From 127948a7130a08f3f557a32f829ecc1421bfd8de Mon Sep 17 00:00:00 2001 From: David Kaplan Date: Fri, 7 Aug 2026 19:57:30 +0000 Subject: [PATCH 1/2] fix(unspents): pin varuint-bitcoin as explicit direct dependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit src/inputWeights.ts directly imports varuint-bitcoin for encodingLength used in all fee/vsize calculations, but it was previously declared with a caret range (^1.0.4) that could resolve unexpected 1.x releases. Tighten the declared range to ~1.1.2 (patch-level tilde) so the version this package executes is controlled by its own range — not by whatever @bitgo/utxo-lib's transitive copy happens to resolve to. This also eliminates the phantom-dependency risk under strict linkers (pnpm default, Yarn PnP) where hoisting is not guaranteed. Ticket: WCN-2005 Session-Id: 246d0476-a850-4ced-ba5e-27978aa7cc08 Task-Id: 11c93817-9a0a-4fbb-b685-5cf43507b89a --- modules/unspents/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/unspents/package.json b/modules/unspents/package.json index ebdfd7ea7b..d5b86faff7 100644 --- a/modules/unspents/package.json +++ b/modules/unspents/package.json @@ -39,7 +39,7 @@ "@bitgo/utxo-lib": "^11.24.2", "lodash": "^4.18.0", "tcomb": "~3.2.29", - "varuint-bitcoin": "^1.0.4" + "varuint-bitcoin": "~1.1.2" }, "lint-staged": { "*.{js,ts}": [ From 3c3dda75ca2f2b6e25e88d2aa64a1330b9e6255b Mon Sep 17 00:00:00 2001 From: David Kaplan Date: Fri, 7 Aug 2026 20:05:37 +0000 Subject: [PATCH 2/2] chore(unspents): update yarn.lock for varuint-bitcoin range change Replace the ^1.0.4 key alias in the yarn.lock stanza with ~1.1.2 to match the updated package.json range. Resolved version remains 1.1.2; only the declared range key changes. Required so --frozen-lockfile CI installs do not fail on the mismatch. Ticket: WCN-2005 Session-Id: 246d0476-a850-4ced-ba5e-27978aa7cc08 Task-Id: 11c93817-9a0a-4fbb-b685-5cf43507b89a --- yarn.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yarn.lock b/yarn.lock index c7b425b304..53ff00d433 100644 --- a/yarn.lock +++ b/yarn.lock @@ -20811,7 +20811,7 @@ validator@13.15.23, validator@^13.7.0: resolved "https://registry.npmjs.org/validator/-/validator-13.15.23.tgz#59a874f84e4594588e3409ab1edbe64e96d0c62d" integrity sha512-4yoz1kEWqUjzi5zsPbAS/903QXSYp0UOtHsPpp7p9rHAw/W+dkInskAE386Fat3oKRROwO98d9ZB0G4cObgUyw== -varuint-bitcoin@^1.0.1, varuint-bitcoin@^1.0.4, varuint-bitcoin@^1.1.2: +varuint-bitcoin@^1.0.1, varuint-bitcoin@^1.1.2, varuint-bitcoin@~1.1.2: version "1.1.2" resolved "https://registry.npmjs.org/varuint-bitcoin/-/varuint-bitcoin-1.1.2.tgz" integrity sha512-4EVb+w4rx+YfVM32HQX42AbbT7/1f5zwAYhIujKXKk8NQK+JfRVl3pqT3hjNn/L+RstigmGGKVwHA/P0wgITZw==