Bump the npm-minor-patch group across 1 directory with 3 updates by dependabot[bot] · Pull Request #3 · concrnt/node-client

dependabot · 2026-10-30T05:27:49Z

Bumps the npm-minor-patch group with 3 updates in the / directory: @cosmjs/amino, @cosmjs/crypto and @cosmjs/encoding.

Updates @cosmjs/amino from 0.33.1 to 0.39.0

Release notes

Sourced from @cosmjs/amino's releases.

0.39.0

Changed

all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04 and the crypto stack (@noble/*, @scure/bip39 v2) relies on APIs that only ship in Node 22+. If you are still on an older Node, upgrade before taking this release.

@cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves, @noble/hashes and @scure/bip39 to v2. These upgrades are otherwise transparent to users of the high-level @cosmjs/crypto API, but direct consumers of the underlying libraries should consult their respective migration notes. (#1935)

@cosmjs/crypto: Use pure-JS implementation of Argon2id from @noble/hashes instead of the WASM-based hash-wasm implementation. This removes the hash-wasm runtime dependency and makes Argon2id.execute fully synchronous-capable without requiring a WASM instantiation. (#1938)

@cosmjs/amino, @cosmjs/proto-signing: Remove scream test around argon2 call in wallet serialization/deserialization which is not needed anymore after #1938.

all: Bring back the classic main/types fields in package.json alongside the exports field so tools like bundlephobia that do not understand exports can still resolve the package entry points. (#1944)

@cosmjs/stargate: Change Account.accountNumber from number to bigint. Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when represented as a JavaScript number. Using bigint preserves the full 64-bit range. Breaking change for anyone reading accountNumber off Account (e.g. from StargateClient.getAccount()): you will typically need to either coerce back with Number(account.accountNumber) where you know the value is safe, or keep using bigint end-to-end. (#1956)

@cosmjs/amino: makeSignDoc now accepts number | string | bigint for accountNumber (previously number | string) and encodes the value via Uint64 instead of Uint53 so large account numbers no longer overflow when building a sign doc. (#1956)

@cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions because it will likely be removed when wallet serialization/deserialization is removed.

@cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)

@cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes. (#1959)

#1935: cosmos/cosmjs#1935 #1938: cosmos/cosmjs#1938 #1944: cosmos/cosmjs#1944 #1956: cosmos/cosmjs#1956 #1959: cosmos/cosmjs#1959

... (truncated)

Changelog

Sourced from @cosmjs/amino's changelog.

[0.39.0] - 2026-05-04

Changed

all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04 and the crypto stack (@noble/*, @scure/bip39 v2) relies on APIs that only ship in Node 22+. If you are still on an older Node, upgrade before taking this release.

@cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves, @noble/hashes and @scure/bip39 to v2. These upgrades are otherwise transparent to users of the high-level @cosmjs/crypto API, but direct consumers of the underlying libraries should consult their respective migration notes. (#1935)

@cosmjs/crypto: Use pure-JS implementation of Argon2id from @noble/hashes instead of the WASM-based hash-wasm implementation. This removes the hash-wasm runtime dependency and makes Argon2id.execute fully synchronous-capable without requiring a WASM instantiation. (#1938)

@cosmjs/amino, @cosmjs/proto-signing: Remove scream test around argon2 call in wallet serialization/deserialization which is not needed anymore after #1938.

all: Bring back the classic main/types fields in package.json alongside the exports field so tools like bundlephobia that do not understand exports can still resolve the package entry points. (#1944)

@cosmjs/stargate: Change Account.accountNumber from number to bigint. Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when represented as a JavaScript number. Using bigint preserves the full 64-bit range. Breaking change for anyone reading accountNumber off Account (e.g. from StargateClient.getAccount()): you will typically need to either coerce back with Number(account.accountNumber) where you know the value is safe, or keep using bigint end-to-end. (#1956)

@cosmjs/amino: makeSignDoc now accepts number | string | bigint for accountNumber (previously number | string) and encodes the value via Uint64 instead of Uint53 so large account numbers no longer overflow when building a sign doc. (#1956)

@cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions because it will likely be removed when wallet serialization/deserialization is removed.

@cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)

@cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes. (#1959)

#1935: cosmos/cosmjs#1935 #1938: cosmos/cosmjs#1938 #1944: cosmos/cosmjs#1944 #1956: cosmos/cosmjs#1956 #1959: cosmos/cosmjs#1959

... (truncated)

Commits

ec55c66 Set version: 0.39.0
e39b5ff Convert account Number to bigint (#1956)
45156aa Merge pull request #1960 from codingki/rename-evmd-to-evmd051
6536a4b Mirror evmd051Enabled pattern for slow variant
20a429b Rename evmd scripts to versioned name (evmd051)
0fedbb2 Merge pull request #1959 from codingki/chore/security-audit-fixes
6cfedd5 chore(deps): Fix security vulnerabilities reported by yarn audit
2338a7e Merge pull request #1958 from cosmos/fix/yarn-node25-ebadf
c21c737 [autofix.ci] apply automated fixes
e664c60 fix(ci): Drop accidental .yarnrc.yml security relaxations
Additional commits viewable in compare view

Updates @cosmjs/crypto from 0.33.1 to 0.39.0

Release notes

Sourced from @cosmjs/crypto's releases.

0.39.0

Changed

all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04 and the crypto stack (@noble/*, @scure/bip39 v2) relies on APIs that only ship in Node 22+. If you are still on an older Node, upgrade before taking this release.

@cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves, @noble/hashes and @scure/bip39 to v2. These upgrades are otherwise transparent to users of the high-level @cosmjs/crypto API, but direct consumers of the underlying libraries should consult their respective migration notes. (#1935)

@cosmjs/crypto: Use pure-JS implementation of Argon2id from @noble/hashes instead of the WASM-based hash-wasm implementation. This removes the hash-wasm runtime dependency and makes Argon2id.execute fully synchronous-capable without requiring a WASM instantiation. (#1938)

@cosmjs/amino, @cosmjs/proto-signing: Remove scream test around argon2 call in wallet serialization/deserialization which is not needed anymore after #1938.

all: Bring back the classic main/types fields in package.json alongside the exports field so tools like bundlephobia that do not understand exports can still resolve the package entry points. (#1944)

@cosmjs/stargate: Change Account.accountNumber from number to bigint. Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when represented as a JavaScript number. Using bigint preserves the full 64-bit range. Breaking change for anyone reading accountNumber off Account (e.g. from StargateClient.getAccount()): you will typically need to either coerce back with Number(account.accountNumber) where you know the value is safe, or keep using bigint end-to-end. (#1956)

@cosmjs/amino: makeSignDoc now accepts number | string | bigint for accountNumber (previously number | string) and encodes the value via Uint64 instead of Uint53 so large account numbers no longer overflow when building a sign doc. (#1956)

@cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions because it will likely be removed when wallet serialization/deserialization is removed.

@cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)

@cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes. (#1959)

#1935: cosmos/cosmjs#1935 #1938: cosmos/cosmjs#1938 #1944: cosmos/cosmjs#1944 #1956: cosmos/cosmjs#1956 #1959: cosmos/cosmjs#1959

... (truncated)

Changelog

Sourced from @cosmjs/crypto's changelog.

[0.39.0] - 2026-05-04

Changed

all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04 and the crypto stack (@noble/*, @scure/bip39 v2) relies on APIs that only ship in Node 22+. If you are still on an older Node, upgrade before taking this release.

@cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves, @noble/hashes and @scure/bip39 to v2. These upgrades are otherwise transparent to users of the high-level @cosmjs/crypto API, but direct consumers of the underlying libraries should consult their respective migration notes. (#1935)

@cosmjs/crypto: Use pure-JS implementation of Argon2id from @noble/hashes instead of the WASM-based hash-wasm implementation. This removes the hash-wasm runtime dependency and makes Argon2id.execute fully synchronous-capable without requiring a WASM instantiation. (#1938)

@cosmjs/amino, @cosmjs/proto-signing: Remove scream test around argon2 call in wallet serialization/deserialization which is not needed anymore after #1938.

all: Bring back the classic main/types fields in package.json alongside the exports field so tools like bundlephobia that do not understand exports can still resolve the package entry points. (#1944)

@cosmjs/stargate: Change Account.accountNumber from number to bigint. Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when represented as a JavaScript number. Using bigint preserves the full 64-bit range. Breaking change for anyone reading accountNumber off Account (e.g. from StargateClient.getAccount()): you will typically need to either coerce back with Number(account.accountNumber) where you know the value is safe, or keep using bigint end-to-end. (#1956)

@cosmjs/amino: makeSignDoc now accepts number | string | bigint for accountNumber (previously number | string) and encodes the value via Uint64 instead of Uint53 so large account numbers no longer overflow when building a sign doc. (#1956)

@cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions because it will likely be removed when wallet serialization/deserialization is removed.

@cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)

@cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes. (#1959)

#1935: cosmos/cosmjs#1935 #1938: cosmos/cosmjs#1938 #1944: cosmos/cosmjs#1944 #1956: cosmos/cosmjs#1956 #1959: cosmos/cosmjs#1959

... (truncated)

Commits

ec55c66 Set version: 0.39.0
e39b5ff Convert account Number to bigint (#1956)
45156aa Merge pull request #1960 from codingki/rename-evmd-to-evmd051
6536a4b Mirror evmd051Enabled pattern for slow variant
20a429b Rename evmd scripts to versioned name (evmd051)
0fedbb2 Merge pull request #1959 from codingki/chore/security-audit-fixes
6cfedd5 chore(deps): Fix security vulnerabilities reported by yarn audit
2338a7e Merge pull request #1958 from cosmos/fix/yarn-node25-ebadf
c21c737 [autofix.ci] apply automated fixes
e664c60 fix(ci): Drop accidental .yarnrc.yml security relaxations
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by kiki-skip, a new releaser for @cosmjs/crypto since your current version.

Updates @cosmjs/encoding from 0.33.1 to 0.39.0

Release notes

Sourced from @cosmjs/encoding's releases.

0.39.0

Changed

all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04 and the crypto stack (@noble/*, @scure/bip39 v2) relies on APIs that only ship in Node 22+. If you are still on an older Node, upgrade before taking this release.

@cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves, @noble/hashes and @scure/bip39 to v2. These upgrades are otherwise transparent to users of the high-level @cosmjs/crypto API, but direct consumers of the underlying libraries should consult their respective migration notes. (#1935)

@cosmjs/crypto: Use pure-JS implementation of Argon2id from @noble/hashes instead of the WASM-based hash-wasm implementation. This removes the hash-wasm runtime dependency and makes Argon2id.execute fully synchronous-capable without requiring a WASM instantiation. (#1938)

@cosmjs/amino, @cosmjs/proto-signing: Remove scream test around argon2 call in wallet serialization/deserialization which is not needed anymore after #1938.

all: Bring back the classic main/types fields in package.json alongside the exports field so tools like bundlephobia that do not understand exports can still resolve the package entry points. (#1944)

@cosmjs/stargate: Change Account.accountNumber from number to bigint. Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when represented as a JavaScript number. Using bigint preserves the full 64-bit range. Breaking change for anyone reading accountNumber off Account (e.g. from StargateClient.getAccount()): you will typically need to either coerce back with Number(account.accountNumber) where you know the value is safe, or keep using bigint end-to-end. (#1956)

@cosmjs/amino: makeSignDoc now accepts number | string | bigint for accountNumber (previously number | string) and encodes the value via Uint64 instead of Uint53 so large account numbers no longer overflow when building a sign doc. (#1956)

@cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions because it will likely be removed when wallet serialization/deserialization is removed.

@cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)

@cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes. (#1959)

#1935: cosmos/cosmjs#1935 #1938: cosmos/cosmjs#1938 #1944: cosmos/cosmjs#1944 #1956: cosmos/cosmjs#1956 #1959: cosmos/cosmjs#1959

... (truncated)

Changelog

Sourced from @cosmjs/encoding's changelog.

[0.39.0] - 2026-05-04

Changed

all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04 and the crypto stack (@noble/*, @scure/bip39 v2) relies on APIs that only ship in Node 22+. If you are still on an older Node, upgrade before taking this release.

@cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves, @noble/hashes and @scure/bip39 to v2. These upgrades are otherwise transparent to users of the high-level @cosmjs/crypto API, but direct consumers of the underlying libraries should consult their respective migration notes. (#1935)

@cosmjs/crypto: Use pure-JS implementation of Argon2id from @noble/hashes instead of the WASM-based hash-wasm implementation. This removes the hash-wasm runtime dependency and makes Argon2id.execute fully synchronous-capable without requiring a WASM instantiation. (#1938)

@cosmjs/amino, @cosmjs/proto-signing: Remove scream test around argon2 call in wallet serialization/deserialization which is not needed anymore after #1938.

all: Bring back the classic main/types fields in package.json alongside the exports field so tools like bundlephobia that do not understand exports can still resolve the package entry points. (#1944)

@cosmjs/stargate: Change Account.accountNumber from number to bigint. Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when represented as a JavaScript number. Using bigint preserves the full 64-bit range. Breaking change for anyone reading accountNumber off Account (e.g. from StargateClient.getAccount()): you will typically need to either coerce back with Number(account.accountNumber) where you know the value is safe, or keep using bigint end-to-end. (#1956)

@cosmjs/amino: makeSignDoc now accepts number | string | bigint for accountNumber (previously number | string) and encodes the value via Uint64 instead of Uint53 so large account numbers no longer overflow when building a sign doc. (#1956)

@cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions because it will likely be removed when wallet serialization/deserialization is removed.

@cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)

@cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes. (#1959)

#1935: cosmos/cosmjs#1935 #1938: cosmos/cosmjs#1938 #1944: cosmos/cosmjs#1944 #1956: cosmos/cosmjs#1956 #1959: cosmos/cosmjs#1959

... (truncated)

Commits

ec55c66 Set version: 0.39.0
e39b5ff Convert account Number to bigint (#1956)
45156aa Merge pull request #1960 from codingki/rename-evmd-to-evmd051
6536a4b Mirror evmd051Enabled pattern for slow variant
20a429b Rename evmd scripts to versioned name (evmd051)
0fedbb2 Merge pull request #1959 from codingki/chore/security-audit-fixes
6cfedd5 chore(deps): Fix security vulnerabilities reported by yarn audit
2338a7e Merge pull request #1958 from cosmos/fix/yarn-node25-ebadf
c21c737 [autofix.ci] apply automated fixes
e664c60 fix(ci): Drop accidental .yarnrc.yml security relaxations
Additional commits viewable in compare view

Bumps the npm-minor-patch group with 3 updates in the / directory: [@cosmjs/amino](https://github.com/cosmos/cosmjs), [@cosmjs/crypto](https://github.com/cosmos/cosmjs) and [@cosmjs/encoding](https://github.com/cosmos/cosmjs). Updates `@cosmjs/amino` from 0.33.1 to 0.39.0 - [Release notes](https://github.com/cosmos/cosmjs/releases) - [Changelog](https://github.com/cosmos/cosmjs/blob/main/CHANGELOG.md) - [Commits](cosmos/cosmjs@v0.33.1...v0.39.0) Updates `@cosmjs/crypto` from 0.33.1 to 0.39.0 - [Release notes](https://github.com/cosmos/cosmjs/releases) - [Changelog](https://github.com/cosmos/cosmjs/blob/main/CHANGELOG.md) - [Commits](cosmos/cosmjs@v0.33.1...v0.39.0) Updates `@cosmjs/encoding` from 0.33.1 to 0.39.0 - [Release notes](https://github.com/cosmos/cosmjs/releases) - [Changelog](https://github.com/cosmos/cosmjs/blob/main/CHANGELOG.md) - [Commits](cosmos/cosmjs@v0.33.1...v0.39.0) --- updated-dependencies: - dependency-name: "@cosmjs/amino" dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@cosmjs/crypto" dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@cosmjs/encoding" dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 30, 2026

github-actions Bot enabled auto-merge (squash) October 30, 2026 05:28

dependabot Bot changed the title ~~Bump the npm-minor-patch group with 3 updates~~ Bump the npm-minor-patch group across 1 directory with 3 updates Oct 30, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-patch-6180ac6f25 branch from 5dbf484 to d77001f Compare October 30, 2026 05:48

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-patch-6180ac6f25 branch from d77001f to 1998f5a Compare October 30, 2026 05:53

Update package-lock.json for @cosmjs 0.39

f32b332

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions Bot merged commit c4f80a8 into main Oct 30, 2026
4 checks passed

Navigation Menu

Repository navigation

Bump the npm-minor-patch group across 1 directory with 3 updates - #3

Bump the npm-minor-patch group across 1 directory with 3 updates#3
github-actions[bot] merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-6180ac6f25

dependabot Bot commented on behalf of github Oct 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.39.0

Changed

[0.39.0] - 2026-05-04

Changed

0.39.0

Changed

[0.39.0] - 2026-05-04

Changed

0.39.0

Changed

[0.39.0] - 2026-05-04

Changed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 30, 2026 •

edited

Loading