diff --git a/.changeset/drop-metamask-sdk-connector.md b/.changeset/drop-metamask-sdk-connector.md deleted file mode 100644 index b7313a1..0000000 --- a/.changeset/drop-metamask-sdk-connector.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -'@openzeppelin/adapter-evm': major -'@openzeppelin/adapter-polkadot': major ---- - -Remove the dedicated `metaMask()` wagmi connector, and strip `@metamask/sdk` from the install -tree. - -**Why** - -`@metamask/sdk` is not open source. It ships a proprietary licence — "Copyright ConsenSys -Software Inc. 2022. All rights reserved" — granting only a non-exclusive, non-transferable -licence for **Non-Commercial Use**. Clause 2 requires any Resulting Program to carry that same -Non-Commercial restriction forward. - -We publish under AGPL-3.0, which forbids conveying the work under added restrictions. A -non-commercial-only restriction is exactly such a restriction, while the SDK licence demands our -derivative propagate it. Those two obligations cannot both be satisfied. - -This conflict is structural, not a threshold question — it does not depend on any monthly -active user count. There is also no clean version to pin: none of the published versions of -`@metamask/sdk` declare a `license` field at all, and the proprietary licence file dates from -2022. The same 2715-byte licence ships in `@metamask/sdk`, -`@metamask/sdk-communication-layer` and `@metamask/sdk-install-modal-web`. - -**What changed** - -`createDefaultConfig()` in the shared wagmi implementation now builds its connector list from -`[injected(), safe()]` instead of `[injected(), metaMask(), safe()]`. `@openzeppelin/adapter-polkadot` -extends the same class, so it inherits the change. - -Removing the connector alone is not sufficient: `@wagmi/connectors` declares `@metamask/sdk` as -a **hard dependency**, not an optional peer, so it installed whether or not the connector was -registered. A `.pnpmfile.cjs` `readPackage` hook now strips it, and -`scripts/check-dependency-licenses.cjs` fails if it returns to the lockfile or if the hook is -removed. - -The strip targets those three package names exactly, **not** the `@metamask/*` scope. Most of -that scope is MIT or ISC (`utils`, `providers`, `json-rpc-engine`, `rpc-errors`, `superstruct`, -`sdk-analytics`, …) and is legitimately required; a scope-wide ban would break far more than it -fixes. - -**What this means for users** - -MetaMask **desktop keeps working.** The browser extension is discovered through `injected()` -plus EIP-6963 multi-injected provider discovery, which `createConfig` leaves enabled by -default. - -**MetaMask mobile deep-link / QR pairing is gone.** That pairing flow was provided only by the -SDK, and it is a user-visible behaviour change. Mobile users can still connect through the -MetaMask in-app browser, which exposes an injected provider. - -The RainbowKit path is unaffected: its wallet list was already pinned to -`[injectedWallet, safeWallet]`. diff --git a/packages/adapter-evm/CHANGELOG.md b/packages/adapter-evm/CHANGELOG.md index 37cd056..1258444 100644 --- a/packages/adapter-evm/CHANGELOG.md +++ b/packages/adapter-evm/CHANGELOG.md @@ -1,5 +1,58 @@ # @openzeppelin/transaction-form-adapter-evm +## 5.0.0 + +### Major Changes + +- [#83](https://github.com/OpenZeppelin/openzeppelin-adapters/pull/83) [`42fc0fe`](https://github.com/OpenZeppelin/openzeppelin-adapters/commit/42fc0fe0551eb2b1528d2c8b2ad9c66a5f6105a4) Thanks [@pasevin](https://github.com/pasevin)! - Remove the dedicated `metaMask()` wagmi connector, and strip `@metamask/sdk` from the install + tree. + + **Why** + + `@metamask/sdk` is not open source. It ships a proprietary licence — "Copyright ConsenSys + Software Inc. 2022. All rights reserved" — granting only a non-exclusive, non-transferable + licence for **Non-Commercial Use**. Clause 2 requires any Resulting Program to carry that same + Non-Commercial restriction forward. + + We publish under AGPL-3.0, which forbids conveying the work under added restrictions. A + non-commercial-only restriction is exactly such a restriction, while the SDK licence demands our + derivative propagate it. Those two obligations cannot both be satisfied. + + This conflict is structural, not a threshold question — it does not depend on any monthly + active user count. There is also no clean version to pin: none of the published versions of + `@metamask/sdk` declare a `license` field at all, and the proprietary licence file dates from 2022. The same 2715-byte licence ships in `@metamask/sdk`, + `@metamask/sdk-communication-layer` and `@metamask/sdk-install-modal-web`. + + **What changed** + + `createDefaultConfig()` in the shared wagmi implementation now builds its connector list from + `[injected(), safe()]` instead of `[injected(), metaMask(), safe()]`. `@openzeppelin/adapter-polkadot` + extends the same class, so it inherits the change. + + Removing the connector alone is not sufficient: `@wagmi/connectors` declares `@metamask/sdk` as + a **hard dependency**, not an optional peer, so it installed whether or not the connector was + registered. A `.pnpmfile.cjs` `readPackage` hook now strips it, and + `scripts/check-dependency-licenses.cjs` fails if it returns to the lockfile or if the hook is + removed. + + The strip targets those three package names exactly, **not** the `@metamask/*` scope. Most of + that scope is MIT or ISC (`utils`, `providers`, `json-rpc-engine`, `rpc-errors`, `superstruct`, + `sdk-analytics`, …) and is legitimately required; a scope-wide ban would break far more than it + fixes. + + **What this means for users** + + MetaMask **desktop keeps working.** The browser extension is discovered through `injected()` + plus EIP-6963 multi-injected provider discovery, which `createConfig` leaves enabled by + default. + + **MetaMask mobile deep-link / QR pairing is gone.** That pairing flow was provided only by the + SDK, and it is a user-visible behaviour change. Mobile users can still connect through the + MetaMask in-app browser, which exposes an injected provider. + + The RainbowKit path is unaffected: its wallet list was already pinned to + `[injectedWallet, safeWallet]`. + ## 4.0.2 ### Patch Changes diff --git a/packages/adapter-evm/package.json b/packages/adapter-evm/package.json index 4f3f6c2..01d19a8 100644 --- a/packages/adapter-evm/package.json +++ b/packages/adapter-evm/package.json @@ -1,6 +1,6 @@ { "name": "@openzeppelin/adapter-evm", - "version": "4.0.2", + "version": "5.0.0", "private": false, "description": "EVM Adapter for UI Builder", "keywords": [ diff --git a/packages/adapter-polkadot/CHANGELOG.md b/packages/adapter-polkadot/CHANGELOG.md index 7f98046..6396b36 100644 --- a/packages/adapter-polkadot/CHANGELOG.md +++ b/packages/adapter-polkadot/CHANGELOG.md @@ -1,5 +1,58 @@ # @openzeppelin/adapter-polkadot +## 5.0.0 + +### Major Changes + +- [#83](https://github.com/OpenZeppelin/openzeppelin-adapters/pull/83) [`42fc0fe`](https://github.com/OpenZeppelin/openzeppelin-adapters/commit/42fc0fe0551eb2b1528d2c8b2ad9c66a5f6105a4) Thanks [@pasevin](https://github.com/pasevin)! - Remove the dedicated `metaMask()` wagmi connector, and strip `@metamask/sdk` from the install + tree. + + **Why** + + `@metamask/sdk` is not open source. It ships a proprietary licence — "Copyright ConsenSys + Software Inc. 2022. All rights reserved" — granting only a non-exclusive, non-transferable + licence for **Non-Commercial Use**. Clause 2 requires any Resulting Program to carry that same + Non-Commercial restriction forward. + + We publish under AGPL-3.0, which forbids conveying the work under added restrictions. A + non-commercial-only restriction is exactly such a restriction, while the SDK licence demands our + derivative propagate it. Those two obligations cannot both be satisfied. + + This conflict is structural, not a threshold question — it does not depend on any monthly + active user count. There is also no clean version to pin: none of the published versions of + `@metamask/sdk` declare a `license` field at all, and the proprietary licence file dates from 2022. The same 2715-byte licence ships in `@metamask/sdk`, + `@metamask/sdk-communication-layer` and `@metamask/sdk-install-modal-web`. + + **What changed** + + `createDefaultConfig()` in the shared wagmi implementation now builds its connector list from + `[injected(), safe()]` instead of `[injected(), metaMask(), safe()]`. `@openzeppelin/adapter-polkadot` + extends the same class, so it inherits the change. + + Removing the connector alone is not sufficient: `@wagmi/connectors` declares `@metamask/sdk` as + a **hard dependency**, not an optional peer, so it installed whether or not the connector was + registered. A `.pnpmfile.cjs` `readPackage` hook now strips it, and + `scripts/check-dependency-licenses.cjs` fails if it returns to the lockfile or if the hook is + removed. + + The strip targets those three package names exactly, **not** the `@metamask/*` scope. Most of + that scope is MIT or ISC (`utils`, `providers`, `json-rpc-engine`, `rpc-errors`, `superstruct`, + `sdk-analytics`, …) and is legitimately required; a scope-wide ban would break far more than it + fixes. + + **What this means for users** + + MetaMask **desktop keeps working.** The browser extension is discovered through `injected()` + plus EIP-6963 multi-injected provider discovery, which `createConfig` leaves enabled by + default. + + **MetaMask mobile deep-link / QR pairing is gone.** That pairing flow was provided only by the + SDK, and it is a user-visible behaviour change. Mobile users can still connect through the + MetaMask in-app browser, which exposes an injected provider. + + The RainbowKit path is unaffected: its wallet list was already pinned to + `[injectedWallet, safeWallet]`. + ## 4.0.2 ### Patch Changes diff --git a/packages/adapter-polkadot/package.json b/packages/adapter-polkadot/package.json index 5036206..1760dc1 100644 --- a/packages/adapter-polkadot/package.json +++ b/packages/adapter-polkadot/package.json @@ -1,6 +1,6 @@ { "name": "@openzeppelin/adapter-polkadot", - "version": "4.0.2", + "version": "5.0.0", "private": false, "description": "Polkadot Adapter for UI Builder", "keywords": [ diff --git a/packages/adapters-vite/CHANGELOG.md b/packages/adapters-vite/CHANGELOG.md index bb109e5..2af32a2 100644 --- a/packages/adapters-vite/CHANGELOG.md +++ b/packages/adapters-vite/CHANGELOG.md @@ -1,5 +1,13 @@ # @openzeppelin/adapters-vite +## 12.0.0 + +### Patch Changes + +- Updated dependencies [[`42fc0fe`](https://github.com/OpenZeppelin/openzeppelin-adapters/commit/42fc0fe0551eb2b1528d2c8b2ad9c66a5f6105a4)]: + - @openzeppelin/adapter-evm@5.0.0 + - @openzeppelin/adapter-polkadot@5.0.0 + ## 11.0.1 ### Patch Changes diff --git a/packages/adapters-vite/package.json b/packages/adapters-vite/package.json index 267d241..15a733a 100644 --- a/packages/adapters-vite/package.json +++ b/packages/adapters-vite/package.json @@ -1,6 +1,6 @@ { "name": "@openzeppelin/adapters-vite", - "version": "11.0.1", + "version": "12.0.0", "private": false, "description": "Shared Vite and Vitest integration helpers for OpenZeppelin adapter packages", "keywords": [ @@ -41,9 +41,9 @@ "test:watch": "vitest" }, "peerDependencies": { - "@openzeppelin/adapter-evm": "^4.0.2", + "@openzeppelin/adapter-evm": "^5.0.0", "@openzeppelin/adapter-midnight": "^4.0.1", - "@openzeppelin/adapter-polkadot": "^4.0.2", + "@openzeppelin/adapter-polkadot": "^5.0.0", "@openzeppelin/adapter-solana": "^4.0.1", "@openzeppelin/adapter-stellar": "^4.0.1", "vite": "^7.0.0"