Cardano Updates

Bump actions/checkout from 6 to 7 in the actions group

ip-address was used in exactly one place — pool-relay address (de)serialization
in ipUtils.ts (Address4/Address6 validation, IPv6 expansion to bytes, and
canonical formatting). Vendor a ~50-line functional parser (RFC 4291: `::`
zero-compression and trailing IPv4-mapped suffixes) and drop the dependency.

Because this feeds consensus-affecting serialization, the local implementation
was proven byte-for-byte identical to ip-address across a 26-case corpus
(validation, expansion, canonical formatting; valid/edge/invalid) before removal,
then locked in with vector-based unit tests.

Removes ip-address from core's production closure (no consumer pulls it via core
any longer). Full core suite (1018 tests) green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Add docs/core-dependency-minimisation.md (decision table + transitive/size
impact) and a reusable dependency-minimisation skill (closure-aware targeting,
differential equivalence for consensus code, the two impact metrics, and the
gotchas hit along the way).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

@foxglove/crc was used in exactly one place — the Byron-era address
checksum. CRC-32 (IEEE 802.3 / zlib variant) is ~15 lines, so vendor a
local implementation and drop the dependency from core's closure.

Adds a dedicated crc32 unit test pinning the implementation bit-for-bit to
the canonical CRC-32 vectors (123456789 -> 0xCBF43926, empty -> 0, the
"quick brown fox" -> 0x414FA339, 0..255 -> 0x29058C73), so it provably
matches the variant @foxglove/crc provided. Byron address round-trips
(Address/PaymentAddress suites) cover the integration path.

Part of the core dependency-minimisation effort.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The rule wants uppercase hex digits, which conflicts head-on with the repo's
enforced Prettier config (lowercase) — making it unsatisfiable for any hex
literal containing a-f. It had accumulated `/* eslint-disable */` directives in
16 files as a workaround. Disable it once in the shared config (as no-bitwise
already is) and drop the redundant per-file directives.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

chore: target Node 22 LTS (drop EOL Node 18)

web-encoding polyfilled TextDecoder for environments lacking it. TextDecoder
has been a Node.js global since v11 — so it was already available under the
previous >=16.20.2 engine, independent of the Node 22 bump — and is native in
all bundler-targeted modern browsers, making the polyfill (and its ~8MB
@zxing/text-encoding dependency) dead weight. Both decode sites only use
`new TextDecoder('utf8', { fatal: true })` + `.decode()`, fully covered by the
global.

Removes ~9.5MB from core's node_modules closure. Behaviour unchanged; full core
suite (992 tests) green. Part of the core dependency-minimisation effort.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Consolidates the pure dependency version bumps that stack on top of the
Node 22 upgrade. Each is a behaviour-preserving bump that closes (or
hardens against) Dependabot alerts on consumer-facing and build-context
deps; no public API changes.

- uuid 8/9/10 -> ^11.1.1 across cardano-services, e2e, projection-typeorm,
  web-extension, wallet; drop now-redundant @types/uuid (uuid 11 ships
  its own types).
- core: ip-address ^9.0.5 -> ^10.2.0.
- axios relocked within ^1.7.4 to 1.18.0.
- cardano-services: express-openapi-validator ^4.13.8 -> ^5.6.2
  (pulls multer 2.x, removing the vulnerable multer 1.x). v5 renames
  the OpenAPIV3.Document type to DocumentV3 — updated in openApi.ts and
  its test.

Audits the wave in docs/security/dependency-vulnerability-audit-2026-06-19.md
(follow-up section): OSV.dev clean for every resolved version, 0 residual
advisories in CISA KEV, production closure clean, no lockfile downgrades,
per-tier blast-radius diagrams, and the lone publisher transition (multer
linusu -> ulisesgascon) annotated as a known maintenance handoff.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

This TypeScript incremental-build cache has been committed since
1dcb0993c84 (2021-10-04) but was only added to .gitignore later in
f0a8724593b (2022-06-14). Git keeps already-tracked files even once
ignored, so it lingered in the tree — churning on every build and
showing up as spurious diffs. Remove it from version control (the file
stays locally; tsc regenerates it).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Drop three sections that referenced removed functionality:
- Deployments / STD Workflow — the std deployment framework (and its
  std.yml workflow) was removed in 16e986e2603; the link 404s.
- Attic / RabbitMQ tx-submit provider — long-removed feature pointer.
- Possible issues — obsolete `yarn build --mode=skip-build` Docker note.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The project was pinned to the now-EOL Node 18.12.0 (.nvmrc + all CI workflows)
with a stale `engines: >=16.20.2`. Move to the Node 22 LTS line, tracked by
major so it doesn't go stale again:

- .nvmrc: 22 · all 9 CI workflows: node-version 22 · engines.node: >=22 (all manifests)
- @types/node: ^18 -> ^22

Node 22 / @types/node 22 compatibility fixes (folded in so every commit builds):
- cardano-services WsServer + projection/e2e tests: type interval handles as
  NodeJS.Timeout (setInterval no longer returns the legacy NodeJS.Timer)
- e2e measurement-util (src + test): PerformanceEntry no longer carries `detail`
- shared jest base config: fakeTimers `doNotFake: ['performance']` (Node 22's
  read-only global `performance` can't be replaced by the fake-timers impl), and
  a setupFile disabling http(s).globalAgent keepAlive — Node 19+ defaults it to
  true, so HTTP tests that restart servers between cases reused stale sockets
  ("socket hang up" / AxiosError in HttpProvider + TxSubmit suites)
- cardano-services-client test: --runInBand (avoids a jest-worker circular-JSON
  IPC crash on a follow-redirects object)
- TypeormStakePoolProvider util test: assert toThrow(SyntaxError) (V8 JSON
  message wording differs across Node versions)

Docker: NODEJS_MAJOR_VERSION=22, plus a multi-stage `deps-builder` that installs
the build toolchain (build-essential/python3/libudev-dev/libusb/pkg-config) to
compile native modules — Node 22 has no prebuilds for some older native deps
(cpu-features, chacha-native, node-hid/usb). Toolchain stays in the builder;
runtime images copy the compiled node_modules and stay lean.

Unblocks the Node-20+ dependency majors that couldn't pass CI on Node 18.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

This TypeScript incremental-build cache has been committed since
1dcb0993c84 (2021-10-04), but was added to .gitignore later in
f0a8724593b (2022-06-14). Git keeps already-tracked files even once
ignored, so it lingered in the tree — churning on every build and
showing up as spurious diffs. Remove it from version control (the file
stays locally; it is regenerated by tsc).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Consolidates the pure dependency version bumps that stack on top of the
Node 22 upgrade. Each is a behaviour-preserving bump that closes (or
hardens against) Dependabot alerts on consumer-facing and build-context
deps; no public API changes.

- uuid 8/9/10 -> ^11.1.1 across cardano-services, e2e, projection-typeorm,
  web-extension, wallet; drop now-redundant @types/uuid (uuid 11 ships
  its own types).
- core: ip-address ^9.0.5 -> ^10.2.0.
- axios relocked within ^1.7.4 to 1.18.0.
- cardano-services: express-openapi-validator ^4.13.8 -> ^5.6.2
  (pulls multer 2.x, removing the vulnerable multer 1.x). v5 renames
  the OpenAPIV3.Document type to DocumentV3 — updated in openApi.ts and
  its test.

Audits the wave in docs/security/dependency-vulnerability-audit-2026-06-19.md
(follow-up section): OSV.dev clean for every resolved version, 0 residual
advisories in CISA KEV, production closure clean, no lockfile downgrades,
per-tier blast-radius diagrams, and the lone publisher transition (multer
linusu -> ulisesgascon) annotated as a known maintenance handoff.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: Akhil Repala <[email protected]>

Signed-off-by: Akhil Repala <[email protected]>