[alexander-sei]

Fixes the scheduled Sei Global Wallet Consumer Smoke failure, which has been red since October 6. Three sets of advisories landed after #354:

• GHSA-wq5f-xc86-pv6w (high, October 6) covers sharp below 0.35.5: a memory bug in the bundled librsvg (CVE-2026-96889) that can lead to RCE on glibc-based Linux when decoding untrusted SVG. Dynamic's @dynamic-labs/iconic still pins sharp@0.35.0 exactly, so the wallet-only npm consumer, which must audit clean, reported sharp plus the eight packages above it.
• GHSA-hqr4-qq8f-hg3x and GHSA-mjw6-4jj6-33hc (moderate, October 5) cover stream-json below 3.6.0, which jayson requires as CommonJS on the optional AA path.
• Six Vite and bundled launch-editor advisories (October 20 and 21) cover the vite@8.2.2 the verifier's browser consumer builds with.

Changes

• Move the sharp override from 0.35.4 to 0.35.5 in the verifier's override set and all three README blocks, and rewrite the README's Sharp note to cover both Sharp advisories.

• Accept the two stream-json advisories for the npm and Bun AA consumers. 3.6.0, the only fixed release, is still ESM-only under the moved src/ layout, so an override breaks jayson's require the same way it does for GHSA-528h-pc64-c93x. Neither is reachable from a wallet:

  • GHSA-hqr4-qq8f-hg3x is in the JSONC parser and verifier, and stream-json@1.9.1 ships no JSONC parser.
  • GHSA-mjw6-4jj6-33hc is in Assembler, which jayson runs only in its TCP and TLS transports. @solana/web3.js 1.98.1 imports only jayson/lib/client/browser, which loads uuid and generateRequest and nothing else.

  The README's waiver section now lists all three stream-json advisories.

• Bump the verifier's vite from 8.2.2 to 8.2.4, the patched release on the same minor.

• Add a @sei-js/sei-global-wallet patch changeset, since the override and waiver guidance ships in the package README.

Verification

• bun run test:sei-global-wallet-release (full run, without the fast-check flag) passes locally on Bun 1.3.14, the version main pins. The wallet-only npm consumer audits clean, the full npm consumer reports only the three waived stream-json advisories, and the Bun AA consumer reports only its waived bn.js, stream-json, and ws advisories.
• bun run check and bun run test:scripts (48 tests) pass.

No published dependency or peer range changes.

[cursor]

PR Summary

Low Risk
Documentation, audit waiver lists, and verifier harness pins only; no runtime API or published package contract changes.

Overview
Restores green Sei Global Wallet consumer smoke after registry advisories that did not change this repo’s dependency graph.

sharp consumer override moves from 0.35.4 to 0.35.5 in the README’s three required override blocks and in the release verifier’s baseSafeOverrides, so wallet-only npm installs audit clean against GHSA-wq5f-xc86-pv6w. The Sharp note now documents both high-severity Sharp issues (libheif and librsvg/SVG).

Optional AA path: two additional stream-json advisories (GHSA-hqr4-qq8f-hg3x, GHSA-mjw6-4jj6-33hc) are added to the documented waiver list and to acceptedNpmAdvisories / acceptedBunAdvisories in check-sei-global-wallet.ts, with README rationale (no fix without breaking jayson’s CommonJS require; not reachable on wallet/browser paths). Wallet-only npm remains waiver-free.

Verifier tooling: the browser consumer’s vite devDependency bumps 8.2.2 → 8.2.4 to clear recent Vite/launch-editor advisories.

Patch changeset only; no published dependency or peer range changes.

^{Reviewed by Cursor Bugbot for commit f3232f8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.82%. Comparing base (14103db) to head (f3232f8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #356   +/-   ##
=======================================
  Coverage   97.82%   97.82%           
=======================================
  Files          81       81           
  Lines        5652     5652           
=======================================
  Hits         5529     5529           
  Misses        123      123           

Flag	Coverage Δ
mcp-server	96.92% <ø> (ø)
precompiles	100.00% <ø> (ø)
registry	100.00% <ø> (ø)
sei-global-wallet	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[seidroid]

This PR raises the documented and verifier sharp override to 0.35.5, bumps the verifier's vite to 8.2.4, and waives two new stream-json advisories on the optional AA path only. The wallet-only npm consumer is still held to a clean audit, the README and script stay in sync, and a patch changeset is included. I found nothing blocking.

Findings: 0 blocking | 3 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• The Cursor review file (cursor-review.md) was empty, so that pass produced no output. Codex found no material issues.
• I couldn't check the advisory IDs and dates from the diff: GHSA-wq5f-xc86-pv6w / CVE-2026-96889, GHSA-hqr4-qq8f-hg3x and GHSA-mjw6-4jj6-33hc. The same goes for the claim that stream-json@1.9.1 ships no JSONC parser and that jayson/lib/client/browser never loads Assembler. Reviewers should confirm them against the GitHub Advisory Database before the waiver ships in the published README.
• The waiver scope is correct: the new IDs go only into acceptedNpmAdvisories and acceptedBunAdvisories, which apply to the full AA consumers. The wallet-only consumer stays strictly audit-clean, and the existing 'now audits clean' check will flag the waivers once upstream fixes land. Consider tracking a follow-up to drop the stream-json waivers once jayson or @solana/web3.js move off the CommonJS stream-json@1.x.