cosmos/cosmjs v0.39.0

0.39.0

on GitHub

Changed

• all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04
  and the crypto stack (@noble/*, @scure/bip39 v2) relies on APIs that only
  ship in Node 22+. If you are still on an older Node, upgrade before taking
  this release.
• @cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves,
  @noble/hashes and @scure/bip39 to v2. These upgrades are otherwise transparent
  to users of the high-level @cosmjs/crypto API, but direct consumers of the
  underlying libraries should consult their respective migration notes.
  (#1935)
• @cosmjs/crypto: Use pure-JS implementation of Argon2id from @noble/hashes
  instead of the WASM-based hash-wasm implementation. This removes the
  hash-wasm runtime dependency and makes Argon2id.execute fully
  synchronous-capable without requiring a WASM instantiation. (#1938)
• @cosmjs/amino, @cosmjs/proto-signing: Remove scream test around argon2 call in
  wallet serialization/deserialization which is not needed anymore after
  #1938.
• all: Bring back the classic main/types fields in package.json alongside
  the exports field so tools like bundlephobia that do not understand
  exports can still resolve the package entry points. (#1944)
• @cosmjs/stargate: Change Account.accountNumber from number to bigint.
  Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed
  Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when
  represented as a JavaScript number. Using bigint preserves the full 64-bit
  range. Breaking change for anyone reading accountNumber off Account
  (e.g. from StargateClient.getAccount()): you will typically need to either
  coerce back with Number(account.accountNumber) where you know the value is
  safe, or keep using bigint end-to-end. (#1956)
• @cosmjs/amino: makeSignDoc now accepts number | string | bigint for
  accountNumber (previously number | string) and encodes the value via
  Uint64 instead of Uint53 so large account numbers no longer overflow when
  building a sign doc. (#1956)
• @cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions
  because it will likely be removed when wallet serialization/deserialization is
  removed.
• @cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection
  advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)
• @cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary
  code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes.
  (#1959)