chore: sync published workspace versions

[github-actions]

Program and scope

• Tracker or issue: protected release run 30951281829
• Program gate(s) advanced: published-version reconciliation and reproducible OCI release inputs
• Why this change is needed: synchronize first-party package floors and standalone infrastructure locks after protected npm publication.
• Explicitly out of scope: product behavior beyond consuming the already-reviewed package artifacts.
• Exact head SHA reviewed: abb7940

Impact

• No public package source or manifest changed
• Infrastructure source, dependency, image, or deployment configuration changed
• Security-sensitive boundary changed

Affected services and intended patch versions are the changed infra package manifests in this PR.

Verification

• Local commands and results: generated by protected release run 30951281829 after successful npm publication.
• Hosted CI run: CI 30952340170, CodeQL 30952340644, and container runtime contracts 30952340868 all succeeded on the exact head.
• Conformance evidence: Not selected because no conformance input changed.
• Coverage delta: No product source changed.
• Lint/typecheck delta: Hosted affected-graph build, lint, typecheck, dependency review, and merge gate all pass.
• Browser/mobile/packed-consumer evidence: The protected release passed package, clean-consumer, browser, and mobile verification before publication.
• Performance or bundle-size delta: No product source or bundle composition changed.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed by the protected release
• No new override, advisory dismissal, quality suppression, or skipped test
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: The protected release already validated the coordinated package release notes and migration guidance.
• Runtime, build, and peer compatibility: The release verified the governed Node, browser, mobile, runtime, and peer-dependency contracts.
• Deduplicated lockfile: Workspace and standalone npm locks were regenerated once from the published first-party versions without lifecycle scripts.
• Audit and CodeQL: The release rejected high and critical package findings; exact-head CodeQL and dependency review pass on this PR.
• Package and consumer tests: The release passed full builds, typecheck, package artifacts, clean consumers, browser, mobile, registry signatures, provenance, and reconciliation.
• Bundle and performance impact: No bundle composition changed; affected releases retain their documented compatibility contracts.
• Affected public package versions: Derived from the published workspace manifests synchronized by this exact commit.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented by the protected infrastructure release
• Documentation, changelog, migration, and operational guidance are current

The protected infrastructure release builds Linux/amd64 images, rejects high and critical findings, publishes immutable GHCR tags, and attaches SBOM, provenance, and signature evidence after merge. Existing immutable tags remain the rollback path.

Completion evidence

• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​bsv/​wallet-toolbox@​2.4.22 ⏵ 2.5.0	+1		+1	+1
	npm/​@​bsv/​sdk@​2.3.0
	npm/​@​bsv/​wallet-toolbox-client@​2.4.22 ⏵ 2.5.0	+1		+1	+1

View full report

[ty-everett]

Reviewed generated version, integrity, lockfile, infra patch-version, and stack-facts reconciliation against protected release run 30951281829 and the live npm registry. Exact-head CI, CodeQL, Sonar, infra builds, and container runtime contracts are green.