chore(deps): bump the hiero-sdk group with 2 updates

[dependabot]

Bumps the hiero-sdk group with 2 updates: @hiero-ledger/cryptography and @hiero-ledger/sdk.

Updates @hiero-ledger/cryptography from 1.20.1 to 1.21.0

Changelog

Sourced from @​hiero-ledger/cryptography's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

v2.87.0

Added

• MirrorNodeAccountBalanceQuery, the mirror-node replacement for AccountBalanceQuery ahead of its deprecation. Resolves shard.realm.num IDs, EVM addresses, public-key aliases, and contract IDs through a single GET /api/v1/balances request and returns the read-only MirrorNodeAccountBalance carrying hbars; retries 5xx/network failures with exponential backoff within a total requestTimeout budget. Token balances are deliberately out of scope per the migration proposal. #4320 #4286
• Mirror node streaming queries (e.g. TopicMessageQuery subscriptions) now work on WebClient and NativeClient, not just the Node client: new gRPC-Web mirror channels for browsers (streaming fetch) and React Native (XMLHttpRequest text mode with incremental base64 decoding). #4268 #4263

Changed

• Re-applied the @noble / @scure v2 upgrade (reverted in v2.86.2) with the ESM-only packages bundled into the CommonJS artifact (lib/index.cjs) via esbuild, so require() no longer fails with ERR_REQUIRE_ESM on ts-node or Node.js < 20.19. The strict-CJS guard now runs the entire common_js_test suite under --no-experimental-require-module in CI, and the @noble/curves >=2.0.0 Dependabot ignore was removed. PublicKey.verify() continues to accept 65-byte recoverable ECDSA signatures (r || s || v) as before. Released as @hiero-ledger/cryptography@1.21.0. #4296
• Upgraded ansi-styles from 6.2.3 to 7.0.0. #4303

Fixed

• Client.ping() / Client.pingAll() now probe nodes with a free COST_ANSWER AccountInfoQuery instead of AccountBalanceQuery, whose cryptoGetBalance endpoint is being throttled to zero in consensus node release 77. CostQuery (and therefore Query.getCost()) no longer requires an operator: the payment transaction is left unsigned when none is configured, so operator-less clients can still ping. #4312
• NativeChannel (React Native transport) no longer keeps processing the response after reporting an HTTP error, which previously invoked the gRPC callback a second time. #4181

Removed

• Breaking: removed long-deprecated APIs: LiveHashAddTransaction, LiveHashDeleteTransaction, LiveHashQuery, LiveHash, AccountInfo.liveHashes, SystemDeleteTransaction, SystemUndeleteTransaction, EthereumFlow (use EthereumTransaction), AccountAllowanceAdjustTransaction (use AccountAllowanceApproveTransaction / AccountAllowanceDeleteTransaction), and toSolidityAddress() / fromSolidityAddress() on AccountId, ContractId, DelegateContractId, FileId, TokenId, and TopicId (use toEvmAddress() / fromEvmAddress()). ScheduleId.toSolidityAddress() / fromSolidityAddress() are kept for now, as ScheduleId has no toEvmAddress() replacement yet. #4269 #4264

v2.86.2

Fixed

• Reverted the @noble/curves 1.8.1 → 2.2.0 upgrade: v2 is ESM-only, which broke the CommonJS build (lib/index.cjs) with ERR_REQUIRE_ESM for ts-node and Node.js < 20.19 consumers. A strict-CJS smoke test now guards the CommonJS build against ESM-only dependencies. Released as @hiero-ledger/cryptography@1.20.1. #4259
• Transaction.fromBytes now rejects empty input with a clear error and reports separate, accurate errors for "no transactions found in bytes" and "failed to decode TransactionBody" instead of a single misleading message. #4265 #4260

v2.86.1

Fixed

• The SDK can now be bundled for the browser with esbuild-based tooling (Vite, modern React). A browser condition was added to the package exports map so bundlers no longer resolve the Node.js entry point and fail on fs/util/tls/net and @grpc/grpc-js. #2173 #4256

Changed

• Migrated @hiero-ledger/cryptography primitives to the Noble and @​scure libraries, collapsing the separate browser/native/default implementations into a single portable one and removing the react-native-get-random-values dependency. Released as @hiero-ledger/cryptography@1.20.0. #4229 #4233

Security

• Forced brace-expansion and fast-uri to patched versions to address advisories. #4226
• Upgraded vite to 7.3.6 and forced esbuild to >=0.28.1 to address advisories. #4223

v2.86.0

Added

• Native sign(key) for Ethereum transaction data across all four envelope variants (Legacy, EIP-2930, EIP-1559, EIP-7702). #4183
• Typed accessors and structured access-list / authorization (HIP-1340) views for Ethereum transaction data, plus the AccessListItem and Authorization classes. #4186
• EthereumTransaction.setEthereumData(EthereumTransactionData) overload with a never-submit-unsigned guard and EthereumTransactionData.isSigned(). #4187

Changed

... (truncated)

Commits

• See full diff in compare view

Updates @hiero-ledger/sdk from 2.86.2 to 2.87.0

Release notes

Sourced from @​hiero-ledger/sdk's releases.

v2.87.0

This stable release completes the first stage of the mirror-node migration story: a new MirrorNodeAccountBalanceQuery arrives as the replacement for AccountBalanceQuery ahead of its deprecation, mirror node streaming queries now work on WebClient and NativeClient (browsers and React Native, not just Node), and Client.ping() no longer depends on the cryptoGetBalance endpoint that consensus node release 77 throttles to zero. The @noble / @scure v2 upgrade reverted in v2.86.2 is re-applied with the ESM-only packages bundled into the CommonJS artifact, co-released as @hiero-ledger/cryptography@1.21.0.

This release also removes a set of long-deprecated APIs (deprecated since 2022): see Breaking Changes below.

Breaking Changes

• Removed long-deprecated APIs: LiveHashAddTransaction, LiveHashDeleteTransaction, LiveHashQuery, LiveHash, AccountInfo.liveHashes, SystemDeleteTransaction, SystemUndeleteTransaction, EthereumFlow, AccountAllowanceAdjustTransaction, and toSolidityAddress() / fromSolidityAddress() on AccountId, ContractId, DelegateContractId, FileId, TokenId, and TopicId. ScheduleId.toSolidityAddress() / fromSolidityAddress() remain for now, as ScheduleId has no toEvmAddress() replacement yet. #4269

Upgrading

Replacements for the removed APIs:

• EthereumFlow → EthereumTransaction (jumbo transactions are supported natively)
• AccountAllowanceAdjustTransaction → AccountAllowanceApproveTransaction / AccountAllowanceDeleteTransaction
• toSolidityAddress() / fromSolidityAddress() → toEvmAddress() / fromEvmAddress() on the same entity ID classes
• The live hash and system delete/undelete operations have no replacement: they were removed from HAPI and consensus nodes have returned NOT_SUPPORTED for years

Enhancements

• MirrorNodeAccountBalanceQuery: mirror-node replacement for AccountBalanceQuery ahead of its deprecation. Accepts shard.realm.num IDs, EVM addresses, public-key aliases, and contract IDs, and returns a read-only MirrorNodeAccountBalance carrying hbars; 5xx/network failures retry with exponential backoff within a total requestTimeout budget. Token balances are deliberately out of scope per the migration proposal. #4320

  Usage Example:

  import { Client, MirrorNodeAccountBalanceQuery } from "@hiero-ledger/sdk";
  const client = Client.forTestnet();
  const balance = await new MirrorNodeAccountBalanceQuery()
  .setAccountId("0.0.12345") // or EVM address / alias / contract ID
  .execute(client);
  console.log(balance.hbars.toString());

• WebClient / NativeClient: mirror node streaming queries (e.g. TopicMessageQuery subscriptions) now work in browsers and React Native, not just Node. Browsers stream binary gRPC-Web over fetch; React Native uses gRPC-Web text mode over XMLHttpRequest with incremental base64 decoding. #4268

Bug Fixes

• Client.ping() / Client.pingAll(): the liveness probe now sends a free COST_ANSWER AccountInfoQuery instead of an AccountBalanceQuery, whose cryptoGetBalance endpoint is being throttled to zero in consensus node release 77. CostQuery (and therefore Query.getCost()) no longer requires an operator: the payment transaction is left unsigned when none is configured, so operator-less clients can still ping. #4312
• NativeChannel (React Native): the gRPC callback is no longer invoked a second time after an HTTP error response. #4181

Dependency Changes

• Re-applied the @noble / @scure v2 upgrade (@noble/curves, @noble/hashes, @noble/ciphers, @scure/base, @scure/bip32 → 2.2.0), with the ESM-only packages bundled into the CommonJS artifact (lib/index.cjs) via esbuild so require() no longer fails with ERR_REQUIRE_ESM on ts-node or Node.js < 20.19. Signature outputs are unchanged, and PublicKey.verify() continues to accept 65-byte recoverable ECDSA signatures. Co-released as @hiero-ledger/cryptography@1.21.0. #4296
• Upgraded ansi-styles from 6.2.3 to 7.0.0. #4303

Changelog

Sourced from @​hiero-ledger/sdk's changelog.

v2.87.0

Added

• MirrorNodeAccountBalanceQuery, the mirror-node replacement for AccountBalanceQuery ahead of its deprecation. Resolves shard.realm.num IDs, EVM addresses, public-key aliases, and contract IDs through a single GET /api/v1/balances request and returns the read-only MirrorNodeAccountBalance carrying hbars; retries 5xx/network failures with exponential backoff within a total requestTimeout budget. Token balances are deliberately out of scope per the migration proposal. #4320 #4286
• Mirror node streaming queries (e.g. TopicMessageQuery subscriptions) now work on WebClient and NativeClient, not just the Node client: new gRPC-Web mirror channels for browsers (streaming fetch) and React Native (XMLHttpRequest text mode with incremental base64 decoding). #4268 #4263

Changed

• Re-applied the @noble / @scure v2 upgrade (reverted in v2.86.2) with the ESM-only packages bundled into the CommonJS artifact (lib/index.cjs) via esbuild, so require() no longer fails with ERR_REQUIRE_ESM on ts-node or Node.js < 20.19. The strict-CJS guard now runs the entire common_js_test suite under --no-experimental-require-module in CI, and the @noble/curves >=2.0.0 Dependabot ignore was removed. PublicKey.verify() continues to accept 65-byte recoverable ECDSA signatures (r || s || v) as before. Released as @hiero-ledger/cryptography@1.21.0. #4296
• Upgraded ansi-styles from 6.2.3 to 7.0.0. #4303

Fixed

• Client.ping() / Client.pingAll() now probe nodes with a free COST_ANSWER AccountInfoQuery instead of AccountBalanceQuery, whose cryptoGetBalance endpoint is being throttled to zero in consensus node release 77. CostQuery (and therefore Query.getCost()) no longer requires an operator: the payment transaction is left unsigned when none is configured, so operator-less clients can still ping. #4312
• NativeChannel (React Native transport) no longer keeps processing the response after reporting an HTTP error, which previously invoked the gRPC callback a second time. #4181

Removed

• Breaking: removed long-deprecated APIs: LiveHashAddTransaction, LiveHashDeleteTransaction, LiveHashQuery, LiveHash, AccountInfo.liveHashes, SystemDeleteTransaction, SystemUndeleteTransaction, EthereumFlow (use EthereumTransaction), AccountAllowanceAdjustTransaction (use AccountAllowanceApproveTransaction / AccountAllowanceDeleteTransaction), and toSolidityAddress() / fromSolidityAddress() on AccountId, ContractId, DelegateContractId, FileId, TokenId, and TopicId (use toEvmAddress() / fromEvmAddress()). ScheduleId.toSolidityAddress() / fromSolidityAddress() are kept for now, as ScheduleId has no toEvmAddress() replacement yet. #4269 #4264

Commits

• 0dfd381 chore(release): v2.87.0 (#4327)
• 4f6c35f feat(sdk): add MirrorNodeAccountBalanceQuery as mirror node replacement for A...
• ba31586 fix(examples): prevent never-exiting examples from hanging CI (#4321)
• cad6369 test: raise browser integration suite timeouts to 240s (#4319)
• f80e774 fix: replace AccountBalanceQuery ping probe with a COST_ANSWER query (#4312)
• 87b1516 test: stabilize flaky previewnet TLS and high-volume fee tests (#4318)
• a8e8fd5 feat: add mirror node support to WebClient and NativeClient (#4268)
• aecd44a chore(deps): bump ansi-styles from 6.2.3 to 7.0.0 (#4303)
• f921b6e chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 in /tck (#4307)
• 35d3b19 fix: remove long-deprecated classes and methods (#4269)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[swirlds-automation]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.