fix: replace deprecated @paulmillr/qr with qr - #1396
Open
ZayanKhan-12 wants to merge 2 commits into
Open
Conversation
@paulmillr/qr is deprecated on npm with the notice 'Switch to qr (new package name) for security updates'. The qr package is the same library by the same author with an identical API (default-export encodeQR, same Output types and QrOpts), so this is a rename-only swap across the four packages that declared it. Fixes MetaMask#1297 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
@paulmillr/qris deprecated on npm: "Switch to qr (new package name) for security updates".qris the same library by the same author with an identical API (default-exportencodeQR, sameOutputunion andQrOpts), so this is a rename-only swap.Changes:
packages/sdk,packages/sdk-install-modal-web,packages/sdk-multichain,packages/sdk-multichain-ui: dependency@paulmillr/qr@^0.2.1→qr@^0.6.0import encodeQR from '@paulmillr/qr'sites,declare moduleshims, and test mocks updated to'qr'Both packages are ESM-only, so module-format behavior for consumers is unchanged (
qr'sengines: node >=20.19reflects itsrequire(esm)support).Fixes #1297
Testing
yarn workspace @metamask/sdk-install-modal-web build✅yarn workspace @metamask/sdk build+test— QR-related suites pass (the two failing suites,isOldIOS/PlatfformManager, fail identically on unmodifiedmainunder Node ≥21 —Cannot redefine property: navigator— unrelated to this change)yarn workspace @metamask/sdk-multichain test— 256 tests pass (includes theqrmock suites)yarn workspace @metamask/sdk-multichain-ui build✅🤖 Generated with Claude Code
Note
Low Risk
Dependency rename with the same
encodeQRAPI and updated tests/mocks; no auth or connection logic changes, only QR encoding for install modals.Overview
Swaps the deprecated
@paulmillr/qrdependency forqr@^0.6.0across@metamask/sdk,sdk-install-modal-web,sdk-multichain, andsdk-multichain-ui, with matchingyarn.lockupdates.All
encodeQRimport sites,declare moduleshims, and test mocks now target'qr'instead of'@paulmillr/qr'(Stencil install/select modals, Node install modals, and related tests). Changelogs record the change under [Unreleased]; call patterns such asencodeQR(link, 'ascii')andencodeQR(link, 'svg', { ecc, scale })are unchanged.Reviewed by Cursor Bugbot for commit d986350. Bugbot is set up for automated code reviews on this repo. Configure here.