Dependency major-migration backlog (surfaced by Dependabot coverage, 2026-06-19)

Open
#1,186 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
20/100
Issue type
Refactor
Clarity
Needs clarification
Activity status
Quiet
Tech stack
node.js, typescript
Domain
blockchain, ci-cd, mobile

Research direction

Review the listed Dependabot PRs and separate the coordinated Expo SDK 56 and Anchor 1.0 migrations from the smaller package upgrades. Start with the existing worker tests under .github and the local Anchor build in sip-arcium-program, then use device testing for sip-mobile. Done means the selected major upgrades build and pass their available tests, with PR CI added where recommended.

Written by the indexing model from the issue text.

Description

dependencies tech-debt

Enabling Dependabot on previously-unmonitored repos surfaced an accumulated backlog of major version bumps that need deliberate migration (left open by design — not blind-merged). Safe minor/patch/actions bumps were merged. This issue tracks the majors.

sip-mobile — Expo SDK 56 upgrade

expo-status-bar, expo-task-manager, expo-apple-authentication, expo-document-picker, expo-updates, expo-file-system all jump to SDK 56 (PRs #101–#107). Needs a coordinated Expo SDK 56 upgrade + device testing — not individual merges.

sip-arcium-program — Anchor 1.0 + Arcium 0.10 (⚠️ no PR CI)

anchor-lang 0.32→1.0, @arcium-hq/* 0.6→0.10, plus typescript 6, chai 6, mocha 11, prettier 3 (PRs #5–#17). This repo has no CI on PRs, so none can be auto-verified — needs an Anchor/Arcium toolchain upgrade done locally.

sip-protocol

  • anchor-lang 0.30→1.0 in the on-chain programs (#1169, #1171) — cross-program upgrade (see #1161)
  • @aztec/bb.js 3→4 (#1184) — already tracked in #1129
  • commander 14→15 (#1183), https-proxy-agent 7→9 (#1178), @types/supertest 6→7 (#1179)
  • @langchain/* v1 → #1173 · yellowstone-grpc v5 → #1174

sipher

  • @noble/hashes 2.0 (#335) — crypto primitive major
  • zod 3→4 (#332), vitest 3→4 (#331), pino-http 10→11 (#330), jsdom 25→29 (#334), reqwest 0.13 (#322), node 26-alpine (#328)
  • minor/patch group (#329) + actions/setup-node (#323) currently failing CI — needs a look

.github (⚠️ no PR CI)

wrangler 3→4 (#8) + actions bumps (#6, #7). Worker has node --test tests that could be wired into PR CI.

Recommendation: add minimal PR CI to .github (worker tests) and sip-arcium-program (anchor build) so their Dependabot PRs become verifiable. Tackle the framework majors (Expo 56, Anchor 1.0) as dedicated upgrades.

Dominant language
TypeScript
Stars
3
Forks
1
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sip-protocol/sip-protocol

All issues in sip-protocol/sip-protocol

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.