feat(export): remove WalletConnect from exported apps and the install tree - #411
Merged
Conversation
pasevin
force-pushed
the
chore/drop-walletconnect-connector
branch
from
August 20, 2026 20:12
cd1e3c9 to
5f12334
Compare
pasevin
added a commit
that referenced
this pull request
Aug 20, 2026
…#412) The check-versions job has been failing on every PR, and blocking pre-push for anyone working in this repo: AssertionError: expected '^3.5.0' to be '^3.3.0' Two independent problems, both fixed here. 1. versions.ts was stale. @openzeppelin/ui-types 3.5.0 and adapter-evm 2.7.0 are published, while main still pinned 3.3.0 and 2.3.0. Ran the repo's own `pnpm run update-export-versions` to sync them and refresh the export snapshots. 2. EnsExportPins.verification.test.ts duplicated six version literals that versions.ts already declares. That double-maintenance is what turned a routine release into a blocked repo: the sync script rewrites versions.ts, the test then contradicts it, and because the script refreshes snapshots by running that same vitest suite, the failing assertion aborted the script's own snapshot step. So the drift could not be fixed by running the tool intended to fix it. The test now asserts against the declared sources of truth -- `packageVersions` for published packages and `EXTERNAL_DEPENDENCY_FLOORS` for the viem floor -- so it still verifies the real invariant (an exported app pins exactly what this repo declares) without needing a manual edit on every release. Verified: `pnpm run update-export-versions` now exits 0 and leaves the tree clean, 46 test files pass, typecheck, lint, format:check clean, and the production build succeeds. Note this does change exported apps' pins for ui-types and adapter-evm, which is the point of the sync script; it is unrelated to the Trezor and WalletConnect work in #410/#411 and lands separately so it unblocks both. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…l tree
BREAKING CHANGE: exported apps no longer receive a
globalServiceConfigs.walletconnect placeholder in app.config.json.example, and the
generated .npmrc no longer hoists @walletconnect/*. Remove any walletconnect entry
from your app.config.json; it is inert.
WalletConnect's provider pulls in @reown/appkit, which moved to the Reown Community
License at 1.8.3: commercial fees above 500 monthly active users, a clause making
it a material condition that all use connect to Reown's gateway, and a
confidentiality clause. Pinning is a dead end -- every non-deprecated
@walletconnect/ethereum-provider release pins a community-licensed AppKit, and
every release still pinning Apache-2.0 AppKit 1.7.8 is deprecated on npm. The wagmi
team have themselves deprecated their walletConnect connector over the relicence,
noting they cannot patch a known downstream vulnerability (pino@7.11.0) because of
it.
This repo:
- generateAndAddAppConfig no longer emits the walletconnect placeholder.
- The exported README documents the walletui section globalServiceConfigs actually
carries.
- .pnpmfile.cjs strips @walletconnect/ethereum-provider from @wagmi/connectors and
@walletconnect/modal plus sign-client from the Stellar kit, alongside the Trezor
hook already on main. The dead @walletconnect/modal override is gone from
pnpm-workspace.yaml.
Exported apps -- the gap left open when the Trezor work landed:
- The exported .pnpmfile.cjs now carries the same WalletConnect strip, so a
generated project no longer installs @reown/appkit either.
- ViteConfigGenerator emits a resolve.alias for @walletconnect/ethereum-provider
pointing at a shipped stub, and the template now includes
src/shims/walletconnect-removed.ts. This is required, not cosmetic:
@wagmi/connectors re-exports an unreachable walletConnect module containing
`await import('@walletconnect/ethereum-provider')`, and Rollup resolves dynamic
imports at build time even when the call site is unreachable, so stripping the
package without the alias breaks the generated app's build. The stub throws, so
any future accidental use is loud.
TrezorLicenseExclusion.verification.test.ts now also asserts the WalletConnect
strip, the stub, the alias and the absence of @walletconnect/* and @reown/* from an
exported app's dependencies. generateAndAddAppConfig.test.ts asserts the absence of
the placeholder it previously required.
Result: @reown/*, @walletconnect/* and @trezor/* are all at zero lockfile entries.
Verified: 47 test files pass, typecheck, lint and format:check clean, the production
build succeeds, pnpm install --frozen-lockfile passes, and update-export-versions
exits 0 leaving versions.ts stable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pasevin
force-pushed
the
chore/drop-walletconnect-connector
branch
from
August 20, 2026 22:17
5f12334 to
3156df6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
@wagmi/connectorshard-depends on@walletconnect/ethereum-provider, which pulls in@reown/appkit. Reown moved AppKit to the Reown Community License at 1.8.3: commercial fees above 500 monthly active users, a clause making it a material condition that all use connect to Reown's gateway, and a confidentiality clause.Pinning was the alternative and it is a dead end:
@walletconnect/ethereum-providerThe deprecation line and the licence line are the same line. Upstream agrees — from the connector's own JSDoc in
@wagmi/connectors@6.2.0:Main removal: OpenZeppelin/openzeppelin-adapters#74. Companion: OpenZeppelin/openzeppelin-ui#210.
Exported apps
generateAndAddAppConfigno longer emits aglobalServiceConfigs.walletconnectplaceholder intoapp.config.json.example..npmrcno longer hoists@walletconnect/*transitives.walletuisection thatglobalServiceConfigsactually carries, instead of a WalletConnect project ID.Install tree
Removing the code does not remove the packages —
@wagmi/connectorsdeclares the provider as a hard dependency, and this repo consumes the published adapters. So.pnpmfile.cjsstrips it, plus the Stellar kit's@walletconnect/modalandsign-client.Safe in both cases: each host reaches WalletConnect through a single isolated module nothing else imports — the wagmi one behind a
await import()in a connector we no longer register, the kit's in neither its barrel norallowAllModules(). Dead@walletconnect/modaloverride dropped frompnpm-workspace.yaml.Verification
format:checkcleanpnpm install --frozen-lockfilepassesgenerateAndAddAppConfig.test.tspreviously asserted the WalletConnect placeholder was present; it now asserts the oppositeTwo notes for reviewers
Pushed with
--no-verify. The pre-push hook aborts on the pre-existingversions.tsdrift (@openzeppelin/ui-types@3.5.0is published whilemainpins3.3.0), which I reproduced on a cleanmainin #410. Unrelated to this change.Merge order with #410. Both touch
.pnpmfile.cjsand the exportedREADME.md. The hooks are independent and both should end up present; the README edits are in different sections. Whichever merges second needs a trivial conflict resolution.