You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#5712f2d2539 Thanks @enesozturk! - Recover Coinbase Wallet from the EIP-1193 4100 ("Must call 'eth_requestAccounts' before other methods") error that could dead-end signing after a session restore.
On an AppKit auto-restore, the Coinbase Wallet SDK provider keeps its accounts but drops its internal authorization — unlike wagmi's own reconnect, AppKit's restore reads eth_accounts without re-issuing eth_requestAccounts. Consumers that call .request() directly on the provider (rather than through wagmi's hooks) then failed the first signing RPC with 4100.
The provider registration seam (syncProvider) now wraps Coinbase eip155 providers — keyed on the connector id, which is stable across the wagmi, ethers, and ethers5 adapters (the provider "type" is remapped to 'EXTERNAL' on most paths, so it can't be used to detect Coinbase). A 4100 then triggers a one-shot recovery: a single eth_requestAccounts re-authorization, an active-chain re-assert before an eth_sendTransaction retry (so the transaction can't broadcast on the wrong network after the handshake resets the SDK's chain), then exactly one retry. Non-4100 errors, rejected re-auth prompts, and non-Coinbase providers are unaffected. The wrapper is cached per provider instance so consumers keep a stable reference.
#5665e5ee43c Thanks @Khizr97! - Fix coinbasePreference option being ignored — 'all' and 'eoaOnly' now correctly use the coinbaseWallet connector (with QR code support) instead of always using baseAccount. 'smartWalletOnly' uses baseAccount. Regression introduced in PR #5269.
#5663da65c78 Thanks @Khizr97! - fix(ethers,ethers5): resolve walletProvider after account switch in modal
useAppKitProvider returned a stale provider when switching accounts inside the
modal. In the early-return path of connect(), connector.provider was never
initialised, causing the base-client's accountChanged handler to skip syncProvider(). The provider is now resolved from ethersProviders before the
event is emitted.
#5706ccf0dcb Thanks @ignaciosantise! - fix: persist the universal-link base as the WalletConnect deeplink choice when experimental_preferUniversalLinks is enabled, so session-request re-opens (handled by universal-provider) use the wallet's universal link instead of falling back to its native custom scheme
#56976b9c313 Thanks @enesozturk! - Add a headless read for the WalletConnect URI, so a host can render a QR without the useAppKitWallets React hook.
The AppKit instance now exposes getWalletConnectUri() — returning { wcUri, wcError, wcFetchingUri } — and subscribeWalletConnectUri(). Both read the connection layer directly (mirroring the existing getWalletList() / subscribeWalletList() pair), so a headless host gets the URI ungated through the instance without importing @reown/appkit-controllers (which can otherwise resolve to a different valtio singleton). This replaces the connection-level subscribeConnections, which is gated behind the multiWallet remote feature and so can't serve the URI for a single-wallet QR.
Breaking: the imperative pre-fetch trigger previously named getWalletConnectUri() is renamed to prefetchWalletConnectUri(), freeing getWalletConnectUri() for the new read.
#5701fb09a6d Thanks @enesozturk! - Add headless reset methods for the WalletConnect URI + connecting-wallet state.
The AppKit instance now exposes resetWalletConnectUri() and resetConnectingWallet() — thin passthroughs to HeadlessWalletUtil.resetWcUri() / resetConnectingWallet(). A headless host that reads the URI via getWalletConnectUri() can now clear it (e.g. when a QR is dismissed or a connection is cancelled) through the instance, without importing @reown/appkit-controllers. This completes the headless WalletConnect-URI surface alongside getWalletConnectUri / subscribeWalletConnectUri / prefetchWalletConnectUri.
#5695a4b2d2f Thanks @enesozturk! - Expose the headless wallet list imperatively on the AppKit client, so a non-React host can list / search / connect wallets without the useAppKitWallets React hook.
New AppKit instance methods: fetchWallets(options?), getWalletList(), subscribeWalletList(cb), getWalletConnectUri(options?), and connectWallet(wallet, namespace?, options?). The shared imperative logic lives in a new HeadlessWalletUtil (@reown/appkit-controllers), which both the client methods and the React hook can use — one tested code path for headless wallet listing, search, pagination, the WalletConnect URI, and programmatic connect (injected / API / mobile-deeplink).
#56941c17897 Thanks @enesozturk! - Fixed TRON tron_signTransaction payload shape to respect the wallet's tron_method_version session property. The connector now sends the spec-mandated legacy nested transaction.transaction shape by default, and the simplified flat shape only when the wallet advertises tron_method_version: "v1" in sessionProperties.
#5685ea99fd1 Thanks @enesozturk! - Add includePayOnly and sort options to useAppKitWallets().fetchWallets(). includePayOnly surfaces wallets that support WalletConnect Pay but are not v2-compatible (filtered out by default), and sort: 'wcpay' bubbles WalletConnect Pay-supporting wallets to the top.
#5655cc75433 Thanks @rtomas! - Fix injected and EIP6963 wallets showing despite being disabled and appearing duplicated. enableInjected is now wired through to the controller state, the wagmi adapter no longer conflates the basic injected connector with EIP6963-discovered ones, featured/recommended wallets are deduped against connectors regardless of the enableEIP6963 flag, and includeWalletIds/excludeWalletIds now also filter injected and EIP6963 connectors in the connect view.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@coinbase/cdp-sdk@1.54.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm @solana-program/system is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@solana-program/system@0.10.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.8.19→1.8.23Release Notes
reown-com/appkit (@reown/appkit)
v1.8.23Compare Source
Patch Changes
#5712
f2d2539Thanks @enesozturk! - Recover Coinbase Wallet from the EIP-11934100("Must call 'eth_requestAccounts' before other methods") error that could dead-end signing after a session restore.On an AppKit auto-restore, the Coinbase Wallet SDK provider keeps its accounts but drops its internal authorization — unlike wagmi's own
reconnect, AppKit's restore readseth_accountswithout re-issuingeth_requestAccounts. Consumers that call.request()directly on the provider (rather than through wagmi's hooks) then failed the first signing RPC with4100.The provider registration seam (
syncProvider) now wraps Coinbase eip155 providers — keyed on the connectorid, which is stable across the wagmi, ethers, and ethers5 adapters (the provider "type" is remapped to'EXTERNAL'on most paths, so it can't be used to detect Coinbase). A4100then triggers a one-shot recovery: a singleeth_requestAccountsre-authorization, an active-chain re-assert before aneth_sendTransactionretry (so the transaction can't broadcast on the wrong network after the handshake resets the SDK's chain), then exactly one retry. Non-4100errors, rejected re-auth prompts, and non-Coinbase providers are unaffected. The wrapper is cached per provider instance so consumers keep a stable reference.#5665
e5ee43cThanks @Khizr97! - FixcoinbasePreferenceoption being ignored —'all'and'eoaOnly'now correctly use thecoinbaseWalletconnector (with QR code support) instead of always usingbaseAccount.'smartWalletOnly'usesbaseAccount. Regression introduced in PR #5269.#5663
da65c78Thanks @Khizr97! - fix(ethers,ethers5): resolve walletProvider after account switch in modaluseAppKitProviderreturned a stale provider when switching accounts inside themodal. In the early-return path of
connect(),connector.providerwas neverinitialised, causing the base-client's
accountChangedhandler to skipsyncProvider(). The provider is now resolved fromethersProvidersbefore theevent is emitted.
#5706
ccf0dcbThanks @ignaciosantise! - fix: persist the universal-link base as the WalletConnect deeplink choice whenexperimental_preferUniversalLinksis enabled, so session-request re-opens (handled by universal-provider) use the wallet's universal link instead of falling back to its native custom schemeUpdated dependencies [
f2d2539,e5ee43c,da65c78,ccf0dcb]:v1.8.22Compare Source
Patch Changes
#5697
6b9c313Thanks @enesozturk! - Add a headless read for the WalletConnect URI, so a host can render a QR without theuseAppKitWalletsReact hook.The AppKit instance now exposes
getWalletConnectUri()— returning{ wcUri, wcError, wcFetchingUri }— andsubscribeWalletConnectUri(). Both read the connection layer directly (mirroring the existinggetWalletList()/subscribeWalletList()pair), so a headless host gets the URI ungated through the instance without importing@reown/appkit-controllers(which can otherwise resolve to a different valtio singleton). This replaces the connection-levelsubscribeConnections, which is gated behind themultiWalletremote feature and so can't serve the URI for a single-wallet QR.Breaking: the imperative pre-fetch trigger previously named
getWalletConnectUri()is renamed toprefetchWalletConnectUri(), freeinggetWalletConnectUri()for the new read.#5701
fb09a6dThanks @enesozturk! - Add headless reset methods for the WalletConnect URI + connecting-wallet state.The AppKit instance now exposes
resetWalletConnectUri()andresetConnectingWallet()— thin passthroughs toHeadlessWalletUtil.resetWcUri()/resetConnectingWallet(). A headless host that reads the URI viagetWalletConnectUri()can now clear it (e.g. when a QR is dismissed or a connection is cancelled) through the instance, without importing@reown/appkit-controllers. This completes the headless WalletConnect-URI surface alongsidegetWalletConnectUri/subscribeWalletConnectUri/prefetchWalletConnectUri.#5695
a4b2d2fThanks @enesozturk! - Expose the headless wallet list imperatively on the AppKit client, so a non-React host can list / search / connect wallets without theuseAppKitWalletsReact hook.New
AppKitinstance methods:fetchWallets(options?),getWalletList(),subscribeWalletList(cb),getWalletConnectUri(options?), andconnectWallet(wallet, namespace?, options?). The shared imperative logic lives in a newHeadlessWalletUtil(@reown/appkit-controllers), which both the client methods and the React hook can use — one tested code path for headless wallet listing, search, pagination, the WalletConnect URI, and programmatic connect (injected / API / mobile-deeplink).#5694
1c17897Thanks @enesozturk! - Fixed TRONtron_signTransactionpayload shape to respect the wallet'stron_method_versionsession property. The connector now sends the spec-mandated legacy nestedtransaction.transactionshape by default, and the simplified flat shape only when the wallet advertisestron_method_version: "v1"insessionProperties.Updated dependencies [
6b9c313,fb09a6d,a4b2d2f,1c17897]:v1.8.21Compare Source
Patch Changes
#5685
ea99fd1Thanks @enesozturk! - AddincludePayOnlyandsortoptions touseAppKitWallets().fetchWallets().includePayOnlysurfaces wallets that support WalletConnect Pay but are not v2-compatible (filtered out by default), andsort: 'wcpay'bubbles WalletConnect Pay-supporting wallets to the top.Updated dependencies [
ea99fd1]:v1.8.20Compare Source
Patch Changes
#5655
cc75433Thanks @rtomas! - Fix injected and EIP6963 wallets showing despite being disabled and appearing duplicated.enableInjectedis now wired through to the controller state, the wagmi adapter no longer conflates the basic injected connector with EIP6963-discovered ones, featured/recommended wallets are deduped against connectors regardless of theenableEIP6963flag, andincludeWalletIds/excludeWalletIdsnow also filter injected and EIP6963 connectors in the connect view.Updated dependencies [
08f5c48,f913185,ed51ea6,cc75433,6b7096e]:Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.