fix(deps): update npm dependencies by ci-protocols-renovate[bot] · Pull Request #1112 · Consensys-Incorporated/ocap-kernel

ci-protocols-renovate · 2026-09-18T01:18:11Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@agoric/internal	`0.4.0-u21.0.1` → `0.4.0`
@agoric/store	`0.9.3-u21.0.1` → `0.10.0`
@agoric/swingset-liveslots	`0.10.3-u21.0.1` → `0.11.0`
@endo/bundle-source (source)	`^4.1.2` → `^4.3.2`
@endo/captp (source)	`^4.4.8` → `^4.5.1`
@endo/errors (source)	`^1.2.13` → `^1.3.1`
@endo/eventual-send (source)	`^1.3.4` → `^1.5.0`
@endo/exo (source)	`^1.5.12` → `^1.7.0`
@endo/lockdown (source)	`^1.0.18` → `^1.0.19`
@endo/marshal (source)	`^1.8.0` → `^1.10.0`
@endo/pass-style (source)	`^1.6.3` → `^1.8.2`
@endo/patterns (source)	`^1.7.0` → `^1.9.1`
@endo/promise-kit (source)	`^1.1.13` → `^1.2.1`
@endo/stream (source)	`^1.2.13` → `^1.3.1`
@metamask/auto-changelog	`^5.3.0` → `^5.3.2`
@metamask/create-release-branch	`^4.1.4` → `^4.2.2`
@metamask/design-system-react (source)	`^0.10.0` → `^0.43.0`
@metamask/design-system-tailwind-preset (source)	`^0.6.1` → `^0.13.0`
@metamask/design-tokens (source)	`^8.1.1` → `^8.7.0`
@metamask/eslint-config	`^15.0.0` → `^15.0.1`
@metamask/eslint-config-nodejs	`^15.0.0` → `^15.0.1`
@metamask/eslint-config-typescript	`^15.0.0` → `^15.0.1`
@metamask/eslint-config-vitest	`^15.0.0` → `^15.0.1`
@metamask/json-rpc-engine (source)	`^10.2.0` → `^10.5.0`
@metamask/snaps-execution-environments (source)	`^11.1.0` → `^11.3.0`
@metamask/snaps-utils (source)	`^12.1.0` → `^12.6.0`
@metamask/superstruct	`^3.2.1` → `^3.4.1`
@metamask/utils	`^11.9.0` → `^11.12.1`
ses (source)	`^1.14.0` → `^1.15.0`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

Agoric/agoric-sdk (@agoric/store)

`v0.10.0`

Compare Source

0.0.24 (2019-09-26)

0.0.23 (2019-09-26)

endojs/endo (@endo/bundle-source)

`v4.3.2`

Compare Source

Patch Changes

#3186 d5e2498 Thanks @boneskull! - Fixes poorly-defined support for asynchronous parsers.
Updated dependencies [d5e2498, fe6be07, c4337e5]:
- @endo/compartment-mapper@2.3.0
- @endo/evasive-transform@2.3.0

`v4.3.1`

Compare Source

Patch Changes

#3261 7309d69 Thanks @turadg! - Replace ts-blank-space with Amaro for TypeScript type erasure, matching the parser Node.js uses for type stripping.
#3216 7325bbe Thanks @kriskowal! - @endo/base64's named exports (encodeBase64, decodeBase64, atob, btoa)
are now frozen.
Consumers that previously assigned to or extended these exports will see a
TypeError under SES; read-only consumers are unaffected.

The shim entry point @endo/base64/shim.js (which @endo/init/pre.js uses to
install globalThis.atob / globalThis.btoa before lockdown()) is unchanged
and continues to be safe to load pre-lockdown.
#3237 b845f85 Thanks @kriskowal! - Update BundleOptions and the powers parameter types to reflect what
bundleSource already accepts at runtime: cacheSourceMaps is now
documented on BundleOptions, commonDependencies and importHook
(only for the endoZipBase64 format) are surfaced, and the optional
powers parameter accepts the wider BundlePowers shape (including
pathResolve, userInfo, env, platform, and computeSha512).
This is a JSDoc/typings-only change; no runtime behavior changes.
Updated dependencies [7325bbe, 7325bbe, 69ca27c, 5c098c4, 67ed1ce, 75253ad]:
- @endo/base64@1.1.0
- @endo/compartment-mapper@2.2.0
- @endo/evasive-transform@2.2.0

`v4.3.0`

Compare Source

Minor Changes

#3180 7f7ae8e Thanks @turadg! - BundleCache.load() is now generic on the format option:
- Omitted (default) → Promise<BundleSourceResult<'endoZipBase64'>>
- Literal format → Promise<BundleSourceResult<format>>
- Runtime-typed ModuleFormat → Promise<BundleSourceResult<ModuleFormat>>
Previously load() returned Promise<unknown>, requiring callers to assert the bundle shape.

Patch Changes

Updated dependencies [154102b, 2b674ca, d1d9625, b4820dc, acbacba, cdb6eae, 6ada52b, 6ad084a, 1cd1246]:
- @endo/compartment-mapper@2.1.0
- @endo/promise-kit@1.2.1
- @endo/harden@1.1.0

`v4.2.0`

Compare Source

Minor Changes

#3008 d83b1ab Thanks @kriskowal! - - Relaxes dependence on a global, post-lockdown harden function by taking a
dependency on the new @endo/harden package.
Consequently, bundles will now entrain a harden implementation that is
superfluous if the bundled program is guaranteed to run in a post-lockdown
HardenedJS environment.
To compensate, use bundle-source with -C hardened or the analogous feature
for packaging conditions with your preferred bundler tool.
This will hollow out @endo/harden and defer exclusively to the global
harden.

Patch Changes

#3083 644ab15 Thanks @turadg! - Fix bundle cache corner cases, improve cache-root validation, and clarify CLI docs for endoScript bundle format.
Updated dependencies [2e00276, 029dcc4, d83b1ab, b8b52ce, a2c32ec, 81b4c40]:
- @endo/compartment-mapper@2.0.0
- @endo/harden@1.1.0
- @endo/promise-kit@1.2.0
- @endo/init@1.1.13
- @endo/evasive-transform@2.1.0

endojs/endo (@endo/captp)

`v4.5.1`

Compare Source

Patch Changes

#2901 69ca27c Thanks @kriskowal! - Sweep makeFinalizingMap's get operator to use optional chaining
(keyToRef.get(key)?.deref()) now that #1514 has completed, replacing
the prior explicit conditional. Behavior is unchanged.
Updated dependencies [45d06cd]:
- @endo/marshal@1.10.0

`v4.5.0`

Compare Source

Minor Changes

#3008 d83b1ab Thanks @kriskowal! - - Relaxes dependence on a global, post-lockdown harden function by taking a
dependency on the new @endo/harden package.
Consequently, bundles will now entrain a harden implementation that is
superfluous if the bundled program is guaranteed to run in a post-lockdown
HardenedJS environment.
To compensate, use bundle-source with -C hardened or the analogous feature
for packaging conditions with your preferred bundler tool.
This will hollow out @endo/harden and defer exclusively to the global
harden.

Patch Changes

Updated dependencies [2e00276, 029dcc4, d83b1ab, 98f77e9]:
- @endo/errors@1.3.0
- @endo/harden@1.1.0
- @endo/eventual-send@1.4.0
- @endo/marshal@1.9.0
- @endo/nat@5.2.0
- @endo/pass-style@1.7.0
- @endo/promise-kit@1.2.0

endojs/endo (@endo/errors)

`v1.3.1`

Compare Source

Patch Changes

Updated dependencies [e619205, a675d8e]:
- ses@2.0.0
- @endo/harden@1.1.0

`v1.3.0`

Compare Source

Minor Changes

#3082 2e00276 Thanks @boneskull! - - Exports assert.details under its own name (i.e., details).
- hideAndHardenFunction - If a function foo is first frozen with hideAndHardenFunction(foo) rather than freeze(foo) or harden(foo), then foo.name is changed from 'foo' to '__HIDE_foo'. When stackFiltering: 'concise' or stackFiltering: 'omit-frames', then (currently only on v8), the stack frames for that function are omitted from the stacks reported by our causal console.
- The new Rejector type supports the confirmFoo/reject pattern:
```
@&#8203;import {FAIL, hideAndHardenFunction} from '@&#8203;endo@errors';
@&#8203;import {Rejector} from '@&#8203;endo/errors/rejector.js';

const confirmFoo = (specimen, reject: Rejector) =>
  test(specimen) || reject && reject`explanation of what went wrong`;

export const isFoo = specimen => confirmFoo(specimen, false);
hideAndHardenFunction(isFoo);

export const assertFoo = specimen => {
  confirmFoo(specimen, FAIL);
};
hideAndHardenFunction(assertFoo);
```
  Both false and Fail satisfy the Rejector type.
  We also deprecate the old checkFoo/assertChecker pattern from @endo/common.
  The exported isFoo and assertFoo behave the same as they had when then they were using the checkFoo/assertChecker pattern, but are now internally faster and clearer.

Patch Changes

Updated dependencies [2e00276, 029dcc4, a29ecd4]:
- ses@1.15.0
- @endo/harden@1.1.0

endojs/endo (@endo/eventual-send)

`v1.5.0`

Compare Source

Minor Changes

#3172 f65b000 Thanks @turadg! - Improve E() type inference and publicly export method-projection helpers.
- RemoteFunctions, PickCallable, and ECallableOrMethods now short-circuit on any, preventing E(anyValue) from collapsing to an unusable type.
- EMethods, EGetters, and related helpers are now part of the public type surface, so downstream packages can name the projected shapes E() produces.
Compile-time type changes only; no runtime behavior changes.

Patch Changes

Updated dependencies []:
- @endo/harden@1.1.0

`v1.4.0`

Compare Source

Minor Changes

#3008 d83b1ab Thanks @kriskowal! - - Relaxes dependence on a global, post-lockdown harden function by taking a
dependency on the new @endo/harden package.
Consequently, bundles will now entrain a harden implementation that is
superfluous if the bundled program is guaranteed to run in a post-lockdown
HardenedJS environment.
To compensate, use bundle-source with -C hardened or the analogous feature
for packaging conditions with your preferred bundler tool.
This will hollow out @endo/harden and defer exclusively to the global
harden.

Patch Changes

Updated dependencies [029dcc4]:
- @endo/harden@1.1.0

endojs/endo (@endo/exo)

[`v1.7.0

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 7am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Note

Medium Risk
Wide bumps to ses, Agoric liveslots, and Endo packages touch core kernel and sandbox behavior; the design-system major-style jump in kernel-ui adds UI regression risk despite no code edits in this PR.

Overview
This PR only updates dependency version ranges in root and workspace package.json files; there are no application source changes in the diff.

It refreshes shared MetaMask tooling (@metamask/eslint-config*, auto-changelog, create-release-branch) and bumps @metamask/superstruct, @metamask/utils, json-rpc-engine, and Snaps-related packages where the browser runtime and core kernel depend on them.

The Endo / HardenedJS stack moves forward together—ses 1.14 → 1.15, plus newer @endo/eventual-send, captp, marshal, exo, patterns, promise-kit, pass-style, bundle-source, and related packages—across kernel shims, agents, extension, and test packages.

Agoric pins change from upgrade-tagged builds to release lines: @agoric/internal, @agoric/store, and @agoric/swingset-liveslots on ocap-kernel and kernel-test.

The largest consumer-facing jump is in kernel-ui: @metamask/design-system-react, tailwind preset, and design-tokens are bumped by several minor/major steps, which may affect control-panel styling and component APIs after install.

^{Reviewed by Cursor Bugbot for commit f393fe4. Bugbot is set up for automated code reviews on this repo. Configure here.}

ci-protocols-renovate · 2026-09-18T01:18:14Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

! Corepack is about to download https://repo.yarnpkg.com/4.12.0/packages/yarnpkg-cli/bin/yarn.js

cursor

Stale Bugbot comment from a previous run.

cursor · 2026-09-18T01:21:58Z

    "libp2p": "3.1.7",
    "multiformats": "^13.3.6",
-    "ses": "^1.14.0",
+    "ses": "^1.15.0",


SES 1.x conflicts with SES 2

High Severity

@endo/errors ^1.3.1 and the new @agoric/store / @agoric/swingset-liveslots releases depend on ses 2.x, while this repo still pins ses ^1.15.0. That can install two SES copies or fail resolution. Dual SES is unsafe here because lockdown mutates the shared realm.

Additional Locations (2)

packages/kernel-utils/package.json#L130-L135

packages/kernel-test/package.json#L47-L53

^{Reviewed by Cursor Bugbot for commit 2ddfe81. Configure here.}

Signed-off-by: Erik Marks <erik.marks@consensys.com>

cursor

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

There are 3 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f393fe4. Configure here.}

cursor · 2026-09-18T17:00:45Z

+    "@endo/errors": "^1.3.1",
+    "@endo/exo": "^1.7.0",
+    "@endo/patterns": "^1.9.1",
+    "@endo/promise-kit": "^1.2.1",


Endo upgrades pull SES 2

High Severity

@endo/errors 1.3.1 (and related Endo/Agoric packages in this bump) declare a dependency on ses@2.0.0, while this repo only moves ses to ^1.15.0. That can install two SES copies. In a Hardened JS kernel, dual ses/harden implementations can fail lockdown() or break vat messaging.

Additional Locations (2)

packages/ocap-kernel/package.json#L72-L77

packages/ocap-kernel/package.json#L103-L104

^{Reviewed by Cursor Bugbot for commit f393fe4. Configure here.}

cursor · 2026-09-18T17:00:45Z

-    "@metamask/design-tokens": "^8.1.1",
+    "@metamask/design-system-react": "^0.43.0",
+    "@metamask/design-system-tailwind-preset": "^0.13.0",
+    "@metamask/design-tokens": "^8.7.0",


Design system Tailwind scan outdated

Medium Severity

@metamask/design-system-react jumps from 0.10.0 to 0.43.0, which moved typography and class-name maps into @metamask/design-system-shared. packages/kernel-ui/tailwind.config.js still scans only design-system-react, so Tailwind can omit classes used by Text, Button, and Box.

^{Reviewed by Cursor Bugbot for commit f393fe4. Configure here.}

fix(deps): update npm dependencies

2ddfe81

ci-protocols-renovate Bot requested a review from a team as a code owner September 18, 2026 01:18

cursor Bot reviewed Sep 18, 2026

View reviewed changes

joshuafernandes and others added 2 commits September 18, 2026 11:23

Merge branch 'main' into renovate/npm-dependencies

2421ed9

Merge branch 'main' into renovate/npm-dependencies

f393fe4

Signed-off-by: Erik Marks <erik.marks@consensys.com>

cursor Bot reviewed Sep 18, 2026

View reviewed changes

Navigation Menu

fix(deps): update npm dependencies - #1112

fix(deps): update npm dependencies#1112
ci-protocols-renovate[bot] wants to merge 3 commits into
mainfrom
renovate/npm-dependencies

ci-protocols-renovate Bot commented Sep 18, 2026 •

edited by cursor Bot

Loading

Uh oh!

ci-protocols-renovate Bot commented Sep 18, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot Sep 18, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Sep 18, 2026

Uh oh!

cursor Bot Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ci-protocols-renovate Bot commented Sep 18, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

0.0.24 (2019-09-26)

0.0.23 (2019-09-26)

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

[`v1.7.0

Configuration

Uh oh!

ci-protocols-renovate Bot commented Sep 18, 2026

⚠️ Artifact update problem

File name: yarn.lock

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot Sep 18, 2026

Choose a reason for hiding this comment

SES 1.x conflicts with SES 2

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Sep 18, 2026

Choose a reason for hiding this comment

Endo upgrades pull SES 2

Uh oh!

cursor Bot Sep 18, 2026

Choose a reason for hiding this comment

Design system Tailwind scan outdated

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ci-protocols-renovate Bot commented Sep 18, 2026 •

edited by cursor Bot

Loading

cursor Bot left a comment •

edited

Loading