directly — the old indexer-proxy indirection and backend toggle are gone.
• Hardening preserved — with an rpc, evicted temporary signers are flagged and reverse-lookup candidates are confirmed on-chain before being trusted.

Breaking (pre-1.0)

• StellarIndexerBackend / StellarIndexerConfig / indexerForConfig removed (mainnet-only, never had a live testnet path; Mercury now covers both networks). SignerIndexer has one implementation.
• IndexedSigner type removed — PasskeyServer.getSigners returns WalletSigner[].
• MercuryIndexer moved from passkey-kit/server to the main passkey-kit entry.
• MercuryConfig collapsed to an optional { url? } (defaults to the network's hosted endpoint); projectName/jwt/apiKey and the interim zephyrExecuteConfirmed gate are gone.
• The zephyr/ self-host indexer program was removed.

See the CHANGELOG and migration guide.

Changelog

Sourced from passkey-kit's changelog.

0.14.0 — 2026-07-14

Robustness, validation, and test-coverage improvements across the contract, SDK, and relayer-proxy. All changes are forward-only. Bindings package passkey-kit-sdk is bumped to 0.8.0. Breaking: updateSecp256r1 drops its publicKey parameter (updateSecp256r1(keyId, limits, store, expiration?)).

Contract

• Rebuilt canonical WASM. The smart-wallet contract's canonical testnet hash is now fdefad64b96837147e1c333e51f537b696eab925e9f147e63d597c04e3c903f0 (sample-policy 801b68fabf9f8746b10bfbc6d3da1b41462db0a38364ab8139d32dec3676ef39), superseding 84924c53… from 0.13.0/0.13.1 — see docs/deployments-testnet-2026-07-11.md for the re-pinned manifest and upload transactions. Bindings (passkey-kit-sdk) are regenerated from the new WASM.
• New contract error codes, mirrored in CONTRACT_ERROR_REGISTRY: LastAdminSigner = 103 (removing or demoting the wallet's last durable admin signer is rejected — add or promote a replacement admin first), LastSigner = 104 (any operation that would leave the wallet without a durable — Persistent, non-expiring — signer is rejected, enforced at construction, removal, and update-demotion, so at least one signer that cannot evict or expire always exists), and AuthenticatorDataTooLarge = 126 (authenticatorData capped at 1024 bytes). Policy invocations now run only after every other requirement of a signer's limits has passed, so a losing auth candidate never invokes a state-committing policy; a rejecting policy does not block its own removal.

SDK

• V2 address-bound signing. signAuthEntry now upgrades V1 address credentials to V2 (toAddressBoundCredentials) before hashing and refuses to sign any non-address-bound entry — the CAP-0071-02 V2 preimage binds the wallet address into every signed payload, and there is no V1 signing path. A regression test pins that two wallets produce different payload hashes for a byte-identical address-free invocation, and that the signed payload equals the stellar-sdk's own buildAuthorizationEntryPreimage V2 hash.
• updateSecp256r1 no longer accepts a publicKey. Breaking: updateSecp256r1(keyId, publicKey, limits, store, expiration?) → updateSecp256r1(keyId, limits, store, expiration?). update_signer replaces the whole on-chain signer value, so the kit now treats the ledger as the single source of truth for key material: it re-reads the authoritative public key on-chain and throws SignerNotFoundError if the signer is not found.
• connectWallet no longer treats RPC transport errors as not-found. The derived-address instance read distinguishes an authoritative not-found (falls through to storage/indexer) from a transport error (429/5xx/timeout — propagates), so a flaky RPC never reroutes wallet resolution. New contractInstanceExists helper in rpc-data.
• Reverse lookup fails closed. MercuryIndexer.findWallets now throws IndexerError(INDEXER_NOT_CONFIGURED) when candidates exist but no confirmation route does (no rpc, and hardening derivation only covers Secp256r1 keys) — unconfirmed indexer rows are never returned. Previously they were returned unfiltered when neither rpc nor hardening was configured.
• Failed verifyWasmHash disconnects. A connectWallet({ verifyWasmHash: true }) mismatch now clears wallet/keyId before throwing, so a subsequent sign cannot operate on the rejected contract.
• Input validation. compactSignature validates the DER structure (tags, short-form lengths that exactly span the buffer, r/s in [1, n-1]) before any offset is read. extractPublicKeyFromAttestation verifies the COSE prefix/labels and bounds in place instead of trusting fixed offsets, and rejects any extracted key that is not a point on the P-256 curve — a wallet deployed from a mangled key could never verify a signature; new isOnP256Curve export. validateExpiration accepts the contract's full u64 UNIX-seconds range instead of capping at u32.

0.13.1 — 2026-07-13

Indexing — live Mercury discovery

Rewires the MercuryIndexer onto Mercury's hosted, keyless passkey-indexer, now live on both networks. This resolves the "indexer live-query pending a decision" limitation noted in 0.13.0. No contract change — the bindings (passkey-kit-sdk 0.7.3, sac-sdk 0.4.3) and the canonical WASM hash 84924c53… are unchanged.

• Keyless hosted endpoint. MercuryIndexer now queries Mercury's public passkey-indexer REST API (https://{testnet,mainnet}.mercurydata.app/rest/passkey-indexer, GET /api/wallet/:id + /api/lookup/*) — no JWT / API key. It covers testnet and mainnet with full history across both signer generations (legacy ("sw_v1", …) tuples and the v1 #[contractevent]s). The endpoint returns fully-decoded signers, so the client maps JSON straight onto WalletSigner with no XDR round-trip. New MercuryIndexer.forNetwork(config, networkPassphrase) resolves the base URL per network (returns null off testnet/mainnet); new mercuryPasskeyIndexerUrl(passphrase) helper + MERCURY_PASSKEY_INDEXER_URLS constant.
• MercuryIndexer is now browser-safe. Because the endpoint is keyless, MercuryIndexer (+ MercuryIndexerConfig, mercuryPasskeyIndexerUrl, MERCURY_PASSKEY_INDEXER_URLS) is exported from the main passkey-kit entry instead of passkey-kit/server — call it directly from the browser, no proxy. The demo now does exactly this (the indexer-proxy indirection is gone).
• Stellar Indexer backend removed. StellarIndexerBackend (Creit Tech, POST /v1/contract-data) is dropped along with indexerForConfig: it was mainnet-only and never had a live testnet path, and Mercury now covers both networks keylessly. SignerIndexer has one implementation.
• Hardening preserved. With an rpc, temporary signers are still confirmed on-chain (evicted TTL entries flagged status: "evicted" — the indexer can't observe eviction), and reverse-lookup candidates are still confirmed by deterministic derivation or on-chain signer presence before being trusted (#598 F3/F6, audit H2).
• PasskeyServer consolidation. getSigners / getContractId now delegate to a single MercuryIndexer — the duplicated POST /zephyr/execute client is gone. getSigners returns WalletSigner[].
• zephyr/ removed. The self-hosted Zephyr indexer program and its docs are dropped; Mercury's hosted indexer replaces it entirely.

[!IMPORTANT] Breaking (pre-1.0). StellarIndexerBackend / StellarIndexerConfig / indexerForConfig and the IndexedSigner type are removed (PasskeyServer.getSigners now returns WalletSigner[]). MercuryIndexer moved from passkey-kit/server to the main passkey-kit entry. MercuryConfig collapses to an optional { url? } (defaults to the network's hosted endpoint); MercuryConfig/MercuryIndexerConfig no longer take projectName / jwt / apiKey, and the interim zephyrExecuteConfirmed gate is gone.

0.13.0 — 2026-07-12

[!NOTE] Version. The v1 overhaul ships as passkey-kit@0.13.0 (minor bump from 0.12.1, forward-only). The reworked contract stamps binver = 1.0.0 in its metadata. Per-component versions below are the source of truth; npm view is authoritative for what is published. This tag is the reference for the canonical v1 contract WASM hash 84924c53a413318df2ce753e30de53ec651404c916d30e861718ad155c94b319 (see docs/deployments-testnet-2026-07-11.md).

Component	Version
passkey-kit (SDK)	0.12.1 → 0.13.0
passkey-kit-sdk (bindings)	regenerated from canonical v1 WASM
sac-sdk (bindings)	regenerated
smart-wallet (contract)	binver 1.0.0, soroban-sdk 27.0.0
sample-policy (contract)	soroban-sdk 27.0.0

[!IMPORTANT] Compatibility: breaking, forward-only — there is no compatibility layer with 0.12.x. The on-chain contract, its wire events, its error codes, the signer model, the SDK's public API, and the package's shape all changed. See docs/migration-v1.md for a complete migration guide with Before/After examples, a removed-exports list, and an A/B gap analysis.

... (truncated)

Commits

• See full diff in compare view

Updates jsdom from 29.1.1 to 30.0.0

Release notes

Sourced from jsdom's releases.

v30.0.0

Breaking changes:

• Node.js minimum version raised to ^22.22.2 || ^24.15.0 || >=26.0.0.

Other changes:

• Added CSS.escape() and CSS.supports() functions. (@​asamuzaK)
• Added 'background-position-x' and 'background-position-y' CSS properties. (@​olagokemills)
• Fixed getComputedStyle() to convert length values into pixels. (@​asamuzaK)
• Fixed CSS function serialization, e.g., in the return value of getPropertyValue(). (@​asamuzaK)
• Fixed the type of error thrown by document.evaluate() (@​dokson)

Commits

• 20a01fc 30.0.0
• 8c8e583 Precompute WPT expectation matches
• f32245c Bump Node.js floor and dependencies
• 03ef23b Add background-position longhands
• ded056f Test CSS.escape() with numeric IDs
• d312832 Convert CSS values to pixels for computed styles
• 4e0ee41 Implement CSS.escape() and CSS.supports()
• 05eb709 Fix benchmark:compare script on Windows
• 97c1b90 Fix CSS function value serialization
• 15642ba Add benchmark comparison script
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
bimex-frontend	Ready	Preview	Aug 1, 2026 1:09am