chore(deps): fix audit vulnerabilities

apps/expo-example/package.json

@@ -18,7 +18,7 @@
     "@turnkey/api-key-stamper": "0.6.4",
     "@turnkey/crypto": "2.8.13",
     "@turnkey/react-native-passkey-stamper": "1.2.16",
-    "@wagmi/core": "^2.22.0",
+    "@wagmi/core": "^3.0.0",
     "@zerodev/wallet-core": "workspace:^",
     "@zerodev/wallet-react": "workspace:^",
     "babel-preset-expo": "~56.0.0",
@@ -45,9 +45,9 @@
     "react-native-web": "^0.21.2",
     "react-native-webview": "13.16.1",
     "tslib": "^2.8.1",
-    "uuid": "^13.0.0",
-    "viem": "~2.47.18",
-    "wagmi": "^2.19.0"
+    "uuid": "^13.0.2",
+    "viem": "~2.54.6",
+    "wagmi": "^3.0.0"
   },
   "devDependencies": {
     "@types/react": "~19.2.14",

apps/zerodev-signer-demo/next-env.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
+/// <reference path="./.next/types/routes.d.ts" />
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

apps/zerodev-signer-demo/package.json

@@ -22,12 +22,12 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "lucide-react": "^0.545.0",
-    "next": "15.3.8",
-    "react": "19.2.0",
-    "react-dom": "19.2.0",
+    "next": "15.5.20",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
     "react-hook-form": "^7.68.0",
     "tailwind-merge": "^3.3.1",
-    "viem": "^2.47.18",
+    "viem": "2.54.6",
     "wagmi": "^3.0.0",
     "zustand": "^5.0.3"
   },

apps/zerodev-signer-demo/tsconfig.json

@@ -10,7 +10,7 @@
     "incremental": true,
     "module": "esnext",
     "esModuleInterop": true,
-    "moduleResolution": "node",
+    "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
     "jsx": "preserve",

package.json

@@ -43,18 +43,18 @@
   ],
   "license": "MIT",
   "devDependencies": {
-    "@biomejs/biome": "^2.2.4",
+    "@biomejs/biome": "2.2.4",
     "@playwright/test": "^1.52.0",
     "@changesets/cli": "^2.29.7",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^20.0.0",
     "@vitest/coverage-v8": "^4.0.18",
-    "happy-dom": "^20.6.0",
+    "happy-dom": "^20.10.6",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.3",
     "typescript": "~5.9.0",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.10"
   },
   "packageManager": "pnpm@10.17.1+sha512.17c560fca4867ae9473a3899ad84a88334914f379be46d455cbf92e5cf4b39d34985d452d2583baf19967fa76cb5c17bc9e245529d0b98745721aa7200ecaf7a",
   "lint-staged": {

packages/core/package.json

@@ -163,7 +163,7 @@
     "@types/node": "^20.0.0",
     "expo-secure-store": "55.0.9",
     "typescript": "5.9.3",
-    "uuid": "^13.0.0"
+    "uuid": "^13.0.2"
   },
   "type": "module"
 }

packages/react-ui/package.json

@@ -68,13 +68,13 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@vitejs/plugin-react": "^4.7.0",
-    "postcss": "^8.5.10",
-    "react": "19.2.0",
-    "react-dom": "19.2.0",
+    "postcss": "^8.5.16",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
     "storybook": "^10.3.3",
     "tailwindcss": "^4.2.2",
     "typescript": "5.9.3",
-    "vite": "^6.4.1",
+    "vite": "^6.4.3",
     "vite-plugin-svgr": "5.0.0"
   },
   "dependencies": {

packages/react/package.json

@@ -132,7 +132,7 @@
     "react-native": "0.83.4",
     "react-native-webview": "13.16.0",
     "typescript": "5.9.3",
-    "uuid": "^13.0.0"
+    "uuid": "^13.0.2"
   },
   "type": "module"
 }

packages/wallet-react-ui/package.json

@@ -81,14 +81,15 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@vitejs/plugin-react": "^4.7.0",
-    "postcss": "^8.5.8",
-    "react": "19.2.0",
-    "react-dom": "19.2.0",
+    "postcss": "^8.5.16",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
     "storybook": "^10.3.3",
     "tailwindcss": "^4.2.2",
     "typescript": "5.9.3",
-    "vite": "^6.4.1",
-    "vite-plugin-node-polyfills": "^0.25.0"
+    "vite": "^6.4.3",
+    "vite-plugin-node-polyfills": "^0.25.0",
+    "vocs": "^1.4.1"
   },
   "type": "module"
 }

pnpm-workspace.yaml

@@ -9,3 +9,29 @@ minimumReleaseAge: 1440
 # Exclude trusted packages from age restriction
 minimumReleaseAgeExclude:
   - '@zerodev/*'
+
+# Acknowledged audit findings we cannot fix by bumping (verified 2026-07-08).
+# All are pinned by upstream packages or have no patched release. Re-check when
+# the named upstream moves; remove the entry once the finding no longer applies.
+auditConfig:
+  ignoreGhsas:
+    # ws 8.18.0 memory-exhaustion DoS (high). Reached only via wagmi 2.x ->
+    # @wagmi/connectors@6.2.0 -> @walletconnect/ethereum-provider@2.21.1 (exact pin)
+    # -> @walletconnect/utils@2.21.1, which hard-pins viem@2.23.2 -> isows -> ws.
+    # wagmi 2.x is EOL; @walletconnect/utils >=2.23 drops viem entirely.
+    # Real fix: migrate apps to wagmi 3 — remove this entry then.
+    - GHSA-96hv-2xvq-fx4p
+    # ws 8.18.0 uninitialized-memory disclosure (moderate). Same pinned chain as above.
+    - GHSA-58qx-3vcg-4xpx
+    # uuid v3/v5/v6 buffer bounds check (moderate), patched only in >=11.1.1.
+    # Old majors pinned by xcode@3 (uuid ^7, via expo config tooling) and
+    # @metamask/utils (uuid ^9) — even their latest releases still pin them.
+    # Not exploitable here: requires the caller to pass `buf`, these parents don't.
+    - GHSA-w5hq-g745-h8pq
+    # postcss <8.5.10 XSS via unescaped </style> (moderate). next hard-pins
+    # postcss@8.4.31 in every 15.5.x release; build-time only, processes our own CSS.
+    - GHSA-qx2v-qp2m-jg93
+    # elliptic risky crypto primitive (low). No patched release exists (advisory has
+    # no fix version). Dev-only path: wallet-react-ui docs/build via
+    # vite-plugin-node-polyfills -> crypto-browserify.
+    - GHSA-848j-6mx2-7j84