chore(deps): upgrade typescript-wallet-sdk-km to 5.0.0 and stellar-sdk to 17.0.1 - #3006
Merged
Conversation
Key manager 3.0.1 shipped a bundle with stellar-sdk 15.0.1 inlined, so the background service worker ran a v15 XDR layer beside the v17 the extension itself uses. 5.0.0 inlines 17.0.1; bringing the workspace aliases to the same patch leaves one stellar-sdk resolution in the lockfile as well. Adds a regression test that unlocks a keystore blob written by 3.0.1, so an encrypter change can't silently lock existing installs out of their accounts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
There was a problem hiding this comment.
Pull request overview
Aligns Freighter’s key-management and Stellar SDK dependencies while preserving legacy keystore compatibility.
Changes:
- Upgrades wallet SDK KM to 5.0.0.
- Aligns Stellar SDK aliases on 17.0.1.
- Adds legacy keystore unlock coverage.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
yarn.lock |
Resolves upgraded dependency trees. |
extension/src/background/messageListener/__tests__/legacyKeystore.test.ts |
Tests legacy keystore compatibility. |
extension/package.json |
Upgrades extension dependencies. |
@shared/helpers/package.json |
Aligns Stellar SDK versions. |
@shared/constants/package.json |
Aligns Stellar SDK versions. |
@shared/api/package.json |
Aligns Stellar SDK versions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
|
PR Preview build is ready: https://github.com/stellar/freighter/releases/tag/untagged-70263082b4ba8833d8b2 |
CassioMG
changed the title
JiahuiWho
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
@stellar/typescript-wallet-sdk-km3.0.1 → 5.0.0stellar-sdk/stellar-sdk-next17.0.0 → 17.0.1 inextension,@shared/api,@shared/constants,@shared/helpersNo source changes.
Why
km 3.0.1 shipped a bundle with stellar-sdk 15.0.1 inlined, so the background service worker ran a v15 XDR layer beside our v17. 5.0.0 inlines 17.0.1, and the 15.0.1 tree drops out of the lockfile. Matching the alias patch puts mobile, the extension and the wallet SDK on the same versions.
Is 17.0.1 safe to take?
Yes. Diffing it against 17.0.0, the only behaviour change is
BytesValue#toString()rendering an xdr byte wrapper's declared encoding instead of base64; everything else is additive. Nothing here stringifies one — checked statically, and by logging every call to it across the full jest run.About the new test
It covers the km bump, not 17.0.1. km owns our encrypter and existing installs hold blobs it wrote, but neither suite covered the upgrade path — they only round-trip within one version.
legacyKeystore.test.tsunlocks a real blob captured from 3.0.1.Testing
yarn test:ci(221 suites / 1776 tests),yarn build:extension,yarn test:e2e(235 passed).sendPayment.test.ts › Swap doesn't throw error when account is unfundedfails locally without a realINDEXER_URL— it uses unstubbed endpoints, and fails identically on master, so it is the environment rather than this change.🤖 Generated with Claude Code