Skip to content

Improve security and add new tooling and demo app integrations - #714

Merged
Dargon789 merged 153 commits into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-488391c1c5
Aug 11, 2026
Merged

Improve security and add new tooling and demo app integrations#714
Dargon789 merged 153 commits into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-488391c1c5

Conversation

@Dargon789

@Dargon789 Dargon789 commented Aug 5, 2026

Copy link
Copy Markdown
Owner

Summary by Sourcery

Improve security and add new tooling and demo app integrations.

New Features:

  • Add a new wagmi-based demo dapp project using Vite and React for wallet interactions.
  • Introduce Fortify AST Scan GitHub workflow and Azure Pipelines configuration for additional CI coverage.
  • Add GitHub issue templates and a SECURITY policy document.

Bug Fixes:

  • Prevent internal JSON parse errors from being exposed in HTTP error responses.
  • Use cryptographically secure randomness for dapp client ID generation.
  • Replace time-based nonce in identity instrument signing with a random nonce to avoid predictability.

Enhancements:

  • Grant minimal required permissions to the pnpm-format-label GitHub workflow.
  • Ensure tests workflow installs dependencies with a non-frozen lockfile to avoid install failures.

dependabot Bot and others added 30 commits March 30, 2024 07:24
Bumps the npm_and_yarn group with 1 update in the / directory: [express](https://github.com/expressjs/express).


Updates `express` from 4.18.2 to 4.19.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@4.18.2...4.19.2)

---
updated-dependencies:
- dependency-name: express
  dependency-type: direct:development
  dependency-group: npm_and_yarn-security-group
...

Signed-off-by: dependabot[bot] <support@github.com>
…yarn-security-group-e0cd778f82

Bump the npm_and_yarn group across 1 directory with 1 update
Snyk has created this PR to upgrade @tanstack/react-query from 5.45.1 to 5.64.2.

See this package in npm:
@tanstack/react-query

See this project in Snyk:
https://app.snyk.io/org/dargon789/project/bb845543-cbee-4e11-8cf9-8bfdf9205bf1?utm_source=github&utm_medium=referral&page=upgrade-pr
…9e16dcb9a2eda9

Snyk upgrade 03178c54d4c54014129e16dcb9a2eda9
Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>
Bumps the npm_and_yarn group with 1 update in the / directory: [next](https://github.com/vercel/next.js).


Updates `next` from 15.4.2 to 15.4.7
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.4.2...v15.4.7)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.4.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>
Bumps the npm_and_yarn group with 1 update in the / directory: [happy-dom](https://github.com/capricorn86/happy-dom).
Bumps the npm_and_yarn group with 1 update in the /packages/wallet/dapp-client directory: [happy-dom](https://github.com/capricorn86/happy-dom).
Bumps the npm_and_yarn group with 1 update in the /packages/wallet/wdk directory: [happy-dom](https://github.com/capricorn86/happy-dom).


Updates `happy-dom` from 17.6.3 to 20.0.0
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v17.6.3...v20.0.0)

Updates `happy-dom` from 17.6.3 to 20.0.0
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v17.6.3...v20.0.0)

Updates `happy-dom` from 17.6.3 to 20.0.0
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v17.6.3...v20.0.0)

---
updated-dependencies:
- dependency-name: happy-dom
  dependency-version: 20.0.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: happy-dom
  dependency-version: 20.0.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: happy-dom
  dependency-version: 20.0.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps the npm_and_yarn group with 1 update in the / directory: [happy-dom](https://github.com/capricorn86/happy-dom).


Updates `happy-dom` from 20.0.0 to 20.0.2
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.0.0...v20.0.2)

---
updated-dependencies:
- dependency-name: happy-dom
  dependency-version: 20.0.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Dargon789 Dargon789 linked an issue Aug 5, 2026 that may be closed by this pull request
Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
@vercel
vercel Bot temporarily deployed to Preview – sequence-js-docs August 11, 2026 01:44 Inactive
@vercel
vercel Bot temporarily deployed to Preview – sequence-js-web August 11, 2026 01:44 Inactive
@vercel
vercel Bot temporarily deployed to Preview – wagmi-project August 11, 2026 01:44 Inactive
@vercel
vercel Bot temporarily deployed to Preview – sequence.js August 11, 2026 01:44 Inactive
@Dargon789
Dargon789 merged commit 4b353b6 into master Aug 11, 2026
13 of 19 checks passed
@Dargon789
Dargon789 deleted the dependabot/npm_and_yarn/npm_and_yarn-488391c1c5 branch August 11, 2026 01:47
@Dargon789
Dargon789 restored the dependabot/npm_and_yarn/npm_and_yarn-488391c1c5 branch August 11, 2026 01:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Sequence diagram for relayer fee sponsorship and fee options flow

10 participants