chore(deps): bump the connectrpc group across 1 directory with 2 updates

[dependabot]

Bumps the connectrpc group with 2 updates in the /frontend directory: @connectrpc/connect and @connectrpc/connect-web.

Updates @connectrpc/connect from 2.1.2 to 2.2.0

Release notes

Sourced from @​connectrpc/connect's releases.

v2.2.0

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers: the request gate is a function that runs after the request headers are available. Throwing a ConnectError in the gate rejects a request before messages are read, decompressed, or parsed. Use this option to reject unauthenticated requests instead of interceptors. See the documentation for details.

We also recommend that you configure a message size limit for your server, see the readMaxBytes option.

• Disallow propagation of protocol headers by @​ajeetdsouza in connectrpc/connect-es#1717
• Fix Http2SessionManager.verify() never settling when the connection closes during verification by @​jackyzha0 in connectrpc/connect-es#1746
• Drop support for Node.js 20 by @​ajeetdsouza in connectrpc/connect-es#1777
• Add requestGate handler option by @​timostamm in connectrpc/connect-es#1781
• Stop delivering stream messages after cancellation by @​ajeetdsouza in connectrpc/connect-es#1792
• Enable gRPC in Cloudflare conformance tests by @​mar-cf in connectrpc/connect-es#1774

New Contributors

• @​jackyzha0 made their first contribution in connectrpc/connect-es#1746
• @​mar-cf made their first contribution in connectrpc/connect-es#1774

Full Changelog: connectrpc/connect-es@v2.1.2...v2.2.0

Commits

• 378bb8f Release 2.2.0 (#1796)
• d0c2c0f Stop delivering stream messages after cancellation (#1792)
• f16eb17 Simplify tests with type-narrowing assertions (#1782)
• 2548dac Add requestGate handler option (#1781)
• 86dc519 Use mock timers for timeout test (#1778)
• 61900e4 Bump @​bufbuild/buf from 1.66.1 to 1.72.0 (#1762)
• e86b489 Migrate jasmine to node:test (#1730)
• a8e1588 Disallow propagation of protocol headers (#1717)
• See full diff in compare view

Updates @connectrpc/connect-web from 2.1.2 to 2.2.0

Release notes

Sourced from @​connectrpc/connect-web's releases.

v2.2.0

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers: the request gate is a function that runs after the request headers are available. Throwing a ConnectError in the gate rejects a request before messages are read, decompressed, or parsed. Use this option to reject unauthenticated requests instead of interceptors. See the documentation for details.

We also recommend that you configure a message size limit for your server, see the readMaxBytes option.

• Disallow propagation of protocol headers by @​ajeetdsouza in connectrpc/connect-es#1717
• Fix Http2SessionManager.verify() never settling when the connection closes during verification by @​jackyzha0 in connectrpc/connect-es#1746
• Drop support for Node.js 20 by @​ajeetdsouza in connectrpc/connect-es#1777
• Add requestGate handler option by @​timostamm in connectrpc/connect-es#1781
• Stop delivering stream messages after cancellation by @​ajeetdsouza in connectrpc/connect-es#1792
• Enable gRPC in Cloudflare conformance tests by @​mar-cf in connectrpc/connect-es#1774

New Contributors

• @​jackyzha0 made their first contribution in connectrpc/connect-es#1746
• @​mar-cf made their first contribution in connectrpc/connect-es#1774

Full Changelog: connectrpc/connect-es@v2.1.2...v2.2.0

Commits

• 378bb8f Release 2.2.0 (#1796)
• fca66b5 Bump webdriverio from 9.31.2 to 9.31.4 in the webdriver group (#1784)
• 355b1fd Bump webdriverio from 9.19.2 to 9.31.2 in the webdriver group across 1 direct...
• e10098f Remove Browserstack tests (#1731)
• e86b489 Migrate jasmine to node:test (#1730)
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[netlify]

✅ Deploy Preview for memba-multisig canceled.

Name	Link
🔨 Latest commit	2073e62
🔍 Latest deploy log	https://app.netlify.com/projects/memba-multisig/deploys/6aa91191a7e9ba000897b67a

[zxxma]

Merge-train position: after #1201 → #1190 → #1189.

Reviewed head: 409c96f814681d819497dd1d104b28f6d37bb219. Keep connect and connect-web aligned at 2.2.0. Upstream's Node20 support change raises engine requirements for server adapters, not these two installed core/browser packages; it does remove upstream Node20 CI. Memba's own Node20/22 compatibility checks therefore remain important.

Local integration after the backend dependency updates merged cleanly. Frozen installation, typecheck, lint, production build, production/dev audit gates and 319 focused transport/auth/multisig/privacy/game tests passed on each of Node20 and Node22. The combined backend race suite also passed.

After the predecessors merge, refresh against current main and run fresh full exact-head CI with ordinary approval. Do not remove Node20 from the repository matrix to make this update pass. The local focused matrix is not a substitute for full PR CI.

[github-actions]

The latest Buf updates on your PR. Results from workflow CI / proto (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 15, 2026, 9:36 AM

[zxxma]

Summary

Refreshed against merged #1189, then caught the concurrent #1202 merge and refreshed again. Final candidate: 2073e6220f28cdecdfe37eb9ebe758c0dfc84d18, based on f1b322e4c63a099b900cce12a863142aae17118e. Both updates used normal fast-forward pushes; no force push.

The PR still changes only frontend/package.json and frontend/package-lock.json (11 insertions / 11 deletions). Resolved Connect core/web versions move together from 2.1.2 to 2.2.0; Protobuf remains 2.15.0. No application, generated protocol, flag, workflow or simulator change is introduced by this PR.

Compatibility review found no actionable scoped issue. The Node >=22 engines change in the upstream release applies to server adapters, not these installed packages. Local Node20 compatibility was explicitly validated; this is not a claim of upstream Node20 support. Existing auth self-heal still uses the same Unauthenticated error code. No request-gate/early-auth migration is enabled.

Test plan and evidence

• Frozen install, lint, TypeScript/production build, bundle-isolation gate, production and development audit gates: passed.
• Full local Node20 and Node22 suites: 5,062 passes / 15 skips each. All six Gno integration files were then run with the exact CI pin and REQUIRE_GNO=1: 30/30 passed on each runtime, covering the 14 toolchain skips. The remaining skip is the opt-in corpus generator.
• Local Chromium: 232 passed / four skipped, including all three unchanged visual snapshots; mobile guardrails: 59/59 passed. No retries or snapshot updates.
• Worker rebuilt byte-identically.
• Fresh full backend build/race/coverage/lint/vulnerability checks after incorporating Count every arcade broadcast attempt toward the cycle limit #1202: passed; coverage 47.2%, lint zero issues, zero affected symbols/imported-package vulnerabilities (ten module-level findings remain).
• Extra local loopback probe: real Connect JS2.2 transports against the generated Connect-Go1.21 handler, with its metrics interceptor and Go race detector. Node20/22 × protobuf/JSON/gRPC-web all passed rejection/authenticated-fixture-read/pre-cancellation checks. Repeated successfully after Count every arcade broadcast attempt toward the cycle limit #1202. This temporary fixture-only overlay is not a committed or hosted test, wallet test or chain test.
• The exact first candidate's immutable preview passed four fresh mobile touch-start/pause smoke sessions with outbound writes blocked. After the backend-only Count every arcade broadcast attempt toward the cycle limit #1202 refresh, the entire frontend tree is unchanged. Netlify canceled the new attempt during no-content-change detection; its success status is not a newly built/tested preview.

Final exact-head CI and security: all passed, including both Node versions, backend, Docker, workspaces, Buf and security scans. Final rollup: 18 successes, three neutral Netlify metadata checks for the no-content-change cancellation. Hosted Chromium: 229 passed / seven skipped (unchanged local visual snapshots cover three of those skips); guardrails: 59 passed. No flaky or retried browser result reported.

Existing non-blocking warnings remain: backend coverage below the 50% target, total JS 4,675KB above the 3MB warning threshold, and missing Lighthouse upload artifact. No gate or assertion was weakened. Six existing default-branch advisories outside this diff (one high indirect gRPC xDS alert; five medium workspace alerts) remain separate follow-up work; passing this PR is not an advisory-free claim.

Review handoff

Final remote check: head 2073e622, base/current main f1b322e4, MERGEABLE, no unresolved review threads and no additional page. Normal independent approving review is still required; this evidence comment is not an approving review. Ready for that review and normal merge, without bypassing protection. #1191 remains excluded from this merge train. No mainnet realm deployment, wallet ceremony or unrelated feature-worktree change was performed.

[zxxma]

Post-merge verification

Merged as f8302d49913cdd8905a3baa8cd2f6d09fb9c770d; its complete tree exactly matches the validated PR candidate. Local main is clean and current.

• Post-merge CI, security, and frontend main-push gate: all passed. Chromium 229 passed/seven skipped; guardrails 59 passed, no retries reported.
• Netlify production deploy 6aa914fa7a67740008073a41 is ready with commit_ref exactly f8302d49. Four fresh mobile touch-start/pause smoke sessions passed, with outbound writes/telemetry blocked and no page errors. This is not wallet or live RPC acceptance evidence.
• Backend health remains application/database ok, version f1b322e. This frontend-only merge did not trigger a backend deployment.
• Existing coverage, bundle-size and Lighthouse-artifact warnings remain unchanged. No gates were weakened.

The approved dependency train is complete. #1191 remains excluded. Six existing dependency alerts (five distinct advisories) remain separate hardening follow-up work; no mainnet realm deployment or signing ceremony was performed.