@dynamic-labs/waas 4.72.0 → 4.73.1

package/CHANGELOG.md

@@ -1,4 +1,25 @@
 
+### [4.73.1](https://github.com/dynamic-labs/dynamic-auth/compare/v4.73.0...v4.73.1) (2026-03-30)
+
+
+### Features
+
+* **tempo:** add isTempoWallet type guard and TempoWallet class ([#10814](https://github.com/dynamic-labs/dynamic-auth/issues/10814)) ([1f2ec94](https://github.com/dynamic-labs/dynamic-auth/commit/1f2ec949bcfd25b2c460e07214041d06b172f12d))
+
+## [4.73.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.72.0...v4.73.0) (2026-03-30)
+
+
+### Features
+
+* allow passing credentialId at call time for step-up auth methods ([#10795](https://github.com/dynamic-labs/dynamic-auth/issues/10795)) ([9746667](https://github.com/dynamic-labs/dynamic-auth/commit/974666758ad8b01584cf30efbf2cb64dbde63986))
+* **waas:** preserve WaaS key shares on session expiry using LogoutReason ([#10714](https://github.com/dynamic-labs/dynamic-auth/issues/10714)) ([26f40f7](https://github.com/dynamic-labs/dynamic-auth/commit/26f40f722302b8cf4cc035886d4408393a785283))
+
+
+### Bug Fixes
+
+* override handlebars to >=4.7.9 (CVE-2026-33937) ([#10805](https://github.com/dynamic-labs/dynamic-auth/issues/10805)) ([7aa40b8](https://github.com/dynamic-labs/dynamic-auth/commit/7aa40b8472487694b438ae3a64b14524c9c726e4))
+* use currentColor in settings icons for dark mode support ([#10811](https://github.com/dynamic-labs/dynamic-auth/issues/10811)) ([8653e97](https://github.com/dynamic-labs/dynamic-auth/commit/8653e97759f0ea5126258c1ced36ae26af3a405c)), closes [#383C48](https://github.com/dynamic-labs/dynamic-auth/issues/383C48) [#ABACB2](https://github.com/dynamic-labs/dynamic-auth/issues/ABACB2)
+
 ## [4.72.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.71.0...v4.72.0) (2026-03-26)
 
 

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.72.0";
+var version = "4.73.1";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "4.72.0";
+var version = "4.73.1";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/waas",
-  "version": "4.72.0",
+  "version": "4.73.1",
   "type": "module",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -16,16 +16,17 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@dynamic-labs/assert-package-version": "4.72.0",
+    "@dynamic-labs-sdk/client": "0.19.0",
+    "@dynamic-labs/assert-package-version": "4.73.1",
     "@dynamic-labs/sdk-api-core": "0.0.909",
     "@dynamic-labs-wallet/browser-wallet-client": "0.0.314",
-    "@dynamic-labs/ethereum-core": "4.72.0",
-    "@dynamic-labs/logger": "4.72.0",
-    "@dynamic-labs/solana-core": "4.72.0",
-    "@dynamic-labs/sui-core": "4.72.0",
-    "@dynamic-labs/utils": "4.72.0",
-    "@dynamic-labs/wallet-book": "4.72.0",
-    "@dynamic-labs/wallet-connector-core": "4.72.0"
+    "@dynamic-labs/ethereum-core": "4.73.1",
+    "@dynamic-labs/logger": "4.73.1",
+    "@dynamic-labs/solana-core": "4.73.1",
+    "@dynamic-labs/sui-core": "4.73.1",
+    "@dynamic-labs/utils": "4.73.1",
+    "@dynamic-labs/wallet-book": "4.73.1",
+    "@dynamic-labs/wallet-connector-core": "4.73.1"
   },
   "peerDependencies": {}
 }

package/src/DynamicWaasMixin.cjs

@@ -572,13 +572,25 @@ const withDynamicWaas = (BaseClass) => {
                 });
             });
         }
-        endSession() {
+        endSession(reason) {
             return _tslib.__awaiter(this, void 0, void 0, function* () {
                 const waasClient = yield this.getWaasWalletClient();
                 if (!waasClient) {
                     return;
                 }
-                yield waasClient.cleanup();
+                // When a session token expires, we preserve key shares in storage instead
+                // of clearing them. Customers with short-lived sessions (minutes) were
+                // hitting excessive server-side share recovery on every re-login, which
+                // also forced users to re-enter their wallet password since the unlocked
+                // share only lives for the duration of the session.
+                //
+                // This is safe because the waas-sdk separately fingerprints the user
+                // (sub + environment_id) and clears all storage if a different user logs
+                // in. On explicit user-initiated logout, shares are always cleared for
+                // security.
+                if (reason !== 'token-expired') {
+                    yield waasClient.cleanup();
+                }
                 this.dynamicWaasClient = undefined;
             });
         }

package/src/DynamicWaasMixin.d.ts

@@ -1,4 +1,5 @@
 import { BitcoinConfig, DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';
+import type { LogoutReason } from '@dynamic-labs-sdk/client';
 import { InstrumentOptions, Logger } from '@dynamic-labs/logger';
 import { MFAAction, TokenScope } from '@dynamic-labs/sdk-api-core';
 import { GetWalletPasswordFn } from '@dynamic-labs/wallet-connector-core';
@@ -141,7 +142,7 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
     getWalletRecoveryState({ accountAddress, }: {
         accountAddress: string;
     }): Promise<import("@dynamic-labs-wallet/browser-wallet-client").WalletRecoveryState>;
-    endSession(): Promise<void>;
+    endSession(reason?: LogoutReason): Promise<void>;
     getActiveAccountAddress(): Promise<string | undefined>;
     /**
      * Get connected accounts by fetching wallets from Waas client.

package/src/DynamicWaasMixin.js

@@ -568,13 +568,25 @@ const withDynamicWaas = (BaseClass) => {
                 });
             });
         }
-        endSession() {
+        endSession(reason) {
             return __awaiter(this, void 0, void 0, function* () {
                 const waasClient = yield this.getWaasWalletClient();
                 if (!waasClient) {
                     return;
                 }
-                yield waasClient.cleanup();
+                // When a session token expires, we preserve key shares in storage instead
+                // of clearing them. Customers with short-lived sessions (minutes) were
+                // hitting excessive server-side share recovery on every re-login, which
+                // also forced users to re-enter their wallet password since the unlocked
+                // share only lives for the duration of the session.
+                //
+                // This is safe because the waas-sdk separately fingerprints the user
+                // (sub + environment_id) and clears all storage if a different user logs
+                // in. On explicit user-initiated logout, shares are always cleared for
+                // security.
+                if (reason !== 'token-expired') {
+                    yield waasClient.cleanup();
+                }
                 this.dynamicWaasClient = undefined;
             });
         }