July 2026 Stack Modernization Release

This release reconciles the TypeScript stack onto one Node.js 24, pnpm 10, TypeScript 6, and Oxlint baseline. It removes stale first-party registry pins, refreshes compatible direct dependencies, replaces the legacy AsyncAPI generator, reduces overrides to one time-bounded Jest security compatibility substitution, removes every known audit finding, and prepares every changed public package for the protected OIDC workflow. Package publication remains a separate operator-approved action.

Compatibility and security highlights

• @bsv/sdk now preserves OP_16 PushDrop fields, emits canonical comma-separated X-Topics, uses the configured HTTP client for SHIP submissions, produces fixed-width cross-SDK Schnorr linkage proofs, and can preserve already-signed inputs.
• Overlay HTTP accepts canonical comma-separated topics and the legacy JSON array during migration. Empty payloads receive stable validation errors.
• Overlay proof refresh persists updated Merkle paths through recursive source transactions.
• Remote wallet basket queries remain scoped to the authenticated user.
• Internal workspace dependencies use workspace:^; public SDK peer ranges remain broad enough to prevent duplicate nominal SDK types.
• The client and mobile wallet-toolbox packages own their build artifacts, so recursive workspace builds order every consumer correctly from a clean checkout.
• AsyncAPI reference pages are rendered deterministically with yaml and no remote assets or legacy generator/parser chain.
• The docs site uses React Router 8 with a repository-owned static renderer.
• Direct esbuild-based library builds remove an obsolete bundler advisory path while preserving each package's CJS, ESM, and declaration contracts, plus the relay's source-map and watch contracts.
• The frozen audit has no known findings or advisory holds. The only remaining override is a time-bounded, fully tested Jest/brace-expansion security substitution. See Dependency and Release Policy.

Public package manifest

Consumer baseline

Applications should use Node.js 24.11 or newer and install the latest package versions normally. Libraries that expose SDK types should declare @bsv/sdk as a peer dependency instead of bundling another runtime copy. Overlay deployments should accept both X-Topics formats during the transition and emit the comma-separated canonical form.

The release is validated by the frozen install, audit gate, full workspace build, package test suites, 6,650 conformance vectors, docs render/link check, dependency review, CodeQL, Socket, and the repository merge gate.