[pietro909]

Summary by CodeRabbit

• Chores
  • Updated several underlying dependencies to newer versions to improve compatibility, stability, and security of the app.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2d7d7722-c57d-45bc-ae97-d573ab8ff750

📥 Commits

Reviewing files that changed from the base of the PR and between 9a49f89 and c6f734d.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

✅ Files skipped from review due to trivial changes (1)

• package.json

---

Walkthrough

Updated dependency versions in package.json: @arkade-os/boltz-swap 0.3.5 → 0.3.7, @arkade-os/sdk 0.4.7 → 0.4.9, and dompurify ^3.2.6 → ^3.3.3.

Changes

Cohort / File(s)	Summary
Dependency updates package.json	Bumped @arkade-os/boltz-swap (0.3.5 → 0.3.7), @arkade-os/sdk (0.4.7 → 0.4.9), and dompurify (^3.2.6 → ^3.3.3).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• Upgrade ts-sdk@0.4.8 and boltz-swap@0.3.6 #441: Bumps @arkade-os/boltz-swap and @arkade-os/sdk in package.json.
• Upgrade sdk 0.4.6 - boltz-swap 0.3.4 #432: Updates the same dependencies (@arkade-os/sdk, @arkade-os/boltz-swap).
• Revert "Upgrade ts-sdk@0.4.8 and boltz-swap@0.3.6" #443: Modifies @arkade-os/sdk and @arkade-os/boltz-swap entries in package.json.

Suggested reviewers

• bordalix
• Kukks

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and specifically summarizes the main changes: upgrading two key dependencies (@arkade-os/sdk to 0.4.9 and @arkade-os/boltz-swap to 0.3.7), which are the primary focus of this changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch upgrade-ts-sdk-0.4.9-boltz-swap-0.3.7

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ghost]

🔍 Arkana Review — Dependency Bump

Changes: @arkade-os/sdk 0.4.7→0.4.9, @arkade-os/boltz-swap 0.3.5→0.3.7, dompurify 3.3.0→3.3.2

Assessment: Clean version bumps, lockfile consistent with specifiers.

• sdk 0.4.9 — picks up recent TS SDK work (asset support, fixes from ts-sdk#353–#365)
• boltz-swap 0.3.7 — aligns with boltz-swap#99/#100 changes
• dompurify 3.3.2 — pinned (was ^3.2.6), adds engines: {node: ">=20"} constraint; worth noting the pin is intentional vs the previous caret range

No security concerns. Lockfile integrity hashes present and consistent.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 21: Package.json changed dompurify from ^3.2.6 to pinned 3.3.2 which both
removes automatic patch/minor updates and skips the current 3.3.3 release;
because InfoBox (in src/components/AlertBox.tsx) calls DOMPurify.sanitize(html)
you must either restore a permissive range (e.g., ^3.3.3 or >=3.2.6 <4) or
explicitly bump to the latest 3.3.3, then run targeted verification: load
representative PSA HTML cases used by InfoBox and compare sanitized output
before/after the upgrade (pay attention to raw-text/textarea handling and jsdom
parsing changes), update tests or sanitization options if output changed, and
document/approve pinning decision if you intentionally want to lock to a
specific patch.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 09483bd3-7bce-44c9-b678-a010cb4caf33

📥 Commits

Reviewing files that changed from the base of the PR and between da3a767 and 9a49f89.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

[cloudflare-workers-and-pages]

Deploying wallet-mutinynet with    Cloudflare Pages

Latest commit:	c6f734d
Status:	✅  Deploy successful!
Preview URL:	https://d696a760.arkade-wallet.pages.dev
Branch Preview URL:	https://upgrade-ts-sdk-0-4-9-boltz-s.arkade-wallet.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying wallet-bitcoin with    Cloudflare Pages

Latest commit:	c6f734d
Status:	✅  Deploy successful!
Preview URL:	https://25aa556d.wallet-bitcoin.pages.dev
Branch Preview URL:	https://upgrade-ts-sdk-0-4-9-boltz-s.wallet-bitcoin.pages.dev

View logs

[ghost]

🔍 Arkana PR Review — Iterative Update

Scope: 1 new commit (c6f734de) since last review — switches dompurify specifier from ^3.3.2 to ^3.3.3, resolving to 3.3.3 in the lockfile.

Assessment

✅ No issues. This is a semver range relaxation. The ^3.3.3 specifier still pins to the 3.x line. DOMPurify 3.3.3 contains minor fixes for textarea/noscript edge cases in jsdom environments — not relevant to the browser runtime this PWA uses.

Lockfile is consistent. No functional change to sanitization behavior (the wallet calls DOMPurify.sanitize() with defaults on simple HTML).

Verdict: LGTM — clean dependency update.