From 0b980ffc5b300d32e032eba21be544a79a8cd2af Mon Sep 17 00:00:00 2001 From: Akash Gianchandani Date: Tue, 11 Aug 2026 15:15:17 +0530 Subject: [PATCH] fix(sdk-coin-iota): constrain @iota/iota-sdk to node-20 range @iota/iota-sdk raised engines.node from ">=20" to ">=24" in 1.11.0, a minor release. Because this package declares "^1.6.0", any fresh resolve now picks 1.15.x and the install fails engine checks on Node 20: npm error code EBADENGINE npm error engine Not compatible with your version of node/npm: @iota/iota-sdk@1.15.0 npm error notsup Required: {"node":">=24"} npm error notsup Actual: {"npm":"10.8.2","node":"v20.20.2"} That contradicts this package's own "engines": { "node": ">=20" }, and BitGoJS CI still runs a 20.x/22.x/24.x matrix. Our lockfile is the only reason the Node 20 leg passes today; any lockfile refresh breaks it. sdk-coin-iota is a hard (non-optional, non-peer) dependency of the @bitgo/bitgo aggregate, so every consumer inherits the constraint. Downstream repos cannot work around it: npm `overrides` do not bind when npm nests the package under @bitgo/bitgo/node_modules, which is where it lands once that aggregate is bumped. 1.10.1 is the newest release that still supports Node 20, so the range is capped below 1.11.0. This moves the resolved version 1.6.1 -> 1.10.1 and, inside iota-sdk's own subtree, @iota/bcs 1.2.0 -> 1.4.0 and valibot ^0.36.0 -> ^1.2.0. The imports this module uses are all stable subpaths (transactions, utils, cryptography, keypairs/ed25519). TICKET: GOA-1525 --- modules/sdk-coin-iota/package.json | 2 +- yarn.lock | 23 +++++++++++++++-------- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/modules/sdk-coin-iota/package.json b/modules/sdk-coin-iota/package.json index d2828b06c9..65b96cdb36 100644 --- a/modules/sdk-coin-iota/package.json +++ b/modules/sdk-coin-iota/package.json @@ -44,7 +44,7 @@ "@bitgo/sdk-core": "^38.6.0", "@bitgo/statics": "^59.4.0", "@iota/bcs": "^1.2.0", - "@iota/iota-sdk": "^1.6.0", + "@iota/iota-sdk": ">=1.6.0 <1.11.0", "bignumber.js": "^9.1.2", "lodash": "^4.18.0" }, diff --git a/yarn.lock b/yarn.lock index 123c5d4137..82001ae13c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3145,20 +3145,27 @@ resolved "https://registry.npmjs.org/@inquirer/type/-/type-3.0.8.tgz" integrity sha512-lg9Whz8onIHRthWaN1Q9EGLa/0LFJjyM8mEUbL1eTi6yMGvBf8gvyDLtxSXztQsxMvhxxNpJYrwa1YHdq+w4Jw== -"@iota/bcs@1.2.0", "@iota/bcs@^1.2.0": +"@iota/bcs@1.4.0": + version "1.4.0" + resolved "https://registry.npmjs.org/@iota/bcs/-/bcs-1.4.0.tgz#a6b26ffc9b86d99bec0fe860778b1ce02731bd32" + integrity sha512-Bpg8uPB3UTweJyFS3G+aycGcTCxaJQi2a9bEy2QXWMBM8a/tLN1KCg4IzKWkAJ4FyMNrZZrdXiBqAzmNK6xdVQ== + dependencies: + bs58 "^6.0.0" + +"@iota/bcs@^1.2.0": version "1.2.0" resolved "https://registry.npmjs.org/@iota/bcs/-/bcs-1.2.0.tgz" integrity sha512-QdRSR0KpJ87tdjVNmM/j0+0DvE0aTxHIa02337iluaOsMqtJ8OdgUCfSyLduC/3qS+8tJE+UB1KOw55tF+sN2w== dependencies: bs58 "^6.0.0" -"@iota/iota-sdk@^1.6.0": - version "1.6.1" - resolved "https://registry.npmjs.org/@iota/iota-sdk/-/iota-sdk-1.6.1.tgz" - integrity sha512-V7rx7m9erCn9lr4hNZVMtwmka2NsoTZ9EFSE4ZqEDO44cWdheM61+i/y5HJhvvmYAb/kkDfSmfdmzLaGTbVVYg== +"@iota/iota-sdk@>=1.6.0 <1.11.0": + version "1.10.1" + resolved "https://registry.npmjs.org/@iota/iota-sdk/-/iota-sdk-1.10.1.tgz#49ad63c2c0dbb967f741328ca567b6a4360739a0" + integrity sha512-q0GxOCFzPqIcaw1lFuFljmMDj1ajIK6UZFzOYnnPqfs/nufOZrJQ9Bg/hLj23xbMno/tdND+aIjDWY6GG8MAXw== dependencies: "@graphql-typed-document-node/core" "^3.2.0" - "@iota/bcs" "1.2.0" + "@iota/bcs" "1.4.0" "@noble/curves" "^1.4.2" "@noble/hashes" "^1.4.0" "@scure/bip32" "^1.4.0" @@ -3169,7 +3176,7 @@ gql.tada "^1.8.2" graphql "^16.9.0" tweetnacl "^1.0.3" - valibot "^0.36.0" + valibot "^1.2.0" "@isaacs/balanced-match@^4.0.1": version "4.0.1" @@ -20794,7 +20801,7 @@ v8-compile-cache@^2.0.3: resolved "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.4.0.tgz" integrity sha512-ocyWc3bAHBB/guyqJQVI5o4BZkPhznPYUG2ea80Gond/BgNWpap8TOmLSeeQG7bnh2KMISxskdADG59j7zruhw== -valibot@1.2.0, valibot@^0.36.0: +valibot@1.2.0, valibot@^1.2.0: version "1.2.0" resolved "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz#8fc720d9e4082ba16e30a914064a39619b2f1d6f" integrity sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==