Conversation
actions ^0.0.221, client 0.0.55, wallet-node 0.0.77 (pulls wallet 0.0.110, templates 0.0.37, types 0.0.48). The marketplace listing/purchase tools now use the canonical OrdLock v2 batch contract; the prior v2 draft contract is deprecated. The autoStoragePayments patches are re-keyed to @1sat/wallet@0.0.110 and @1sat/wallet-node@0.0.77; the patched sites are unchanged upstream and the hunks apply cleanly. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015UyixGQxRnUu3YA7EPDGZT
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
rohenaz
left a comment
rohenaz
left a comment
There was a problem hiding this comment.
Security review at e39c7391fa617334dec048d412dbc2c602923821 found one low-severity dependency compatibility issue to address before merge.
-
package.json:63still declares@bsv/sdkas^2.4.2, while every upgraded package in the canonical OrdLock v2 graph (@1sat/actions,client,wallet,wallet-node,templates, andtypes) publishes a peer requirement of@bsv/sdk ^2.6.0. The submitted lock happens to resolve 2.6.0, but a narrow clean update from the base retained 2.4.2 and emitted six peer warnings. Please raise the direct floor to^2.6.0so a fresh or regenerated install cannot produce an unsupported combination on transaction-construction paths. -
The submitted lock refresh changes 54 resolved entries and migrates the lock format, including unrelated upgrades to Hono, Next, Vite, mysql2, zod, and tooling. A Bun 1.3.11 reproduction changed only the intended @1sat dependency graph (plus its nested message-box resolution), so this extra supply-chain surface is avoidable. Please regenerate narrowly or split those upgrades into a separately reviewed PR.
The intended dependency set otherwise checked out: published package integrity matches the lock, both re-keyed patches are byte-identical and apply cleanly, frozen install/typecheck/build pass, and 38 focused OrdLock/package tests pass. The full suite was 757 pass / 1 known base-equivalent Grok plugin-version failure. No key was loaded and no transaction was signed or broadcast.
2 participants
Repins the
@1satpackages to the release carrying the canonical OrdLock v2 batch contract: actions ^0.0.208 → ^0.0.221, client 0.0.51 → 0.0.55, wallet-node 0.0.73 → 0.0.77 (pulls wallet 0.0.110, templates 0.0.37, types 0.0.48). The earlier v2 draft contract is deprecated, so the marketplace tools should not keep producing or buying listings against it.The two
bun patchfiles that add theautoStoragePaymentsopt-out are re-keyed to@1sat/wallet@0.0.110and@1sat/wallet-node@0.0.77. The patched sites are unchanged upstream and the hunks apply cleanly to the installed dist (verified after a freshbun install).Validation:
tsc --noEmit,bun run build, andbun testpass. The one failing test (Grok plugin packaging → published npm package) fails identically on master.🤖 Generated with Claude Code
https://claude.ai/code/session_015UyixGQxRnUu3YA7EPDGZT