chore(deps): update dependencies and clear transitive advisories

[chybisov]

Dependency maintenance. No behaviour change in any published package.

Direct bumps

Package	From	To	Where
@biomejs/biome	2.5.3	2.5.5	root, dev
@changesets/cli	2.31.0	2.31.1	root, dev
fs-extra	11.3.6	11.4.0	root, dev
knip	6.26.0	6.29.0	root, dev
tsdown	0.22.7	0.22.14	root, dev
react / react-dom	19.2.7	19.2.8	@bigmi/react, dev
@wallet-standard/app / base	^1.1.0	^1.1.1	@bigmi/client, runtime

The @wallet-standard change is a range bump only — ^1.1.0 already resolved to 1.1.1, so nothing shifts for consumers.

Security advisories

All seven open Dependabot alerts are now clear. Five resolve from the lockfile refresh alone:

• brace-expansion → 5.0.8 (2 alerts, high)
• js-yaml → 3.15.0 / 4.3.0 (2 alerts, high)
• fast-uri → 3.1.4 (high)

The other two are pinned by dependents that have not moved yet, so they need overrides in pnpm-workspace.yaml:

• postcss 8.5.15 → ≥8.5.18 (high) — pinned by vite@8.1.0, dev-only
• valibot 1.4.1 → ≥1.4.2 (medium) — pinned by bitcoinjs-lib@7.0.1

Each override carries a note to drop it once the parent ships a release that resolves past the patched version. Worth knowing: the valibot override fixes our lockfile, not downstream consumers' — they resolve bitcoinjs-lib's own range. The real fix there is upstream.

tsdown deprecation

0.22.14 deprecates deps.skipNodeModulesBundle in favour of deps.neverBundle, and the build started warning twice per package. Updated all three tsdown.config.ts files. Verified the emitted output is equivalent — packages/core/dist/esm/utils/getAddressInfo.js still has import { sha256 } from "@noble/hashes/sha256" rather than an inlined copy, so dependencies stay external.

Release-age gate

minimumReleaseAgeExclude still listed the superseded tsdown@0.22.7 tree — every entry was stale (yuku-*@0.6.1, rolldown-plugin-dts@0.27.8). Refreshed to what the lockfile now pins (0.8.0 / 0.27.14 / 0.22.14).

This is not cosmetic: tsdown@0.22.14 was published ~23h before this PR, right at the gate that broke the release pipeline in #63. Verified with pnpm install --frozen-lockfile, which re-validated all 564 entries in 10.4s from cold rather than reusing the cached result.

Deliberately excluded: @noble/hashes 2.x

pnpm outdated reports 1.8.0 → 2.2.0, but it should not go in a routine bump:

1. It would duplicate the library. bitcoinjs-lib@7.0.1 and bs58check@4.0.0 both declare ^1.2.0, which cannot resolve to 2.x. Today all three dependents dedupe to a single 1.8.0; bumping only @bigmi/core puts two copies of the hashing library in every consumer's bundle.
2. It is a breaking API change. v2 dropped the ./sha256 subpath — its exports map has only ./sha2.js. getAddressInfo.ts:1 does import { sha256 } from '@noble/hashes/sha256', which would fail to resolve outright.

So it needs its own PR with a @bigmi/core changeset, and is best done once bitcoinjs-lib supports v2 — otherwise consumers pay the duplication.

One preparatory step is available now if wanted: @noble/hashes/sha2.js exports sha256 on both 1.8.0 and 2.2.0 (verified against the installed 1.8.0), so switching the import path is forward-compatible and would decouple that change from the version bump.

Validation

pnpm check, check:types, check:circular-deps, knip:check, test (28 client + 32 core / 1 skipped), and build all pass. Empty changeset included — release-less by design.

[changeset-bot]

🦋 Changeset detected

Latest commit: 115ee72

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR