chore: bump wormhole sdk to latest version by M-Picco · Pull Request #4941 · wormhole-foundation/wormhole

M-Picco · 2026-08-10T22:48:37Z

Clean up deprecated chains' code
Move cli related logic from build action to its own build-cli action triggered when modifying its files. This should prevent from running the ci on PRs unrelated to it

socket-security · 2026-08-10T22:51:01Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@wormhole-foundation/sdk-base@0.9.0 ⏵ 6.1.5			⁺²
npm/@wormhole-foundation/sdk-cosmwasm@0.9.0 ⏵ 6.1.5	⁺²		⁺²
npm/@injectivelabs/networks@1.14.13 ⏵ 1.20.34	⁺⁸
npm/@injectivelabs/utils@1.14.13 ⏵ 1.20.34	⁺⁷	⁺¹
npm/@wormhole-foundation/sdk-definitions@0.9.0 ⏵ 6.1.5			⁺²
npm/js-base64@3.9.2
npm/@wormhole-foundation/sdk@0.9.0 ⏵ 6.1.5	⁺¹		⁺²
npm/@injectivelabs/sdk-ts@1.14.13 ⏵ 1.20.34	⁺⁶	⁺¹

View full report

socket-security · 2026-08-10T22:51:02Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@injectivelabs/core-proto-ts-v2` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: clients/js/package-lock.json → `npm/@injectivelabs/sdk-ts@1.20.34` → `npm/@injectivelabs/core-proto-ts-v2@1.20.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@injectivelabs/core-proto-ts-v2@1.20.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `stream-json` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: clients/js/package-lock.json → `npm/@certusone/wormhole-sdk@0.10.18` → `npm/@solana/web3.js@1.98.4` → `npm/stream-json@1.9.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/stream-json@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

…s code

…ing the clients/js files

johnsaigle

Would you be able to explain more the decision to remove the IBC relayer tests? From my understanding this is still a live path on Wormhole via Gateway/Wormchain. So, it's something we should be running in CI. I know the standard relayer was deprecated in favour of the Executor, but I'm not aware that the IBC relayer is also replaced or deprecated.
Also, we should be careful with removing the Terra2 tests. I don't have a full understanding of the impact but I remember Bruce flagged this when I tried to remove Terra2 things before. IMO it's worth reviewing this Issue and the related PRs to get a sense of the impact here. #4473 (comment).
Can you regenerate the package-lock.json file? It is missing the integrity hashes that we need in order to safely use npm ci (see here: https://github.com/wormhole-foundation/wormhole/blob/main/CONTRIBUTING.md#working-with-node-dependencies). AFAICT this can happen if you re-generate the lockfile without first deleting node_modules/ locally.

johnsaigle · 2026-08-13T12:13:30Z

    );
  }

  // TODO: Convert this over to sdkv2


Can this be removed?

johnsaigle · 2026-08-13T12:15:54Z

-    "Gnosis": "0x0000000000000000000000000000000000000000000000000000000000000000",
    "Pythnet": "0x0000000000000000000000000000000000000000000000000000000000000000",
-    "Xpla": "0x8f9cf727175353b17a5f574270e370776123d90fd74956ae4277962b4fdee24c",
    "Btc": "0x0000000000000000000000000000000000000000000000000000000000000000",


Should Btc get removed?

johnsaigle · 2026-08-13T12:16:12Z

    "Klaytn": "0x0000000000000000000000005b08ac39eaed75c0439fc750d9fe7e1f9dd0193f",
    "Celo": "0x000000000000000000000000796dff6d74f3e27060b71255fe517bfb23c93eed",
    "Near": "0x148410499d3fcda4dcfd68a1ebfcdddda16ab28326448d4aae4d2f0465cdfcb7",
    "Moonbeam": "0x000000000000000000000000b1731c586ca89a23809861c6103f0b96b3f57d92",


I believe Moonbeam has shut down

johnsaigle · 2026-08-13T12:18:29Z

+    branches:
+      - main
+    paths:
+      - ./clients/js


Suggested change

- ./clients/js

- clients/js/**

I'm not sure this paths value is correct. I think we need to do it from the repo root. It's worth doing a proper red-green test here to confirm

I suggested a different path but I'd recommend checking the correct syntax here as I'm not 100% my suggestion is right.

johnsaigle · 2026-08-13T12:21:12Z

-    rpc: undefined,
-    key: undefined,
-  },
  Moonbeam: {


Moonbeam is gone

johnsaigle · 2026-08-13T12:25:16Z

                "0x0000000000000000000000005b08ac39eaed75c0439fc750d9fe7e1f9dd0193f",
              Celo: "0x000000000000000000000000796dff6d74f3e27060b71255fe517bfb23c93eed",
              Near: "0x148410499d3fcda4dcfd68a1ebfcdddda16ab28326448d4aae4d2f0465cdfcb7",
              Moonbeam:


Can be deleted

johnsaigle · 2026-08-13T12:26:43Z

+            try {
+              const outputObject = JSON.parse(stdout);
+
+              // Can't check the signature, sequence, or digest because they


You could consider checking that they are non-empty and within the expected range for their types?

e.g.

Signature is a fixed, expected size (and probably a hex value?)

Sequence is in the bounds of u64

Digest is also a fixed, expected size (and probably a hex value?)

M-Picco added 3 commits August 11, 2026 15:15

chore: bump wormhole sdk to latest version; clean up deprecated chain…

c9dba03

…s code

core: move cli workflow logic to its own action triggered when modify…

68a1bca

…ing the clients/js files

chore: add tests for some cli subcommands

76f9252

M-Picco force-pushed the chore/worm-cli-sdk-bump branch from 52bfbcf to dfb998c Compare August 11, 2026 19:48

fix: rebase issues after Sui gRPC support was merged

883f79b

M-Picco force-pushed the chore/worm-cli-sdk-bump branch from dfb998c to 883f79b Compare August 12, 2026 17:16

fix: remove test for unused command; revert change to chain querying

4d060dc

M-Picco marked this pull request as ready for review August 12, 2026 18:17

M-Picco requested review from djb15, evan-gray, kcsongor and kev1n-peters as code owners August 12, 2026 18:17

fix: remove deprecated terra2 chain from testing environmen

d53cb93

M-Picco force-pushed the chore/worm-cli-sdk-bump branch from 3a59efd to d53cb93 Compare August 13, 2026 03:31

M-Picco requested review from SEJeff, bemic, johnsaigle, mdulin2, panoel and pleasew8t as code owners August 13, 2026 03:31

johnsaigle requested changes Aug 13, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore: bump wormhole sdk to latest version - #4941

chore: bump wormhole sdk to latest version#4941
M-Picco wants to merge 6 commits into
wormhole-foundation:mainfrom
wormholelabs-xyz:chore/worm-cli-sdk-bump

M-Picco commented Aug 10, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

johnsaigle left a comment

Uh oh!

johnsaigle Aug 13, 2026

Uh oh!

johnsaigle Aug 13, 2026

Uh oh!

johnsaigle Aug 13, 2026

Uh oh!

johnsaigle Aug 13, 2026 •

edited

Loading

Uh oh!

johnsaigle Aug 13, 2026

Uh oh!

johnsaigle Aug 13, 2026

Uh oh!

johnsaigle Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

M-Picco commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

johnsaigle left a comment

Choose a reason for hiding this comment

Uh oh!

johnsaigle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

johnsaigle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

johnsaigle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

johnsaigle Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnsaigle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

johnsaigle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

johnsaigle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

M-Picco commented Aug 10, 2026 •

edited

Loading

socket-security Bot commented Aug 10, 2026 •

edited

Loading

socket-security Bot commented Aug 10, 2026 •

edited

Loading

johnsaigle Aug 13, 2026 •

edited

Loading