chore: bump packages

[chybisov]

Which Linear task is linked to this PR?

N/A — routine dependency maintenance.

Why was it implemented this way?

Routine dependency refresh across the workspace, plus a pass over the pinned GitHub Action SHAs.

npm dependencies

All bumps are patch / >=1.x minor — no majors, nothing held back by pnpm's 24h release-age floor, no deprecated packages flagged.

Package	Type	From	To	Bump
@lifi/types (sdk)	runtime	17.85.0	17.86.0	minor
viem (ethereum)	runtime	^2.55.1	^2.55.8	patch
@mysten/sui (sui)	runtime	^2.20.3	^2.22.1	minor
@lifi/data-types (all)	dev	^6.82.4	^6.83.0	minor
@biomejs/biome	dev	^2.5.3	^2.5.5	patch
@changesets/cli	dev	^2.31.0	^2.31.1	patch
knip	dev	^6.26.0	^6.29.0	minor
tsdown	dev	^0.22.7	^0.22.14	patch

Package manager: pnpm 11.10.0 → 11.17.0 (latest). CI derives pnpm from packageManager, so no workflow change is needed.

GitHub Actions

All pinned SHAs re-resolved against each action's newest release; the # vX.Y.Z comment next to every pin was updated in lockstep.

Action	From	To	Occurrences
actions/checkout	v7.0.0	v7.0.1	5
actions/setup-node	v6.4.0	v7.0.0	1
linear/linear-release-action	v0.14.5	v0.14.6	3
pnpm/action-setup	v6.0.9	— already latest	1
changesets/action	v1.9.0	— already latest	2

On the actions/setup-node major (v6 → v7) — applied deliberately, and it is lower-risk than the major implies:

• v6.4.0 was already on the node24 runner runtime, so v7 is not a runtime jump. The major is the internal ESM refactor (#1574).
• #1558 removes the dummy NODE_AUTH_TOKEN export. This is a net positive here: we set registry-url and publish via npm OIDC trusted publishing, and the dummy value was exactly what could inject a non-functional token into .npmrc during an OIDC publish.
• No input/output we use was removed; v7 only adds outputs (cache-primary-key, cache-matched-key).

Other changes

• pnpm check:write reformatted three *.unit.spec.ts files. These are formatter-only changes from the biome 2.5.3 → 2.5.5 bump (it now breaks .each([...])(...) call arguments differently) — no test logic was touched.
• Closes a high-severity Dependabot alert. The relocked tree pulls fast-uri to 3.1.4, resolving alert #236 ("fast-uri vulnerable to host confusion via literal backslash authority delimiter", vulnerable >=3.0.0 <=3.1.3). It reaches us transitively and dev-only, via @commitlint/cli → @commitlint/load → @commitlint/config-validator → ajv, so it never shipped in a published tarball.
• A fix:-level changeset (patch) is included for the three packages with runtime dependency changes: @lifi/sdk, @lifi/sdk-provider-ethereum, @lifi/sdk-provider-sui. The remaining providers cascade automatically from the @lifi/sdk bump (updateInternalDependencies: "patch"), so they are deliberately not declared.

Notes / left alone

• pnpm-workspace.yaml minimumReleaseAgeExclude still lists exact-version entries (tsdown@0.22.7, rolldown-plugin-dts@0.27.8, the @yuku-* 0.6.1 bindings) that no longer match anything now that tsdown is at 0.22.14. Harmless dead entries — left untouched, worth a separate cleanup.
• The build emits deps.skipNodeModulesBundle is deprecated. Use deps.neverBundle: true instead. from all six tsdown.config.ts files. Pre-existing — the same warning ships in tsdown 0.22.7 — so it's out of scope here, but it's a cheap follow-up.
• The generated packages/*/src/version.ts files are stale on main (checked in as 4.0.0-beta.11; the real version is 4.2.0). pnpm build rewrites them, so they were discarded from this commit as usual — but every PR that builds will keep hitting the same dance, and staging them by accident would ship a wrong version export. Worth fixing separately.

Visual showcase (Screenshots or Videos)

N/A

Checklist before requesting a review

• I have performed a self-review and testing of my code.
• This pull request is focused and addresses a single problem.
• If this PR modifies the SDK API or adds new features that require documentation, I have updated the documentation in the public-docs repository. — N/A, no API change.

---

Validation

Run locally against the bumped tree:

pnpm install --frozen-lockfile ✅ · pnpm build ✅ · pnpm check ✅ · pnpm check:types ✅ (clean, no new errors) · pnpm check:circular-deps ✅ · pnpm knip:check ✅ · pnpm test:unit ✅ (91 files, 438 passed / 5 skipped)

Scope of CI coverage for the action bumps: this PR's own tests.yaml run does exercise actions/checkout@v7.0.1 and the pnpm-install composite (actions/setup-node@v7.0.0 with node-version: '26') — i.e. the riskiest bump is covered. changesets/action and linear/linear-release-action@v0.14.6 live only in publish.yaml and are not exercised by a pull request, so those two are verified by pin/tag correctness only.

[changeset-bot]

🦋 Changeset detected

Latest commit: 98535c4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@lifi/sdk	Patch
@lifi/sdk-provider-ethereum	Patch
@lifi/sdk-provider-sui	Patch
@lifi/sdk-provider-bitcoin	Patch
@lifi/sdk-provider-solana	Patch
@lifi/sdk-provider-tron	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR