chore: bump @polkadot/keyring from 13.4.3 to 14.0.3#3256
chore: bump @polkadot/keyring from 13.4.3 to 14.0.3#3256dependabot[bot] wants to merge 1 commit into
Conversation
✅ No Blockers —
|
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Approved — 3 non-blocking findings — 53990006
Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Latest PR review status: sticky summary
tangletools · 2026-06-03T17:42:18Z · immutable trace
Bumps [@polkadot/keyring](https://github.com/polkadot-js/common/tree/HEAD/packages/keyring) from 13.4.3 to 14.0.3. - [Release notes](https://github.com/polkadot-js/common/releases) - [Changelog](https://github.com/polkadot-js/common/blob/master/CHANGELOG.md) - [Commits](https://github.com/polkadot-js/common/commits/v14.0.3/packages/keyring) --- updated-dependencies: - dependency-name: "@polkadot/keyring" dependency-version: 14.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/polkadot/keyring-14.0.3
branch
from
5399000 to
6501d8f
Compare
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
✅ Auto-approved PR — 6501d8f0
Blanket team auto-approval is enabled for this reviewer service.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.
tangletools · auto-approval · reason: blanket_auto_approve · 2026-06-21T20:01:57Z
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
⚪ Value Audit — audit-incomplete
| Verdict | audit-incomplete |
| Concerns | 0 (none) |
| Heuristic | 0.0s |
| Duplication | 0.0s |
| Interrogation | 180.9s (2 bridge agents) |
| Total | 180.9s |
💰 Value — error
value agent produced no parseable value-audit JSON.
- Model: opencode/deepseek/deepseek-v4-pro
- Bridge attempts: 3
- Bridge error: opencode/kimi-for-coding/k2p7: bridge stream ended without value-audit content; opencode/zai-coding-plan/glm-5.2: bridge stream ended without value-audit content; opencode/deepseek/deepseek-v4-pro: bridge stream ended without value-audit content
🎯 Usefulness — error
usefulness agent produced no parseable value-audit JSON.
- Model: opencode/deepseek/deepseek-v4-pro
- Bridge attempts: 3
- Bridge error: opencode/zai-coding-plan/glm-5.2: bridge stream ended without value-audit content; opencode/kimi-for-coding/k2p7: bridge stream ended without value-audit content; opencode/deepseek/deepseek-v4-pro: bridge stream ended without value-audit content
No PR concerns were produced because the value/usefulness agent pass did not complete. Treat this audit as incomplete, not as approval.
What this audit checks
It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.
| Pass | What it asks |
|---|---|
| Heuristic | Vague title? Whitespace-only or cruft-bearing diff? (content signals only) |
| Duplication | Do added function/class names already exist elsewhere in the repo? |
| Value Audit | What does it do? What goal does it achieve? Is it good? Better architecture or already-exists? |
| Usefulness Audit | Does it integrate and fit? Will it hold up in real use and actually get used? |
Findings are concerns, not blocks — the human reviewer decides what to do with them.
❌ Needs Work —
|
| opencode-kimi | glm | deepseek | aggregate | |
|---|---|---|---|---|
| Readiness | 45 | 79 | 92 | 45 |
| Confidence | 70 | 70 | 70 | 70 |
| Correctness | 45 | 79 | 92 | 45 |
| Security | 45 | 79 | 92 | 45 |
| Testing | 45 | 79 | 92 | 45 |
| Architecture | 45 | 79 | 92 | 45 |
Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision.
Blocking
🔴 HIGH Incomplete Polkadot JS major-version upgrade causes peer-dependency mismatch — package.json
Line 77 bumps @polkadot/keyring to ^14.0.3, but lines 80-81 leave @polkadot/util and @polkadot/util-crypto at ^13.4.3. yarn.lock:8373-8378 shows @polkadot/keyring@14.0.3 has both dependencies and peerDependencies pinned to @polkadot/util 14.0.3 and @polkadot/util-crypto 14.0.3. This forces two major versions of util/util-crypto into the tree. Polkadot JS packages require strict major-version alignment; this can produce crypto/keyring type mismatches and runtime errors. scripts/util.ts imports Keyring from @polkadot/api (v13, which transitively uses keyring v13 per yarn.lock:8630)
🔴 HIGH @polkadot/keyring v14 bump conflicts with locked @polkadot/util/util-crypto v13 — yarn.lock
yarn.lock:34216 bumps the workspace root to '@polkadot/keyring': 'npm:^14.0.3', but @polkadot/keyring@14.0.3 (yarn.lock:8369-8378) has peerDependencies on @polkadot/util@14.0.3 and @polkadot/util-crypto@14.0.3. The workspace root still provides @polkadot/util@13.4.3 and @polkadot/util-crypto@13.4.3 (yarn.lock:9369-9380), and @polkadot/api@13.2.1 (yarn.lock:8207) still depends on @polkadot/keyring ^13.1.1.
yarn install --immutableemits YN0060 peer warnings andyarn explain peer-requirements pe9a79reports the requested ranges have no overlap. This duplicates major versions of crypto/keyring packages and is a known source of runtime type/instanceof incompatibilities in polkadot-js. Fix by either reverting keyring to ^13.4.3 in yarn.lock/package.json, or bumping the full polkadot suite (
Other
🟠 MEDIUM Major-version bump of @polkadot/keyring without lockstep bump of other @polkadot/* packages creates version misalignment — package.json
package.json:77 changes @polkadot/keyring from ^13.4.3 to ^14.0.3 while @polkadot/api (^13.2.1, line 73), @polkadot/types (^13.2.1, line 79), @polkadot/util (^13.4.3, line 80), and @polkadot/util-crypto (^13.4.3, line 81) remain on v13. yarn.lock:8369-8378 shows keyring@14.0.3 declares exact peer deps @polkadot/util:14.0.3 and @polkadot/util-crypto:14.0.3, which it pulls in tra
🟡 LOW @polkadot/* version mix: keyring v14 with api/util/util-crypto at v13 — package.json
Line 77 bumps @polkadot/keyring to ^14.0.3 while @polkadot/api (line 73), @polkadot/types (line 79), @polkadot/util (line 80), and @polkadot/util-crypto (line 81) remain at v13.x. The @polkadot/* monorepo releases in lockstep — mixing major versions risks peer-dep mismatch a
🟡 LOW Duplicate @polkadot/util/util-crypto/keyring installed; bundle bloat and latent singleton risk — package.json
Because keyring@14.0.3 pins exact peer deps util@14.0.3 and util-crypto@14.0.3, yarn installs both v13.x and v14.0.3 copies. Node_modules and any bundler that fails to dedupe across majors will carry the extra ~117KB (matches the comment at libs/ui-components/src/components/Avatar/Identicon.tsx:7). Any future code that does a runtime import from '@polkadot/keyring' at root will instantiate the v14 crypto singletons, which are isolated from the v13 singletons used by @polkadot/api — known root cause of 'multiple instances of @polkadot/util-crypto' runtime errors in the polkadot-js ecosystem. No runtime import exists today, so impact is latent.
🟡 LOW Type-only import crosses major versions; typecheck may regress — package.json
scripts/util.ts:3 imports KeyringPair from @polkadot/keyring/types (now resolved to v14 type defs), while the runtime Keyring instance comes from @polkadot/api (v13, which wraps keyring@13.5.9). addFromUri() returns a v13 KeyringPair but is annotated against the v14 KeyringPair type. If v14 introduced required fields, removed fields, or renamed members on KeyringPair, yarn typecheck (nx typecheck) will fail. No typecheck run is shown in the PR. Mitigation: run yarn typecheck against this change before merge; if it fails, either align all @polkadot/* on v14 or revert.
tangletools · 2026-06-21T20:20:43Z · trace
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
❌ 2 Blocking Findings — 6501d8f0
Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision.
Full immutable report for this review: trace
Summary comment for this run: full summary
tangletools · 2026-06-21T20:20:43Z · immutable trace
1 participant
Bumps @polkadot/keyring from 13.4.3 to 14.0.3.
Release notes
Sourced from @polkadot/keyring's releases.
... (truncated)
Changelog
Sourced from @polkadot/keyring's changelog.
... (truncated)
Commits
9281daa[CI Skip] release/stable 14.0.3c7ed69f14.0.3 (#2025)22a1246[CI Skip] bump/beta 14.0.3-0-x152d460[CI Skip] release/stable 14.0.24ab957e14.0.2 (#2023)610c8bb[CI Skip] bump/beta 14.0.2-1-xa8732a9[CI Skip] bump/beta 14.0.2-0-x8d3cb0eSet headers to 2026 (#2021)fe0886b[CI Skip] release/stable 14.0.1bac357a14.0.1 (#2014)Maintainer changes
This version was pushed to npm by paritytech-ci, a new releaser for
@polkadot/keyringsince your current version.