Version Packages

packages/create-sei/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @sei-js/create-sei-app
 
+## 1.0.1
+
+### Patch Changes
+
+- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`.
+
+  This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively.
+
+  No shipped code or public API changes in this package — this is a repository/CI hardening release.
+
+- 9168186: Improve the `next-template` runtime defaults generated by `create-sei`.
+
+  - Add a `prebuild` Biome check and include Biome in template dev dependencies.
+  - Configure Next.js to allow Sei CDN images and skip ESLint during builds.
+  - Update provider and shell setup for improved chain/image handling.
+  - Align template config/docs with current defaults (`.env.example`, `README`, Biome, Tailwind v4 config).
+
 ## 1.0.0
 
 ### Major Changes

packages/create-sei/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sei-js/create-sei",
-	"version": "1.0.0",
+	"version": "1.0.1",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/sei-protocol/sei-js.git",

packages/ledger/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @sei-js/ledger
 
+## 1.1.6
+
+### Patch Changes
+
+- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`.
+
+  This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively.
+
+  No shipped code or public API changes in this package — this is a repository/CI hardening release.
+
 ## 1.1.5
 
 ### Patch Changes

packages/ledger/package.json

@@ -1,12 +1,14 @@
 {
 	"name": "@sei-js/ledger",
-	"version": "1.1.5",
+	"version": "1.1.6",
 	"description": "TypeScript library for SEI Ledger app helper functions",
 	"main": "./dist/cjs/src/index.js",
 	"module": "./dist/esm/src/index.js",
 	"types": "./dist/types/src/index.d.ts",
 	"sideEffects": false,
-	"files": ["dist"],
+	"files": [
+		"dist"
+	],
 	"scripts": {
 		"build": "rimraf dist && pnpm run build:cjs && pnpm run build:esm && pnpm run build:types",
 		"build:cjs": "tsc --outDir dist/cjs --module commonjs",
@@ -15,7 +17,12 @@
 		"test": "jest"
 	},
 	"homepage": "https://github.com/sei-protocol/sei-js#readme",
-	"keywords": ["sei", "javascript", "typescript", "ledger"],
+	"keywords": [
+		"sei",
+		"javascript",
+		"typescript",
+		"ledger"
+	],
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/sei-protocol/sei-js.git",

packages/mcp-server/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.3.3
+
+### Patch Changes
+
+- bc17ace: Fix session binding and response isolation in the HTTP SSE transport.
+
+  - POST handler now validates `sessionId` on every request — rejects missing session IDs (400) and unknown session IDs (404)
+  - Each POST is routed to the transport instance that owns the matching session ID, preventing cross-client request injection
+  - Session IDs now use the MCP SDK's `transport.sessionId` rather than `Date.now()`
+
+- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`.
+
+  This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively.
+
+  No shipped code or public API changes in this package — this is a repository/CI hardening release.
+
 ## 0.3.2
 
 ### Patch Changes

packages/mcp-server/package.json

@@ -2,11 +2,16 @@
 	"name": "@sei-js/mcp-server",
 	"description": "Model Context Protocol (MCP) server for interacting with EVM-compatible networks",
 	"type": "module",
-	"version": "0.3.2",
+	"version": "0.3.3",
 	"bin": "./bin/mcp-server.js",
 	"main": "./dist/esm/index.js",
 	"module": "./dist/esm/index.js",
-	"files": ["dist/", "bin/", "README.md", "LICENSE"],
+	"files": [
+		"dist/",
+		"bin/",
+		"README.md",
+		"LICENSE"
+	],
 	"scripts": {
 		"build": "rm -rf dist && tsc",
 		"start": "node dist/esm/index.js",
@@ -35,7 +40,17 @@
 		"viem": "^2.30.5",
 		"zod": "^3.24.2"
 	},
-	"keywords": ["mcp", "model-context-protocol", "evm", "blockchain", "sei", "web3", "smart-contracts", "ai", "agent"],
+	"keywords": [
+		"mcp",
+		"model-context-protocol",
+		"evm",
+		"blockchain",
+		"sei",
+		"web3",
+		"smart-contracts",
+		"ai",
+		"agent"
+	],
 	"author": "@codebycarson",
 	"license": "MIT",
 	"engines": {

packages/precompiles/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @sei-js/precompiles
 
+## 2.1.3
+
+### Patch Changes
+
+- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`.
+
+  This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively.
+
+  No shipped code or public API changes in this package — this is a repository/CI hardening release.
+
 ## 2.1.2
 
 ### Patch Changes

packages/precompiles/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sei-js/precompiles",
-	"version": "2.1.2",
+	"version": "2.1.3",
 	"description": "TypeScript library for EVM interactions on the Sei blockchain",
 	"main": "./dist/cjs/index.js",
 	"module": "./dist/esm/index.js",
@@ -14,7 +14,13 @@
 		"test": "jest --passWithNoTests"
 	},
 	"homepage": "https://github.com/sei-protocol/sei-js#readme",
-	"keywords": ["sei", "javascript", "typescript", "node", "evm"],
+	"keywords": [
+		"sei",
+		"javascript",
+		"typescript",
+		"node",
+		"evm"
+	],
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/sei-protocol/sei-js.git",

packages/registry/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @sei-js/registry
 
+## 1.0.4
+
+### Patch Changes
+
+- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`.
+
+  This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively.
+
+  No shipped code or public API changes in this package — this is a repository/CI hardening release.
+
 ## 1.0.3
 
 ### Patch Changes

packages/registry/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sei-js/registry",
-	"version": "1.0.3",
+	"version": "1.0.4",
 	"description": "TypeScript library for Sei chain constants and assets",
 	"main": "./dist/cjs/src/index.js",
 	"module": "./dist/esm/src/index.js",

packages/sei-global-wallet/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @sei-js/global-wallet
 
+## 1.4.1
+
+### Patch Changes
+
+- 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`.
+
+  This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively.
+
+  No shipped code or public API changes in this package — this is a repository/CI hardening release.
+
 ## 1.4.0
 
 ### Minor Changes

packages/sei-global-wallet/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@sei-js/sei-global-wallet",
 	"description": "Sei Global Wallet is a library to support Dynamic Global Wallets",
-	"version": "1.4.0",
+	"version": "1.4.1",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/sei-protocol/sei-js.git",