[pasevin]

Problem

Published @openzeppelin/adapter-polkadot bundles contain bare runtime imports of @openzeppelin/ui-components and @openzeppelin/ui-react, but the manifest declared both only as dev dependencies. Under pnpm strict resolution those imports are unresolvable unless the consumer happens to hoist compatible UIKit packages. Role Manager hit this at adapter-polkadot@5.0.0 after removing its global override and currently carries a version-scoped packageExtensions workaround.

Root cause

Polkadot inlines @openzeppelin/adapter-evm-core and @openzeppelin/adapter-runtime-utils through noExternal. EVM core's wallet components import the UIKit packages, while Polkadot keeps them external in its final bundle. Inlining therefore drops EVM core's peer-dependency boundary, and the Polkadot manifest never recreated it. The UIKit v3 range update in #86 moved these entries in dev dependencies but did not add the missing peers.

Fix

• Declare @openzeppelin/ui-components ^3.9.0 and @openzeppelin/ui-react ^3.3.2 as Polkadot peers, retaining the matching dev dependencies used for local builds and tests.
• Include both packages in Polkadot's runtime validatePeerVersions check. The existing ozPeerMinimums build mechanism now derives and embeds all four UIKit floors from the corrected manifest.

Guard

Add validate:dist-externals after workspace builds. It scans every published adapter's runtime dist files, normalizes bare import subpaths to package names, and fails when an imported package is absent from both dependencies and peerDependencies.

Against the unmodified main manifests, the guard failed with exactly two violations:

• @openzeppelin/adapter-polkadot → @openzeppelin/ui-components
• @openzeppelin/adapter-polkadot → @openzeppelin/ui-react

It passes after this fix. The audit also confirmed Solana's generated dist imports only its already-declared OpenZeppelin peers (ui-types and ui-utils).

Semver

Adding required runtime peers is breaking for consumers that do not already provide them, so the changeset bumps @openzeppelin/adapter-polkadot major to 7.0.0, following #86's precedent. Changesets also propagates a major bump to @openzeppelin/adapters-vite 14.0.0 because it peer-depends on the adapter packages.

Consumer notes

Consumers must install or declare @openzeppelin/ui-components ^3.9.0 and @openzeppelin/ui-react ^3.3.2. Role Manager can remove its version-scoped Polkadot package extension after upgrading to this release.

Verification

• pnpm install — pass, 9 workspace projects
• pnpm build — pass, 7 build targets; includes Vite config, host-peer, and dist-external validation
• pnpm test — pass, 3,197 passed / 11 skipped tests across 200 passed / 1 skipped files
• pnpm lint — pass, 7 lint targets
• pnpm changeset status --verbose — pass, 2 major release entries (adapter-polkadot 7.0.0 and adapters-vite 14.0.0)

[Copilot]

Copilot review overview

🟡 Changes recommended

The new dist-import validation script currently misses most dynamic import() usages due to an anchored regex, undermining the guard’s stated purpose.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Dynamic import guard misses inline imports · New

What changed in this PR

This PR fixes @openzeppelin/adapter-polkadot’s published runtime dependency contract by declaring the UIKit packages that remain external in the final bundle as peers, and adds a build-time guard to prevent future “dist imports undeclared runtime dependency” regressions across adapter packages.

Changes:

• Add @openzeppelin/ui-components and @openzeppelin/ui-react to adapter-polkadot peerDependencies and include them in the runtime validatePeerVersions check.
• Add a new validate:dist-externals script and run it after workspace builds to detect undeclared external runtime imports.
• Add a changeset bumping @openzeppelin/adapter-polkadot for the peer dependency contract change.

File	Description
scripts/​validate-dist-externals.cjs	New post-build guard that scans adapter dist/ outputs for bare imports and checks they’re declared as runtime deps/peers.
packages/​adapter-polkadot/​src/​index.ts	Extends runtime peer-version validation to cover ui-components and ui-react.
packages/​adapter-polkadot/​package.json	Declares @openzeppelin/ui-components and @openzeppelin/ui-react as peerDependencies (keeping devDependencies).
package.json	Adds validate:dist-externals and wires it into pnpm build.
.changeset/​polkadot-declare-uikit-peers.md	Documents the breaking peer dependency contract update and consumer action.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.