chore(deps): bump the all-dependencies group across 1 directory with 48 updates

[dependabot]

Bumps the all-dependencies group with 46 updates in the / directory:

Package	From	To
@across-protocol/constants	3.1.109	3.1.111
@coral-xyz/anchor	0.31.1	0.32.1
@ethersproject/abi	5.7.0	5.8.0
@ethersproject/abstract-provider	5.7.0	5.8.0
@ethersproject/abstract-signer	5.7.0	5.8.0
@google-cloud/kms	5.4.0	5.5.0
@layerzerolabs/lz-v2-utilities	3.0.147	3.0.168
@maticnetwork/maticjs	3.6.0	3.9.11
@maticnetwork/maticjs-ethers	1.0.3	1.1.0
@nktkas/hyperliquid	0.25.9	0.32.2
@solana-program/address-lookup-table	0.7.0	0.11.0
@solana-program/compute-budget	0.8.0	0.15.0
@solana/kit	5.4.0	6.9.0
binance-api-node	0.12.7	0.13.9
dotenv	16.3.1	17.4.2
ethers	5.7.2	6.16.0
express	4.21.2	5.2.1
superstruct	1.0.3	2.0.2
tronweb	6.2.2	6.3.0
tsx	4.21.0	4.22.3
viem	2.47.10	2.50.4
winston	3.18.3	3.19.0
zksync-ethers	5.11.1	6.21.2
@nomicfoundation/hardhat-chai-matchers	1.0.6	3.0.0
@nomicfoundation/hardhat-verify	2.1.3	3.0.17
@openzeppelin/hardhat-upgrades	1.28.0	3.9.1
@solana-program/system	0.7.0	0.12.0
@solana-program/token	0.5.1	0.13.0
@types/node	24.3.0	25.9.0
@typescript-eslint/eslint-plugin	8.58.1	8.59.4
@typescript-eslint/parser	8.58.1	8.59.4
@typescript/native-preview	7.0.0-dev.20260421.2	7.0.0-dev.20260519.1
chai	4.3.7	6.2.2
chai-exclude	2.1.0	3.0.1
eslint	8.57.1	10.4.0
eslint-config-prettier	9.1.2	10.1.8
eslint-plugin-chai-expect	3.0.0	4.1.0
eslint-plugin-mocha	10.1.0	11.3.0
eslint-plugin-n	16.6.2	18.0.1
hardhat	2.28.3	3.4.5
hardhat-deploy	0.11.34	2.0.8
prettier	3.8.1	3.8.3
prettier-plugin-solidity	1.1.3	2.3.1
sinon	21.1.2	22.0.0
tar	7.5.13	7.5.15
typescript	6.0.2	6.0.3

Updates @across-protocol/constants from 3.1.109 to 3.1.111

Release notes

Sourced from @​across-protocol/constants's releases.

v3.1.111

What's Changed

• feat: Add LSK on Base by @​gsteenkamp89 in across-protocol/constants#202
• bump version by @​gsteenkamp89 in across-protocol/constants#203

Full Changelog: across-protocol/constants@v3.1.110...v3.1.111

v3.1.110

What's Changed

• feat: Add Avalanche by @​dijanin-brat in across-protocol/constants#201

Full Changelog: across-protocol/constants@v3.1.109...v3.1.110

Commits

• 8c98f57 bump version (#203)
• 77b5679 feat: Add LSK on Base (#202)
• 622ed00 feat: Add Avalanche (#201)
• See full diff in compare view

Updates @coral-xyz/anchor from 0.31.1 to 0.32.1

Release notes

Sourced from @​coral-xyz/anchor's releases.

v0.32.1

The 0.32.1 patch release is here. This patch is aimed to fix the anchor deploy race condition found in 0.32.0.

Check out the release notes from Anchor website or GitHub.

For a list of notable changes with their associated PRs, see the CHANGELOG.

v0.32.0

The 0.32.0 major release is here. This release targets a number of optimizations we wanted to make before 1.0 major release.

Check out the release notes from Anchor website or GitHub.

For a list of notable changes with their associated PRs, see the CHANGELOG.

Changelog

Sourced from @​coral-xyz/anchor's changelog.

[0.32.1] - 2025-10-09

Features

Fixes

• lang: Fix deprecation warnings on alloc and add solana-program to prelude (#3975).
• cli: Fix race condition that could happen when deploying a program (#3976).

Breaking

[0.32.0] - 2025-10-08

Features

• lang: Add #[error] attribute to declare_program! (#3757).
• cli: Replace anchor verify to use solana-verify under the hood, adding automatic installation via AVM, local path support, and future-proof argument passing (#3768).
• lang: Replace solana-program crate with smaller crates (#3819).
• cli: Make anchor deploy to upload the IDL to the cluster by default unless --no-idl is passed (#3863).
• lang: Use solana-invoke instead of solana_cpi::invoke (#3900).
• client: remove solana-client from anchor-client and cli (#3877).
• idl: Build IDL on stable Rustc (#3842).
• lang: Add custom error when using init on SystemAccount (#3828).
• ts: Add support for Bun as a package manager (#3586).
• lang: Add support for tuple types in space calculation (#3744).
• lang: Add missing pubkey const generation (#3677).
• cli: Add the Minimum Supported Rust Version (MSRV) to the Rust template, since an arbitrary compiler version isn't supported (#3873).
• lang: Update mollusk test template dependencies to ~0.4 and remove redundant solana-program dev-dependency from generated template (#3790).

Fixes

• docker: Upgrade node to 20.18.0 LTS (#3687).
• cli: Fix using deprecated commitment recent in migration scripts (#3725).
• cli: Fix not respecting provider.cluster in keys sync command (#3761).
• lang: Fix deprecated realloc, store_current_index and clippy warnings (#3819).
• avm: fix AVM instability with solana-verify (#3867).
• avm: update AVM to only use non-draft releases(#3931).
• lang: update bytemuck (#3858).
• idl: disable Locale in camelCase (#3845).
• ts: Remove event parsing panic (#3657).
• avm: Expose anchor on PATH via $CARGO_HOME/bin symlink (#3835).

Breaking

• spl: Update SPL dependencies to latest compatible versions (#3860).
• cli: Replace anchor verify to use solana-verify under the hood, adding automatic installation via AVM, local path support, and future-proof argument passing (#3768).
• cli: Upload IDL by default with an option to skip ((#3863)[https://redirect.github.com/feat: Upload IDL by default with option to skip otter-sec/anchor#3863]).
• lang: remove Solang (#3824).

... (truncated)

Commits

• 1ebbe58 v0.32.1 (#3978)
• 059bc20 fix(cli): Wait for program confirmation before IDL init during deploy (#3976)
• 45beb40 Fix: realloc and prelude (#3975)
• d4502a6 v0.32.0 (#3968)
• b1b20af feat: 2.3.0 update (#3967)
• d5d7eb9 chore: Update security advisory info (#3906)
• 152d431 feat(cli): Add MSRV (#3873)
• 56b21ed chore: update changelog in prep for 0.32 (#3951)
• 5300d7c fix(avm): Only use non-draft releases (#3931)
• 18d0ca0 feat: Use solana-invoke insteam of solana_cpi::invoke (#3900)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by solana-devs, a new releaser for @​coral-xyz/anchor since your current version.

Updates @ethersproject/abi from 5.7.0 to 5.8.0

Release notes

Sourced from @​ethersproject/abi's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Changelog

Sourced from @​ethersproject/abi's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

Commits

• fa5f647 admin: updated dist files
• See full diff in compare view

Updates @ethersproject/abstract-provider from 5.7.0 to 5.8.0

Release notes

Sourced from @​ethersproject/abstract-provider's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Changelog

Sourced from @​ethersproject/abstract-provider's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

Commits

• fa5f647 admin: updated dist files
• See full diff in compare view

Updates @ethersproject/abstract-signer from 5.7.0 to 5.8.0

Release notes

Sourced from @​ethersproject/abstract-signer's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Changelog

Sourced from @​ethersproject/abstract-signer's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

Commits

• fa5f647 admin: updated dist files
• See full diff in compare view

Updates @ethersproject/bignumber from 5.7.0 to 5.8.0

Release notes

Sourced from @​ethersproject/bignumber's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Changelog

Sourced from @​ethersproject/bignumber's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

Commits

• fa5f647 admin: updated dist files
• See full diff in compare view

Updates @google-cloud/kms from 5.4.0 to 5.5.0

Changelog

Sourced from @​google-cloud/kms's changelog.

5.5.0 (2026-05-01)

Features

• [kms] support external-μ in the Digest (#8014) (048f3db)

Bug Fixes

• Change the copyright year for files in the packages folder (#8109) (c1a03fe)
• Do not publish the protos to npm (#8079) (816216b)
• Revert "fix: Do not publish the protos to npm" (#8096) (ac0fbb6)

Commits

• 4572246 chore: release main (#8148)
• 59f445d fix: sync legacy 0.1.0 snippet metadata versions across monorepo (#8144)
• 138f402 docs: [kms] Update the comment for duration value `unrefreshed_duration_until...
• c1a03fe fix: change the copyright year for files in the packages folder (#8109)
• a47507c chore: consolidate prettierignore and prettierrc files: autogen (#8082)
• ac0fbb6 fix: Revert "fix: Do not publish the protos to npm" (#8096)
• 816216b fix: Do not publish the protos to npm (#8079)
• 048f3db feat: [kms] support external-μ in the Digest (#8014)
• f8da6e1 chore: [Many APIs] migrate generator to google-cloud-node (#7987)
• 5d85291 chore: cleanup redundant .gitattributes files (#8007)
• Additional commits viewable in compare view

Updates @layerzerolabs/lz-v2-utilities from 3.0.147 to 3.0.168

Updates @maticnetwork/maticjs from 3.6.0 to 3.9.11

Release notes

Sourced from @​maticnetwork/maticjs's releases.

@​maticnetwork/maticjs@​3.9.11

Patch Changes

• 234f070: Ship README.md and LICENSE in the published npm package.

  Previous releases were missing both: the package directory (packages/maticjs/) had neither file, and npm's auto-include only looks at the package directory, not the workspace root. Consumers running npm view @maticnetwork/maticjs readme saw nothing.

  Adds packages/maticjs/README.md (consumer-facing, with install, docs, source, and support links) and packages/maticjs/LICENSE (copy of the workspace MIT licence). Both auto-include on publish — no files field change needed.

@​maticnetwork/maticjs@​3.9.10

Patch Changes

• e332a8f: Republish 3.9.9 as 3.9.10 with the missing dist/ directory.

  3.9.9's tarball was 3 files / 2.4 KB instead of the usual ~106 files / 4.2 MB — dist/ is gitignored and the canonical release flow doesn't run a build before changeset publish, so the published package contained only package.json, MIGRATION.md, and license.js. Consumers installing 3.9.9 got a package with no compiled code.

  Fixed by adding "prepublishOnly": "pnpm run build" to packages/maticjs/package.json. prepublishOnly is an npm lifecycle hook that runs immediately before npm publish, so the build always runs regardless of which release path (canonical CI, manual local publish, etc.) invokes the publish.

  3.9.9 has been deprecated on npm; install 3.9.10 to actually receive the canonical RLP encoding fix and RootChain.findRootBlockFromChild hardening from matic.js#465.

@​maticnetwork/maticjs@​3.9.9

Patch Changes

• b424dd0: Harden RootChain.findRootBlockFromChild so it cannot return a checkpoint slot that doesn't actually contain the burn block.

  Two related issues, both fixed:

  • The binary search's single-candidate early exit (start.eq(end)) accepted the converged slot without verifying its range contained the child block. When a burn block sat past every existing checkpoint, the search would converge on currentHeaderBlock / 10000 and silently return that slot — producing a proof that embedded an unrelated or non-existent header. On-chain MPT verification then reverted at submission time. The fix verifies headerStart ≤ child ≤ headerEnd for the converged candidate and throws Burn transaction has not been checkpointed as yet otherwise (matching the existing isCheckPointed_ guard message). The throw also covers the case where no checkpoint has ever been submitted (currentHeaderBlock = 0).
  • currentHeaderBlock() and headerBlocks(slot) reads inside findRootBlockFromChild ignored client.config.rootChainDefaultBlock, defaulting to whatever the underlying provider used (effectively latest). getLastChildBlock already honoured the config. The two reads could therefore observe different chain views, opening a race where isCheckPointed_ could pass against an un-finalised checkpoint that was reorged out before the proof was submitted on L1. Both reads now use the same block tag.

  The binary-search algorithm has been extracted into findCheckpointSlot for direct unit testing. It is plugin-agnostic — it consumes any BaseBigNumber and a constructor factory — so it works correctly with whatever BigNumber implementation the active plugin injects (MaticBigNumber for @maticnetwork/maticjs-ethers, bn.js for...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.