Skip to content

chore(eid-wallet): bump to 1.3.0 - #1189

Merged
Sahil2004 merged 1 commit into
mainfrom
Bekiboo/bump-eid-wallet-1.3.0
Oct 5, 2026
Merged

Sahil2004 merged 1 commit into
mainfrom
Bekiboo/bump-eid-wallet-1.3.0

Conversation

@Bekiboo

@Bekiboo Bekiboo commented Oct 3, 2026 •

Copy link
Copy Markdown
Collaborator

Description of change

Bumps the eID wallet from 1.2.0 to 1.3.0 ahead of the release.

Minor rather than patch: #1181 replaced the five hard-coded apps in the ribbon with the marketplace's live platforms, which is a new user-facing capability and the headline of this release. #1188 follows with labels for the categories those platforms actually publish.

Whoever builds the release must set PUBLIC_TRANSLATIONS_URL. Left empty, the wallet ignores the runtime correction catalog, so the ru/uk category wording #1188 describes as "correctable later without a release" cannot actually be corrected. It has been empty since the mechanism landed in #1145, so no shipped build has ever had it on. This PR only documents the value; setting it is a build-time step.

Design decisions

The Android versionCode is a hand-maintained counter in tauri.conf.json, not derived from the version string, and Play rejects an upload that does not raise it. It goes to 33, continuing 24, 25, 26, 27, 28, 31, 32.

The version string is written in seven places — tauri.conf.json, package.json, Cargo.toml, Cargo.lock, and the three generated iOS files. project.pbxproj is the one that matters for the iOS build: #1168 initially missed it, which would have shipped iOS at the old version.

.env.example keeps the empty default and offers the docs site as a commented alternative, matching how it already lists the registry and provisioner URLs per environment.

Type of change

  • Chore (refactoring, build scripts or anything else that isn't user-facing)

How the change has been tested

pnpm build in infrastructure/eid-wallet, with the catalog URL set locally: the bundle carries 1.3.0 on the settings node and the URL in _app/env.js. No code paths touched otherwise.

The catalog itself is live: https://docs.w3ds.metastate.foundation/translations.json returns 200 with access-control-allow-origin: * and an ETag, and already contains the nine category keys from #1188.

Note for anyone building from a stale checkout: pnpm install is required first, or Rollup fails to resolve @tauri-apps/plugin-http, the dependency #1181 added.

Change checklist

  • I have removed any unnecessary logic
  • My code follows the pattern of the application
  • I have signed my commits
  • I have self reviewed my code

Summary by CodeRabbit

  • Documentation
    • Clarified that translations can be served at runtime, while an empty configuration uses built-in translations. Added guidance and a sample URL for configuring the hosted catalog in release builds.
  • Release
    • Updated the app version to 1.3.0 and incremented the Android build number.

The apps ribbon now loads from the marketplace's live platforms (#1181), a new
user-facing capability, so this is a minor rather than a patch. #1188 follows
with the category translations.

The Android versionCode goes to 33, continuing 24, 25, 26, 27, 28, 31, 32.

.env.example gains the docs site as a commented value for
PUBLIC_TRANSLATIONS_URL, the way it already offers the registry and provisioner
URLs per environment. Empty disables the runtime correction catalog, which suits
a local checkout but leaves a release build unable to receive wording fixes.
@Bekiboo
Bekiboo requested a review from coodos as a code owner October 3, 2026 18:31
@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: eb421bc6-3b58-4de4-af21-5adb5c9ce442
📥 Commits

Reviewing files that changed from the base of the PR and between 6159cf1 and b3707cb.

⛔ Files ignored due to path filters (4)
  • infrastructure/eid-wallet/src-tauri/Cargo.lock is excluded by !**/*.lock
  • infrastructure/eid-wallet/src-tauri/gen/apple/eid-wallet.xcodeproj/project.pbxproj is excluded by !**/gen/**
  • infrastructure/eid-wallet/src-tauri/gen/apple/eid-wallet_iOS/Info.plist is excluded by !**/gen/**
  • infrastructure/eid-wallet/src-tauri/gen/apple/project.yml is excluded by !**/gen/**
📒 Files selected for processing (4)
  • .env.example
  • infrastructure/eid-wallet/package.json
  • infrastructure/eid-wallet/src-tauri/Cargo.toml
  • infrastructure/eid-wallet/src-tauri/tauri.conf.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The changes update translation URL comments in .env.example and change the eID wallet package and application versions to 1.3.0. The Android bundle version code changes to 33.

Changes

Translation URL Documentation

Layer / File(s) Summary
Document translation URL settings
.env.example
The comments describe runtime translation delivery, empty configuration behavior, and release-build guidance. A sample docs-site URL is added.

eID Wallet Version Metadata

Layer / File(s) Summary
Update wallet version metadata
infrastructure/eid-wallet/package.json, infrastructure/eid-wallet/src-tauri/Cargo.toml, infrastructure/eid-wallet/src-tauri/tauri.conf.json
The package and application versions change from 1.2.0 to 1.3.0. The Android bundle version code changes from 32 to 33.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to b3707

The wallet’s release metadata is aligned across platforms, and the translation guidance matches the catalog generation and fallback behavior. No actionable merge-blocking risk remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to b3707

The changes do not themselves enable remote translations or weaken existing controls. However, following the release guidance would let the configured catalog supply wallet wording. The actual release configuration and publisher controls remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — If an unauthorized party controlled an enabled catalog endpoint, the independently affected scope could include wallet installations built to use that endpoint, with effects bounded by accepted message keys and locales. Previously accepted wording can persist in each installation's cache. The evidence does not establish which shipped installations, if any, enable this path.

Security Findings and Attack Paths

  • inferred — The conditional attack path is control of the configured catalog publisher, followed by schema-valid wording changes reaching message lookup and persistent cache. This is an existing trust dependency, not a verified vulnerability or an evidenced PR-introduced expansion of authority.

Trust Boundaries and Controls

  • observed — Network responses and local-storage contents both pass through catalog validation before becoming active corrections. Transport validation precedes the fetch. These controls constrain compatibility and transport, but the release URL's ownership and publisher authority remain outside the established evidence.

Resilience and Maintainability Implications

  • inferred — Concurrent successful refreshes would apply in completion order because there is no request-order guard. The inspected startup caller invokes refresh once, and the PR does not change this behavior, so this is not retained as an introduced security concern.

Hardening Proposals

  • proposed — Before enabling the catalog in a release, record the approved endpoint and its publishing owner, verify the value embedded in each release artifact, and define rollback that accounts for cached corrections rather than relying only on an empty URL.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely identifies the eID wallet version bump to 1.3.0, which is the primary change.
Description check ✅ Passed The description explains the version bump, design decisions, testing, and change type. The Issue Number section is blank, and the checklist omits the CI-check and documentation items, but the descript…
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 Biome (2.5.13)
infrastructure/eid-wallet/package.json

Biome could not lint this file: configuration resulted in errors. Check the repository's Biome configuration and plugins.

infrastructure/eid-wallet/src-tauri/tauri.conf.json

Biome could not lint this file: configuration resulted in errors. Check the repository's Biome configuration and plugins.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Bekiboo Bekiboo self-assigned this Oct 5, 2026
@Sahil2004
Sahil2004 merged commit a9a999c into main Oct 5, 2026
4 checks passed
@Sahil2004
Sahil2004 deleted the Bekiboo/bump-eid-wallet-1.3.0 branch October 5, 2026 07:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants