Repository navigation
chore(deps): bump @walletconnect/ethereum-provider from 2.23.9 to 2.25.0 - #20
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@walletconnect/ethereum-provider](https://github.com/WalletConnect/walletconnect-monorepo/tree/HEAD/providers/ethereum-provider) from 2.23.9 to 2.25.0. - [Release notes](https://github.com/WalletConnect/walletconnect-monorepo/releases) - [Changelog](https://github.com/WalletConnect/walletconnect-monorepo/blob/v2.0/providers/ethereum-provider/CHANGELOG.md) - [Commits](https://github.com/WalletConnect/walletconnect-monorepo/commits/@walletconnect/[email protected]/providers/ethereum-provider) --- updated-dependencies: - dependency-name: "@walletconnect/ethereum-provider" dependency-version: 2.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
![justalab-agents[bot]](https://avatars.githubusercontent.com/u/159771991?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR bumps @walletconnect/ethereum-provider from ^2.23.9 to ^2.25.0, resolving to version 2.25.0, along with the cascade of WalletConnect and related dependency upgrades (core, sign-client, universal-provider, types, utils) reflected in the lockfile. Several other transitive dependencies are also updated as a side effect (e.g., @reown/appkit suite, @coinbase/cdp-sdk, jose, idb-keyval, es-toolkit, readdirp).
The main risk to be aware of: the upgrade introduces a version split where @walletconnect/[email protected] pulls in [email protected], but @reown/[email protected] (a transitive dependency) still pins [email protected] — meaning two different instances of the universal provider will coexist at runtime, which can lead to duplicate relay connections or divergent session state.
Findings outside the diff
These sit on lines this PR did not change, but this PR is what makes them wrong. They cannot be posted as inline comments.
- [WARNING]
pnpm-lock.yaml:37— Split@walletconnect/universal-providerversions in the same tree:@walletconnect/[email protected]directly pulls in[email protected], while its own dependency@reown/[email protected](and sub-packagesappkit-controllers,appkit-utils) still pin[email protected]. This means two different instances of the universal provider co-exist at runtime, each with separate WebSocket connections, session stores, and event emitters. This can cause duplicate relay connections, missed events (one instance receives a session update that the other doesn't), and divergent internal state. The lockfile shows this clearly: the@walletconnect/[email protected]snapshot lists@walletconnect/[email protected]while@reown/[email protected]snapshot lists@walletconnect/[email protected]. This split was not present before this PR (both were at 2.23.9).
Reviewer callouts (1)
Non-blocking observations. Nothing here needs to change before merge.
.github:1— "The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see actions/runner-images#14748"
Bumps @walletconnect/ethereum-provider from 2.23.9 to 2.25.0.
Release notes
Sourced from @walletconnect/ethereum-provider's releases.
Changelog
Sourced from @walletconnect/ethereum-provider's changelog.
Commits
c8a72d4chore: update versions and lerna.json50399e3chore: update versions and lerna.json83ba7d4chore: remove unused dependencies and bump dev tooling security versions3ef9f3echore: update versions and lerna.jsond6a7508fix: add missing wait-on devDependency to ethereum-provider4aed1dbchore: fix vulnerabilities, remove unused deps, update packagesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)