chore(deps): update dependencies to latest

.changeset/config.json

@@ -1,10 +1,12 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.0.5/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "changelog": ["@changesets/changelog-github", { "repo": "lifinance/widget" }],
   "commit": false,
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
+  "format": false,
+  "privatePackages": { "version": true, "tag": false },
   "ignore": [
     "@lifi/widget-embedded",
     "@lifi/widget-playground",

.changeset/update-checkout-runtime-deps.md

@@ -0,0 +1,5 @@
+---
+"@lifi/widget-checkout": patch
+---
+
+Update runtime dependencies, including Motion 13, `@lifi/sdk` 4.4.0 and MUI 9.3.

.changeset/update-provider-runtime-deps.md

@@ -0,0 +1,12 @@
+---
+"@lifi/wallet-management": patch
+"@lifi/widget-provider": patch
+"@lifi/widget-provider-bitcoin": patch
+"@lifi/widget-provider-ethereum": patch
+"@lifi/widget-provider-mesh": patch
+"@lifi/widget-provider-solana": patch
+"@lifi/widget-provider-sui": patch
+"@lifi/widget-provider-tron": patch
+---
+
+Update runtime dependencies, including `@lifi/sdk` 4.4.0 and the `@lifi/sdk-provider-*` packages.

.changeset/update-widget-runtime-deps.md

@@ -0,0 +1,5 @@
+---
+"@lifi/widget": patch
+---
+
+Update runtime dependencies, including Motion 13, `react-intersection-observer` 11, `@lifi/sdk` 4.4.0 and MUI 9.3.

.github/actions/pnpm-install/action.yaml

@@ -12,7 +12,7 @@ runs:
   using: 'composite'
   steps:
     - name: Set up pnpm
-      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
     - name: Set up Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:

.github/actions/preview-publish/action.yml

@@ -16,7 +16,23 @@ runs:
           pnpm changeset pre exit
         fi
 
+    # `changeset version` exits 1 when there are no changesets (Changesets v3), so
+    # gate it on a changeset actually being present. Top level only — pre-mode moves
+    # already-versioned changesets into .changeset/pre/, and those are not pending.
+    # README.md is not a changeset either.
+    - name: Check for changesets
+      id: check
+      shell: bash
+      run: |
+        if [ -n "$(find .changeset -maxdepth 1 -name '*.md' ! -name 'README.md' -print -quit)" ]; then
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "::warning::No changeset in this PR — nothing to publish as a preview."
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: Version changed packages as a preview snapshot
+      if: steps.check.outputs.present == 'true'
       shell: bash
       env:
         GITHUB_TOKEN: ${{ github.token }} # changeset version hits the GitHub API (changelog-github)
@@ -27,6 +43,7 @@ runs:
 
     - name: Detect preview packages
       id: detect
+      if: steps.check.outputs.present == 'true'
       shell: bash
       run: |
         # non-private packages the snapshot bumped = exactly what gets published
@@ -36,7 +53,7 @@ runs:
           echo "publish=true" >> "$GITHUB_OUTPUT"
           echo "Preview versions to publish:"; cat "$RUNNER_TEMP/preview-pkgs.txt"
         else
-          echo "::warning::No changeset in this PR — nothing to publish as a preview."
+          echo "::warning::The changesets in this PR bumped no publishable package."
           echo "publish=false" >> "$GITHUB_OUTPUT"
         fi
 

.github/workflows/linear-release.yaml

@@ -1,7 +1,7 @@
 name: 'Release · Linear Sync'
 
 # Reusable: sync one anchor package's published release into its Linear pipeline.
-# Version + channel are derived from the changesets publishedPackages output (not a git tag).
+# Version + channel are derived from the changesets published-packages output (not a git tag).
 on:
   workflow_call:
     inputs:
@@ -14,7 +14,7 @@ on:
         required: true
         type: string
       published_packages:
-        description: 'Raw changesets publishedPackages JSON: [{name, version}, …]'
+        description: 'Raw changesets published-packages JSON: [{name, version}, …]'
         required: true
         type: string
     secrets:
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Sync issues to release
-        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0.14.6
+        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
         with:
           access_key: ${{ secrets.access_key }}
           command: sync
@@ -66,7 +66,7 @@ jobs:
       # prerelease: advance the stage; the release stays open
       - name: Advance stage (alpha/beta)
         if: steps.meta.outputs.channel != 'stable'
-        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0.14.6
+        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
         with:
           access_key: ${{ secrets.access_key }}
           command: update
@@ -76,7 +76,7 @@ jobs:
       # stable: complete the release (fires the "→ Done" automation)
       - name: Complete release (stable)
         if: steps.meta.outputs.channel == 'stable'
-        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0.14.6
+        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
         with:
           access_key: ${{ secrets.access_key }}
           command: complete

.github/workflows/publish.yaml

@@ -45,7 +45,7 @@ jobs:
       contents: write # to create the version PR / push tags
       pull-requests: write # to create the version PR
     outputs:
-      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
+      has-changesets: ${{ steps.changesets.outputs.has-changesets }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -57,26 +57,28 @@ jobs:
           cache: 'false' # privileged job — don't restore a potentially poisoned cache
       - name: Create version pull request
         id: changesets
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
         with:
-          version: pnpm changeset:version
-          title: 'chore: version packages'
-          commit: 'chore: version packages'
+          version-script: pnpm changeset:version
+          pr-title: 'chore: version packages'
+          commit-message: 'chore: version packages'
+        # No `env: GITHUB_TOKEN` — v2 throws when it is set and differs from the
+        # `github-token` input. The action injects its own token into the version
+        # script's environment, which is what changelog-github needs.
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HUSKY: '0'
 
   release:
     name: Release
     needs: changesets
     # Only publish once the version PR has been merged (no changesets left).
-    if: needs.changesets.outputs.hasChangesets == 'false'
+    if: needs.changesets.outputs.has-changesets == 'false'
     runs-on: ubuntu-latest
     permissions:
       contents: write # to create GitHub Releases
       id-token: write # OIDC token for npm provenance / trusted publishing
     outputs:
-      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
+      published-packages: ${{ steps.changesets.outputs.published-packages }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -87,27 +89,29 @@ jobs:
           cache: 'false' # privileged job — don't restore a potentially poisoned cache
       - name: Publish to npm
         id: changesets
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
         with:
-          publish: pnpm changeset:publish
-          createGithubReleases: true
+          publish-script: pnpm changeset:publish
+          create-github-releases: true
+        # No `env: GITHUB_TOKEN` — see the Changesets job. v2 reads the published
+        # packages from the CHANGESETS_OUTPUT file it injects into the publish
+        # script's environment, not from stdout.
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
 
   # Linear sync — one static call per anchor (two anchors use two secrets, so no matrix).
   linear-widget:
     name: Linear Sync (Widget)
     needs: release
     # Fires only when @lifi/widget was actually published this run.
-    if: contains(needs.release.outputs.publishedPackages, '"@lifi/widget"')
+    if: contains(needs.release.outputs.published-packages, '"@lifi/widget"')
     permissions:
       contents: read
     uses: ./.github/workflows/linear-release.yaml
     with:
       release_name: Widget
       package_name: '@lifi/widget'
-      published_packages: ${{ needs.release.outputs.publishedPackages }}
+      published_packages: ${{ needs.release.outputs.published-packages }}
     secrets:
       access_key: ${{ secrets.WIDGET_LINEAR_RELEASE_ACCESS_KEY }}
 
@@ -116,14 +120,14 @@ jobs:
   linear-checkout:
     name: Linear Sync (Checkout)
     needs: release
-    if: contains(needs.release.outputs.publishedPackages, '"@lifi/widget-checkout"')
+    if: contains(needs.release.outputs.published-packages, '"@lifi/widget-checkout"')
     permissions:
       contents: read
     uses: ./.github/workflows/linear-release.yaml
     with:
       release_name: Checkout
       package_name: '@lifi/widget-checkout'
-      published_packages: ${{ needs.release.outputs.publishedPackages }}
+      published_packages: ${{ needs.release.outputs.published-packages }}
     secrets:
       access_key: ${{ secrets.CHECKOUT_LINEAR_RELEASE_ACCESS_KEY }}
 

e2e/examples.json

@@ -115,7 +115,9 @@
     "port": 4173,
     "buildCmd": "build",
     "serveCmd": "start",
-    "serveEnv": { "PORT": "4173" },
+    "serveEnv": {
+      "PORT": "4173"
+    },
     "profile": "standard",
     "mountPath": "/",
     "status": "active"
@@ -126,7 +128,9 @@
     "port": 4173,
     "buildCmd": "build",
     "serveCmd": "start",
-    "serveEnv": { "PORT": "4173" },
+    "serveEnv": {
+      "PORT": "4173"
+    },
     "profile": "standard",
     "mountPath": "/",
     "status": "active"
@@ -191,7 +195,7 @@
     "profile": "standard",
     "mountPath": "/",
     "status": "broken",
-    "brokenReason": "vite-plugin-env-compatible only transforms process.env.* at build time and does not shim process globally. Dynamic SDK crashes at runtime with \"process is not defined\". Fix: replace with vite-plugin-node-polyfills."
+    "brokenReason": "Dynamic SDK reads a bare `process` global (nextTick/versions/emit) and imports `buffer/index.js`, so it needs Node shims. vite-plugin-node-polyfills declares Vite 8 support but is broken under its rolldown resolver: it aliases its own shims by bare specifier, and its exports map still has legacy trailing-slash keys pointing at files, which rolldown rejects (\"Expecting folder to folder mapping\"). Fails on 0.26.0 and 0.28.0 alike, in build and in dep pre-bundling. Blocked on upstream davidmyersdev/vite-plugin-node-polyfills#158, #161 and #154. The @dynamic-labs v5 upgrade itself is fine — it type-checks and bundles."
   },
   {
     "name": "nuxt",

e2e/package.json

@@ -15,6 +15,6 @@
     "e2e:example": "playwright test --config playwright.examples.config.ts --project"
   },
   "devDependencies": {
-    "@playwright/test": "^1.61.1"
+    "@playwright/test": "^1.62.1"
   }
 }

examples/connectkit/package.json

@@ -10,28 +10,28 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@lifi/sdk": "^4.3.0",
+    "@lifi/sdk": "^4.4.0",
     "@lifi/wallet-management": "4.1.3",
     "@lifi/widget": "4.5.0",
     "@lifi/widget-provider-ethereum": "4.1.3",
-    "@mui/icons-material": "^9.2.0",
-    "@mui/material": "^9.2.0",
+    "@mui/icons-material": "^9.3.1",
+    "@mui/material": "^9.3.1",
     "@solana/wallet-adapter-base": "^0.9.27",
     "@solana/wallet-adapter-react": "^0.15.39",
     "@solana/web3.js": "^1.98.4",
-    "@tanstack/react-query": "^5.101.2",
+    "@tanstack/react-query": "^5.101.4",
     "connectkit": "^1.9.2",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "viem": ">=2.52.0",
-    "wagmi": "^3.7.1"
+    "wagmi": "^3.7.6"
   },
   "devDependencies": {
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.3",
-    "globals": "^17.7.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "@vitejs/plugin-react": "^6.0.5",
+    "globals": "^17.11.0",
     "typescript": "~7.0.2",
-    "vite": "^8.1.4"
+    "vite": "^8.2.1"
   }
 }

examples/deposit-flow/package.json

@@ -10,24 +10,24 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@lifi/sdk": "^4.3.0",
+    "@lifi/sdk": "^4.4.0",
     "@lifi/widget": "4.5.0",
-    "@mui/material": "^9.2.0",
-    "@tanstack/react-query": "^5.101.2",
+    "@mui/material": "^9.3.1",
+    "@tanstack/react-query": "^5.101.4",
     "events": "^3.3.0",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "viem": ">=2.52.0",
-    "wagmi": "^3.7.1"
+    "wagmi": "^3.7.6"
   },
   "devDependencies": {
     "@types/events": "^3.0.3",
-    "@types/node": "^26.1.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.3",
+    "@types/node": "^26.2.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "@vitejs/plugin-react": "^6.0.5",
     "typescript": "^7.0.2",
-    "vite": "^8.1.4",
+    "vite": "^8.2.1",
     "vite-plugin-node-polyfills": "^0.26.0"
   }
 }