[github-actions]

Publishes the reviewed SDK 3.2.1 and Toolbox 2.14.8 dependency floors into seven infrastructure manifests and locks. Exact source validation also found critical Handlebars 4.7.9 in three existing development locks; this PR upgrades those entries to 4.7.10 and reserves new immutable Message Box 1.1.52, WAB 1.8.12 and UHRP Cloud 0.2.54 images. Production dependency entries are unchanged by the Handlebars fix. No API, wire, schema, route or data migration is required.

Program and scope

• Tracker or issue: protected release run 38347379610
• Program gate(s) advanced: published-version reconciliation and reproducible OCI release inputs
• Why this change is needed: synchronize first-party package floors and standalone infrastructure locks after protected npm publication.
• Explicitly out of scope: product behavior beyond consuming the already-reviewed package artifacts.
• Exact head SHA reviewed: 86ed9da

Impact

• No public package source or manifest changed
• Infrastructure source, dependency, image, or deployment configuration changed
• Security-sensitive boundary changed

Affected services and intended patch versions are the changed infra package manifests in this PR.

Verification

• Local commands and results: Node24.18.0/pnpm10.33.2 frozen install; full workspace build; health, lint, formatting, typecheck and high/critical audit PASS. All three affected services pass frozen npm install, explicit audited native rebuilds, audit, build and lint. Complete unit suites: Message Box27/227, WAB23/202 and UHRP cloud20/112; total70 suites/541 tests PASS, no skips.
• Hosted CI:38353316993, CodeQL:38353317019, runtime contracts:38353316995, conformance:38353317007; all terminal successful at86ed9da1465bbdd793ed48253c9ef2eec75341e6. The repository merge gate validates15 scope skips;35 checks pass, all seven Linux runtime contracts pass, and PR CodeQL has0 open alerts.
• Conformance evidence: Not selected because no conformance input changed.
• Coverage delta: No product source changed.
• Lint/typecheck delta: Passed exact-head hosted affected-graph validation.
• Browser/mobile/packed-consumer evidence: The protected release passed package, clean-consumer, browser, and mobile verification before publication.
• Performance or bundle-size delta: No product source or bundle composition changed.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed by the protected release
• No new override, advisory dismissal, quality suppression, or skipped test
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: The protected release already validated the coordinated package release notes and migration guidance.
• Runtime, build, and peer compatibility: The release verified the governed Node, browser, mobile, runtime, and peer-dependency contracts.
• Deduplicated lockfile: Workspace and standalone npm locks were regenerated once from the published first-party versions without lifecycle scripts.
• Audit and CodeQL: The release rejected high and critical package findings; exact-head CodeQL runs on this PR.
• Package and consumer tests: The release passed full builds, typecheck, package artifacts, clean consumers, browser, mobile, registry signatures, provenance, and reconciliation.
• Bundle and performance impact: No bundle composition changed; affected releases retain their documented compatibility contracts.
• Affected public package versions: Derived from the published workspace manifests synchronized by this exact commit.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented by the protected infrastructure release
• Documentation, changelog, migration, and operational guidance are current

Initial coordinated release38347379610 published seven Linux/amd64 images with zero high/critical runtime scan findings and verified signatures/provenance/SBOMs. Source qualification refused the three development locks and WAB runtime hit a pinned-base ECR HTTP429; original failed/cancelled samples are retained. The corrected three components require fresh image tags after green exact-head source qualification and merge. Previously published tags are immutable and remain retained; deployment is a separate operator step.

Completion evidence

• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​bsv/​wallet-toolbox@​2.14.6 ⏵ 2.14.8
	npm/​@​bsv/​sdk@​3.1.0 ⏵ 3.2.1	+1			+1
	npm/​@​bsv/​wallet-toolbox-client@​2.14.6 ⏵ 2.14.8	-2

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Reviewed exact head 86ed9da. The generated first-party floors match the four verified published npm artifacts. The corrective commit changes only three development Handlebars entries, private image patch versions and generated facts; production dependency entries are unchanged. Node24.18.0/pnpm10.33.2 root checks and builds pass; complete affected suites pass70 suites/541 tests with no skips. Exact-head hosted CI, CodeQL, conformance and all seven Linux runtime contracts pass; original audit refusals and ECR429 are preserved. No API, wire, schema, route or data migration. Three fresh immutable image tags still require protected publication; deployment remains separate.