update dependencies

[mr-zwets]

claude:

Dependency update

Routine refresh of dependencies across the monorepo, plus one security fix that actually
mattered. Nothing here changes the behaviour of the compiler or the SDK — it is all tooling,
type definitions, and lockfile hygiene.

@types/node 22 → 24

Bumped in all three places that declare it: the workspace root, packages/cashc, and
examples. This only affects type checking; it does not change what Node version the packages
run on.

ws security advisory → resolutions entry

yarn audit flagged 115 distinct advisories, but exactly one of them sits on a production
path that ships to users:

cashscript > @electrum-cash/network > @electrum-cash/web-socket > ws

The lockfile was pinned to ws@8.18.1; the advisory requires >= 8.21.0. Since ws is a
transitive dependency, Yarn 1 offers no way to bump it directly, so the root package.json now
carries:

"resolutions": {
  "ws": "^8.21.3"
}

@electrum-cash/web-socket already declares ws: "^8.13.0", so this is not a version override
in any meaningful sense — it just forces the stale lockfile entry forward and pins a floor so
the same drift cannot happen again.

Worth being explicit about the scope: resolutions only applies to this repo's install. It is
not honoured for consumers of the published cashscript package — they resolve ws themselves
from @electrum-cash/web-socket's range, and a fresh install already lands on a patched version.
The durable fix is upstream raising that floor.

@electrum-cash/network 4.1.3 → 4.2.2

Minor bump within the existing ^4 range. This is the package that pulls in ws, so it is
updated alongside the resolution above.

cspell 9 → 10

The only breaking change in cspell 10 is dropping Node 20 support (it now requires ≥ 22.18).
CI runs Node 22 and the package is dev-only, so there is no impact. Clears 6 advisories
(flatted, smol-toml, picomatch, yaml).

Test tooling and small bumps

• vitest and @vitest/coverage-v8 4.0.15 → 4.1.10 (all packages)
• tsx 4.20.3 → 4.23.12
• semver 7.7.2 → 7.8.5, @types/semver → 7.8.0
• fflate 0.8.2 → 0.8.3

Removed

• cpy-cli from packages/cashc. It was referenced nowhere in the repo — no script invokes
  cpy, and build is just yarn clean && yarn compile. Leftover from an older build step.

Deliberately not included

• commander 14 → 15. Works fine technically (cashc is already ESM, and the CLI defines no
  --no-* options), but v15 is ESM-only and requires Node ≥ 22.12, which would raise the runtime
  floor for everyone installing cashc. The release adds nothing we need — one improved error
  message — and v14 has no advisories and is supported until May 2027. Revisit when we are ready
  to drop Node 20 for CLI users, and add an engines field at the same time.
• lerna 3 → 10. Accounts for 92 of the 115 advisories, including all 25 criticals, all via
  its bundled @evocateur/* fork of pacote. Entirely dev-only and unreachable at runtime, but a
  major upgrade that touches bootstrap and publish — deserves its own PR.
• eslint 8 → 9 and @typescript-eslint 7 → 8. Flat config migration; separate chore.

Note

@types/node is ^24 at the root but ^24.13.3 in packages/cashc and examples. Harmless,
but worth making consistent. Also, the types now describe the Node 24 API surface while CI runs
Node 22 — in principle that lets an API land in source that does not exist at runtime on 22.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cashscript	Ready	Preview	Aug 11, 2026 8:57am

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (next@e491f8f). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             next     #435   +/-   ##
=======================================
  Coverage        ?   87.46%           
=======================================
  Files           ?       59           
  Lines           ?     4835           
  Branches        ?      897           
=======================================
  Hits            ?     4229           
  Misses          ?      476           
  Partials        ?      130           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.