Repository navigation
Conversation
Bumps [@solana/kit](https://github.com/anza-xyz/kit) from 8.5.0 to 8.6.0. - [Release notes](https://github.com/anza-xyz/kit/releases) - [Commits](anza-xyz/kit@v8.5.0...v8.6.0) --- updated-dependencies: - dependency-name: "@solana/kit" dependency-version: 8.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Dependabot's lock for #539 nested private copies of @solana/* under their dependents (signers x2, transactions x3, errors x12), which smoke-dist rejects: two copies of signers/transactions sign malformed transactions. Deleted every node_modules/@solana/* and @solana-program/* lock entry and re-resolved with npm 11 (--ignore-scripts). Verified: no @Solana package has more than one install path; only other lock drift is a nested undici-types (types only). Signed payloads byte-identical kit 8.5.0 vs 8.6.0 for exact SVM v2/v1 and EVM v2. npm ci, typecheck, 1271 tests and build + smoke-dist pass.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including
 |
VickyXAI
pushed a commit
that referenced
this pull request
Nov 3, 2026
…402 peers Folds #542 (kit 8.6.0) into this PR so the two payment-signing bumps share one lockfile: @Solana lock entries re-resolved with npm 11, one copy of every @Solana and @x402 package. @blockrun/llm declares @x402/core and @x402/svm as optional peers at ~2.28.0. Reusing old lock placements hid that, but a fresh resolve ERESOLVEs. A scoped override points llm's peers at our own @x402/core/@x402/svm so any future npm install resolves; npm ls is clean. Verified: signed payloads byte-identical (x402 2.29 + kit 8.6 + viem 2.57.13 vs main's 2.28 + 8.5) for exact SVM v2/v1 and EVM v2; npm ci, typecheck, 1284 tests, build + smoke-dist pass.
Contributor
Author
|
Folded into #541. |
VickyXAI
added a commit
that referenced
this pull request
Nov 3, 2026
…rsedes #536, #539, #542) (#541) * build(deps): bump the @x402/* family from 2.28.0 to 2.29.0 in lockstep Supersedes #536, which bumped @x402/evm alone. evm 2.29 requires @x402/core ~2.29.0, so npm nested a second core under evm and every x402Client handed to registerExactEvmScheme failed typecheck (two distinct class types). Moving core/evm/fetch/svm together keeps one copy. Verified: - Signed payloads byte-identical 2.28 vs 2.29 for exact SVM v2, SVM v1 and EVM v2 (fixed key, stubbed RPC, pinned randomness/clock; harness confirmed sensitive by mutating the amount). - @x402/fetch 2.29 now reads 402 bodies with a 1 MiB cap; 2xx and streaming bodies pass through untouched. - typecheck, 1279 tests, build + smoke-dist (single @x402/core) pass. @blockrun/llm declares @x402/core and @x402/svm as optional peers at ~2.28.0, so npm ls reports them invalid; the tree still holds one copy. Also group @x402/* in dependabot.yml so the family arrives as one PR. * build(deps): bump @solana/kit to 8.6.0 and override @blockrun/llm's x402 peers Folds #542 (kit 8.6.0) into this PR so the two payment-signing bumps share one lockfile: @Solana lock entries re-resolved with npm 11, one copy of every @Solana and @x402 package. @blockrun/llm declares @x402/core and @x402/svm as optional peers at ~2.28.0. Reusing old lock placements hid that, but a fresh resolve ERESOLVEs. A scoped override points llm's peers at our own @x402/core/@x402/svm so any future npm install resolves; npm ls is clean. Verified: signed payloads byte-identical (x402 2.29 + kit 8.6 + viem 2.57.13 vs main's 2.28 + 8.5) for exact SVM v2/v1 and EVM v2; npm ci, typecheck, 1284 tests, build + smoke-dist pass. --------- Co-authored-by: 1bcMax <viewitter@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #539. Dependabot's lockfile nested private copies of
@solana/*under each dependent (signers×2,transactions×3,errors×12), andsmoke-distcorrectly failed Build & Test and scanner: two copies of signers/transactions produce malformed Solana transactions (the 2026-03-06 incident).This keeps Dependabot's commit and adds one on top: every
node_modules/@solana/*and@solana-program/*lock entry deleted, then re-resolved with npm 11. It's the same recipe as #358 and the kit 8.5.0 bump.Verification
@solanapackage has more than one install path in the lock. The only non-Solana drift is a nestedundici-types(8.11.2 → 8.12.3, types only).npm ci,npm run typecheck,npm test(1271 passed) andnpm run buildwith smoke-dist all pass. The first full run timed out 4index.*tests under load; they pass in isolation and on a full rerun.Independent of #541 (x402 2.29). Whichever merges second needs a lock re-resolve.