diff --git a/.changeset/calm-houses-listen.md b/.changeset/calm-houses-listen.md deleted file mode 100644 index 3a0fa18da..000000000 --- a/.changeset/calm-houses-listen.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@sei-js/mcp-server": patch ---- - -Fix session binding and response isolation in the HTTP SSE transport. - -- POST handler now validates `sessionId` on every request — rejects missing session IDs (400) and unknown session IDs (404) -- Each POST is routed to the transport instance that owns the matching session ID, preventing cross-client request injection -- Session IDs now use the MCP SDK's `transport.sessionId` rather than `Date.now()` \ No newline at end of file diff --git a/.changeset/security-pin-asyncapi.md b/.changeset/security-pin-asyncapi.md deleted file mode 100644 index e8e8a173e..000000000 --- a/.changeset/security-pin-asyncapi.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@sei-js/create-sei": patch -"@sei-js/ledger": patch -"@sei-js/mcp-server": patch -"@sei-js/precompiles": patch -"@sei-js/registry": patch -"@sei-js/sei-global-wallet": patch ---- - -Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. - -This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. - -No shipped code or public API changes in this package — this is a repository/CI hardening release. diff --git a/.changeset/some-bags-tie.md b/.changeset/some-bags-tie.md deleted file mode 100644 index 0d63ff96c..000000000 --- a/.changeset/some-bags-tie.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@sei-js/create-sei": patch ---- - -Improve the `next-template` runtime defaults generated by `create-sei`. - -- Add a `prebuild` Biome check and include Biome in template dev dependencies. -- Configure Next.js to allow Sei CDN images and skip ESLint during builds. -- Update provider and shell setup for improved chain/image handling. -- Align template config/docs with current defaults (`.env.example`, `README`, Biome, Tailwind v4 config). diff --git a/packages/create-sei/CHANGELOG.md b/packages/create-sei/CHANGELOG.md index 4ce4fc4af..a77655cae 100644 --- a/packages/create-sei/CHANGELOG.md +++ b/packages/create-sei/CHANGELOG.md @@ -1,5 +1,22 @@ # @sei-js/create-sei-app +## 1.0.1 + +### Patch Changes + +- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. + + This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. + + No shipped code or public API changes in this package — this is a repository/CI hardening release. + +- 9168186: Improve the `next-template` runtime defaults generated by `create-sei`. + + - Add a `prebuild` Biome check and include Biome in template dev dependencies. + - Configure Next.js to allow Sei CDN images and skip ESLint during builds. + - Update provider and shell setup for improved chain/image handling. + - Align template config/docs with current defaults (`.env.example`, `README`, Biome, Tailwind v4 config). + ## 1.0.0 ### Major Changes diff --git a/packages/create-sei/package.json b/packages/create-sei/package.json index 0a6ef816e..3195125c0 100644 --- a/packages/create-sei/package.json +++ b/packages/create-sei/package.json @@ -1,6 +1,6 @@ { "name": "@sei-js/create-sei", - "version": "1.0.0", + "version": "1.0.1", "repository": { "type": "git", "url": "https://github.com/sei-protocol/sei-js.git", diff --git a/packages/ledger/CHANGELOG.md b/packages/ledger/CHANGELOG.md index 3ea4456c4..b45d91e36 100644 --- a/packages/ledger/CHANGELOG.md +++ b/packages/ledger/CHANGELOG.md @@ -1,5 +1,15 @@ # @sei-js/ledger +## 1.1.6 + +### Patch Changes + +- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. + + This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. + + No shipped code or public API changes in this package — this is a repository/CI hardening release. + ## 1.1.5 ### Patch Changes diff --git a/packages/ledger/package.json b/packages/ledger/package.json index 985056d8e..de29aba9f 100644 --- a/packages/ledger/package.json +++ b/packages/ledger/package.json @@ -1,12 +1,14 @@ { "name": "@sei-js/ledger", - "version": "1.1.5", + "version": "1.1.6", "description": "TypeScript library for SEI Ledger app helper functions", "main": "./dist/cjs/src/index.js", "module": "./dist/esm/src/index.js", "types": "./dist/types/src/index.d.ts", "sideEffects": false, - "files": ["dist"], + "files": [ + "dist" + ], "scripts": { "build": "rimraf dist && pnpm run build:cjs && pnpm run build:esm && pnpm run build:types", "build:cjs": "tsc --outDir dist/cjs --module commonjs", @@ -15,7 +17,12 @@ "test": "jest" }, "homepage": "https://github.com/sei-protocol/sei-js#readme", - "keywords": ["sei", "javascript", "typescript", "ledger"], + "keywords": [ + "sei", + "javascript", + "typescript", + "ledger" + ], "repository": { "type": "git", "url": "https://github.com/sei-protocol/sei-js.git", diff --git a/packages/mcp-server/CHANGELOG.md b/packages/mcp-server/CHANGELOG.md index a92493fb7..83e00e6e8 100644 --- a/packages/mcp-server/CHANGELOG.md +++ b/packages/mcp-server/CHANGELOG.md @@ -1,5 +1,21 @@ # Changelog +## 0.3.3 + +### Patch Changes + +- bc17ace: Fix session binding and response isolation in the HTTP SSE transport. + + - POST handler now validates `sessionId` on every request — rejects missing session IDs (400) and unknown session IDs (404) + - Each POST is routed to the transport instance that owns the matching session ID, preventing cross-client request injection + - Session IDs now use the MCP SDK's `transport.sessionId` rather than `Date.now()` + +- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. + + This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. + + No shipped code or public API changes in this package — this is a repository/CI hardening release. + ## 0.3.2 ### Patch Changes diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json index 47395a74e..0b5f2b3fb 100644 --- a/packages/mcp-server/package.json +++ b/packages/mcp-server/package.json @@ -2,11 +2,16 @@ "name": "@sei-js/mcp-server", "description": "Model Context Protocol (MCP) server for interacting with EVM-compatible networks", "type": "module", - "version": "0.3.2", + "version": "0.3.3", "bin": "./bin/mcp-server.js", "main": "./dist/esm/index.js", "module": "./dist/esm/index.js", - "files": ["dist/", "bin/", "README.md", "LICENSE"], + "files": [ + "dist/", + "bin/", + "README.md", + "LICENSE" + ], "scripts": { "build": "rm -rf dist && tsc", "start": "node dist/esm/index.js", @@ -35,7 +40,17 @@ "viem": "^2.30.5", "zod": "^3.24.2" }, - "keywords": ["mcp", "model-context-protocol", "evm", "blockchain", "sei", "web3", "smart-contracts", "ai", "agent"], + "keywords": [ + "mcp", + "model-context-protocol", + "evm", + "blockchain", + "sei", + "web3", + "smart-contracts", + "ai", + "agent" + ], "author": "@codebycarson", "license": "MIT", "engines": { diff --git a/packages/precompiles/CHANGELOG.md b/packages/precompiles/CHANGELOG.md index 2a4d3c287..aa1b9c647 100644 --- a/packages/precompiles/CHANGELOG.md +++ b/packages/precompiles/CHANGELOG.md @@ -1,5 +1,15 @@ # @sei-js/precompiles +## 2.1.3 + +### Patch Changes + +- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. + + This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. + + No shipped code or public API changes in this package — this is a repository/CI hardening release. + ## 2.1.2 ### Patch Changes diff --git a/packages/precompiles/package.json b/packages/precompiles/package.json index 3888cd24c..f80871218 100644 --- a/packages/precompiles/package.json +++ b/packages/precompiles/package.json @@ -1,6 +1,6 @@ { "name": "@sei-js/precompiles", - "version": "2.1.2", + "version": "2.1.3", "description": "TypeScript library for EVM interactions on the Sei blockchain", "main": "./dist/cjs/index.js", "module": "./dist/esm/index.js", @@ -14,7 +14,13 @@ "test": "jest --passWithNoTests" }, "homepage": "https://github.com/sei-protocol/sei-js#readme", - "keywords": ["sei", "javascript", "typescript", "node", "evm"], + "keywords": [ + "sei", + "javascript", + "typescript", + "node", + "evm" + ], "repository": { "type": "git", "url": "https://github.com/sei-protocol/sei-js.git", diff --git a/packages/registry/CHANGELOG.md b/packages/registry/CHANGELOG.md index 8c850fdfd..cacd60beb 100644 --- a/packages/registry/CHANGELOG.md +++ b/packages/registry/CHANGELOG.md @@ -1,5 +1,15 @@ # @sei-js/registry +## 1.0.4 + +### Patch Changes + +- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. + + This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. + + No shipped code or public API changes in this package — this is a repository/CI hardening release. + ## 1.0.3 ### Patch Changes diff --git a/packages/registry/package.json b/packages/registry/package.json index 0a9e7b63e..9c5526432 100644 --- a/packages/registry/package.json +++ b/packages/registry/package.json @@ -1,6 +1,6 @@ { "name": "@sei-js/registry", - "version": "1.0.3", + "version": "1.0.4", "description": "TypeScript library for Sei chain constants and assets", "main": "./dist/cjs/src/index.js", "module": "./dist/esm/src/index.js", diff --git a/packages/sei-global-wallet/CHANGELOG.md b/packages/sei-global-wallet/CHANGELOG.md index d95739257..4e9a6e1c3 100644 --- a/packages/sei-global-wallet/CHANGELOG.md +++ b/packages/sei-global-wallet/CHANGELOG.md @@ -1,5 +1,15 @@ # @sei-js/global-wallet +## 1.4.1 + +### Patch Changes + +- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. + + This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. + + No shipped code or public API changes in this package — this is a repository/CI hardening release. + ## 1.4.0 ### Minor Changes diff --git a/packages/sei-global-wallet/package.json b/packages/sei-global-wallet/package.json index c4922ef9a..8ff51838e 100644 --- a/packages/sei-global-wallet/package.json +++ b/packages/sei-global-wallet/package.json @@ -1,7 +1,7 @@ { "name": "@sei-js/sei-global-wallet", "description": "Sei Global Wallet is a library to support Dynamic Global Wallets", - "version": "1.4.0", + "version": "1.4.1", "repository": { "type": "git", "url": "https://github.com/sei-protocol/sei-js.git",