Wave 38: complete release readiness

[ty-everett]

Summary

Completes the Wave 38 release-readiness program without publishing packages,
images, tags, or releases.

• refreshes every mature compatible direct dependency while enforcing the
  24-hour release-age floor and classifying every remaining delta
• re-rehearses every dependency override; all 19 remaining selectors still
  prevent a reproduced vulnerable graph or preserve deterministic codegen
• prepares patch release candidates for all 30 public packages and seven
  standalone service manifests
• restores a fail-closed, repository-owned 90% changed-line/branch coverage
  gate
• deeply verifies every packed conditional/wildcard export, declaration,
  source map, bin, side-effect declaration, optional dependency, and peer
  contract in clean consumers
• fixes SDK and Overlay .ts subpath-pattern shadowing additively, preserving
  all existing import forms
• governs exact browser composition and budgets for all 13 browser consumers,
  plus the wallet Metro/Hermes contract
• codifies the public-service browser edge contract: wildcard/no-credentials
  and opaque-origin access by default, with exact allowlist, credentials, and
  disabled modes remaining opt-in; CSP configuration stays independent
• remediates the two safely addressable Sonar QA smells; the remaining
  compatibility/consensus findings stay in owned, dated exceptions
• removes unsupported CPU, memory, and cache-hit instrumentation; retains only
  Actions-supported timing evidence and reduces repeated work through the
  existing shared build, affected-package selection, pnpm cache, immutable
  MongoDB binary cache, and removal of redundant esbuild rebuilds
• updates generated package, migration, dependency, release, CI, edge-policy,
  and repository-health documentation

Closes no release action and performs no publication. Tracker: #324.

Compatibility and security

• Public API, wire, storage, error, default, and service browser-access
  behavior is preserved
• Exact package consumers pass for every public package
• No new dependency override, suppression, advisory dismissal, or skipped
  test is introduced
• Current exceptions have owners, evidence, review dates, and removal
  conditions
• Local pnpm and all eight standalone npm audit graphs report zero known
  vulnerabilities
• Socket's sole warning was reviewed: the official webpack@5.109.2
  registry artifact is lock-integrity pinned; the heuristic flags bundled
  webpack code, while Socket's PR gate, dependency review, audit, and
  CodeQL all pass
• CodeQL and exact-head zero-new-Sonar-finding checks remain blocking in CI

Dependency evidence

• Release notes and necessity: Reviewed the mature compatible update set and applied @rspack/cli and @rspack/core 2.1.7, @types/node 26.1.2 for workspace packages, better-sqlite3 13.0.2, oxlint 1.76.0, tsx 4.23.1, webpack 5.109.2, and webpack-cli 7.2.2; registry timestamps enforce the 24-hour floor and every remaining delta is a first-party, release-age, coordinated-major, toolchain-bridge, supported-peer, or forward-vendor hold.
• Runtime, build, and peer compatibility: Node 22 public-package and Node 24 infrastructure floors are unchanged; TypeScript 7 native/TypeScript 6 API bridge, React/qrcode/Express peer ranges, Hermes forward build, Babel 8 mobile hold, Chalk 6 migration hold, and isolated codegen compiler are explicitly governed; build, typecheck, exact package, browser, mobile, and infrastructure matrices pass.
• Deduplicated lockfile: Regenerated the pnpm lock and all changed standalone npm locks from their manifests; the direct inventory contains 631 current declarations, 114 first-party release holds, 18 release-age holds, 13 coordinated-major holds, 43 toolchain bridges, three supported-peer ranges, one forward vendor build, and zero unexplained or mature compatible updates.
• Audit and CodeQL: pnpm audit --audit-level=high and all eight standalone npm audit --audit-level=high checks report zero vulnerabilities; advanced CodeQL with security-extended queries and the exact-head zero-new-findings gates remain required CI checks.
• Package and consumer tests: Full workspace tests, 6,650 conformance vectors, all 30 deep pack:check contracts, 13 exact browser consumers, wallet Metro/Hermes, compiled documentation examples against 21 exact tarballs, 30 canonical license tarballs, and all standalone infrastructure install/build/lint/test paths pass locally.
• Bundle and performance impact: Every browser target remains within its committed raw/gzip/brotli budget and now emits normalized chunk/module/package composition evidence; no public entry was removed or split; CI removes redundant worker rebuilds, keeps the shared audited build and all checks, and caches only the immutable MongoDB test binary.
• Affected public package versions: @bsv/amountinator 2.1.4; @bsv/wallet-helper 0.1.6; create-bsv-app 1.0.4; @bsv/did 0.2.4; @bsv/did-client 1.2.3; @bsv/fund-wallet 1.4.3; @bsv/simple 0.4.8; @bsv/templates 1.9.5; @bsv/authsocket 2.1.4; @bsv/authsocket-client 2.1.3; @bsv/message-box-client 2.2.6; @bsv/paymail 2.4.5; @bsv/402-pay 0.2.4; @bsv/auth 0.1.3; @bsv/auth-express-middleware 2.1.5; @bsv/payment-express-middleware 2.1.4; @bsv/teranode-listener 1.1.4; @bsv/gasp 1.3.5; @bsv/overlay 2.2.7; @bsv/overlay-discovery-services 2.1.6; @bsv/overlay-express 2.4.9; @bsv/overlay-topics 1.6.8; @bsv/sdk 2.2.14; @bsv/verifast 0.3.4; @bsv/btms 1.1.4; @bsv/btms-permission-module 1.1.3; @bsv/wallet-relay 0.3.3; @bsv/wallet-toolbox 2.4.19; @bsv/wallet-toolbox-client 2.4.19; @bsv/wallet-toolbox-mobile 2.4.19.

Completion evidence

• Frozen install, formatting, zero-warning lint, build, typecheck, health,
  documentation, version consistency, license, and security gates pass
• Full workspace and standalone infrastructure test suites pass
• No unsupported CI CPU/memory/cache-hit instrumentation remains
• No package, image, tag, release, or deployment was published
• GitHub Actions, CodeQL, and exact-head Sonar checks pass
• Exact-head maintainer review is recorded
• Tracker [RETIRED] TypeScript stack health, security, standardization, testing, docs, and performance #324 is updated after merge

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​rspack/​core@​2.1.7
	npm/​@​types/​node@​26.1.2
	npm/​@​rspack/​cli@​2.1.7
	npm/​better-sqlite3@​13.0.1 ⏵ 13.0.2	+1			+2
	npm/​webpack-cli@​7.2.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/ts-loader@9.6.2 → npm/webpack@5.109.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Exact-head maintainer review completed for 33656c3. I verified the dependency dispositions and 24-hour maturity floor, all 19 override-removal rehearsals, additive package-export fixes, public API/wire/storage/error/default and CORS/CSP compatibility, the restored fail-closed 90% repository patch-coverage gate, browser/mobile artifact contracts, and removal of unsupported Actions resource/cache instrumentation. Hosted evidence is clean: 58 checks passed, one scope-appropriate non-coverage job skipped, zero failures; CodeQL passed; the repository-owned Sonar gate and Sonar API report zero new issues and zero hotspots; Codecov reports all modified coverable lines covered. There are no unresolved review threads. Socket’s sole warning is its known obfuscated-code heuristic on the official webpack@5.109.2 bundle; the registry artifact is integrity-pinned and Socket’s PR gate, dependency review, audit, and CodeQL all pass. No package, image, tag, release, or deployment is authorized by this merge. GitHub does not permit an author to approve their own PR, so this COMMENT review records the exact-head review and the admin merge will explicitly bypass only the independent-approval requirement.