chore(deps): bump @walletconnect to 2.23.10

[Vere-Grey]

Description

Bumps the whole @walletconnect 2.23.x family in lockstep, 2.23.9 → 2.23.10:

Package	Workspace
@walletconnect/{core,types,utils}	suite-common/walletconnect
@walletconnect/{sign-client,types}	suite/e2e
@walletconnect/react-native-compat	suite-native/app

Independent of #30865 — no shared commits, based directly on develop.

Why this is safe on the JS side

Verified by diffing the published tarballs rather than trusting semver. Every change is additive — no removed or renamed exports in any of the five packages:

• @walletconnect/types is byte-identical apart from sourcemaps. That is the package our code compiles against: 9 of our 11 imports are import type { ProposalTypes / EngineTypes / SessionTypes / SignClientTypes / ISignClient } from it. The typed contract has not moved.
• @walletconnect/utils gains one module (extractCantonTransfers, getCantonTransactionHashes).
• @walletconnect/sign-client gains one engine key (canton_prepareSignExecute).
• @walletconnect/core's only .d.ts change is the RELAYER_SDK_VERSION string, and it re-pins its internal es-toolkit 1.44.0 → 1.45.1. That adds a second es-toolkit entry to the lockfile; the 1.44.0 copy remains for storybook only, so production still bundles one.

The remaining two imports are the Core and SignClient constructors, whose signatures are unchanged.

Notes for QA

react-native-compat bumps native dependencies — Android com.github.reown-com.yttrium:yttrium-wcpay 0.10.51 → 0.10.58 and iOS YttriumWrapper 0.10.50 → 0.10.54. No type-check, lint or unit test in the repo can validate that; it needs a prebuild and a real device/EAS build. A 7-version native bump inside a JS patch release is the one part of this PR that deserves manual attention.

Please exercise WalletConnect pairing/session flows on mobile specifically (dApp connect, session approval, sign request, disconnect). Web/desktop is lower risk — suite-common/walletconnect only touches core/types/utils, whose surface is unchanged.

Verified locally:

• type-check passes for @suite-common/walletconnect, @trezor/suite-e2e, @suite-native/app plus their dependency graphs (249 tasks).
• yarn install --immutable passes against current develop.
• suite-common/walletconnect has no unit tests, so type-check plus the WalletConnect e2e is the automated coverage available.

Related Issue

Resolve

🌐 Preview deployments

🌐 Suite Web preview: https://dev.suite.sldev.cz/suite-web/qa-bump-dep-connect/web/

🔍 Currents Test Results

🔍 Suite web test results: View in Currents

🔍 Suite desktop test results: View in Currents

🔒 Quarantined E2E Tests

Trezor Suite (desktop) — 3 test(s)

Test	Type
Trading - Navigation > Navigate to	🤖 auto
Quarantine test: "Recovery - dry run,Recovery after partial recovery"	🙋 manual
Quarantine test: "Recovery - dry run,Recovery with device reconnection"	🙋 manual

Updated: 2026-08-05T10:28:09.902Z • 3 test(s) total

Trezor Suite (web) — 3 test(s)

Test	Type
Quarantine test: "Recovery - dry run,Recovery with device reconnection"	🙋 manual
Quarantine test: "TrezorConnect webextension -> Suite Web,second call after popup was closed by user should work"	🙋 manual
Quarantine test: "Recovery T2T1 - dry run,Recovery after partial recovery"	🙋 manual

Updated: 2026-08-05T10:27:41.488Z • 3 test(s) total

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm es-toolkit is 100.0% likely to have a medium risk anomaly Notes: This module is a runtime JavaScript template compiler built around new Function and code generation. The primary security risk is intentional arbitrary JavaScript execution: <% ... %> blocks are inserted verbatim into the generated function body, and <%= ... %> / <%- ... %> evaluate expressions at runtime. If an attacker can influence the template string or relevant options (especially evaluate and imports), this becomes a high-severity code execution risk. No direct malware or credential/network exfiltration is evident in this snippet, but the execution model itself is dangerous when inputs are untrusted. Confidence: 1.00 Severity: 0.60 From: ? → npm/@storybook/react-native@10.2.1 → npm/@storybook/addon-ondevice-controls@10.2.1 → npm/@walletconnect/core@2.23.10 → npm/@walletconnect/sign-client@2.23.10 → npm/es-toolkit@1.45.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-toolkit@1.45.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

This PR bumps the WalletConnect v2.23.x dependency family from 2.23.9 → 2.23.10 across the Suite workspaces that use it, updating both workspace package.json files and the corresponding yarn.lock resolutions.

Changes:

• Bump @walletconnect/{core,types,utils} in @suite-common/walletconnect to ^2.23.10.
• Bump @walletconnect/{sign-client,types} in suite/e2e to ^2.23.10.
• Bump @walletconnect/react-native-compat in suite-native/app to ^2.23.10, plus lockfile updates (including a new es-toolkit version via transitive deps).

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
yarn.lock	Updates lockfile resolutions for WalletConnect packages to 2.23.10 and introduces updated transitive entries (e.g., es-toolkit).
suite/e2e/package.json	Bumps E2E workspace WalletConnect deps (sign-client, types) to ^2.23.10.
suite-native/app/package.json	Bumps mobile app’s @walletconnect/react-native-compat to ^2.23.10.
suite-common/walletconnect/package.json	Bumps shared WalletConnect deps (core, types, utils) to ^2.23.10.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.