From 5fda209227da6bd075a645fc9a7624f50d12197f Mon Sep 17 00:00:00 2001
From: Nikolaus Heger <nheger@gmail.com>
Date: Sat, 8 Aug 2026 15:07:45 +0800
Subject: [PATCH 1/2] chore: bump qp-poseidon-core to 3.1.0

Align address hashing with latest poseidon-core (sponge wipe hardening).
---
 Cargo.lock | 12 +++++++++---
 Cargo.toml |  2 +-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2caad7f..a10a677 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1962,7 +1962,7 @@ checksum = "f99d71b1b1ba2c8ecc882e76cf5b300d7e411238d749f34429b4af82aeda3b9c"
 dependencies = [
  "log",
  "parity-scale-codec",
- "qp-poseidon-core",
+ "qp-poseidon-core 2.1.0",
  "qp-rusty-crystals-dilithium",
  "qp-rusty-crystals-hdwallet",
  "scale-info",
@@ -1977,6 +1977,12 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78172860cd960773c72e97fba07ead9e5a1c13086c5746283744933e2e4a577b"
 
+[[package]]
+name = "qp-poseidon-core"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5872607e25ea4ee5fb37e64bf1462168e1a36a4e719cdc8a105533c708253918"
+
 [[package]]
 name = "qp-rusty-crystals-dilithium"
 version = "2.5.0"
@@ -1997,7 +2003,7 @@ dependencies = [
  "hex",
  "hex-literal",
  "hmac",
- "qp-poseidon-core",
+ "qp-poseidon-core 2.1.0",
  "qp-rusty-crystals-dilithium",
  "serde",
  "serde_json",
@@ -2014,7 +2020,7 @@ dependencies = [
  "hex",
  "parity-scale-codec",
  "qp-dilithium-crypto",
- "qp-poseidon-core",
+ "qp-poseidon-core 3.1.0",
  "qp-rusty-crystals-dilithium",
  "qp-rusty-crystals-hdwallet",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index 2a2960c..15a95ac 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,7 +12,7 @@ crate-type = ["cdylib", "rlib"]
 [dependencies]
 # Chain crypto, pinned to the exact versions the Quantus runtime uses so that
 # addresses (Poseidon) and signatures (ML-DSA-87) are byte-identical.
-qp-poseidon-core = { version = "2.1.0", default-features = false }
+qp-poseidon-core = { version = "3.1.0", default-features = false }
 qp-rusty-crystals-dilithium = { version = "2.4.0", default-features = false }
 qp-rusty-crystals-hdwallet = { version = "2.4.0", optional = true }
 

From 83fc282c8e77750e861ebb019e88a2d0118ccd47 Mon Sep 17 00:00:00 2001
From: Nikolaus Heger <nheger@gmail.com>
Date: Sat, 8 Aug 2026 15:54:00 +0800
Subject: [PATCH 2/2] ci: drop npm upgrade step incompatible with Node 20

npm@latest now requires Node >=22; the npm bundled with Node 20
already supports lockfileVersion 3, so the upgrade step is unnecessary.
---
 .github/actions/setup/action.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 83a3ec2..ced804a 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -15,9 +15,6 @@ runs:
         node-version: 20
         registry-url: https://registry.npmjs.org
         cache: npm
-    - name: Upgrade npm
-      shell: bash
-      run: npm install -g npm@latest
     - name: Install dependencies
       shell: bash
       run: npm ci