From 9c29dc235ab1cb697795e99f29c71f14a5544326 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 2 Oct 2026 08:57:34 +0000
Subject: [PATCH] Version Packages

---
 .../fix-create-sei-next-sharp-advisories.md   | 17 -------
 .../fix-global-wallet-axios-override.md       | 18 --------
 .../fix-global-wallet-dynamic-peer-drift.md   | 11 -----
 .../fix-global-wallet-sharp-override.md       | 21 ---------
 .../fix-mcp-server-instance-scoped-wallet.md  |  9 ----
 .changeset/precompiles-get-logs-in-range.md   | 11 -----
 bun.lock                                      |  8 ++--
 packages/create-sei/CHANGELOG.md              | 18 ++++++++
 packages/create-sei/package.json              |  2 +-
 packages/mcp-server/CHANGELOG.md              | 10 +++++
 packages/mcp-server/package.json              |  2 +-
 packages/precompiles/CHANGELOG.md             | 12 +++++
 packages/precompiles/package.json             |  2 +-
 packages/sei-global-wallet/CHANGELOG.md       | 45 +++++++++++++++++++
 packages/sei-global-wallet/package.json       |  2 +-
 15 files changed, 93 insertions(+), 95 deletions(-)
 delete mode 100644 .changeset/fix-create-sei-next-sharp-advisories.md
 delete mode 100644 .changeset/fix-global-wallet-axios-override.md
 delete mode 100644 .changeset/fix-global-wallet-dynamic-peer-drift.md
 delete mode 100644 .changeset/fix-global-wallet-sharp-override.md
 delete mode 100644 .changeset/fix-mcp-server-instance-scoped-wallet.md
 delete mode 100644 .changeset/precompiles-get-logs-in-range.md

diff --git a/.changeset/fix-create-sei-next-sharp-advisories.md b/.changeset/fix-create-sei-next-sharp-advisories.md
deleted file mode 100644
index b19258816..000000000
--- a/.changeset/fix-create-sei-next-sharp-advisories.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-'@sei-js/create-sei': patch
----
-
-Bump the Next template's `next` and `sharp` pins to clear three newly published advisories.
-
-The generated-app smoke audits every variant and fails on any high or critical finding. Three advisories landed against the pinned versions, so the check went red without any change to the template:
-
-- `GHSA-p293-qw3h-jr36` — critical, unauthenticated RCE on Windows-hosted Next.js servers, `>=13.4.0 <15.5.24`.
-- `GHSA-2xp9-vwfh-vxw4` — critical, unauthenticated RCE in the Image Optimization API when AVIF files are used, `>=10.0.0 <15.5.24`.
-- `GHSA-rgj7-g3m4-5g8c` — high, heap overflow in Sharp's bundled libheif decoder, `<0.35.4`.
-
-`next` moves `15.5.21` to `15.5.25` and the `sharp` override `0.35.3` to `0.35.4`, both inside their pinned minors.
-
-Next also widened its own Sharp declaration to `^0.34.3 || ^0.35.4`, so the pinned override now sits inside the range Next supports. The image notes in the template README and `next.config.mjs` said the opposite and are corrected: images stay unoptimized to avoid requiring a native Sharp build, which is a template choice rather than a security tradeoff. The `sharp` override itself still is one, and both notes now say so — the `0.34.x` half of Next's range remains inside the advisory, making `0.35.4` the floor rather than a free upgrade.
-
-The remaining `decode-uri-component` finding is moderate and does not block the smoke.
diff --git a/.changeset/fix-global-wallet-axios-override.md b/.changeset/fix-global-wallet-axios-override.md
deleted file mode 100644
index e19b1c0d7..000000000
--- a/.changeset/fix-global-wallet-axios-override.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-'@sei-js/sei-global-wallet': patch
----
-
-Raise the documented `axios` override to `1.20.0` to clear the Axios advisories published on 2026-09-30.
-
-Twelve advisories published that day cover every Axios release below `1.20.0`, including the `1.18.0` the [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks pinned, so the nightly consumer run went red without any change in this repository. The wallet-only npm consumer, which is held to a strictly clean audit, reported nine findings: `axios` itself and the eight Dynamic packages above it in the dependency chain.
-
-Every one of them is patched in `1.20.0` and still open in `1.19.0`:
-
-- High: `GHSA-3pq3-5fj3-cg6v`, `GHSA-542g-h47m-68v8`, `GHSA-c29m-xwm3-cm6r`, `GHSA-m8m8-qj5v-23w3`, `GHSA-mghh-pgcx-3jjj`, `GHSA-r4gj-5m52-g5wh`, `GHSA-x97p-jq2g-jp4f`.
-- Medium: `GHSA-44g4-m2mj-wpvx`, `GHSA-4hqw-qxg8-jxx2`, `GHSA-9fr6-4gfg-395g`, `GHSA-j8rh-479h-cp32`, `GHSA-vh66-26gq-q6x8`.
-
-Dynamic still pins `axios@1.16.0` exactly, so the correction stays a root override. All three blocks now carry `"axios": "1.20.0"`, the first release outside every advisory reported against that pin. It ships the same exports and dependencies as `1.18.0`, apart from raising the `form-data` floor to `^4.0.6`.
-
-The README's Axios note described only the Node HTTP adapter issue that `1.18.0` cleared. It now covers the current set: the high-severity issues are in Node-only transports or are prototype-pollution gadgets, and the `toFormData` and fetch-adapter gadgets also apply in browsers.
-
-No published dependency or peer range changes.
diff --git a/.changeset/fix-global-wallet-dynamic-peer-drift.md b/.changeset/fix-global-wallet-dynamic-peer-drift.md
deleted file mode 100644
index e2d1b422c..000000000
--- a/.changeset/fix-global-wallet-dynamic-peer-drift.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@sei-js/sei-global-wallet': patch
----
-
-Document that `@dynamic-labs/ethereum-aa` has to match the `@dynamic-labs/global-wallet-client` version npm resolves, and keep the release checks on that resolved version instead of a constant.
-
-Dynamic declares `@dynamic-labs/ethereum-aa` as an exact peer of its client and pins its internal packages to the client's version, so the two move together on every patch. `@dynamic-labs/global-wallet-client` is a `^4.96.3` dependency here, which means a Dynamic patch inside that range changes the peer version consumers need. Pinning an older `@dynamic-labs/ethereum-aa` than the resolved client does not fail the install: npm cannot place the client's exact peer beside the older root copy, so it nests the client under this package and duplicates the whole Dynamic runtime. The [Optional peer versions](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#optional-peer-versions) table now states this and shows how to read the version the resolved client asks for.
-
-The consumer verifier resolved `4.96.3` regardless of what the range resolved to, so Dynamic publishing `@dynamic-labs/global-wallet-client@4.96.4` turned the nightly consumer run red on a duplicated Dynamic subtree rather than on any change in this repository. It now resolves the declared range against the registry, pins that client and the peer version it requests in each full consumer, and reports both, so a Dynamic patch is exercised the way an application receives it while a peer pin moving outside this package's published range still fails. A client that npm nests instead of hoisting is now reported as such, rather than as an unresolved dependency.
-
-No published dependency or peer range changes.
diff --git a/.changeset/fix-global-wallet-sharp-override.md b/.changeset/fix-global-wallet-sharp-override.md
deleted file mode 100644
index ebaf35646..000000000
--- a/.changeset/fix-global-wallet-sharp-override.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-'@sei-js/sei-global-wallet': patch
----
-
-Override the newly advised `sharp` pin, and waive the one optional-AA advisory that no override can reach.
-
-Two advisories published against the existing dependency graph, so the nightly consumer run went red without any change in this repository.
-
-`GHSA-rgj7-g3m4-5g8c` covers `sharp` below `0.35.4`, and `@dynamic-labs/iconic` pins `sharp@0.35.0` exactly. That is the same shape as the existing Axios and UUID pins: the vulnerable copy is reachable from `@dynamic-labs/global-wallet-client`, overrides are root-only in both npm and Bun, and this package cannot propagate them to an application. A plain install reported nine high findings, one root advisory cascading up the Dynamic chain to `@sei-js/sei-global-wallet` itself. The [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"sharp": "0.35.4"`, a patch-level move inside the pinned minor. The advisory is a heap overflow in the bundled libheif decoder, so it needs untrusted HEIF input to trigger and `sharp` is a build-time dependency of the icon package that never reaches a browser bundle, but it is high severity with a compatible fix available, so it is corrected rather than waived.
-
-`GHSA-528h-pc64-c93x` covers every `stream-json` up to `3.4.0`, which the Solana RPC client's `jayson` requires as CommonJS on the optional AA path. It cannot be overridden: `3.5.0` onward is ESM-only under a moved `src/` layout, so pointing `jayson` at a fixed version replaces the advisory with a `MODULE_NOT_FOUND` on its own require, and every CommonJS version is inside the advisory. It is now an accepted advisory for the full npm consumer, alongside the Bun waiver that already existed for advisories with no compatible fix. The finding is an `O(depth²)` slowdown in filters that no wallet path feeds, and the wallet-only npm consumer is still held to a strictly clean audit with no waiver, so a default install is unaffected.
-
-Several verifier gaps this exposed are closed as well.
-
-The npm audits ran without allowing a non-zero exit, so any finding surfaced as a raw spawn error carrying the whole audit JSON rather than the assertion naming the consumer; they now fail with the offending package and advisory URL. Allowing that exit means the body has to be validated, because `npm audit` fails the same way when it cannot reach the registry: an `ENOAUDIT` payload carries no counts, so an unvalidated report would read as zero findings and turn an audit that never ran into a pass on the gate this check exists to enforce. Every npm audit result is now rejected unless it carries a real vulnerability count.
-
-The "overrides still required" report and the Bun "overrides are taking effect" assertion are now derived from the override block instead of a hardcoded `axios`/`uuid` list, so a newly overridden package cannot be left out and let a partial upstream fix ask for the whole waiver to be dropped. The README override blocks are asserted against the sets the consumers install, so the three hand-maintained copies cannot document an override that is never tested.
-
-The audit and override-parsing helpers moved into `scripts/consumer-audit.ts` and `scripts/documented-overrides.ts` with unit tests, so these cases are pinned by `bun test --isolate scripts` rather than only by a full consumer run.
-
-No published dependency or peer range changes.
diff --git a/.changeset/fix-mcp-server-instance-scoped-wallet.md b/.changeset/fix-mcp-server-instance-scoped-wallet.md
deleted file mode 100644
index 43305e90d..000000000
--- a/.changeset/fix-mcp-server-instance-scoped-wallet.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-'@sei-js/mcp-server': patch
----
-
-Keep each MCP runtime on the wallet configuration that passed its security check.
-
-A later programmatic `main()` could overwrite the process-wide config object while an HTTP listener started earlier was still serving requests. New sessions on that listener then built their tool list from the updated singleton, so a wallet-disabled HTTP server could expose signing tools after a trusted stdio start in the same process. No shipped CLI or host spawn does that, but the public lifecycle returned independent runtimes without isolating their keys.
-
-`parseArgs()` now returns a frozen `AppConfig` snapshot, and every transport handles requests against that snapshot. Stopping one runtime evicts only its provider cache entry, while other runtimes keep their original signer. HTTP transports require that snapshot and derive signing policy from it.
diff --git a/.changeset/precompiles-get-logs-in-range.md b/.changeset/precompiles-get-logs-in-range.md
deleted file mode 100644
index 821016e66..000000000
--- a/.changeset/precompiles-get-logs-in-range.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@sei-js/precompiles': minor
----
-
-Add `getLogsInRange`, `streamLogsInRange`, `blockRanges` and `MAX_GET_LOGS_BLOCK_RANGE` for reading logs across a block range.
-
-`eth_getLogs` is capped per request, so reading more history than one request allows means walking it in chunks, and every project that needs logs writes that loop again. This walk only sends requests a Sei node can answer. Spans are counted inclusively the way the node counts them (2000 blocks passes, 2001 is refused). A span too heavy to answer is halved and asked again, whether the node refuses it for matching more than `max_log_no_block` logs (sei-chain v6.7 and later), the response passes viem's size limit (before v6.7, when bounded requests are served whole), or the span times out. A node whose refusal names a smaller `max_blocks_for_log` is walked at that, and busy or rate limited refusals are retried with backoff. Every request carries an explicit `toBlock`, because nodes before v6.7 silently cut an open-ended request off at the log cap.
-
-`streamLogsInRange` yields each chunk with its logs, so a backfill can store as it goes and resume from the last `toBlock`. `getLogsInRange` collects the walk into one array and awaits an optional `onChunk` for each chunk. Both take viem's `getLogs` filter (`address`, `event` with `args`, `events`, `strict`), accept a whole contract ABI as `events`, and take any viem `Client`, including one that carries an account. Without a `toBlock` they read to the head, since Sei finalises a block as it is produced. `blockRanges` gives the fixed-width plan without making requests.
-
-No dependency or peer range changes: this uses the `viem` peer already declared.
diff --git a/bun.lock b/bun.lock
index 8776cfabd..90986f661 100644
--- a/bun.lock
+++ b/bun.lock
@@ -18,7 +18,7 @@
     },
     "packages/create-sei": {
       "name": "@sei-js/create-sei",
-      "version": "2.0.0",
+      "version": "2.0.1",
       "bin": "./dist/main.js",
       "dependencies": {
         "boxen": "^7.1.1",
@@ -32,7 +32,7 @@
     },
     "packages/mcp-server": {
       "name": "@sei-js/mcp-server",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "bin": "./bin/mcp-server.js",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.23.0",
@@ -52,7 +52,7 @@
     },
     "packages/precompiles": {
       "name": "@sei-js/precompiles",
-      "version": "3.0.0",
+      "version": "3.1.0",
       "devDependencies": {
         "esbuild": "^0.28.2",
         "ethers": "^6.0.0",
@@ -74,7 +74,7 @@
     },
     "packages/sei-global-wallet": {
       "name": "@sei-js/sei-global-wallet",
-      "version": "2.0.0",
+      "version": "2.0.1",
       "dependencies": {
         "@dynamic-labs/global-wallet-client": "^4.96.3",
         "@wallet-standard/wallet": "^1.1.0",
diff --git a/packages/create-sei/CHANGELOG.md b/packages/create-sei/CHANGELOG.md
index 3009e2375..78a7db0c0 100644
--- a/packages/create-sei/CHANGELOG.md
+++ b/packages/create-sei/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @sei-js/create-sei
 
+## 2.0.1
+
+### Patch Changes
+
+- cb882eb: Bump the Next template's `next` and `sharp` pins to clear three newly published advisories.
+
+  The generated-app smoke audits every variant and fails on any high or critical finding. Three advisories landed against the pinned versions, so the check went red without any change to the template:
+
+  - `GHSA-p293-qw3h-jr36` — critical, unauthenticated RCE on Windows-hosted Next.js servers, `>=13.4.0 <15.5.24`.
+  - `GHSA-2xp9-vwfh-vxw4` — critical, unauthenticated RCE in the Image Optimization API when AVIF files are used, `>=10.0.0 <15.5.24`.
+  - `GHSA-rgj7-g3m4-5g8c` — high, heap overflow in Sharp's bundled libheif decoder, `<0.35.4`.
+
+  `next` moves `15.5.21` to `15.5.25` and the `sharp` override `0.35.3` to `0.35.4`, both inside their pinned minors.
+
+  Next also widened its own Sharp declaration to `^0.34.3 || ^0.35.4`, so the pinned override now sits inside the range Next supports. The image notes in the template README and `next.config.mjs` said the opposite and are corrected: images stay unoptimized to avoid requiring a native Sharp build, which is a template choice rather than a security tradeoff. The `sharp` override itself still is one, and both notes now say so — the `0.34.x` half of Next's range remains inside the advisory, making `0.35.4` the floor rather than a free upgrade.
+
+  The remaining `decode-uri-component` finding is moderate and does not block the smoke.
+
 ## 2.0.0
 
 ### Major Changes
diff --git a/packages/create-sei/package.json b/packages/create-sei/package.json
index bfa1c1923..eb5b91ebf 100644
--- a/packages/create-sei/package.json
+++ b/packages/create-sei/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@sei-js/create-sei",
-	"version": "2.0.0",
+	"version": "2.0.1",
 	"description": "Scaffold new Sei applications with pre-configured templates and tooling",
 	"homepage": "https://github.com/sei-protocol/sei-js/tree/main/packages/create-sei#readme",
 	"repository": {
diff --git a/packages/mcp-server/CHANGELOG.md b/packages/mcp-server/CHANGELOG.md
index edcc2d8be..cd042e84d 100644
--- a/packages/mcp-server/CHANGELOG.md
+++ b/packages/mcp-server/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.0.1
+
+### Patch Changes
+
+- 5a40dc8: Keep each MCP runtime on the wallet configuration that passed its security check.
+
+  A later programmatic `main()` could overwrite the process-wide config object while an HTTP listener started earlier was still serving requests. New sessions on that listener then built their tool list from the updated singleton, so a wallet-disabled HTTP server could expose signing tools after a trusted stdio start in the same process. No shipped CLI or host spawn does that, but the public lifecycle returned independent runtimes without isolating their keys.
+
+  `parseArgs()` now returns a frozen `AppConfig` snapshot, and every transport handles requests against that snapshot. Stopping one runtime evicts only its provider cache entry, while other runtimes keep their original signer. HTTP transports require that snapshot and derive signing policy from it.
+
 ## 1.0.0
 
 ### Major Changes
diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
index a37a4b021..244f4c906 100644
--- a/packages/mcp-server/package.json
+++ b/packages/mcp-server/package.json
@@ -2,7 +2,7 @@
 	"name": "@sei-js/mcp-server",
 	"description": "Model Context Protocol (MCP) server for interacting with EVM-compatible networks",
 	"type": "module",
-	"version": "1.0.0",
+	"version": "1.0.1",
 	"bin": "./bin/mcp-server.js",
 	"main": "./dist/index.js",
 	"module": "./dist/index.js",
diff --git a/packages/precompiles/CHANGELOG.md b/packages/precompiles/CHANGELOG.md
index 94bf47329..64414bdeb 100644
--- a/packages/precompiles/CHANGELOG.md
+++ b/packages/precompiles/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @sei-js/precompiles
 
+## 3.1.0
+
+### Minor Changes
+
+- b7f4e54: Add `getLogsInRange`, `streamLogsInRange`, `blockRanges` and `MAX_GET_LOGS_BLOCK_RANGE` for reading logs across a block range.
+
+  `eth_getLogs` is capped per request, so reading more history than one request allows means walking it in chunks, and every project that needs logs writes that loop again. This walk only sends requests a Sei node can answer. Spans are counted inclusively the way the node counts them (2000 blocks passes, 2001 is refused). A span too heavy to answer is halved and asked again, whether the node refuses it for matching more than `max_log_no_block` logs (sei-chain v6.7 and later), the response passes viem's size limit (before v6.7, when bounded requests are served whole), or the span times out. A node whose refusal names a smaller `max_blocks_for_log` is walked at that, and busy or rate limited refusals are retried with backoff. Every request carries an explicit `toBlock`, because nodes before v6.7 silently cut an open-ended request off at the log cap.
+
+  `streamLogsInRange` yields each chunk with its logs, so a backfill can store as it goes and resume from the last `toBlock`. `getLogsInRange` collects the walk into one array and awaits an optional `onChunk` for each chunk. Both take viem's `getLogs` filter (`address`, `event` with `args`, `events`, `strict`), accept a whole contract ABI as `events`, and take any viem `Client`, including one that carries an account. Without a `toBlock` they read to the head, since Sei finalises a block as it is produced. `blockRanges` gives the fixed-width plan without making requests.
+
+  No dependency or peer range changes: this uses the `viem` peer already declared.
+
 ## 3.0.0
 
 ### Major Changes
diff --git a/packages/precompiles/package.json b/packages/precompiles/package.json
index fd1dc8576..f5fa41916 100644
--- a/packages/precompiles/package.json
+++ b/packages/precompiles/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@sei-js/precompiles",
-	"version": "3.0.0",
+	"version": "3.1.0",
 	"description": "TypeScript library for EVM interactions on the Sei blockchain",
 	"type": "module",
 	"main": "./dist/index.js",
diff --git a/packages/sei-global-wallet/CHANGELOG.md b/packages/sei-global-wallet/CHANGELOG.md
index 77046733d..29580adbc 100644
--- a/packages/sei-global-wallet/CHANGELOG.md
+++ b/packages/sei-global-wallet/CHANGELOG.md
@@ -1,5 +1,50 @@
 # @sei-js/sei-global-wallet
 
+## 2.0.1
+
+### Patch Changes
+
+- 54c991f: Raise the documented `axios` override to `1.20.0` to clear the Axios advisories published on 2026-09-30.
+
+  Twelve advisories published that day cover every Axios release below `1.20.0`, including the `1.18.0` the [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks pinned, so the nightly consumer run went red without any change in this repository. The wallet-only npm consumer, which is held to a strictly clean audit, reported nine findings: `axios` itself and the eight Dynamic packages above it in the dependency chain.
+
+  Every one of them is patched in `1.20.0` and still open in `1.19.0`:
+
+  - High: `GHSA-3pq3-5fj3-cg6v`, `GHSA-542g-h47m-68v8`, `GHSA-c29m-xwm3-cm6r`, `GHSA-m8m8-qj5v-23w3`, `GHSA-mghh-pgcx-3jjj`, `GHSA-r4gj-5m52-g5wh`, `GHSA-x97p-jq2g-jp4f`.
+  - Medium: `GHSA-44g4-m2mj-wpvx`, `GHSA-4hqw-qxg8-jxx2`, `GHSA-9fr6-4gfg-395g`, `GHSA-j8rh-479h-cp32`, `GHSA-vh66-26gq-q6x8`.
+
+  Dynamic still pins `axios@1.16.0` exactly, so the correction stays a root override. All three blocks now carry `"axios": "1.20.0"`, the first release outside every advisory reported against that pin. It ships the same exports and dependencies as `1.18.0`, apart from raising the `form-data` floor to `^4.0.6`.
+
+  The README's Axios note described only the Node HTTP adapter issue that `1.18.0` cleared. It now covers the current set: the high-severity issues are in Node-only transports or are prototype-pollution gadgets, and the `toFormData` and fetch-adapter gadgets also apply in browsers.
+
+  No published dependency or peer range changes.
+
+- 66deb15: Document that `@dynamic-labs/ethereum-aa` has to match the `@dynamic-labs/global-wallet-client` version npm resolves, and keep the release checks on that resolved version instead of a constant.
+
+  Dynamic declares `@dynamic-labs/ethereum-aa` as an exact peer of its client and pins its internal packages to the client's version, so the two move together on every patch. `@dynamic-labs/global-wallet-client` is a `^4.96.3` dependency here, which means a Dynamic patch inside that range changes the peer version consumers need. Pinning an older `@dynamic-labs/ethereum-aa` than the resolved client does not fail the install: npm cannot place the client's exact peer beside the older root copy, so it nests the client under this package and duplicates the whole Dynamic runtime. The [Optional peer versions](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#optional-peer-versions) table now states this and shows how to read the version the resolved client asks for.
+
+  The consumer verifier resolved `4.96.3` regardless of what the range resolved to, so Dynamic publishing `@dynamic-labs/global-wallet-client@4.96.4` turned the nightly consumer run red on a duplicated Dynamic subtree rather than on any change in this repository. It now resolves the declared range against the registry, pins that client and the peer version it requests in each full consumer, and reports both, so a Dynamic patch is exercised the way an application receives it while a peer pin moving outside this package's published range still fails. A client that npm nests instead of hoisting is now reported as such, rather than as an unresolved dependency.
+
+  No published dependency or peer range changes.
+
+- cb882eb: Override the newly advised `sharp` pin, and waive the one optional-AA advisory that no override can reach.
+
+  Two advisories published against the existing dependency graph, so the nightly consumer run went red without any change in this repository.
+
+  `GHSA-rgj7-g3m4-5g8c` covers `sharp` below `0.35.4`, and `@dynamic-labs/iconic` pins `sharp@0.35.0` exactly. That is the same shape as the existing Axios and UUID pins: the vulnerable copy is reachable from `@dynamic-labs/global-wallet-client`, overrides are root-only in both npm and Bun, and this package cannot propagate them to an application. A plain install reported nine high findings, one root advisory cascading up the Dynamic chain to `@sei-js/sei-global-wallet` itself. The [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"sharp": "0.35.4"`, a patch-level move inside the pinned minor. The advisory is a heap overflow in the bundled libheif decoder, so it needs untrusted HEIF input to trigger and `sharp` is a build-time dependency of the icon package that never reaches a browser bundle, but it is high severity with a compatible fix available, so it is corrected rather than waived.
+
+  `GHSA-528h-pc64-c93x` covers every `stream-json` up to `3.4.0`, which the Solana RPC client's `jayson` requires as CommonJS on the optional AA path. It cannot be overridden: `3.5.0` onward is ESM-only under a moved `src/` layout, so pointing `jayson` at a fixed version replaces the advisory with a `MODULE_NOT_FOUND` on its own require, and every CommonJS version is inside the advisory. It is now an accepted advisory for the full npm consumer, alongside the Bun waiver that already existed for advisories with no compatible fix. The finding is an `O(depth²)` slowdown in filters that no wallet path feeds, and the wallet-only npm consumer is still held to a strictly clean audit with no waiver, so a default install is unaffected.
+
+  Several verifier gaps this exposed are closed as well.
+
+  The npm audits ran without allowing a non-zero exit, so any finding surfaced as a raw spawn error carrying the whole audit JSON rather than the assertion naming the consumer; they now fail with the offending package and advisory URL. Allowing that exit means the body has to be validated, because `npm audit` fails the same way when it cannot reach the registry: an `ENOAUDIT` payload carries no counts, so an unvalidated report would read as zero findings and turn an audit that never ran into a pass on the gate this check exists to enforce. Every npm audit result is now rejected unless it carries a real vulnerability count.
+
+  The "overrides still required" report and the Bun "overrides are taking effect" assertion are now derived from the override block instead of a hardcoded `axios`/`uuid` list, so a newly overridden package cannot be left out and let a partial upstream fix ask for the whole waiver to be dropped. The README override blocks are asserted against the sets the consumers install, so the three hand-maintained copies cannot document an override that is never tested.
+
+  The audit and override-parsing helpers moved into `scripts/consumer-audit.ts` and `scripts/documented-overrides.ts` with unit tests, so these cases are pinned by `bun test --isolate scripts` rather than only by a full consumer run.
+
+  No published dependency or peer range changes.
+
 ## 2.0.0
 
 ### Major Changes
diff --git a/packages/sei-global-wallet/package.json b/packages/sei-global-wallet/package.json
index cb8a67aa2..4878671cd 100644
--- a/packages/sei-global-wallet/package.json
+++ b/packages/sei-global-wallet/package.json
@@ -1,7 +1,7 @@
 {
 	"name": "@sei-js/sei-global-wallet",
 	"description": "Sei Global Wallet is a library to support Dynamic Global Wallets",
-	"version": "2.0.0",
+	"version": "2.0.1",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/sei-protocol/sei-js.git",