release: v1.4.0 → main

[philanton]

Release v1.4.0

Highlights

• Audit remediation — MF3 final round (fix: audit findings round final 3 #846): security hardening across contracts, nitronode, SDK, and RPC.
  • Contract: reentrancy guard + event-handler monotonicity, reorg double-spend confirmation gate.
  • Breaking: removed app registry, action allowances, user staking, and rebalance feature; removed SDK locking client + app-registry ABI; RPC surface (docs/api.yaml) trimmed.
  • DoS/overflow fixes: pagination limit=0, uint8 quorum overflow, frame-layer rate limit, deposit-state enforcement.
• feat(nitronode): add USDC asset across 7 chains (feat(nitronode/config/prod): add USDC asset across 7 chains #845)
• fix(go-sdk): preserve channel challenge expiry (fix(go-sdk): preserve channel challenge expiry #816)
• Fix SDK MCP Hono audit failure (Fix SDK MCP Hono audit failure #821)
• Dependency bumps (gomod, npm, ws).

Versioning note

Minor bump (1.3.1 → 1.4.0). Note: removal of app-registry/staking/rebalance + RPC methods is a breaking change for downstream consumers — flagged here rather than a major bump per 1.x cadence.

MCP

mcp-v1.4.0 tag intentionally NOT pushed this release. @yellow-org/sdk-mcp published manually (npm + MCP registry), alongside manual @yellow-org/sdk + @yellow-org/sdk-compat publishes.

Summary by CodeRabbit

• Chores
  • Version updated to 1.4.0 across multiple packages and Helm charts for faucet-app, nitronode, playground, and SDK components (mcp, ts-compat, ts).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9b301e92-67b6-4346-a971-47263198ebae

📥 Commits

Reviewing files that changed from the base of the PR and between 37124a6 and 3a10b5f.

⛔ Files ignored due to path filters (3)

• sdk/mcp/package-lock.json is excluded by !**/package-lock.json
• sdk/ts-compat/package-lock.json is excluded by !**/package-lock.json
• sdk/ts/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

• faucet-app/chart/Chart.yaml
• nitronode/chart/Chart.yaml
• playground/chart/Chart.yaml
• sdk/mcp/package.json
• sdk/mcp/server.json
• sdk/ts-compat/package.json
• sdk/ts/package.json

---

📝 Walkthrough

Walkthrough

Version bump to 1.4.0 across the repository: appVersion updated from 1.3.0 to 1.4.0 in three Helm charts (faucet-app, nitronode, playground), and version updated from 1.3.1 to 1.4.0 in four SDK package manifests (sdk/ts, sdk/ts-compat, sdk/mcp/package.json, sdk/mcp/server.json).

Changes

Version Bump to 1.4.0

Layer / File(s)	Summary
Helm chart appVersion bumps faucet-app/chart/Chart.yaml, nitronode/chart/Chart.yaml, playground/chart/Chart.yaml	appVersion bumped from 1.3.0 to 1.4.0 in all three deployment charts.
SDK package version bumps sdk/ts/package.json, sdk/ts-compat/package.json, sdk/mcp/package.json, sdk/mcp/server.json	version bumped from 1.3.1 to 1.4.0 in the TypeScript SDK, TS compatibility package, MCP package manifest, and MCP server config (both top-level and nested package entry).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• layer-3/nitrolite#596: Updates the same version fields in sdk/ts/package.json and sdk/ts-compat/package.json.
• layer-3/nitrolite#798: Updates the same Helm chart appVersion and SDK package version fields in an earlier release bump to 1.3.0.

Suggested reviewers

• ihsraham
• nksazonov
• dimast-x

Poem

🐇 Hop, hop, version's new,
From 1.3 we bid adieu!
Charts and packages all agree,
1.4.0 is where we'll be.
The rabbit stamps the bumped YAML,
And off we go in grand new style! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'release: v1.4.0 → main' directly matches the PR objective of merging the v1.4.0 release to main, and the version bumps across all changed files (1.3.1→1.4.0 and 1.3.0→1.4.0) align with the title.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v1.4.0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}