release: v1.4.0 → main by philanton · Pull Request #850 · layer-3/nitrolite

philanton · 2026-06-18T09:01:13Z

Release v1.4.0

Highlights

Audit remediation — MF3 final round (fix: audit findings round final 3 #846): security hardening across contracts, nitronode, SDK, and RPC.
- Contract: reentrancy guard + event-handler monotonicity, reorg double-spend confirmation gate.
- Breaking: removed app registry, action allowances, user staking, and rebalance feature; removed SDK locking client + app-registry ABI; RPC surface (docs/api.yaml) trimmed.
- DoS/overflow fixes: pagination limit=0, uint8 quorum overflow, frame-layer rate limit, deposit-state enforcement.
feat(nitronode): add USDC asset across 7 chains (feat(nitronode/config/prod): add USDC asset across 7 chains #845)
fix(go-sdk): preserve channel challenge expiry (fix(go-sdk): preserve channel challenge expiry #816)
Fix SDK MCP Hono audit failure (Fix SDK MCP Hono audit failure #821)
Dependency bumps (gomod, npm, ws).

Versioning note

Minor bump (1.3.1 → 1.4.0). Note: removal of app-registry/staking/rebalance + RPC methods is a breaking change for downstream consumers — flagged here rather than a major bump per 1.x cadence.

MCP

mcp-v1.4.0 tag intentionally NOT pushed this release. @yellow-org/sdk-mcp published manually (npm + MCP registry), alongside manual @yellow-org/sdk + @yellow-org/sdk-compat publishes.

Summary by CodeRabbit

Chores
- Version updated to 1.4.0 across multiple packages and Helm charts for faucet-app, nitronode, playground, and SDK components (mcp, ts-compat, ts).

## Summary Patch release that re-publishes \`@yellow-org/sdk-compat\` with a correct build. The \`@yellow-org/sdk-compat@1.3.0\` tarball shipped a stale \`dist/\` (built May 5), so it is missing runtime changes from #699 (ts-compat runtime migration surface), #748 (absent-resource GET returns), and #758 (audit final session-key changes). \`@yellow-org/sdk@1.3.0\` rebuilt correctly via its existing \`prepublishOnly\` hook. ## Changes - Bump \`@yellow-org/sdk\`, \`@yellow-org/sdk-compat\`, \`@yellow-org/sdk-mcp\` → \`1.3.1\` (strict-mirror policy) - Add \`prepublishOnly: clean + build:prod\` to \`@yellow-org/sdk-compat\` - Tighten \`@yellow-org/sdk-mcp\` \`prepublishOnly\` to clean \`dist/\` and \`content/\` before build ## Post-merge - [ ] Deprecate \`@yellow-org/sdk-compat@1.3.0\` on npm - [ ] Tag \`v1.3.1\` on stable HEAD - [ ] Local publish \`@yellow-org/sdk@1.3.1\` + \`@yellow-org/sdk-compat@1.3.1\` + \`@yellow-org/sdk-mcp@1.3.1\` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Bump npm package versions (sdk/ts, sdk/ts-compat, sdk/mcp), MCP server.json, and Helm chart appVersions (nitronode, playground, faucet-app) to 1.4.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-06-18T09:01:28Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9b301e92-67b6-4346-a971-47263198ebae

📥 Commits

Reviewing files that changed from the base of the PR and between 37124a6 and 3a10b5f.

⛔ Files ignored due to path filters (3)

sdk/mcp/package-lock.json is excluded by !**/package-lock.json
sdk/ts-compat/package-lock.json is excluded by !**/package-lock.json
sdk/ts/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

faucet-app/chart/Chart.yaml
nitronode/chart/Chart.yaml
playground/chart/Chart.yaml
sdk/mcp/package.json
sdk/mcp/server.json
sdk/ts-compat/package.json
sdk/ts/package.json

📝 Walkthrough

Walkthrough

Version bump to 1.4.0 across the repository: appVersion updated from 1.3.0 to 1.4.0 in three Helm charts (faucet-app, nitronode, playground), and version updated from 1.3.1 to 1.4.0 in four SDK package manifests (sdk/ts, sdk/ts-compat, sdk/mcp/package.json, sdk/mcp/server.json).

Changes

Version Bump to 1.4.0

Layer / File(s)	Summary
Helm chart appVersion bumps `faucet-app/chart/Chart.yaml`, `nitronode/chart/Chart.yaml`, `playground/chart/Chart.yaml`	`appVersion` bumped from `1.3.0` to `1.4.0` in all three deployment charts.
SDK package version bumps `sdk/ts/package.json`, `sdk/ts-compat/package.json`, `sdk/mcp/package.json`, `sdk/mcp/server.json`	`version` bumped from `1.3.1` to `1.4.0` in the TypeScript SDK, TS compatibility package, MCP package manifest, and MCP server config (both top-level and nested package entry).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

layer-3/nitrolite#596: Updates the same version fields in sdk/ts/package.json and sdk/ts-compat/package.json.
layer-3/nitrolite#798: Updates the same Helm chart appVersion and SDK package version fields in an earlier release bump to 1.3.0.

Suggested reviewers

ihsraham
nksazonov
dimast-x

Poem

🐇 Hop, hop, version's new,
From 1.3 we bid adieu!
Charts and packages all agree,
1.4.0 is where we'll be.
The rabbit stamps the bumped YAML,
And off we go in grand new style! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'release: v1.4.0 → main' directly matches the PR objective of merging the v1.4.0 release to main, and the version bumps across all changed files (1.3.1→1.4.0 and 1.3.0→1.4.0) align with the title.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch release/v1.4.0

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

philanton and others added 3 commits May 28, 2026 17:34

chore(release): bump version to v1.4.0

b158c80

Bump npm package versions (sdk/ts, sdk/ts-compat, sdk/mcp), MCP server.json, and Helm chart appVersions (nitronode, playground, faucet-app) to 1.4.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

release: merge stable into release/v1.4.0 (-s ours)

3a10b5f

philanton requested review from dimast-x, ihsraham and nksazonov as code owners June 18, 2026 09:01

philanton merged commit cc21377 into main Jun 18, 2026
23 checks passed

philanton deleted the release/v1.4.0 branch June 18, 2026 09:10

coderabbitai Bot mentioned this pull request Jun 18, 2026

release: v1.4.1 → main #853

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

release: v1.4.0 → main#850

release: v1.4.0 → main#850
philanton merged 3 commits into
mainfrom
release/v1.4.0

philanton commented Jun 18, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 18, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

philanton commented Jun 18, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release v1.4.0

Highlights

Versioning note

MCP

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

philanton commented Jun 18, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 18, 2026 •

edited

Loading