solana-studio 0.13.0 → 0.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f185a71eb6ae6c07cd11e28ce02fe5d8ffe29d4f47cab0d77034a016440074b
-  data.tar.gz: 839d205b8f7334d6226c9373ee3cb265b9a9932d29245d7a164ca481c1636ec8
+  metadata.gz: 56be661c11337e9a3fa4187cfecd9d3f371516dda3977ee8eb526b066ede7e3b
+  data.tar.gz: 9ef60196d761d93975fcf2eb814cce5dd7fcd4821c41907224d5b0c4d69d1edf
 SHA512:
-  metadata.gz: ba9c5ba1f63d0a51cdf543bd7068b185af5988617f4c42573325b02817327984b919d5dde2f37bca4d0ef842d3af946a2eaffbfa02064b0c2bc5eb95248a6ceb
-  data.tar.gz: bc8725d019f925591503a34ff30609efe1fb0d7d7fc4ab55d802d6669fbbca239cbe884a5e0a9c899ec44742bd980d0174a7b15466b7146e6ef68dd545725f8f
+  metadata.gz: b86371b0fd28522d5f565a32cbd0ce12f41a3e99e6787f65e81f249e591d799c11c1cc1361ab91a5a68516bf4068cab53970cf5c14752e8f1fee807955566df6
+  data.tar.gz: f55dc88a2445bbdfb2fef054d44e18c35ef81be6ea36e69b43663d570d45fbdd2a702eea8cb9193d0a3afaaf6f88f22caa39a31e49c82034231e830919ba7dcb

data/CHANGELOG.md

@@ -4,6 +4,14 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## v0.13.1 (2026-10-25)
+
+### Changed
+- **The browser and node lanes pin tweetnacl to exactly 1.0.3** (`package.json`, `package-lock.json`). It was `^1.0.3`, a range, while production loads the exact `tweetnacl@1.0.3` CDN file, so an `npm install` could have tested different bytes from the ones a phone runs. Development and test only; the gem's runtime dependencies are unchanged.
+
+### Tests
+- **`test/views/remote_script_integrity_test.rb` (6, new): the tweetnacl pin in `solana_studio/deeplink_assets` is now guarded.** The partial has pinned `tweetnacl@1.0.3/nacl-fast.min.js` with a sha384 `integrity` and `crossOrigin = 'anonymous'` since 0.10.0, but no test asserted either, so deleting the line would have shipped green. The suite renders the partial, runs its inline script under node against a stub `document`, and asserts that the one element it appends carries the pinned sha384 and `crossorigin="anonymous"`. A control proves the append is real: nothing is appended when the host already supplies `window.nacl`. It also scans every view under `app/views` for remote `.js` URLs and fails on any not covered; tweetnacl is the only one. The pin was recomputed on 2026-10-24 against the live jsDelivr file and the npm tarball, and both give the committed value. Two more tests tie the lanes together. The tweetnacl version in `package.json` must be exact and must equal the version in the CDN URL; the test reads it from `package.json` rather than copying it. The installed `node_modules/tweetnacl/nacl-fast.min.js` must hash to the pinned SRI, which re-derives the pin offline on every run. 8 mutants, all KILLED: the integrity line removed, `crossOrigin` removed, one hash character changed, integrity set on a different object, a new unpinned remote `<script src>` added, `package.json` back to `^1.0.3`, `package.json` at 1.0.2, and the installed file's bytes changed.
+
 ## v0.13.0 (2026-10-12)
 
 ### Changed

data/lib/solana_studio/version.rb

@@ -16,5 +16,5 @@ module SolanaStudio
   # through the normal cycle. Splitting the version out is the same shape
   # studio-engine already uses (lib/studio/version.rb) and hands each file back
   # to its real owner: this one to the release, the gemspec to the PR.
-  VERSION = "0.13.0"
+  VERSION = "0.13.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solana-studio
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.13.1
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-12 00:00:00.000000000 Z
+date: 2026-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ed25519