Skip to content

chore(deps-dev): bump starknet from 8.5.2 to 10.8.0 in /packages/core - #56

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/core/starknet-10.8.0
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/core/starknet-10.8.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown

Bumps starknet from 8.5.2 to 10.8.0.

Release notes

Sourced from starknet's releases.

v10.8.0

10.8.0 (2026-09-10)

Bug Fixes

  • deps: bump get-starknet wallet-standard to 6.0.6 (5a8cb12)

Features

  • add RPC 0.10.4 support (starknet-types-0104, RpcChannel v0_10_4) (24561f4)

Security

This release line contains fixes for six security advisories published on 28 September 2026. Affected versions and patched versions are listed on each advisory. Versions 7.x, 8.x and 9.x are end-of-life and do not receive these fixes; upgrade to 10.8.0 or later. See SECURITY.md.

  • GHSA-h32h-x935-6345 High: paymaster appended gas-token call insufficiently validated (fixed in 10.7.2)
  • GHSA-wcqp-4fff-8rjj High: SNIP-29 V2 case-distinct calls field bypasses call validation (fixed in 10.7.2)
  • GHSA-qc84-vrxf-5cqj High: SNIP-12 preset-type shadowing makes distinct schemas hash identically (fixed in 10.7.4)
  • GHSA-4254-vwr3-jp79 Medium: paymaster typed-data domain not bound to the account provider chain (fixed in 10.7.2)
  • GHSA-5v3j-x5p9-4grp Medium: ABI-backed deployment discards constructor argument names (fixed in 10.7.3)
  • GHSA-mv8m-rfr4-jcq8 Medium: default parser returns raw felt for signed integers (fixed in 10.7.5)

Credits: rickypud, Dickson Wu (@​DicksonWu654). Fixes by @​PhilippeR26.

v10.7.6

10.7.6 (2026-09-09)

Bug Fixes

  • logger: coerce message to string before sanitizing CR/LF (f0a3058)
  • security: harden code scanning findings (63bf7bc)

v10.7.5

10.7.5 (2026-09-08)

Bug Fixes

  • calldata: default to the parsing strategy that decodes signed integers correctly (d766915)

v10.7.4

10.7.4 (2026-09-08)

... (truncated)

Changelog

Sourced from starknet's changelog.

10.8.0 (2026-09-10)

Bug Fixes

  • deps: bump get-starknet wallet-standard to 6.0.6 (5a8cb12)

Features

  • add RPC 0.10.4 support (starknet-types-0104, RpcChannel v0_10_4) (24561f4)

10.7.6 (2026-09-09)

Bug Fixes

  • logger: coerce message to string before sanitizing CR/LF (f0a3058)
  • security: harden code scanning findings (63bf7bc)

10.7.5 (2026-09-08)

Bug Fixes

  • calldata: default to the parsing strategy that decodes signed integers correctly (d766915)

10.7.4 (2026-09-08)

Bug Fixes

  • typedData: reject caller types that shadow SNIP-12 preset names (3f06927)

10.7.3 (2026-09-08)

Bug Fixes

  • deployer: preserve constructor argument names before ABI ordering (b27222a)

10.7.2 (2026-09-08)

Bug Fixes

  • paymaster: accept a raw shortstring for the paymaster typed-data domain chainId (4abd5ae)
  • paymaster: bind paymaster typed-data domain to the account's provider chain (f194c61)
  • paymaster: reject paymaster typed data declaring both "calls" and "Calls" (e618f70)
  • paymaster: validate selector and calldata shape of the appended gas-token call (4b72d35)
  • paymaster: validate the full u256 gas-token amount unconditionally (3d1a1ec)
  • paymaster: verify calls equality for sponsored paymaster transactions too (c403643)

10.7.1 (2026-08-21)

Bug Fixes

... (truncated)

Commits
  • 28eb396 chore(release): 10.8.0 [skip ci]
  • 5a423a4 Merge pull request #1701 from PhilippeR26/rpc--0.10.4
  • 5a8cb12 fix(deps): bump get-starknet wallet-standard to 6.0.6
  • 24561f4 feat: add RPC 0.10.4 support (starknet-types-0104, RpcChannel v0_10_4)
  • 4a10c4b Merge pull request #1693 from starknet-io/codex/code-scanning-cleanup
  • 94bec6d chore(release): 10.7.6 [skip ci]
  • cd4b98d Merge pull request #1692 from starknet-io/codex/security-code-scanning
  • f0a3058 fix(logger): coerce message to string before sanitizing CR/LF
  • d60bf9f Merge pull request #1698 from PhilippeR26/docs/algolia-key-update
  • c991386 docs: change keys of algolia search
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for starknet since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [starknet](https://github.com/starknet-io/starknet.js) from 8.5.2 to 10.8.0.
- [Release notes](https://github.com/starknet-io/starknet.js/releases)
- [Changelog](https://github.com/starknet-io/starknet.js/blob/develop/CHANGELOG.md)
- [Commits](starknet-io/starknet.js@v8.5.2...v10.8.0)

---
updated-dependencies:
- dependency-name: starknet
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants