chore: 2026 Q4 stack upgrade — Node 24.22/npm 12, Vite+, Oxlint/Oxfmt, security (EMBED-595)

.changeset/README.md

@@ -0,0 +1,5 @@
+# Changesets
+
+This folder is managed by `@changesets/cli`. It versions and publishes this package. The release workflow opens a pull request and does not publish. Publish from the default branch after that pull request merges.
+
+See the [Changesets documentation](https://github.com/changesets/changesets).

.changeset/config.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.0.3/schema.json",
+  "baseBranch": "master",
+  "access": "public",
+  "privatePackages": {
+    "version": false
+  },
+  "updateInternalDependencies": "patch",
+  "fixed": [],
+  "linked": [],
+  "ignore": []
+}

.changeset/stack-upgrade-node-24.md

@@ -0,0 +1,5 @@
+---
+"@web3auth/auth": major
+---
+
+Require Node.js 24.22 or later and npm 12. Development and CI run on Node 26. Build with Vite+ into the existing `dist/lib.esm` and `dist/lib.cjs` paths for every subpath export, targeting ES2022 so `Object.hasOwn` stays native. Type declarations move from `dist/lib.cjs/types/` to sit next to the CommonJS files, for example `dist/lib.cjs/index.d.ts`; the `exports` map points at the new paths. Drop the `@babel/runtime` peer dependency. Depend on `@toruslabs/ffjavascript` 7, `@toruslabs/constants` 17, `@toruslabs/metadata-helpers` 9, `@toruslabs/session-manager` 6, and `@toruslabs/secure-pub-sub` 5. `getHashQueryParams` now returns only the known redirect keys. In iframe mode, a redirect resumes login only when `loginParams` is valid JSON that names an auth connection.

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /examples/react-example
+      - /examples/vue-example
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3

.github/workflows/ci.yml

@@ -1,77 +1,162 @@
-name: Build
+name: Validate
 
-on: [push]
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
 
 jobs:
   test:
+    name: run tests
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: ["24.x"]
+        node: ["24.22", "26"]
         os: [ubuntu-latest]
 
     runs-on: ${{ matrix.os }}
-
     steps:
       - name: Wiz sensor
         uses: Web3Auth/.github/.github/actions/wiz-sensor@545f7c255313f85d38a02dc36c4ad01387d03149 # v1.0.0
         with:
           enabled: ${{ vars.WIZ_SENSOR_ENABLED }}
           token: ${{ secrets.WIZ_SENSOR_TOKEN }}
-      - name: Check out Git repository
-        uses: actions/checkout@v4
 
-      - name: Set up node
-        uses: actions/setup-node@v4
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Use Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
 
+      - name: Install npm 12
+        run: npm install --global npm@12.2.0
+
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
-      - name: Lint
-        run: npm run lint
+      - name: Check dependency hardening
+        run: npm run harden
 
-      - name: Test
-        run: npm run test
+      - name: Check lint and format
+        run: npm run check
+
+      - name: Typecheck
+        run: npm run typecheck
 
       - name: Build
         run: npm run build
 
-      - name: Pack and build example
-        if: github.ref == 'refs/heads/master'
+      - name: Run tests
+        run: npm run test
+
+      - name: Check packed package
+        run: npm run check:pack
+
+      - name: Build React example
+        working-directory: examples/react-example
+        run: |
+          npm ci
+          npm run build
+
+      - name: Build Vue example
+        working-directory: examples/vue-example
+        run: |
+          npm ci
+          npm run build
+
+  release-notes:
+    if: github.event_name == 'pull_request' && !startsWith(github.head_ref, 'changeset-release/')
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Use Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24.22"
+          cache: "npm"
+
+      - name: Install npm 12
+        run: npm install --global npm@12.2.0
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check release notes
+        env:
+          BASE_REF: ${{ github.base_ref }}
         run: |
-          cd examples/vue-example
-          npm install
+          git fetch --no-tags origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"
+          npm exec -- changeset status --since="origin/${BASE_REF}"
+
+  deploy-demo:
+    name: deploy demo
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    needs: test
+    permissions:
+      contents: read
+      id-token: write
+    concurrency:
+      group: deploy-demo
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    steps:
+      - name: Wiz sensor
+        uses: Web3Auth/.github/.github/actions/wiz-sensor@545f7c255313f85d38a02dc36c4ad01387d03149 # v1.0.0
+        with:
+          enabled: ${{ vars.WIZ_SENSOR_ENABLED }}
+          token: ${{ secrets.WIZ_SENSOR_TOKEN }}
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Use Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "26"
+          cache: "npm"
+
+      - name: Install npm 12
+        run: npm install --global npm@12.2.0
+
+      - name: Build package
+        run: |
+          npm ci
+          npm run build
+
+      - name: Build Vue example
+        working-directory: examples/vue-example
+        run: |
+          npm ci
           npm run build
 
-      # Set the credentials from repository settings/secrets
       - name: Configure AWS credentials
-        if: github.ref == 'refs/heads/master'
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION_US }}
 
-      # Copy the files from build folder to the S3 bucket
-      # Upload to S3
-      - name: sync s3
-        if: github.ref == 'refs/heads/master'
-        uses: jakejarvis/s3-sync-action@master
+      - name: Upload demo to S3
+        run: aws s3 sync ./examples/vue-example/dist s3://demo-auth.web3auth.io --region us-east-1
+
+      - name: Invalidate CloudFront
         env:
-          SOURCE_DIR: "./examples/vue-example/dist"
-          AWS_REGION: "us-east-1"
-          AWS_S3_BUCKET: "demo-auth.web3auth.io"
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
-      # Invalidate Cloudfront (this action)
-      - name: Update AWS Cloudfront Config
-        uses: chaitanyapotti/cloudfront-update-distribution@v4
-        if: github.ref == 'refs/heads/master'
-        with:
-          cloudfront-distribution-id: ${{ secrets.AWS_CLOUDFRONT_DISTRIBUTION_ID }}
-          cloudfront-invalidation-required: true
-          cloudfront-invalidation-path: "/*"
-          cloudfront-wait-for-service-update: false
+          DISTRIBUTION_ID: ${{ secrets.AWS_CLOUDFRONT_DISTRIBUTION_ID }}
+        run: aws cloudfront create-invalidation --distribution-id "$DISTRIBUTION_ID" --paths "/*"

.github/workflows/release-pr.yml

@@ -0,0 +1,39 @@
+name: Create release pull request
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-pr
+  cancel-in-progress: false
+
+jobs:
+  release-pr:
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "26"
+      - name: Install npm 12
+        run: npm install --global npm@12.2.0
+      - name: Install dependencies
+        run: npm ci
+      # The GitHub API commit mode signs the release commit, which `master` requires.
+      - name: Create or update the release pull request
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
+        with:
+          version-script: npm run version-packages
+          commit-message: "chore: release packages"
+          pr-title: "chore: release packages"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security-code-scanner.yml

@@ -0,0 +1,27 @@
+name: Security code scanner
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security-scan:
+    uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@becb242930b3cc271c26da0280050db9c157e291 # v2.1.1
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    with:
+      scanner-ref: becb242930b3cc271c26da0280050db9c157e291 # v2.1.1
+      paths-ignored: |
+        **/node_modules/**
+        **/dist/**
+        **/build/**
+        **/coverage/**

.gitignore

@@ -106,5 +106,3 @@ dist
 .DS_Store
 
 .rollup*
-
-.npmrc