Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@sei-js/create-sei@1.0.1

Patch Changes

• 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning @asyncapi/* packages to non-compromised versions via root pnpm.overrides.

  This stops a fresh install or lockfile regeneration from floating @asyncapi/specs up into the compromised 6.11.2 through the mint docs toolchain (mint → @asyncapi/parser). Resolved change: @asyncapi/specs 6.10.0 → 6.11.1; @asyncapi/generator, @asyncapi/generator-helpers, and @asyncapi/generator-components are pinned preventively.

  No shipped code or public API changes in this package — this is a repository/CI hardening release.

• 9168186: Improve the next-template runtime defaults generated by create-sei.

  • Add a prebuild Biome check and include Biome in template dev dependencies.
  • Configure Next.js to allow Sei CDN images and skip ESLint during builds.
  • Update provider and shell setup for improved chain/image handling.
  • Align template config/docs with current defaults (.env.example, README, Biome, Tailwind v4 config).

@sei-js/ledger@1.1.6

Patch Changes

• 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning @asyncapi/* packages to non-compromised versions via root pnpm.overrides.

  This stops a fresh install or lockfile regeneration from floating @asyncapi/specs up into the compromised 6.11.2 through the mint docs toolchain (mint → @asyncapi/parser). Resolved change: @asyncapi/specs 6.10.0 → 6.11.1; @asyncapi/generator, @asyncapi/generator-helpers, and @asyncapi/generator-components are pinned preventively.

  No shipped code or public API changes in this package — this is a repository/CI hardening release.

@sei-js/mcp-server@0.3.3

Patch Changes

• bc17ace: Fix session binding and response isolation in the HTTP SSE transport.

  • POST handler now validates sessionId on every request — rejects missing session IDs (400) and unknown session IDs (404)
  • Each POST is routed to the transport instance that owns the matching session ID, preventing cross-client request injection
  • Session IDs now use the MCP SDK's transport.sessionId rather than Date.now()

• 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning @asyncapi/* packages to non-compromised versions via root pnpm.overrides.

  This stops a fresh install or lockfile regeneration from floating @asyncapi/specs up into the compromised 6.11.2 through the mint docs toolchain (mint → @asyncapi/parser). Resolved change: @asyncapi/specs 6.10.0 → 6.11.1; @asyncapi/generator, @asyncapi/generator-helpers, and @asyncapi/generator-components are pinned preventively.

  No shipped code or public API changes in this package — this is a repository/CI hardening release.

@sei-js/precompiles@2.1.3

Patch Changes

• 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning @asyncapi/* packages to non-compromised versions via root pnpm.overrides.

  This stops a fresh install or lockfile regeneration from floating @asyncapi/specs up into the compromised 6.11.2 through the mint docs toolchain (mint → @asyncapi/parser). Resolved change: @asyncapi/specs 6.10.0 → 6.11.1; @asyncapi/generator, @asyncapi/generator-helpers, and @asyncapi/generator-components are pinned preventively.

  No shipped code or public API changes in this package — this is a repository/CI hardening release.

@sei-js/registry@1.0.4

Patch Changes

• 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning @asyncapi/* packages to non-compromised versions via root pnpm.overrides.

  This stops a fresh install or lockfile regeneration from floating @asyncapi/specs up into the compromised 6.11.2 through the mint docs toolchain (mint → @asyncapi/parser). Resolved change: @asyncapi/specs 6.10.0 → 6.11.1; @asyncapi/generator, @asyncapi/generator-helpers, and @asyncapi/generator-components are pinned preventively.

  No shipped code or public API changes in this package — this is a repository/CI hardening release.

@sei-js/sei-global-wallet@1.4.1

Patch Changes

• 2666156: Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning @asyncapi/* packages to non-compromised versions via root pnpm.overrides.

  This stops a fresh install or lockfile regeneration from floating @asyncapi/specs up into the compromised 6.11.2 through the mint docs toolchain (mint → @asyncapi/parser). Resolved change: @asyncapi/specs 6.10.0 → 6.11.1; @asyncapi/generator, @asyncapi/generator-helpers, and @asyncapi/generator-components are pinned preventively.

  No shipped code or public API changes in this package — this is a repository/CI hardening release.

[cursor]

PR Summary

Low Risk
The diff is version/changelog housekeeping; substantive MCP security and template changes are already on main and only documented here for publish.

Overview
This is a Changesets “Version Packages” release PR: it bumps semver on six @sei-js/* packages, appends CHANGELOG entries, removes the consumed changeset files, and applies minor package.json formatting only—no new runtime source in the diff itself.

@sei-js/mcp-server@0.3.3 documents a security fix for HTTP SSE: mandatory sessionId validation on POST (400/404), routing each message to the transport that owns that session (blocks cross-client injection), and session IDs from the MCP SDK’s transport.sessionId instead of Date.now().

@sei-js/create-sei@1.0.1 records improved next-template defaults (Biome prebuild, Sei CDN images in Next.js, ESLint skipped on build, provider/shell and config/doc alignment).

ledger, precompiles, registry, sei-global-wallet (and the other packages’ notes) carry a coordinated patch note for AsyncAPI supply-chain hardening via root pnpm.overrides—consumer visibility for repo/CI pinning, not API changes in those packages.

^{Reviewed by Cursor Bugbot for commit 9f8ed4f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.75%. Comparing base (2666156) to head (9f8ed4f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #311   +/-   ##
=======================================
  Coverage   79.75%   79.75%           
=======================================
  Files          83       83           
  Lines        1309     1309           
  Branches      189      217   +28     
=======================================
  Hits         1044     1044           
  Misses        259      259           
  Partials        6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[alexander-sei]

Approving the coordinated release: create-sei@1.0.1, ledger@1.1.6, mcp-server@0.3.3, precompiles@2.1.3, registry@1.0.4, sei-global-wallet@1.4.1. Bundles the AsyncAPI supply-chain hardening note (all packages) with the existing mcp-server SSE fix and create-sei template changes.