You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Manual, comprehensive pinned-dependency refresh (replacement for Dependabot, which is being retired in a separate PR — manual upgrade cadence takes over). Every target version was re-verified against npm publish times immediately before the bump, respecting the repo .npmrc (min-release-age=1, packages younger than 24h are uninstallable except @fairmint/*).
Merging to main auto-publishes a patch release via trusted publishing (publish.yml): next release would be 0.0.263. This PR must be CI-green before merge.
Dependency changes
Note: axios/ws/zod upgrades already merged to main via #418 and are part of this branch's baseline; @canton-network/wallet-sdk was removed as a direct dependency on main in cee3b6c (#420) — nothing to bump here. Remaining delta:
Package
Old
New
Notes
dotenv
17.4.2
18.0.3
major; config({ path }) API unchanged; smoke-tested
@fairmint/canton-dev-tools
0.1.7
0.1.11
@types/node
26.1.2
26.6.2
@typescript-eslint/eslint-plugin
8.62.1
8.70.1
rule changes accommodated (see below)
@typescript-eslint/parser
8.62.1
8.70.1
jest
30.4.2
30.5.2
npm-package-json-lint
10.4.1
11.0.0
major; .npmpackagejsonlintrc.json unchanged and compatible (verified: v10.4.1 and v11.0.0 report identical results)
prettier
3.9.6
3.9.8
3.9.9 was published 2026-09-23 06:31 UTC (<24h old at install time) → took 3.9.8 per min-release-age policy
@typescript-eslint/unbound-method now flags bare method references, catching the jest idiom expect(mock.method). The rule is now disabled for test files only via a scoped eslint config override (jest mocks never rely on this; non-test code keeps full protection), replacing the previous 34 per-assertion suppression comments (31 new + 3 pre-existing).
no-meaningless-void-operator now also flags void <variable>; and void-returning calls in test/typecheck/* files (their idiom for pinning inferred types against noUnusedLocals) — autofixed by removing void (verified no-floating-promises still catches un-awaited promise calls, so no protection lost).
4 pre-existing baseline lint errors (present on main under its own pins) fixed: 3 × promise-function-async kept as non-async arrows with targeted eslint-disable + rationale — reverting the autofix was required because making them async changed promise-rejection timing and broke two race-condition unit tests; plus 1 × consistent-type-imports.
Validation
check-pinned-deps (@hardlydifficult/ci-scripts@1.0.85) — all pins exact
npm install clean — no ERESOLVE/ETARGET (npm 11.12.1, repo .npmrc respected; lockfile gitignored, not committed)
npm run build (openapi typegen + client-method gen + TS7 tsc + lint-config tsc)
npm run check:package-artifacts (PR CI parity for package-artifacts.yml)
npm run lint — 0 errors, 0 warnings
npm run lint:npm:check with v11 — root package.json clean (13 reported errors are all libs/splice submodule package.jsons scanned locally; identical output verified under v10.4.1; not CI-gated)
Unit tests: npx jest test/unit — 82/82 suites, 1163/1163 tests pass (integration/localnet suites excluded — they require a running LocalNet and run in test-cn-quickstart.yml CI)
tsc7 check: npm run tsc7 runs as part of npm run build (TS7-only issues from new deps: none observed)
npm run format (prettier --check .): fails identically on main under its own pins (same 36 files, verified by running with prettier 3.9.6 on a9be49c) — pre-existing drift, not a version interaction; prettier 3.9.8 output is byte-identical to 3.9.6 on this repo. Not fixed here to keep this PR pure dependency-bump + required lint accommodation; recommend a standalone chore(format) pass.
Post-merge
Auto-release 0.0.263 fires on merge (patch; no version bump included in this PR). Dependabot retirement (separate PR) makes this the first manual-cadence dependency refresh.
- Scope unbound-method off to test files (jest expect(mock.method) idiom
flagged by the tightened rule; mocks never rely on this).
- Drop now-redundant eslint-disable comments in three test files.
- Fix 4 pre-existing baseline errors: promise-function-async in
race-sensitive spots kept non-async with targeted disables (timing
verified by unit tests), plus one consistent-type-imports fix.
- Remove meaningless void operators in typecheck tests flagged by
no-meaningless-void-operator in typescript-eslint 8.69+.
Co-authored-by: Cursor <cursoragent@cursor.com>
Address Copilot review finding: keep exact-version documentation and
contributor guidance in sync with the dependency bump in this PR.
Co-authored-by: Cursor <cursoragent@cursor.com>
Disabling unbound-method for the entire test/** tree removes protection from integration/typecheck tests and from future callback-style method references, although this upgrade only needs three known Jest assertion suppressions. Keep the rule enabled and retain targeted disables at those three assertion sites instead.
…ed disables
Address Copilot review (medium): keep unbound-method active everywhere;
suppress it only at the 34 bare jest mock-reference assertion sites where
the tightened rule misfires (expect(mock.method) idiom, no this-capture
risk). Also update the LocalNet testing skill's dev-tools floor to
0.1.11+ to match this bump.
Co-authored-by: Cursor <cursoragent@cursor.com>
Acknowledged Copilot's latest head review (5295642002, submitted 2026-09-23 19:18 UTC).
Docs fix — "LocalNet documentation remains stale":docs/package-boundary.md:16 was the remaining stale @fairmint/canton-dev-tools reference (0.1.7+), missed when README.md, AGENTS.md, and .cursor/skills/localnet-testing/SKILL.md were updated to 0.1.11 in earlier commits (97ea504, 9c6a3cc). Fixed in dd16e5a — the dev-tools floor in that doc now reads 0.1.11+.
Validation: Repo-wide scan for 0.1.7 (excluding node_modules/, libs/ submodules, and lockfiles) now returns no dev-tools version references — the only remaining matches are unrelated Splice DAML package versions inside the libs/splice submodule. Docs-only change (docs/ is not compiled), so no build/test run was needed; eslint-config and test files are untouched by this commit.
The open lint-suppression finding from that review was acknowledged separately (19:33 UTC reply); this commit does not change it.
Cross-reference: the first slice of this dependency refresh is split out as #418 (three runtime deps only: axios 1.19.0→1.20.0, ws 8.21.2→8.21.3, zod 4.4.3→4.6.5 at commit f109217). It is non-draft, CI green at exact head (all 10 checks), mergeable, Copilot-reviewed (approval recommended, no findings), and assigned to @HardlyDifficult for final review. The remaining upgrades stay tracked here.
Per Nick's request, the noisy per-assertion // eslint-disable-next-line @typescript-eslint/unbound-method suppressions (34 total: 31 added in this PR + 3 pre-existing) have been removed and replaced by a test-scoped eslint config override: @typescript-eslint/unbound-method is now off for test/** files only, since jest mocks are invoked as bare functions and never rely on this. Non-test code keeps full rule protection. Lint is clean (0 errors, 0 warnings) and npx jest test/unit still passes 1163/1163 (lint-only change). Commit: dfa6b0e.
FYI on the conflict resolution: main's cee3b6c (wallet-sdk direct-dep removal) was merged into this branch as a3b4d78 with package.json resolved to main's dependency list (no wallet-sdk entry) + this PR's bumps. The PR then merged via a parallel path (1e3a11a → 830e214); final package.json on main is byte-identical to a3b4d78's resolution, so nothing was lost. The a3b4d78 merge was validated locally (lint 0/0, build green, jest 1163/1163, pins exact) before the PR state was noticed as merged. The briefly recreated head branch has been deleted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Manual, comprehensive pinned-dependency refresh (replacement for Dependabot, which is being retired in a separate PR — manual upgrade cadence takes over). Every target version was re-verified against npm publish times immediately before the bump, respecting the repo
.npmrc(min-release-age=1, packages younger than 24h are uninstallable except@fairmint/*).Merging to
mainauto-publishes a patch release via trusted publishing (publish.yml): next release would be 0.0.263. This PR must be CI-green before merge.Dependency changes
Note: axios/ws/zod upgrades already merged to main via #418 and are part of this branch's baseline; @canton-network/wallet-sdk was removed as a direct dependency on main in cee3b6c (#420) — nothing to bump here. Remaining delta:
dotenvconfig({ path })API unchanged; smoke-tested@fairmint/canton-dev-tools@types/node@typescript-eslint/eslint-plugin@typescript-eslint/parserjestnpm-package-json-lint.npmpackagejsonlintrc.jsonunchanged and compatible (verified: v10.4.1 and v11.0.0 report identical results)prettiertsxKept back (with reasons and unlock paths)
typescriptts-jest29.4.x peer requires<7;openapi-typescript@7.13.0peer requires^5.xtypescript-7(aliasnpm:typescript@7.0.2)tsc7script); not a routine bumpeslinteslint-plugin-import@2.32.0peer caps at^9eslint-plugin-import→eslint-plugin-import-x, then bump eslint to 10 (carried forward as explicit follow-up)eslint-plugin-importts-jestAlready at latest (untouched)
@hardlydifficult/rest-client1.0.65,@hardlydifficult/websocket1.0.73,@stellar/stellar-base15.0.0,glob13.0.6,openapi-fetch0.17.0,openapi-typescript7.13.0,pino10.3.1,@types/jest30.0.0,@types/ws8.18.1,eslint-config-prettier10.1.8,eslint-import-resolver-typescript4.4.5,eslint-plugin-markdown5.1.0,eslint-plugin-unused-imports4.4.1,markdownlint-cli0.49.1,prettier-plugin-jsdoc1.8.1,prettier-plugin-organize-imports4.3.0,prettier-plugin-packagejson3.0.2Source-code accommodations (typescript-eslint 8.69+ tightened rules)
Second commit, minimal and mechanical:
@typescript-eslint/unbound-methodnow flags bare method references, catching the jest idiomexpect(mock.method). The rule is now disabled for test files only via a scoped eslint config override (jest mocks never rely onthis; non-test code keeps full protection), replacing the previous 34 per-assertion suppression comments (31 new + 3 pre-existing).no-meaningless-void-operatornow also flagsvoid <variable>;and void-returning calls intest/typecheck/*files (their idiom for pinning inferred types againstnoUnusedLocals) — autofixed by removingvoid(verifiedno-floating-promisesstill catches un-awaited promise calls, so no protection lost).mainunder its own pins) fixed: 3 ×promise-function-asynckept as non-async arrows with targetedeslint-disable+ rationale — reverting the autofix was required because making themasyncchanged promise-rejection timing and broke two race-condition unit tests; plus 1 ×consistent-type-imports.Validation
check-pinned-deps(@hardlydifficult/ci-scripts@1.0.85) — all pins exactnpm installclean — no ERESOLVE/ETARGET (npm 11.12.1, repo.npmrcrespected; lockfile gitignored, not committed)npm run build(openapi typegen + client-method gen + TS7tsc+ lint-config tsc)npm run check:package-artifacts(PR CI parity for package-artifacts.yml)npm run lint— 0 errors, 0 warningsnpm run lint:npm:checkwith v11 — root package.json clean (13 reported errors are alllibs/splicesubmodule package.jsons scanned locally; identical output verified under v10.4.1; not CI-gated)npx jest test/unit— 82/82 suites, 1163/1163 tests pass (integration/localnet suites excluded — they require a running LocalNet and run in test-cn-quickstart.yml CI)npm run tsc7runs as part ofnpm run build(TS7-only issues from new deps: none observed)config({ path: 'example.env' })parses 25 vars, values readablenpm run format(prettier --check .): fails identically onmainunder its own pins (same 36 files, verified by running withprettier 3.9.6ona9be49c) — pre-existing drift, not a version interaction;prettier 3.9.8output is byte-identical to3.9.6on this repo. Not fixed here to keep this PR pure dependency-bump + required lint accommodation; recommend a standalonechore(format)pass.Post-merge
Auto-release 0.0.263 fires on merge (patch; no version bump included in this PR). Dependabot retirement (separate PR) makes this the first manual-cadence dependency refresh.
Made with Cursor