[dependabot]

Bumps the parity group with 2 updates: @parity/product-sdk and @parity/truapi-host.

Updates @parity/product-sdk from 0.42.0 to 0.43.0

Updates @parity/truapi-host from 0.27.0 to 0.28.0

Release notes

Sourced from @​parity/truapi-host's releases.

@​parity/truapi-host 0.28.0

What's Changed

• build(deps): bump next from 15.5.24 to 15.5.28 in /playground by @​dependabot[bot] in paritytech/trinity-user-agents#1653
• build(deps-dev): bump vite from 8.0.16 to 8.3.4 in /explorer by @​dependabot[bot] in paritytech/trinity-user-agents#1587
• fix(trinity-stack): refuse a URL that is not ASCII by @​mordamax in paritytech/trinity-user-agents#1824
• release: @​parity/truapi 0.28.0, @​parity/truapi-host 0.28.0, @​parity/trinity-stack 0.2.0 by @​mordamax in paritytech/trinity-user-agents#1829

Full Changelog: https://github.com/paritytech/trinity-user-agents/compare/android-20261030-2238-0fc7576...@​parity/truapi-host@0.28.0

Changelog

Sourced from @​parity/truapi-host's changelog.

0.28.0

Minor Changes

• 7a9b1e7: Native hosts can provide encrypted storage for the secrets the core keeps through the new encryptedStorageRead, encryptedStorageWrite and encryptedStorageDelete host callbacks, which default to a rejection. A missing key reads as absent; a store that cannot be read, or a value that no longer decrypts, is an error.
• 1136d53: Native hosts serve NftPurse.createReceiveKey and NftPurse.createCheque. createReceiveKey makes a one-time X25519 receive key into any purse, with no grant; its secret is kept in the host's encrypted storage, so a host that does not provide it cannot create receive keys. createCheque seals the secret of each item to the receive key or a static X25519 key and returns the cheque for the product to deliver; the items are spent from then on. encryptedSecrets is the ephemeral X25519 key, the 12-byte nonce, and the ChaCha20-Poly1305 ciphertext (HKDF-SHA256 key) of the SCALE-encoded 64-byte sr25519 secrets in items order, each in schnorrkel's SecretKey::to_bytes form (scalar, then nonce), not the ed25519-expanded form. An ephemeral cheque id is blake2_256("nft-purse/cheque-id" ++ receiveKey). NftPurseCreateChequeError gains NoItems and OperationExists, the latter for a second cheque with the same id from the same product. Handing off items of a purse the product does not own asks the user through NftPurseDrain, whose destination gains Cheque. The browser core answers both calls Unsupported.
• 860a5f4: Native hosts serve NftPurse.deposit and the new NftPurse.staticReceiveKey. deposit opens a received cheque and registers one move per item into the purse the product names, under the cheque id, which observeOperationStatus follows. An Ephemeral cheque may be deposited only by the product that made its receive key, and only into that key's purse: another purse answers the new NftPurseDepositError.PurseMismatch, and another product's receive key answers CorruptedCheque. A Static cheque opens with the key staticReceiveKey returns, the same for every product, so it is returned only with the identity disclosure consent getUserId asks for (NftPurseStaticReceiveKeyError.PermissionDenied otherwise). Any product may deposit a Static cheque into any purse, but items another deposit already moves answer the new NftPurseDepositError.ItemsInUse. Each move waits up to an hour for its cheque key to hold an NFT. The item secrets are kept in the host's encrypted storage, so each move can be signed again after a restart. The browser core answers both calls Unsupported.
• 54f55e6: Native hosts serve NftPurse.listenOneTimePayment, which replaces listenForPayment, and the new NftPurse.listenPaymentInbox. A sender publishes a statement whose data is the cheque sealed to the receiver's key: the ephemeral X25519 key, the nonce, then the ChaCha20-Poly1305 ciphertext of SCALE(version: u8 = 0, topic, cheque). listenOneTimePayment watches blake2_256("nft-purse/payment-channel" ‖ receiveKey) for a receive key the product made, emits that channel, then the first cheque addressed to the key, and ends; another product's key answers ReceiveKeyNotFound. listenPaymentInbox watches blake2_256("nft-purse/payment-inbox" ‖ identityAccount ‖ blake2_256(productId) ‖ inboxDomain) for Static cheques sealed to the static receive key, emits that channel, then every cheque already stored as one batch, possibly empty, then each batch of new ones. Both emit cheques already deposited again while the store holds them, and end with Other when the connection drops. The browser core answers both Unsupported.
• 24f3157: Native hosts serve NftPurse.rebalancePurse, NftPurse.transferItem and the new NftPurse.observeOperationStatus. A chain operation takes an idempotencyKey the product chooses and returns once it is registered; a second call under the same key fails with OperationExists. observeOperationStatus follows any operation the product registered, by its key, until it is Cleared or Incomplete; deposits and refunds will be followed by their cheque id once they are served. Each transfer is a fee-less Scarcity transfer signed by its item key; an item a live transfer spends is no longer listed by queryPurse. Transferring items out of a purse the product does not own asks the user through the new NftPurseDrain confirmation review. deposit and refund take the same shape and still answer unavailable. The browser core answers the new calls Unsupported.
• 4a92efa: Native hosts serve NftPurse.revokeCheque and NftPurse.refund. revokeCheque moves the items at the keys of a cheque the product created back into fresh keys of its purse, and can be repeated to retry the keys whose move failed; another product's cheque answers ChequeNotFound, a cheque whose items a deposit on this device already moves

... (truncated)

Commits

• 78390e6 release: @​parity/truapi 0.28.0, @​parity/truapi-host 0.28.0, @​parity/trinity-s...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​parity/​product-sdk@​0.42.0 ⏵ 0.43.0	+3			+1
	@​parity/​truapi-host@​0.27.0 ⏵ 0.28.0	+1		+1	+1

View full report

[github-actions]

pr114.host-playground · logs

Network	Browser
Paseo	https://paseo.li/pr114.host-playground
Previewnet	https://testnet.li/pr114.host-playground