Merge branch 'main' into audit-q2-2026

# Conflicts:
#	.changeset/cross-collateral-rename.md
#	.github/workflows/node-services-docker.yml
#	Dockerfile
#	pnpm-lock.yaml
#	solidity/build-tron.sh
#	solidity/contracts/middleware/AbstractInterchainAccountRouter.sol
#	solidity/contracts/middleware/MinimalInterchainAccountRouter.sol
#	solidity/multicollateral/CHANGELOG.md
#	solidity/multicollateral/package.json
#	solidity/package.json
#	typescript/cli/src/commands/warp.ts
#	typescript/cli/src/send/transfer.ts
#	typescript/docker-bake.hcl
#	typescript/infra/config/docker.ts
#	typescript/sdk/src/fee/EvmTokenFeeReader.ts
#	typescript/sdk/src/fee/types.test.ts
#	typescript/sdk/src/token/configUtils.ts

Author: yorhodes

.changeset/config.json

@@ -10,13 +10,11 @@
       "@hyperlane-xyz/cli",
       "@hyperlane-xyz/cosmos-sdk",
       "@hyperlane-xyz/cosmos-types",
-      "@hyperlane-xyz/eslint-config",
       "@hyperlane-xyz/github-proxy",
       "@hyperlane-xyz/helloworld",
       "@hyperlane-xyz/http-registry-server",
       "@hyperlane-xyz/infra",
       "@hyperlane-xyz/radix-sdk",
-      "@hyperlane-xyz/rebalancer",
       "@hyperlane-xyz/sealevel-sdk",
       "@hyperlane-xyz/sdk",
       "@hyperlane-xyz/tsconfig",

.changeset/cross-collateral-rename.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": patch
+---
+
+Fixed SafeERC20.sol operations for Tron

.changeset/cuddly-meals-retire.md

@@ -0,0 +1,8 @@
+---
+'@hyperlane-xyz/starknet-sdk': patch
+'@hyperlane-xyz/deploy-sdk': patch
+'@hyperlane-xyz/provider-sdk': patch
+'@hyperlane-xyz/cli': patch
+---
+
+Starknet AltVM follow-up behavior was fixed across the CLI toolchain. Warp apply/update paths now preserve existing Starknet hook and ISM settings when config leaves them unset or uses empty addresses, zero-address hook and ISM references are normalized as unset during provider artifact conversion, and core mailbox bootstrap only passes through existing hook addresses for Starknet while other AltVMs keep zero-address placeholders.

.changeset/late-wolves-repeat.md

@@ -0,0 +1,5 @@
+---
+'@hyperlane-xyz/metrics': patch
+---
+
+Fixed metrics server startup to validate `PROMETHEUS_PORT` before listening and throw a clear error for empty, non-numeric, or out-of-range values.

.changeset/metrics-port-validation.md

@@ -0,0 +1,5 @@
+---
+'@hyperlane-xyz/sealevel-sdk': major
+---
+
+SvmSigner send/confirm flow was refactored with block-height-based polling, client-side rebroadcast, structured blockhash error detection via @solana/errors, and double-execution prevention for processed transactions. Program deployment write stages are now sent in parallel batches with retry on failure. Breaking: DeployStage requires a new `kind` field (DeployStageKind discriminant).

.changeset/svm-signer-deploy-improvements.md

@@ -0,0 +1,5 @@
+---
+'@hyperlane-xyz/utils': patch
+---
+
+Yaml sorting helpers were exported from `@hyperlane-xyz/utils` so repo tooling can reuse a single implementation for YAML transforms and warp config ordering.

.changeset/token-bridge-oft-refactor.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/warp-widget": major
+---
+
+Added @hyperlane-xyz/warp-widget — iframe-based SDK for embedding the Hyperlane Warp bridge in any web app

.changeset/utils-yaml-exports.md

@@ -9,11 +9,11 @@ Build and publish Docker images to GHCR (`ghcr.io/hyperlane-xyz/*`).
 
 ## Workflows
 
-| Workflow                   | Image(s)                                                                                                                             | Contents                         |
-| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------- |
-| `rust-docker.yml`          | `hyperlane-agent`                                                                                                                    | Rust relayer, validator, scraper |
-| `monorepo-docker.yml`      | `hyperlane-monorepo`                                                                                                                 | Full TS/Solidity monorepo        |
-| `node-services-docker.yml` | `hyperlane-rebalancer`, `hyperlane-warp-monitor`, `hyperlane-key-funder`, `hyperlane-ts-relayer`, `hyperlane-offchain-lookup-server` | TypeScript node services         |
+| Workflow                   | Image(s)                  | Contents                                                                         |
+| -------------------------- | ------------------------- | -------------------------------------------------------------------------------- |
+| `rust-docker.yml`          | `hyperlane-agent`         | Rust relayer, validator, scraper                                                 |
+| `monorepo-docker.yml`      | `hyperlane-monorepo`      | Full TS/Solidity monorepo                                                        |
+| `node-services-docker.yml` | `hyperlane-node-services` | All TS node services (rebalancer, warp-monitor, ccip-server, keyfunder, relayer) |
 
 ## How to Trigger
 
@@ -26,7 +26,7 @@ gh workflow run rust-docker.yml --ref <branch>
 # Monorepo image
 gh workflow run monorepo-docker.yml --ref <branch>
 
-# Node services (all 5 built together)
+# Node services (single unified image)
 gh workflow run node-services-docker.yml --ref <branch>
 
 # Include arm64 (multi-arch, slower)