feat(awm): bump SDK betas and adapt to async encrypt/decrypt#258
Merged
Conversation
zahin-mohammad
force-pushed
the
feat/sdk-bump-async-crypto
branch
from
July 23, 2026 15:53
fa10a45 to
5a57a9b
Compare
Bumps all @bitgo-beta/* dependencies to their latest betas via bump-version.ts, pulling in new coin support through @bitgo-beta/statics. The new sdk-core makes BitGo.encrypt/decrypt async (string -> Promise<string>). Adds await to all six call sites in the MPC wallet generation handlers and switches the decrypt test stubs from .returns() to .resolves(). One site (eddsa initialize) was not caught by tsc due to a loose return type but returned an unresolved Promise as encryptedData. Ticket: WCN-1593 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Trivy flagged 10 findings (1 CRITICAL, 9 HIGH) on the pre-bump lockfile. The SDK bump's lockfile regeneration already resolves all of them to fixed versions within existing semver ranges, so these overrides do not change the current tree; they pin a floor so the per-release lockfile regen cannot silently regress below the fix. - axios: ^1.13.5 -> ^1.18.0 (GHSA-gcfj-64vw-6mp9) - tar: ^7.5.11 -> ^7.5.19 (CVE-2026-59873 CRITICAL, CVE-2026-59874) - fast-uri: ^3.1.4 (CVE-2026-13676, CVE-2026-16221) - shell-quote: ^1.9.0 (CVE-2026-13311) - brace-expansion: ^1.1.16 / ^2.1.2 / ^5.0.7 (CVE-2026-13149) - js-yaml: ^3.15.0 / ^4.3.0 (CVE-2026-59869) Ticket: WCN-1593 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
zahin-mohammad
force-pushed
the
feat/sdk-bump-async-crypto
branch
from
July 23, 2026 16:14
5a57a9b to
3219108
Compare
zahin-mohammad
enabled auto-merge
July 23, 2026 16:16
pranishnepal
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@bitgo-beta/*deps to latest betas viabump-version.ts— pulls in new coin support through@bitgo-beta/statics. This bump is the release content (no other commits sincev3.4.0).BitGo.encrypt/decryptare now async (string→Promise<string>). Addedawaitto all 6 call sites in the MPC wallet-generation handlers; switched decrypt test stubs.returns()→.resolves(). One site (eddsaMPCWalletGenerationInitialize.ts:104) was not flagged by tsc (loose return type) but was returning an unresolved Promise asencryptedData.bump-version.tsnow syncs the npmoverridesblock. Pins moved from yarnresolutionsto npmoverridesduring the yarn→npm migration, but the script only updatedresolutions, sosdk-core/staticsoverrides drifted and brokenpm installwithEOVERRIDE.node_modules/.../duplicates the lockstep betas collapse), not lost dependencies. Reproduced under the repo's Node 22.1.0.Test plan
npm ci(Node 22.1.0)npm run build— cleannpm run lint— cleannpm test— 400 passingv3.5.0)🤖 Generated with Claude Code