@sei-js/create-sei 2.0.0 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/templates/next-template/README.md +4 -2
  2. package/dist/templates/next-template/next.config.mjs +5 -2
  3. package/dist/templates/next-template/package.json +2 -2
  4. package/package.json +1 -1
package/dist/templates/next-template/README.md CHANGED
@@ -30,11 +30,13 @@ bun run build
30
30
 
31
31
  ## Image handling
32
32
 
33
- Next.js image optimization is disabled because Next 15.5.21 declares only vulnerable Sharp 0.34.x releases. The manifest resolves secure Sharp 0.35.x for audit safety, while images are served unoptimized until Next.js supports that Sharp line.
33
+ Next.js image optimization is disabled so the generated app needs no native Sharp build. Turning it on is a template choice rather than a security tradeoff.
34
+
35
+ The manifest's `sharp` override is a separate matter and has to stay. The pinned Next 15 line declares Sharp `^0.34.3 || ^0.35.4`, and the `0.34.x` half of that range is still inside [GHSA-rgj7-g3m4-5g8c](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c), so `0.35.4` is the advisory floor. Loosening or removing the override reintroduces a high audit finding whether or not optimization is enabled.
34
36
 
35
37
  ## Development bundler
36
38
 
37
- `bun run dev` uses the Next 15 webpack default. Do not add `--turbopack`: Next 15.5.21 cannot express the required `false` alias for MetaMask SDK's mobile-only storage import in Turbopack without adding a synthetic replacement module. The production build and smoke use the validated webpack alias in `next.config.mjs`.
39
+ `bun run dev` uses the Next 15 webpack default. Do not add `--turbopack`: the pinned Next 15 line cannot express the required `false` alias for MetaMask SDK's mobile-only storage import in Turbopack without adding a synthetic replacement module. The production build and smoke use the validated webpack alias in `next.config.mjs`.
38
40
 
39
41
  ## Sei brand
40
42
 
package/dist/templates/next-template/next.config.mjs CHANGED
@@ -5,8 +5,11 @@ const nextConfig = {
5
5
  ignoreDuringBuilds: true,
6
6
  },
7
7
  images: {
8
- // Next 15.5.21 declares vulnerable Sharp 0.34.x. Keep the secure 0.35.x
9
- // override for resolution, but do not rely on its unsupported optimizer API.
8
+ // Images stay unoptimized so the generated app needs no native Sharp
9
+ // build. Keep the manifest's Sharp override: Next declares
10
+ // `^0.34.3 || ^0.35.4`, and the 0.34.x half is still inside
11
+ // GHSA-rgj7-g3m4-5g8c, so 0.35.4 is the advisory floor. Loosening that
12
+ // pin reintroduces a high finding even though this flag is off.
10
13
  unoptimized: true,
11
14
  },
12
15
  webpack: (config) => {
package/dist/templates/next-template/package.json CHANGED
@@ -25,7 +25,7 @@
25
25
  "@tailwindcss/postcss": "4.3.3",
26
26
  "@tanstack/react-query": "5.85.3",
27
27
  "ethers": "6.17.0",
28
- "next": "15.5.21",
28
+ "next": "15.5.25",
29
29
  "pino-pretty": "13.1.3",
30
30
  "postcss": "8.5.26",
31
31
  "react": "19.1.2",
@@ -46,7 +46,7 @@
46
46
  "@metamask/sdk": "0.33.1",
47
47
  "@metamask/sdk-communication-layer": "0.33.1",
48
48
  "postcss": "8.5.26",
49
- "sharp": "0.35.3",
49
+ "sharp": "0.35.4",
50
50
  "use-sync-external-store": "1.6.0",
51
51
  "uuid": "11.1.1",
52
52
  "ws": "8.21.3"
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sei-js/create-sei",
3
- "version": "2.0.0",
3
+ "version": "2.0.1",
4
4
  "description": "Scaffold new Sei applications with pre-configured templates and tooling",
5
5
  "homepage": "https://github.com/sei-protocol/sei-js/tree/main/packages/create-sei#readme",
6
6
  "repository": {