Upgrade SDK history compatibility and patch build dependencies - #21
Conversation
|
Authoring-maintainer final review of Exact-head CI validation and image scan passed. Local lint, both typechecks, 33 tests and client/server builds passed; the production audit is zero. Full audit is reduced to the six existing low crypto-browserify/elliptic-chain findings, openly retained without suppression or a breaking forced downgrade. Native signing and app-level payment authorization are not part of this application dependency diff. Guarded deployment and subsequent actual app-flow validation are still required. No blocking finding in the reviewed change. This is the authoring maintainer's review. |
1 participant
Upgrade to verified published SDK 2.8.4 for existing wallet histories with empty stored descriptions or unassigned baskets. BRC100 calls, wire bytes, payments and entitlement behavior are unchanged; no API or account-data migration is required.
The lockfile also applies compatible patches to the existing build/test dependencies, including Vite 7.3.6, esbuild 0.28.2, Vitest 4.1.11, shell-quote, form-data and PostCSS. Full audit findings fall from 18 (including two critical and six high) to six low findings in the pre-existing crypto-browserify/elliptic chain. The production dependency audit is zero. The low elliptic finding has no fixed release; npm's forced remedy downgrades the polyfill plugin from 0.28 to 0.2 and is not applied. This PR neither suppresses the finding nor claims a clean full audit. The client build can include polyfills, so dev classification alone is not a runtime exemption; replacing that legacy graph requires separate compatibility work.
Lint, both typechecks, all 33 tests in 12 files, production client/server builds and the production audit passed. Hosted CI and guarded deployment acceptance remain pending.