@dynamic-labs/sdk-react-core 4.96.0 → 4.96.1

package/CHANGELOG.md

@@ -1,4 +1,12 @@
 
+### [4.96.1](https://github.com/dynamic-labs/dynamic-auth/compare/v4.96.0...v4.96.1) (2026-08-10)
+
+
+### Bug Fixes
+
+* security updates ([#12151](https://github.com/dynamic-labs/dynamic-auth/issues/12151)) ([faf22dd](https://github.com/dynamic-labs/dynamic-auth/commit/faf22dda11f5cfd888e860bd05731604ee19b51d))
+* **sdk-react-core:** avoid spurious WaaS client rebuild on transient user sessionId churn ([#12183](https://github.com/dynamic-labs/dynamic-auth/issues/12183)) ([6248f74](https://github.com/dynamic-labs/dynamic-auth/commit/6248f7498fbd279031a4e9176fa707bca360f0f1))
+
 ## [4.96.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.95.2...v4.96.0) (2026-08-03)
 
 

package/package.cjs

@@ -3,7 +3,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.96.0";
+var version = "4.96.1";
 var dependencies = {
 	"@dynamic-labs/sdk-api-core": "0.0.1093",
 	"@dynamic-labs-sdk/client": "1.20.0",

package/package.js

@@ -1,5 +1,5 @@
 'use client'
-var version = "4.96.0";
+var version = "4.96.1";
 var dependencies = {
 	"@dynamic-labs/sdk-api-core": "0.0.1093",
 	"@dynamic-labs-sdk/client": "1.20.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/sdk-react-core",
-  "version": "4.96.0",
+  "version": "4.96.1",
   "dependencies": {
     "@dynamic-labs/sdk-api-core": "0.0.1093",
     "@dynamic-labs-sdk/client": "1.20.0",
@@ -18,17 +18,17 @@
     "react-i18next": "13.5.0",
     "react-international-phone": "4.5.0",
     "yup": "0.32.11",
-    "@dynamic-labs/assert-package-version": "4.96.0",
-    "@dynamic-labs/iconic": "4.96.0",
-    "@dynamic-labs/locale": "4.96.0",
-    "@dynamic-labs/logger": "4.96.0",
-    "@dynamic-labs/multi-wallet": "4.96.0",
-    "@dynamic-labs/rpc-providers": "4.96.0",
-    "@dynamic-labs/store": "4.96.0",
-    "@dynamic-labs/types": "4.96.0",
-    "@dynamic-labs/utils": "4.96.0",
-    "@dynamic-labs/wallet-book": "4.96.0",
-    "@dynamic-labs/wallet-connector-core": "4.96.0",
+    "@dynamic-labs/assert-package-version": "4.96.1",
+    "@dynamic-labs/iconic": "4.96.1",
+    "@dynamic-labs/locale": "4.96.1",
+    "@dynamic-labs/logger": "4.96.1",
+    "@dynamic-labs/multi-wallet": "4.96.1",
+    "@dynamic-labs/rpc-providers": "4.96.1",
+    "@dynamic-labs/store": "4.96.1",
+    "@dynamic-labs/types": "4.96.1",
+    "@dynamic-labs/utils": "4.96.1",
+    "@dynamic-labs/wallet-book": "4.96.1",
+    "@dynamic-labs/wallet-connector-core": "4.96.1",
     "eventemitter3": "5.0.1"
   },
   "devDependencies": {

package/src/lib/client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.cjs

@@ -0,0 +1,30 @@
+'use client'
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var sdkApiCore = require('@dynamic-labs/sdk-api-core');
+var parseToken = require('../../../../shared/utils/functions/parseToken/parseToken.cjs');
+var getMinAuthToken = require('../getMinAuthToken/getMinAuthToken.cjs');
+
+/**
+ * Reads the session id (`sid` claim) from the current min JWT claims.
+ * Returns `undefined` when no token, decode fails, or the claim is missing.
+ */
+const getSessionIdFromMinToken = () => {
+    const token = getMinAuthToken.getMinAuthToken();
+    if (!token)
+        return undefined;
+    const payload = parseToken.parseToken(token);
+    if (!payload || typeof payload !== 'object')
+        return undefined;
+    try {
+        const minJwt = sdkApiCore.MinifiedDynamicJwtFromJSON(payload);
+        return minJwt.sid;
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+
+exports.getSessionIdFromMinToken = getSessionIdFromMinToken;

package/src/lib/client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Reads the session id (`sid` claim) from the current min JWT claims.
+ * Returns `undefined` when no token, decode fails, or the claim is missing.
+ */
+export declare const getSessionIdFromMinToken: () => string | undefined;

package/src/lib/client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.js

@@ -0,0 +1,26 @@
+'use client'
+import { MinifiedDynamicJwtFromJSON } from '@dynamic-labs/sdk-api-core';
+import { parseToken } from '../../../../shared/utils/functions/parseToken/parseToken.js';
+import { getMinAuthToken } from '../getMinAuthToken/getMinAuthToken.js';
+
+/**
+ * Reads the session id (`sid` claim) from the current min JWT claims.
+ * Returns `undefined` when no token, decode fails, or the claim is missing.
+ */
+const getSessionIdFromMinToken = () => {
+    const token = getMinAuthToken();
+    if (!token)
+        return undefined;
+    const payload = parseToken(token);
+    if (!payload || typeof payload !== 'object')
+        return undefined;
+    try {
+        const minJwt = MinifiedDynamicJwtFromJSON(payload);
+        return minJwt.sid;
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+
+export { getSessionIdFromMinToken };

package/src/lib/client/extension/functions/getSessionIdFromMinToken/index.d.ts

@@ -0,0 +1 @@
+export { getSessionIdFromMinToken } from './getSessionIdFromMinToken';

package/src/lib/client/extension/index.d.ts

@@ -13,6 +13,7 @@ export { useRefetchProjectSettings } from './projectSettings/useRefetchProjectSe
 export { isCookieEnabled } from './functions/isCookieEnabled';
 export { getMinAuthToken } from './functions/getMinAuthToken';
 export { getSignInCredentialIdFromMinToken } from './functions/getSignInCredentialIdFromMinToken';
+export { getSessionIdFromMinToken } from './functions/getSessionIdFromMinToken';
 export { getAuthToken } from './functions/getAuthToken';
 export { getExpiresAt } from './functions/getExpiresAt';
 export { hasElevatedAccessToken } from './functions/hasElevatedAccessToken';

package/src/lib/utils/hooks/useSyncDynamicWaas/useSyncDynamicWaas.cjs

@@ -32,6 +32,7 @@ require('../../functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.cjs');
 require('../../../events/dynamicEvents.cjs');
 var useOnboardingCompleteUser = require('../../../client/extension/user/useOnboardingCompleteUser/useOnboardingCompleteUser.cjs');
 var useProjectSettings = require('../../../client/extension/projectSettings/useProjectSettings/useProjectSettings.cjs');
+var getSessionIdFromMinToken = require('../../../client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.cjs');
 require('../../../context/DynamicContext/useDynamicContext/useDynamicContext.cjs');
 var useInternalDynamicContext = require('../../../context/DynamicContext/useDynamicContext/useInternalDynamicContext/useInternalDynamicContext.cjs');
 var LoadingContext = require('../../../context/LoadingContext/LoadingContext.cjs');
@@ -219,19 +220,22 @@ const useSyncDynamicWaas = () => {
     // Initialize waas iframe when user is authenticated
     // This handles both page reload (user already authenticated) and fresh authentication
     React.useEffect(() => {
+        const tokenSessionId = getSessionIdFromMinToken.getSessionIdFromMinToken();
+        const currentSessionId = tokenSessionId !== null && tokenSessionId !== void 0 ? tokenSessionId : user === null || user === void 0 ? void 0 : user.sessionId;
         // handle logout case where user is logged out but session id is still valid
-        if (sessionIdRef.current && !(user === null || user === void 0 ? void 0 : user.sessionId)) {
+        if (sessionIdRef.current && !currentSessionId) {
             sessionIdRef.current = undefined;
             hasWaasInitializedRef.current = false;
             initializingWaasRef.current = false;
             clearRecoveredWallets();
         }
-        if (shouldInitializeWaas && (user === null || user === void 0 ? void 0 : user.sessionId)) {
-            const { sessionId, id: userId } = user;
+        if (shouldInitializeWaas && currentSessionId && (user === null || user === void 0 ? void 0 : user.sessionId)) {
+            const { id: userId } = user;
             const shouldInitialize = !initializingWaasRef.current &&
-                (!hasWaasInitializedRef.current || sessionIdRef.current !== sessionId);
+                (!hasWaasInitializedRef.current ||
+                    sessionIdRef.current !== currentSessionId);
             if (shouldInitialize) {
-                const isSessionIdChanged = sessionIdRef.current !== sessionId;
+                const isSessionIdChanged = sessionIdRef.current !== currentSessionId;
                 // A swap from a prior session (e.g. step-up reauth) must rebuild the
                 // WaaS client so the iframe re-auths with the new session instead of
                 // 401-ing on the stale cached one. First init (no prior session) keeps
@@ -245,8 +249,11 @@ const useSyncDynamicWaas = () => {
                 initializeWaas({ forceClientRebuild })
                     .then(() => {
                     logger.logger.debug('[useSyncDynamicWaas] waas initialized');
+                    // Persist the session id this init actually ran with so a token
+                    // rotation that happened mid-flight is still detected on the next
+                    // effect run and triggers a force-rebuild.
                     hasWaasInitializedRef.current = true;
-                    sessionIdRef.current = sessionId;
+                    sessionIdRef.current = currentSessionId;
                     // Host-observed time to get the WaaS iframe/client ready. Ships to
                     // Datadog (sliced by @version + environmentId) as the host-side
                     // companion to the iframe app's `waas_iframe_*` timing — used to
@@ -261,13 +268,14 @@ const useSyncDynamicWaas = () => {
                     .catch((error) => {
                     logger.logger.warn('[useSyncDynamicWaas] Error initializing waas', {
                         error,
-                        sessionId,
+                        sessionId: currentSessionId,
                         userId,
                     });
                     logger.logger.instrument('WaaS host init failed', {
                         environmentId,
                         key: 'waas_host_init_failed',
                         reason: error instanceof Error ? error.message : String(error),
+                        sessionId: currentSessionId,
                         time: Date.now() - initStartedAt,
                         userId,
                     });
@@ -277,7 +285,13 @@ const useSyncDynamicWaas = () => {
                 });
             }
         }
-    }, [initializeWaas, shouldInitializeWaas, user]);
+    }, [
+        initializeWaas,
+        shouldInitializeWaas,
+        user,
+        environmentId,
+        clearRecoveredWallets,
+    ]);
     React.useEffect(() => {
         if (shouldCreateWallets()) {
             handleWalletCreation();

package/src/lib/utils/hooks/useSyncDynamicWaas/useSyncDynamicWaas.js

@@ -28,6 +28,7 @@ import '../../functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.js';
 import '../../../events/dynamicEvents.js';
 import { useOnboardingCompleteUser } from '../../../client/extension/user/useOnboardingCompleteUser/useOnboardingCompleteUser.js';
 import { useProjectSettings } from '../../../client/extension/projectSettings/useProjectSettings/useProjectSettings.js';
+import { getSessionIdFromMinToken } from '../../../client/extension/functions/getSessionIdFromMinToken/getSessionIdFromMinToken.js';
 import '../../../context/DynamicContext/useDynamicContext/useDynamicContext.js';
 import { useInternalDynamicContext } from '../../../context/DynamicContext/useDynamicContext/useInternalDynamicContext/useInternalDynamicContext.js';
 import { useLoadingContext } from '../../../context/LoadingContext/LoadingContext.js';
@@ -215,19 +216,22 @@ const useSyncDynamicWaas = () => {
     // Initialize waas iframe when user is authenticated
     // This handles both page reload (user already authenticated) and fresh authentication
     useEffect(() => {
+        const tokenSessionId = getSessionIdFromMinToken();
+        const currentSessionId = tokenSessionId !== null && tokenSessionId !== void 0 ? tokenSessionId : user === null || user === void 0 ? void 0 : user.sessionId;
         // handle logout case where user is logged out but session id is still valid
-        if (sessionIdRef.current && !(user === null || user === void 0 ? void 0 : user.sessionId)) {
+        if (sessionIdRef.current && !currentSessionId) {
             sessionIdRef.current = undefined;
             hasWaasInitializedRef.current = false;
             initializingWaasRef.current = false;
             clearRecoveredWallets();
         }
-        if (shouldInitializeWaas && (user === null || user === void 0 ? void 0 : user.sessionId)) {
-            const { sessionId, id: userId } = user;
+        if (shouldInitializeWaas && currentSessionId && (user === null || user === void 0 ? void 0 : user.sessionId)) {
+            const { id: userId } = user;
             const shouldInitialize = !initializingWaasRef.current &&
-                (!hasWaasInitializedRef.current || sessionIdRef.current !== sessionId);
+                (!hasWaasInitializedRef.current ||
+                    sessionIdRef.current !== currentSessionId);
             if (shouldInitialize) {
-                const isSessionIdChanged = sessionIdRef.current !== sessionId;
+                const isSessionIdChanged = sessionIdRef.current !== currentSessionId;
                 // A swap from a prior session (e.g. step-up reauth) must rebuild the
                 // WaaS client so the iframe re-auths with the new session instead of
                 // 401-ing on the stale cached one. First init (no prior session) keeps
@@ -241,8 +245,11 @@ const useSyncDynamicWaas = () => {
                 initializeWaas({ forceClientRebuild })
                     .then(() => {
                     logger.debug('[useSyncDynamicWaas] waas initialized');
+                    // Persist the session id this init actually ran with so a token
+                    // rotation that happened mid-flight is still detected on the next
+                    // effect run and triggers a force-rebuild.
                     hasWaasInitializedRef.current = true;
-                    sessionIdRef.current = sessionId;
+                    sessionIdRef.current = currentSessionId;
                     // Host-observed time to get the WaaS iframe/client ready. Ships to
                     // Datadog (sliced by @version + environmentId) as the host-side
                     // companion to the iframe app's `waas_iframe_*` timing — used to
@@ -257,13 +264,14 @@ const useSyncDynamicWaas = () => {
                     .catch((error) => {
                     logger.warn('[useSyncDynamicWaas] Error initializing waas', {
                         error,
-                        sessionId,
+                        sessionId: currentSessionId,
                         userId,
                     });
                     logger.instrument('WaaS host init failed', {
                         environmentId,
                         key: 'waas_host_init_failed',
                         reason: error instanceof Error ? error.message : String(error),
+                        sessionId: currentSessionId,
                         time: Date.now() - initStartedAt,
                         userId,
                     });
@@ -273,7 +281,13 @@ const useSyncDynamicWaas = () => {
                 });
             }
         }
-    }, [initializeWaas, shouldInitializeWaas, user]);
+    }, [
+        initializeWaas,
+        shouldInitializeWaas,
+        user,
+        environmentId,
+        clearRecoveredWallets,
+    ]);
     useEffect(() => {
         if (shouldCreateWallets()) {
             handleWalletCreation();