@dynamic-labs/iframe-setup 4.91.1 → 4.91.3

package/CHANGELOG.md

@@ -1,4 +1,40 @@
 
+### [4.91.3](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.2...v4.91.3) (2026-06-30)
+
+
+### Bug Fixes
+
+* **bitcoin:** detect late-registering wallet-standard wallets (DYNT-1210) ([#11747](https://github.com/dynamic-labs/dynamic-auth/issues/11747)) ([17809f6](https://github.com/dynamic-labs/dynamic-auth/commit/17809f6e811fe101367cc31a2d899a8d0b0d107e))
+* fetch onramp providers lazily instead of eagerly on mount ([#11767](https://github.com/dynamic-labs/dynamic-auth/issues/11767)) ([3ee6708](https://github.com/dynamic-labs/dynamic-auth/commit/3ee67087142ae1942f865e0ab37b7108700b3327))
+* **iframe-setup:** sync parent URL to iframe on pushState/replaceState ([#11751](https://github.com/dynamic-labs/dynamic-auth/issues/11751)) ([c8be3af](https://github.com/dynamic-labs/dynamic-auth/commit/c8be3afc301f77b349f23398bed940ce40f93b73))
+* **nonce:** fetch nonce on demand when missing before wallet verification ([#11753](https://github.com/dynamic-labs/dynamic-auth/issues/11753)) ([4f01a21](https://github.com/dynamic-labs/dynamic-auth/commit/4f01a21b6081c852f32868c8a5e04d70aaf280a2)), closes [#1](https://github.com/dynamic-labs/dynamic-auth/issues/1)
+* **react-native-extension:** arm loading timer before setUrl to cover pre-onLoadStart gap ([#11764](https://github.com/dynamic-labs/dynamic-auth/issues/11764)) ([31f2015](https://github.com/dynamic-labs/dynamic-auth/commit/31f20151a4b59279f9c133b723e50de771b06436))
+* **webview-controller:** unwrap ZeroDev smart wallet for native gasless ([#11758](https://github.com/dynamic-labs/dynamic-auth/issues/11758)) ([989714e](https://github.com/dynamic-labs/dynamic-auth/commit/989714e414556868c8e0c54401aac1ed7354331b))
+
+### [4.91.2](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.1...v4.91.2) (2026-06-26)
+
+
+### ⚠ BREAKING CHANGES
+
+* **waas:** require expectedAddresses on migrateFromFireblocks (#11730)
+
+### Features
+
+* **midnight:** support shielded/unshielded transfers and dust states in the embedded Send flow ([#11731](https://github.com/dynamic-labs/dynamic-auth/issues/11731)) ([663d171](https://github.com/dynamic-labs/dynamic-auth/commit/663d171a9628c634586831ee35c234e9331e3f80))
+* **react-native-extension:** instrument all embedded webview failure paths ([#11737](https://github.com/dynamic-labs/dynamic-auth/issues/11737)) ([172998b](https://github.com/dynamic-labs/dynamic-auth/commit/172998b56e9bee04fbb8da71e83ce8885bc378ff))
+* **waas:** migrateFromFireblocks connector method + demo panel (browser-wallet-client 1.0.46) ([#11702](https://github.com/dynamic-labs/dynamic-auth/issues/11702)) ([6bfc844](https://github.com/dynamic-labs/dynamic-auth/commit/6bfc8443fbaedabe1e7bee0ed78742cbbe5d0084))
+
+
+### Bug Fixes
+
+* add coverage for scenario with passkey re-login and smart account ([#11726](https://github.com/dynamic-labs/dynamic-auth/issues/11726)) ([5364a72](https://github.com/dynamic-labs/dynamic-auth/commit/5364a72a750d835b9b2da602a91e8b5d7d305db7))
+* remediate high-severity dependency vulnerabilities ([#11721](https://github.com/dynamic-labs/dynamic-auth/issues/11721)) ([cdb9306](https://github.com/dynamic-labs/dynamic-auth/commit/cdb93061365a20b8f73a1f8bea8352332e282c1e))
+* replace node-fetch v2 with native fetch to fix Node 22 stream failure ([#11732](https://github.com/dynamic-labs/dynamic-auth/issues/11732)) ([b98f801](https://github.com/dynamic-labs/dynamic-auth/commit/b98f801e307b52dbd7e4b241a9a4a2d34d89118e))
+* **zerodev-extension:** derive kernel 7702 vs 4337 per-wallet, not from global dashboard flag ([#11735](https://github.com/dynamic-labs/dynamic-auth/issues/11735)) ([72cf6a7](https://github.com/dynamic-labs/dynamic-auth/commit/72cf6a70a4857a4ea469faa555c485dbad8d0217))
+
+
+* **waas:** require expectedAddresses on migrateFromFireblocks ([#11730](https://github.com/dynamic-labs/dynamic-auth/issues/11730)) ([c94824e](https://github.com/dynamic-labs/dynamic-auth/commit/c94824ebe11e0433a6ffbd2a5a9dd4283aeed31e))
+
 ### [4.91.1](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.0...v4.91.1) (2026-06-24)
 
 

package/README.md

@@ -161,16 +161,25 @@ export const setupIframe = (
 
   // Watch for url changes and update Dynamic SDK in iframe
   const setupUrlUpdateHandler = (): VoidFunction => {
-    const onPopState = () => {
-      const url = window.location.href;
-
-      messageSender('UPDATE_PARENT_URL', { url });
+    const notifyUrlChange = () => {
+      try {
+        messageSender('UPDATE_PARENT_URL', { url: window.location.href });
+      } catch {
+        // Never let a notification failure surface to the host application
+        // (e.g. an SPA router calling history.pushState)
+      }
     };
 
-    window.addEventListener('popstate', onPopState);
+    patchHistoryOnce();
+
+    // popstate fires on browser back/forward navigation; the custom event
+    // fires on programmatic pushState/replaceState (which never emit popstate)
+    window.addEventListener('popstate', notifyUrlChange);
+    window.addEventListener(URL_CHANGE_EVENT, notifyUrlChange);
 
     return () => {
-      window.removeEventListener('popstate', onPopState);
+      window.removeEventListener('popstate', notifyUrlChange);
+      window.removeEventListener(URL_CHANGE_EVENT, notifyUrlChange);
     };
   };
 
@@ -211,6 +220,44 @@ export const setupIframe = (
 
 // Utils
 
+/**
+ * Custom event dispatched when the parent URL changes via the History API.
+ * Used instead of re-patching history per setupIframe call so that multiple
+ * instances can observe changes without clobbering each other's patches.
+ */
+const URL_CHANGE_EVENT = 'dynamic-labs:url-change';
+
+const HISTORY_PATCHED_FLAG = '__dynamicLabsHistoryPatched';
+
+/**
+ * Patch history.pushState/replaceState to emit URL_CHANGE_EVENT.
+ *
+ * popstate does not fire for programmatic navigation, so we patch the History
+ * API to broadcast a custom event instead. The patch is installed only once,
+ * retains no references, and is intentionally never restored — it merely
+ * dispatches an event, which keeps it safe to leave in place and composable
+ * across multiple setupIframe instances.
+ */
+const patchHistoryOnce = (): void => {
+  const history = window.history as History & Record<string, unknown>;
+
+  if (history[HISTORY_PATCHED_FLAG]) return;
+  history[HISTORY_PATCHED_FLAG] = true;
+
+  const originalPushState = history.pushState.bind(history);
+  const originalReplaceState = history.replaceState.bind(history);
+
+  history.pushState = (...args: Parameters<History['pushState']>) => {
+    originalPushState(...args);
+    window.dispatchEvent(new Event(URL_CHANGE_EVENT));
+  };
+
+  history.replaceState = (...args: Parameters<History['replaceState']>) => {
+    originalReplaceState(...args);
+    window.dispatchEvent(new Event(URL_CHANGE_EVENT));
+  };
+};
+
 /**
  * Create a message handler for the iframe
  */

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.91.1";
+var version = "4.91.3";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "4.91.1";
+var version = "4.91.3";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/iframe-setup",
-  "version": "4.91.1",
+  "version": "4.91.3",
   "description": "Collection of utilities to use the Dynamic SDK in an iframe",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -18,7 +18,7 @@
   },
   "homepage": "https://www.dynamic.xyz/",
   "dependencies": {
-    "@dynamic-labs/assert-package-version": "4.91.1"
+    "@dynamic-labs/assert-package-version": "4.91.3"
   },
   "peerDependencies": {}
 }

package/src/lib/setupIframe/setupIframe.cjs

@@ -35,13 +35,23 @@ const setupIframe = (iframe, origin) => {
     });
     // Watch for url changes and update Dynamic SDK in iframe
     const setupUrlUpdateHandler = () => {
-        const onPopState = () => {
-            const url = window.location.href;
-            messageSender('UPDATE_PARENT_URL', { url });
+        const notifyUrlChange = () => {
+            try {
+                messageSender('UPDATE_PARENT_URL', { url: window.location.href });
+            }
+            catch (_a) {
+                // Never let a notification failure surface to the host application
+                // (e.g. an SPA router calling history.pushState)
+            }
         };
-        window.addEventListener('popstate', onPopState);
+        patchHistoryOnce();
+        // popstate fires on browser back/forward navigation; the custom event
+        // fires on programmatic pushState/replaceState (which never emit popstate)
+        window.addEventListener('popstate', notifyUrlChange);
+        window.addEventListener(URL_CHANGE_EVENT, notifyUrlChange);
         return () => {
-            window.removeEventListener('popstate', onPopState);
+            window.removeEventListener('popstate', notifyUrlChange);
+            window.removeEventListener(URL_CHANGE_EVENT, notifyUrlChange);
         };
     };
     /**
@@ -72,6 +82,38 @@ const setupIframe = (iframe, origin) => {
     return () => cleanupHandlers.forEach((offHandler) => offHandler());
 };
 // Utils
+/**
+ * Custom event dispatched when the parent URL changes via the History API.
+ * Used instead of re-patching history per setupIframe call so that multiple
+ * instances can observe changes without clobbering each other's patches.
+ */
+const URL_CHANGE_EVENT = 'dynamic-labs:url-change';
+const HISTORY_PATCHED_FLAG = '__dynamicLabsHistoryPatched';
+/**
+ * Patch history.pushState/replaceState to emit URL_CHANGE_EVENT.
+ *
+ * popstate does not fire for programmatic navigation, so we patch the History
+ * API to broadcast a custom event instead. The patch is installed only once,
+ * retains no references, and is intentionally never restored — it merely
+ * dispatches an event, which keeps it safe to leave in place and composable
+ * across multiple setupIframe instances.
+ */
+const patchHistoryOnce = () => {
+    const history = window.history;
+    if (history[HISTORY_PATCHED_FLAG])
+        return;
+    history[HISTORY_PATCHED_FLAG] = true;
+    const originalPushState = history.pushState.bind(history);
+    const originalReplaceState = history.replaceState.bind(history);
+    history.pushState = (...args) => {
+        originalPushState(...args);
+        window.dispatchEvent(new Event(URL_CHANGE_EVENT));
+    };
+    history.replaceState = (...args) => {
+        originalReplaceState(...args);
+        window.dispatchEvent(new Event(URL_CHANGE_EVENT));
+    };
+};
 /**
  * Create a message handler for the iframe
  */

package/src/lib/setupIframe/setupIframe.js

@@ -31,13 +31,23 @@ const setupIframe = (iframe, origin) => {
     });
     // Watch for url changes and update Dynamic SDK in iframe
     const setupUrlUpdateHandler = () => {
-        const onPopState = () => {
-            const url = window.location.href;
-            messageSender('UPDATE_PARENT_URL', { url });
+        const notifyUrlChange = () => {
+            try {
+                messageSender('UPDATE_PARENT_URL', { url: window.location.href });
+            }
+            catch (_a) {
+                // Never let a notification failure surface to the host application
+                // (e.g. an SPA router calling history.pushState)
+            }
         };
-        window.addEventListener('popstate', onPopState);
+        patchHistoryOnce();
+        // popstate fires on browser back/forward navigation; the custom event
+        // fires on programmatic pushState/replaceState (which never emit popstate)
+        window.addEventListener('popstate', notifyUrlChange);
+        window.addEventListener(URL_CHANGE_EVENT, notifyUrlChange);
         return () => {
-            window.removeEventListener('popstate', onPopState);
+            window.removeEventListener('popstate', notifyUrlChange);
+            window.removeEventListener(URL_CHANGE_EVENT, notifyUrlChange);
         };
     };
     /**
@@ -68,6 +78,38 @@ const setupIframe = (iframe, origin) => {
     return () => cleanupHandlers.forEach((offHandler) => offHandler());
 };
 // Utils
+/**
+ * Custom event dispatched when the parent URL changes via the History API.
+ * Used instead of re-patching history per setupIframe call so that multiple
+ * instances can observe changes without clobbering each other's patches.
+ */
+const URL_CHANGE_EVENT = 'dynamic-labs:url-change';
+const HISTORY_PATCHED_FLAG = '__dynamicLabsHistoryPatched';
+/**
+ * Patch history.pushState/replaceState to emit URL_CHANGE_EVENT.
+ *
+ * popstate does not fire for programmatic navigation, so we patch the History
+ * API to broadcast a custom event instead. The patch is installed only once,
+ * retains no references, and is intentionally never restored — it merely
+ * dispatches an event, which keeps it safe to leave in place and composable
+ * across multiple setupIframe instances.
+ */
+const patchHistoryOnce = () => {
+    const history = window.history;
+    if (history[HISTORY_PATCHED_FLAG])
+        return;
+    history[HISTORY_PATCHED_FLAG] = true;
+    const originalPushState = history.pushState.bind(history);
+    const originalReplaceState = history.replaceState.bind(history);
+    history.pushState = (...args) => {
+        originalPushState(...args);
+        window.dispatchEvent(new Event(URL_CHANGE_EVENT));
+    };
+    history.replaceState = (...args) => {
+        originalReplaceState(...args);
+        window.dispatchEvent(new Event(URL_CHANGE_EVENT));
+    };
+};
 /**
  * Create a message handler for the iframe
  */