Skip to content

Repository navigation

chore(deps): bump the production group with 21 updates - #1068

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dae70b950c
Closed

chore(deps): bump the production group with 21 updates#1068
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dae70b950c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production group with 21 updates:

Package From To
@iconify-json/lucide 1.2.115 1.2.146
@iconify-json/simple-icons 1.2.88 1.2.100
@shikijs/rehype 4.3.0 4.5.0
@tanstack/react-query 5.101.2 5.104.4
abitype 1.2.4 1.3.0
accounts 0.19.1 0.21.0
hono 4.13.7 4.13.13
monaco-editor 0.55.1 0.57.0
ox 0.14.54 1.8.8
posthog-js 1.396.4 1.438.12
posthog-node 5.39.2 5.56.2
prool 0.2.4 0.2.16
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
react-server-dom-webpack 19.3.0 19.3.1
shiki 4.3.0 4.5.0
sonner 2.0.7 2.0.8
sql-formatter 15.8.2 15.9.0
unplugin-icons 23.0.1 24.0.0
viem 2.57.5 2.57.7
zod 4.6.5 4.6.7

Updates @iconify-json/lucide from 1.2.115 to 1.2.146

Commits

Updates @iconify-json/simple-icons from 1.2.88 to 1.2.100

Commits

Updates @shikijs/rehype from 4.3.0 to 4.5.0

Release notes

Sourced from @​shikijs/rehype's releases.

v4.5.0

   🚀 Features

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v4.4.3

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v4.4.2

   🐞 Bug Fixes

   🏎 Performance

... (truncated)

Commits

Updates @tanstack/react-query from 5.101.2 to 5.104.4

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

  • #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

    • @​tanstack/query-devtools@​5.104.4
    • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
  • Updated dependencies [c208861, a108398]:
    • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-persist-client@​5.104.4

Patch Changes

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
  • Updated dependencies [c208861, a108398]:
    • @​tanstack/react-query@​5.104.4
    • @​tanstack/query-persist-client-core@​5.104.4

@​tanstack/react-query@​5.104.4

Patch Changes

  • #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [1fee044, fce89dd]:

    • @​tanstack/query-core@​5.104.4

@​tanstack/react-query-devtools@​5.104.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.3
    • @​tanstack/query-devtools@​5.104.3

@​tanstack/react-query-next-experimental@​5.104.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.3

@​tanstack/react-query-persist-client@​5.104.3

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.4

Patch Changes

  • #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [1fee044, fce89dd]:

    • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

  • Updated dependencies [0f15bc9]:
    • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

  • Updated dependencies [03e8c39]:
    • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/query-core@​5.104.0

5.103.3

Patch Changes

  • #11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
  • Updated dependencies []:
    • @​tanstack/query-core@​5.103.3

... (truncated)

Commits
  • 1219972 ci: Version Packages (#12062)
  • 1fee044 fix(query-core): clear mutations before notifying subscribers (#11470)
  • c208861 fix(react-query): retry queries with falsy errors on mount (#11328)
  • a108398 fix(react-query*): declare '@​types/react' as an optional peer dependency (#11...
  • ee47993 ci: Version Packages (#11998)
  • 0f15bc9 fix(query-core): preserve union narrowing in setQueryData updaters (#11935)
  • b699b52 ci: Version Packages (#11849)
  • e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
  • df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
  • 833062c chore: replace prettier with oxfmt (#11939)
  • Additional commits viewable in compare view

Updates abitype from 1.2.4 to 1.3.0

Release notes

Sourced from abitype's releases.

abitype@1.3.0

Minor Changes

  • Deprecated human-readable ABI utilities in favor of Ox's Abi, AbiItem, AbiParameter, and AbiParameters modules. (#309)

    Deprecated abitype/zod schemas in favor of Ox's ABI and EIP-712 Typed Data schemas from ox/zod.

Commits

Updates accounts from 0.19.1 to 0.21.0

Release notes

Sourced from accounts's releases.

accounts@0.21.0

Minor Changes

  • a60b2c6: Added provider.ready(), which resolves once the provider has loaded its stored state and rejects with Store.HydrationError when the storage read fails or takes longer than the new hydrationTimeout option (default 10 seconds). request now waits for the load instead of continuing with an empty store after 100ms, and rejects with an RpcResponse.InternalError caused by the Store.HydrationError when the load fails. getAccount throws Store.HydrationError until the load finishes instead of reporting no accounts.

    The default storage now uses IndexedDB only where indexedDB exists, so React Native gets memory storage, and keeps state in memory when IndexedDB fails.

  • 4008d21: Add an optional chainId to wallet_revokeAccessKey so callers can revoke an access key on a specific chain. The provider rejects a chain it is not configured for. Local, Privy, dialog, device-code (including CLI), postMessage and mobile web auth revocations target that chain and remove the local key for it only after the revocation succeeds. Other JSON-RPC adapters reject a chainId other than the active chain. Omitting chainId keeps revoking on the active chain.

Patch Changes

  • 0488591: Limit the WebAuthn adapter's post-registration signing shortcut to the most recent registration, for 5 minutes, so it only applies while that registration still owns the server session. Any later registration, server login or disconnect falls back to server authentication.
  • 0488591: Prompt for the passkey while the WebAuthn ceremony registers the login challenge when the credential is already known (stored account or this session's registration), instead of after the /login/options round trip. Falls back to the ceremony's options if they differ from the locally built ones.
  • 6ec2640: Apply retryCount to wallet_revokeAccessKey in request-based adapters (device code, CLI, postMessage, mobile web auth), which now send revocations through the same transport as other wallet requests. Device-code and CLI revocations are still sent once by default, on the chain named in the request context.
  • af5e9b8: Send device-code wallet requests once by default. A failed or timed-out request such as eth_sendTransactionSync or wallet_revokeAccessKey was retried up to three times, starting a new approval (and possibly a second transaction) on each attempt. Added retryCount to deviceCode, cli, and the CLI Provider.create to opt back into retries. Chain reads still retry.
  • 6b06ace: Route wallet_updateAccessKey to the requested chainId for dialog, device-code, postMessage and mobile web auth adapters by carrying it in the request context, as wallet_revokeAccessKey does, instead of sending it only in params while the context names the active chain. Request-based updates honor retryCount like revocations. Mobile web auth now forwards the request context (account and chain) to the wallet like the other Wata transports, which also fixes chain routing for its revocations. Other JSON-RPC adapters reject a chainId other than the active chain instead of updating on it. wallet_revokeAccessKey and wallet_updateAccessKey reject an address that is not a connected account before any adapter runs, instead of opening the wallet for it.
  • 2a088fc: Reject wallet_updateAccessKey with UnsupportedChainIdError when chainId is not one of the provider's configured chains, instead of updating the key on the default chain. The request fails before any adapter or wallet approval runs and leaves local access-key state unchanged.
Changelog

Sourced from accounts's changelog.

0.21.0

Minor Changes

  • a60b2c6: Added provider.ready(), which resolves once the provider has loaded its stored state and rejects with Store.HydrationError when the storage read fails or takes longer than the new hydrationTimeout option (default 10 seconds). request now waits for the load instead of continuing with an empty store after 100ms, and rejects with an RpcResponse.InternalError caused by the Store.HydrationError when the load fails. getAccount throws Store.HydrationError until the load finishes instead of reporting no accounts.

    The default storage now uses IndexedDB only where indexedDB exists, so React Native gets memory storage, and keeps state in memory when IndexedDB fails.

  • 4008d21: Add an optional chainId to wallet_revokeAccessKey so callers can revoke an access key on a specific chain. The provider rejects a chain it is not configured for. Local, Privy, dialog, device-code (including CLI), postMessage and mobile web auth revocations target that chain and remove the local key for it only after the revocation succeeds. Other JSON-RPC adapters reject a chainId other than the active chain. Omitting chainId keeps revoking on the active chain.

Patch Changes

  • 0488591: Limit the WebAuthn adapter's post-registration signing shortcut to the most recent registration, for 5 minutes, so it only applies while that registration still owns the server session. Any later registration, server login or disconnect falls back to server authentication.
  • 0488591: Prompt for the passkey while the WebAuthn ceremony registers the login challenge when the credential is already known (stored account or this session's registration), instead of after the /login/options round trip. Falls back to the ceremony's options if they differ from the locally built ones.
  • 6ec2640: Apply retryCount to wallet_revokeAccessKey in request-based adapters (device code, CLI, postMessage, mobile web auth), which now send revocations through the same transport as other wallet requests. Device-code and CLI revocations are still sent once by default, on the chain named in the request context.
  • af5e9b8: Send device-code wallet requests once by default. A failed or timed-out request such as eth_sendTransactionSync or wallet_revokeAccessKey was retried up to three times, starting a new approval (and possibly a second transaction) on each attempt. Added retryCount to deviceCode, cli, and the CLI Provider.create to opt back into retries. Chain reads still retry.
  • 6b06ace: Route wallet_updateAccessKey to the requested chainId for dialog, device-code, postMessage and mobile web auth adapters by carrying it in the request context, as wallet_revokeAccessKey does, instead of sending it only in params while the context names the active chain. Request-based updates honor retryCount like revocations. Mobile web auth now forwards the request context (account and chain) to the wallet like the other Wata transports, which also fixes chain routing for its revocations. Other JSON-RPC adapters reject a chainId other than the active chain instead of updating on it. wallet_revokeAccessKey and wallet_updateAccessKey reject an address that is not a connected account before any adapter runs, instead of opening the wallet for it.
  • 2a088fc: Reject wallet_updateAccessKey with UnsupportedChainIdError when chainId is not one of the provider's configured chains, instead of updating the key on the default chain. The request fails before any adapter or wallet approval runs and leaves local access-key state unchanged.

0.20.0

Minor Changes

  • 56efdd1: Add an optional destinationToken to wallet_deposit for destination-aware crypto deposits. Keep the existing token source hint and omitted-parameter behavior unchanged. Callers must check the wallet host's destination support before using the new parameter.
  • 56efdd1: Add Mach.fund and Mach.getFundingUrl to open wallet-bound MACH checkout from browser, mobile, and CLI contexts. Support a funding intent in post-connect and access-key approval deposit prompts. MACH remains distinct from legacy MPP Credits; checkout initiation does not imply payment completion.

Patch Changes

  • e348647: Sign a requested wallet_connect digest (for example a personalSign SIWE message) during WebAuthn registration while the server verifies the new credential, instead of after verification returns.
  • ceaf876: Remove the authentication challenge resource-count limit while preserving per-resource length and line-break validation.
  • e348647: Sign locally when wallet_connect re-authenticates a credential the WebAuthn adapter registered in the same session (for example authorizing an access key right after sign-up), skipping the server authentication options and verification round trips. Disconnecting clears this.
  • 232cc59: Treat access-key authorization expiry 0 as non-expiring when signing, importing, updating, and restoring stored grants. Preserve omitted unrestricted permissions and explicit empty restrictions.
Commits
  • f5b8503 chore: version packages (#884)
  • 6b06ace fix: route wallet_updateAccessKey to the requested chain (#881)
  • f9cef29 ci: give release version and publish jobs room for uncached installs (#883)
  • 6ec2640 fix: apply retryCount to request-based access key revocations (#882)
  • b78a309 chore: version packages (#869)
  • 2a088fc fix: reject unconfigured chainId in wallet_updateAccessKey (#880)
  • af5e9b8 fix: send device-code wallet requests once by default (#877)
  • a60b2c6 fix: wait for persisted provider state instead of a 100ms timer (#878)
  • 4008d21 feat: add chainId to wallet_revokeAccessKey (#879)
  • 3f0be2e chore: pin gh-actions references to 947d9a3c (#875)
  • Additional commits viewable in compare view

Updates hono from 4.13.7 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

  • fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
  • test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
  • fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
  • fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
  • fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
  • chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits
  • 08a023c 4.13.13
  • ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
  • f23b146 fix(jsx): allow JSXNode function component results (#5476)
  • 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
  • deff529 test(client): simulate network error for undefined route in parseResponse tes...
  • 6abd35b 4.13.12
  • 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
  • afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
  • e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
  • c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
  • Additional commits viewable in compare view

Updates monaco-editor from 0.55.1 to 0.57.0

Release notes

Sourced from monaco-editor's releases.

v0.57.0

Changes:

  • #5487: Prepare Monaco Editor 0.57.0 release
  • #5415: Bump uuid and webpack-dev-server in /website
  • #5476: Bump baseline-browser-mapping from 2.9.19 to 2.11.21 in /website
  • #5474: Bump svgo from 2.8.3 to 2.8.4 in /samples/browser-esm-parcel
  • #5479: Bump actions/deploy-pages from 5.0.0 to 5.0.1 in the github-actions group
  • #5468: Bump browserslist from 4.28.1 to 4.28.8 in /website
  • #5475: Bump js-yaml from 4.3.1 to 4.3.2
  • #5470: Bump fast-uri from 3.1.2 to 3.1.7 in /webpack-plugin
  • #5469: Bump nanoid from 3.3.11 to 3.3.18 in /webpack-plugin
  • #5467: Bump fast-uri from 3.1.5 to 3.1.7 in /samples/browser-esm-webpack-typescript-react
  • #5466: Bump fast-uri from 3.1.2 to 3.1.7 in /samples
  • #5465: Bump fast-uri from 3.1.4 to 3.1.7 in /website
  • #5463: Bump postcss-selector-parser from 7.1.0 to 7.1.5 in /website
  • #5416: Bump @​babel/core from 7.17.8 to 7.29.7 in /samples/browser-esm-vite-react
  • #5438: Bump electron from 39.8.5 to 39.8.10 in /samples
  • #5460: Bump the github-actions group with 7 updates
  • #5456: Pin GitHub Actions to full-length commit SHAs
  • #5450: Bump postcss from 8.5.12 to 8.5.26
  • #5449: Bump js-yaml from 4.2.0 to 4.3.1
  • #5439: Bump postcss from 8.5.13 to 8.5.26 in /samples
  • #5441: Bump postcss from 8.5.15 to 8.5.26 in /samples/browser-esm-vite-react
  • #5432: Bump undici from 7.28.0 to 7.29.0
  • #5440: Bump brace-expansion in /website
  • #5436: Bump fast-uri from 3.1.4 to 3.1.5 in /samples/browser-esm-webpack-typescript-react
  • #5437: Bump fast-uri from 3.1.2 to 3.1.5
  • #5413: Bump svgo from 2.8.2 to 2.8.3 in /samples/browser-esm-parcel
  • #5419: Bump launch-editor from 2.12.0 to 2.14.1 in /website
  • #5414: Bump fast-uri from 3.1.2 to 3.1.4 in /samples/browser-esm-webpack-typescript-react
  • #5417: Bump minimatch from 3.1.2 to 3.1.5 in /webpack-plugin
  • #5420: Bump ws from 8.18.0 to 8.21.1 in /samples
  • #5418: Bump http-proxy-middleware from 2.0.9 to 2.0.10 in /samples
  • #5412: Bump fast-uri from 3.1.2 to 3.1.4 in /website
  • #5411: Bump shell-quote from 1.8.4 to 1.10.0 in /website
  • #5409: Bump webpack-dev-server from 5.2.5 to 5.2.6 in /samples
  • #5410: Bump postcss from 8.5.14 to 8.5.23 in /website
  • #5407: Bump immutable from 5.1.5 to 5.1.9 in /website
  • #5401: Bump brace-expansion from 1.1.11 to 1.1.16 in /samples

This list of changes was auto generated.

v0.57.0-rc.2

... (truncated)

Changelog

Sourced from monaco-editor's changelog.

[0.57.0]

New Features and APIs

  • Adds editor.wordWrapIndicator to display an indicator at the wrapping column of soft-wrapped lines.
  • Adds editor.fullwidthCharacterWidth, with font and twoCells modes for rendering full-width characters.
  • Adds languages.score to score a language selector against a URI and language.
  • Exports the editor.DiffEditorViewMode type.
  • Adds isForAnotherDocument to the inline completion languages.LifetimeSummary type.

Updates

  • Updates the editor core to VS Code commit 6a598d4a13031703d483d103c1d934a36ad27971, validated in 0.57.0-rc.2.
  • Updates bundled DOMPurify from 3.4.8 to 3.4.15.

[0.56.0]

Breaking Changes

  • Reorganizes the exported ESM modules to provide supported, tree-shakeable entry points (#5155). The monaco-editor entry point continues to load all features and languages. Custom bundles can now import monaco-editor/editor and opt into:
    • all editor features with monaco-editor/features/register.all, or individual features with monaco-editor/features/<feature>/register;
    • all language definitions with monaco-editor/languages/definitions/register.all, or individual definitions with monaco-editor/languages/definitions/<language>/register;
    • the CSS, HTML, JSON, and TypeScript language features with monaco-editor/languages/features/register.all, or their individual register entry points.
  • Renames the misspelled IOverlayWidgetPosition.stackOridinal property to stackOrdinal.
  • Removes the deprecated IMirrorModel and IWorkerContext worker API types.

New Features and APIs

  • Adds editor.doubleClickSelectsBlock.
  • Adds editor.find.closeOnResult and editor.inlayHints.showLongLineWarning.
  • Adds offWhenInlineCompletions to QuickSuggestionsValue.
  • Adds model and provider option support to inline completion providers.
  • Adds ICodeEditor.revealAllCursors, ICodeEditor.getWidthOfLine, and ICodeEditor.renderAsync.
  • Adds advanced-external and advanced-wasm diff algorithms.
  • Exposes typed native LSP client and transport APIs.

Fixes

  • Treats Markdown returned by language servers as untrusted (#5280).
  • Updates the editor core to the version used by 0.56.0-dev-20260625.
Commits
  • d618242 Merge pull request #5487 from microsoft/hediet/b/release-0.57.0
  • ef061ff Prepare Monaco Editor 0.57.0 release
  • 8e9b0f7 Keep editor release version stable across task retries
  • 3f31304 Prepare VS Code native headers before installing dependencies
  • ebd1312 Use authenticated Foundry Local installer for core builds
  • 176408b Align release build Node version with VS Code 1.139
  • 97d81ca Bump uuid and webpack-dev-server in /website (#5415)
  • f7c7f4c Bump baseline-browser-mapping from 2.9.19 to 2.11.21 in /website (#5476)
  • 36f4fe6 Bump svgo from 2.8.3 to 2.8.4 in /samples/browser-esm-parcel (#5474)
  • f24cd7f Bump actions/deploy-pages in the github-actions group (#5479)
  • Additional commits viewable in compare view

Updates ox from 0.14.54 to 1.8.8

Release notes

Sourced from ox's releases.

ox@1.8.8

Patch Changes

  • #516 36dce4a Thanks @​jxom! - Fixed AbiItem.getSignature (and AbiFunction.getSelector, AbiEvent.getSelector) dropping the first parameter when a space directly follows an opening parenthesis.

ox@1.8.7

Patch Changes

  • #508 42a84e6 Thanks @​jxom! - Renamed the Tempo multisig account APIs to configurable accounts (TIP-1107), including the account_ relay RPC namespace, raised AccountConfig.maxThreshold to 255 per TIP-1114, and added AccountConfig.update for deriving the next config after an owner update.

    - import { MultisigConfig, MultisigOperation, MultisigSimulation } from 'ox/tempo'
+ import { AccountConfig, AccountOperation, AccountSimulation } from 'ox/tempo'

const initialConfig = MultisigConfig.from({ owners, threshold: 2 })


const initialConfig = AccountConfig.from({ owners, threshold: 2 })


SignatureEnvelope.sortMultisigApprovals({ account, config, payload, signatures })


SignatureEnvelope.sortApprovals({ account, config, payload, signatures })


if (signature.type === 'multisig') signature satisfies SignatureEnvelope.Multisig


if (signature.type === 'configurable') signature satisfies SignatureEnvelope.Configurable


KeyAuthorization.from({ account, address, chainId, type: 'multisig' })


KeyAuthorization.from({ account, address, chainId, type: 'configurable' })


TransactionRequest.toRpc({ from, keyType: 'multisig', multisigSimulation })


TransactionRequest.toRpc({ accountSimulation, from, keyType: 'configurable' })


RpcSchema.from<RpcSchemaTempo.Multisig>() // multisig_getConfig, multisig_getOperation, ...


RpcSchema.from<RpcSchemaTempo.Account>() // account_getConfig, account_getOperation, ...

ox@1.8.6

Patch Changes

  • #497 ee2bce9 Thanks @​decofe! - Added the TIP-1006 burnAt role (BURN_AT_ROLE) to TokenRole.

  • #506 ce81454 Thanks @​jxom! - Fixed KeyAuthorization encoding to keep absent limits (unlimited) distinct from an empty limits list (deny-all), matching the Tempo node.

ox@1.8.5

Patch Changes

  • #493 7a7b37d Thanks @​jxom! - Added optional nonceKeys to eth_getTransactionCount requests.

    const nonce = await provider.request({
  method: "eth_getTransactionCount",
  params: [address, "pending", ["0x1", "0x2"]],
});

... (truncated)

Changelog

Sourced from ox's changelog.

1.8.8

Patch Changes

  • #516 36dce4a Thanks @​jxom! - Fixed AbiItem.getSignature (and AbiFunction.getSelector, AbiEvent.getSelector) dropping the first parameter when a space directly follows an opening parenthesis.

1.8.7

Patch Changes

  • #508 42a84e6 Thanks @​jxom! - Renamed the Tempo multisig account APIs to configurable accounts (TIP-1107), including the account_ relay RPC namespace, raised AccountConfig.maxThreshold to 255 per TIP-1114, and added AccountConfig.update for deriving the next config after an owner update.

    - import { MultisigConfig, MultisigOperation, MultisigSimulation } from 'ox/tempo'
+ import { AccountConfig, AccountOperation, AccountSimulation } from 'ox/tempo'

const initialConfig = MultisigConfig.from({ owners, threshold: 2 })


const initialConfig = AccountConfig.from({ owners, threshold: 2 })


SignatureEnvelope.sortMultisigApprovals({ account, config, payload, signatures })


SignatureEnvelope.sortApprovals({ account, config, payload, signatures })


if (signature.type === 'multisig') signature satisfies SignatureEnvelope.Multisig


if (signature.type === 'configurable') signature satisfies SignatureEnvelope.Configurable


KeyAuthorization.from({ account, address, chainId, type: 'multisig' })


KeyAuthorization.from({ account, address, chainId, type: 'configurable' })


TransactionRequest.toRpc({ from, keyType: 'multisig', multisigSimulation })


TransactionRequest.toRpc({ accountSimulation, from, keyType: 'configurable' })


RpcSchema.from<RpcSchemaTempo.Multisig>() // multisig_getConfig, multisig_getOperation, ...


RpcSchema.from<RpcSchemaTempo.Account>() // account_getConfig, account_getOperation, ...

1.8.6

Patch Changes

  • #497 ee2bce9 Thanks @​decofe! - Added the TIP-1006 burnAt role (BURN_AT_ROLE) to TokenRole.

  • #506 ce81454 Thanks @​jxom! - Fixed KeyAuthorization encoding to keep absent limits (unlimited) distinct from an empty limits list (deny-all), matching the Tempo node.

1.8.5

Patch Changes

  • #493 7a7b37d Thanks @​jxom! - Added optional nonceKeys to eth_getTransactionCount requests.

    

    • 






... (truncated)





Commits


    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the production group with 21 updates
        

          
                        
      


      

        

    
    
    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          b2d119b
        
      

    

  

    

      
Bumps the production group with 21 updates:

| Package | From | To |
| --- | --- | --- |
| [@iconify-json/lucide](https://github.com/iconify/icon-sets) | `1.2.115` | `1.2.146` |
| [@iconify-json/simple-icons](https://github.com/iconify/icon-sets) | `1.2.88` | `1.2.100` |
| [@shikijs/rehype](https://github.com/shikijs/shiki/tree/HEAD/packages/rehype) | `4.3.0` | `4.5.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.2` | `5.104.4` |
| [abitype](https://github.com/wevm/abitype) | `1.2.4` | `1.3.0` |
| [accounts](https://github.com/tempoxyz/accounts) | `0.19.1` | `0.21.0` |
| [hono](https://github.com/honojs/hono) | `4.13.7` | `4.13.13` |
| [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.55.1` | `0.57.0` |
| [ox](https://github.com/wevm/ox) | `0.14.54` | `1.8.8` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.396.4` | `1.438.12` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.39.2` | `5.56.2` |
| [prool](https://github.com/wevm/prool) | `0.2.4` | `0.2.16` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [react-server-dom-webpack](https://github.com/react/react/tree/HEAD/packages/react-server-dom-webpack) | `19.3.0` | `19.3.1` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.3.0` | `4.5.0` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [sql-formatter](https://github.com/sql-formatter-org/sql-formatter) | `15.8.2` | `15.9.0` |
| [unplugin-icons](https://github.com/unplugin/unplugin-icons) | `23.0.1` | `24.0.0` |
| [viem](https://github.com/wevm/viem) | `2.57.5` | `2.57.7` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |


Updates `@iconify-json/lucide` from 1.2.115 to 1.2.146
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@iconify-json/simple-icons` from 1.2.88 to 1.2.100
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@shikijs/rehype` from 4.3.0 to 4.5.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.5.0/packages/rehype)

Updates `@tanstack/react-query` from 5.101.2 to 5.104.4
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.4/packages/react-query)

Updates `abitype` from 1.2.4 to 1.3.0
- [Release notes](https://github.com/wevm/abitype/releases)
- [Commits](https://github.com/wevm/abitype/compare/abitype@1.2.4...abitype@1.3.0)

Updates `accounts` from 0.19.1 to 0.21.0
- [Release notes](https://github.com/tempoxyz/accounts/releases)
- [Changelog](https://github.com/tempoxyz/accounts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tempoxyz/accounts/compare/accounts@0.19.1...accounts@0.21.0)

Updates `hono` from 4.13.7 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.7...v4.13.13)

Updates `monaco-editor` from 0.55.1 to 0.57.0
- [Release notes](https://github.com/microsoft/monaco-editor/releases)
- [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md)
- [Commits](microsoft/monaco-editor@v0.55.1...v0.57.0)

Updates `ox` from 0.14.54 to 1.8.8
- [Release notes](https://github.com/wevm/ox/releases)
- [Changelog](https://github.com/wevm/ox/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/ox/compare/ox@0.14.54...ox@1.8.8)

Updates `posthog-js` from 1.396.4 to 1.438.12
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.396.4...posthog-js@1.438.12)

Updates `posthog-node` from 5.39.2 to 5.56.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.56.2/packages/node)

Updates `prool` from 0.2.4 to 0.2.16
- [Release notes](https://github.com/wevm/prool/releases)
- [Changelog](https://github.com/wevm/prool/blob/main/CHANGELOG.md)
- [Commits](wevm/prool@v0.2.4...v0.2.16)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `react-server-dom-webpack` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-server-dom-webpack)

Updates `shiki` from 4.3.0 to 4.5.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.5.0/packages/shiki)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `sql-formatter` from 15.8.2 to 15.9.0
- [Release notes](https://github.com/sql-formatter-org/sql-formatter/releases)
- [Commits](sql-formatter-org/sql-formatter@v15.8.2...v15.9.0)

Updates `unplugin-icons` from 23.0.1 to 24.0.0
- [Release notes](https://github.com/unplugin/unplugin-icons/releases)
- [Commits](unplugin/unplugin-icons@v23.0.1...v24.0.0)

Updates `viem` from 2.57.5 to 2.57.7
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.57.5...viem@2.57.7)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

---
updated-dependencies:
- dependency-name: "@iconify-json/lucide"
  dependency-version: 1.2.146
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@iconify-json/simple-icons"
  dependency-version: 1.2.100
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@shikijs/rehype"
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: abitype
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: accounts
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: monaco-editor
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: ox
  dependency-version: 1.8.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: posthog-js
  dependency-version: 1.438.12
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: posthog-node
  dependency-version: 5.56.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: prool
  dependency-version: 0.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-server-dom-webpack
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: shiki
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: sql-formatter
  dependency-version: 15.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: unplugin-icons
  dependency-version: 24.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: viem
  dependency-version: 2.57.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
      



  

  @vercel






  



    

      

  

    

      
          
      

      
            vercel
    Bot

      

      

      commented


        Oct 26, 2026



      
  •

  

    
      

        
          edited
          
        
        
      

    
    
      
  
        
      Loading


  
    
  



    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
The latest updates on your projects. Learn more about Vercel for GitHub.






Project
Deployment
Actions
Updated






 tempo-docs
Ready Ready
Preview
Oct 26, 2026 12:02pm UTC






Request Review


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Oct 26, 2026

    

  



  

  







      

  
        

  

        

  claude[bot]
  

  
            

              
                    claude
    Bot

              

              reviewed


              
                  
                    Oct 26, 2026
                  
              
              
            


            



                  
    View reviewed changes
  


            






      

  
  
  
            
    
      

        Comment thread


        
              package.json

        
      


        

          
  

    
      
    
    

          


              

              

            
                  "unplugin-icons": "^23.0.1",

            
          

          


              

              

            
                  "viem": "2.57.5",

            
          

          


              

              

            
                  "unplugin-icons": "^24.0.0",

            
          

          


              

              

            
                  "viem": "2.57.7",

            
          

    








  

    

        

        

  

    

      
          @claude
      

      
            claude
    Bot

      

      

      


        Oct 26, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  




        

      

  

  
 

  
    

    
Choose a reason for hiding this comment


    

      The reason will be displayed to describe this comment to others. Learn more.
    


    

      
      



  



  
    

      
🔴 After merge, the Accounts demos for the t14-checkpoint devnet lose the patched ox build. viem would load stock ox 0.14.56, which lacks configurable account hash domains. The override in pnpm-workspace.yaml:35 is keyed to 'viem@ 2.57.5>ox'. Bumping viem to 2.57.7 makes it match nothing, so the lockfile now resolves viem's ox to 0.14.56. Fix: keep viem's ox on the patched build by re-keying the override to 'viem@ 2.57.7>ox' (or a version-less 'viem>ox') and regenerating the lockfile. Alternatively, confirm that a released ox containing wevm/ox#519 is what viem 2.57.7 resolves. [also at: package.json:67 - The account sandbox's devnet transactions may stop using the patched ox build that matches t14-checkpoint account hash domains.]



Why this was flagged

pnpm-workspace.yaml:35 overrides 'viem@ 2.57.5>ox': https://pkg.pr.new/ox@ bf010ee, commented as "Configurable account hash domains matching the t14-checkpoint devnet (wevm/ox#519)". It was added in 3ae2f6b, which pointed the Accounts demos at that devnet. On base, the lockfile resolves viem@ 2.57.5 to ox: https://pkg.pr.new/ox@ bf010ee (version 0.14.57-755f436.0). With viem bumped to 2.57.7 at package.json:68, the selector no longer matches. The regenerated pnpm-lock.yaml (around line 12907) resolves viem@ 2.57.7 to ox: 0.14.56, which is older than the 0.14.57 preview. The lockfile's overrides header still lists the stale viem@ 2.57.5>ox entry, so the install gives no error or warning. The demos in src/components/guides/account-sandbox-devnet.ts use viem/tempo against chain 31_318. They would then compute account hashes with the default domains instead of the devnet's, so the devnet would likely reject transactions or derive the wrong addresses.


Verification: pnpm-workspace.yaml still has the override 'viem@ 2.57.5>ox': https://pkg.pr.new/ox@ bf010ee. package.json changes "viem": "2.57.5" to "viem": "2.57.7", so the selector no longer matches any installed package. The regenerated snapshot viem@ 2.57.7(typescript@ 6.0.3)(zod@ 4.6.7) (pnpm-lock.yaml:12899-12907) now depends on ox: 0.14.56. The base lockfile does not have this problem.




    

  
  




    


        

      
  
  

    
  
    
    

  

  

  



          

              

      








    


  





        

    


  
    
      

        Comment thread


        
              pnpm-lock.yaml

        
      


        

          
  

    
    

          

            
            
            @@ -6177,7 +6288,7 @@ packages:
          

          


              

              

            
                      optional: true

            
          

          


              

              

            
              


            		
          

          


              

              

            
                vocs@https://pkg.pr.new/vocs@1c023ba:

            
          

          


              

              

            
                  resolution: {integrity: sha512-euAAzVKX35kF9xVRVgy1EEwprl0VqRQE1WLjC+AbGtHV9cMOSXc4D9SvqUMGBmpS8azfXu67InEU2xSi3FXhtA==, tarball: https://pkg.pr.new/vocs@1c023ba}

            
          

          


              

              

            
                  resolution: {tarball: https://pkg.pr.new/vocs@1c023ba}

            
          

    








  

    

        

        

  

    

      
          @claude
      

      
            claude
    Bot

      

      

      


        Oct 26, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  




        

      

  

  
 

  
    

    
Choose a reason for hiding this comment


    

      The reason will be displayed to describe this comment to others. Learn more.
    


    

      
      



  



  
    

      
🔴 Installs no longer check the integrity of the vocs tarball fetched from pkg.pr.new, so changed tarball content would install without any error. The regenerated lockfile dropped the integrity: sha512-... field from the vocs@ https://pkg.pr.new/vocs@ 1c023ba resolution and kept only tarball:. Fix: regenerate the lock so the vocs entry records its integrity hash again, for example with pnpm install --fix-lockfile (the base pnpm-lock.yaml has the hash), and check that other tarball-URL entries keep theirs.



Why this was flagged

On the base, pnpm-lock.yaml recorded resolution: {integrity: sha512-euAAzV..., tarball: https://pkg.pr.new/vocs@ 1c023ba} for vocs. After this change, pnpm-lock.yaml:6291 reads only resolution: {tarball: https://pkg.pr.new/vocs@ 1c023ba}. With no integrity field, pnpm install --frozen-lockfile in CI or on Vercel cannot compare the downloaded tarball with a known hash. The tarball comes from a third-party preview host, and vocs runs at build time with hasBin: true, so replaced content would be installed and run with no error. The trustPolicy: no-downgrade setting in pnpm-workspace.yaml covers registry provenance, not URL tarballs, so it does not catch this.


Verification: This bites when the content served at https://pkg.pr.new/vocs@ 1c023ba differs from the tarball the base lockfile pinned. At pnpm-lock.yaml:6291 the vocs resolution lost its integrity hash, and the specifier and version have not changed. Without the hash, pnpm install --frozen-lockfile installs whatever the host serves with no check. vocs then runs at build time.




    

  
  




    


        

      
  
  

    
  
    
    

  

  

  



          

              

      








    


  





        

    








  








      

  
      



  

  @dependabot


    @github




  



    

      

  

    

      
          
      

      
            dependabot
    Bot

      

      

      commented

        on behalf of github

        Oct 27, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Contributor


        

  Author


    

  





      


        



  
    

      
          
Looks like these dependencies are no longer updatable, so this is no longer needed.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



          closed this


      Oct 27, 2026

    

  


    


  

  
  

  
    

        

              @dependabot


        

      

        

              dependabot
Bot

          
    deleted the
    
      
        dependabot/npm_and_yarn/production-dae70b950c
    
    branch

          October 27, 2026 05:01          
        

      

    














  
  

    

      

  










    

    

        

      
      


  

    
  


  
This branch was successfully deployed

  
        1 active
        deployment
  
    

        

          

            

              
            


            

              Preview
              
                —
                b2d119b5
                Deployed

              Oct 26, 2026 by

                vercel[bot]

              
            

          


          

                  
    View deployment
  

          

        

    




    

  










  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    


      

  

    


  
      @claude
  
    claude[bot]



    
      
        
      
    
    claude[bot] left review comments





      






    
  
  


  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            

Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      0 participants