14.0.0

@metamask/mobile-wallet-protocol-core 0.4.0

Added

• isValidConnectionMode() and CONNECTION_MODES for runtime validation of connection mode values (#75)

Changed

• Add validatePeerKey method to IKeyManager interface for peer public key validation at handshake and resume time (#70)
• Pin eciesjs to exact version 0.4.17 (#77)
• BREAKING: SessionStore constructor is now private; use await SessionStore.create(kvstore) (#71)
• BREAKING: Drop Node 18 support, require Node 20+ (#76)

Fixed

• Reject inbound messages on expired sessions instead of processing them (#72)
• Fix SessionStore race conditions and fire-and-forget garbage collection (#71)
• Guard against NaN in session expiry timestamps (#70)
• Use timing-safe comparison for OTP verification (#74)

@metamask/mobile-wallet-protocol-dapp-client 0.3.0

Changed

• Validate peer public keys during handshake in both trusted and untrusted connection flows (#70)
• Validate connection mode at client construction time (#75)
• BREAKING: Drop Node 18 support, require Node 20+ (#76)

Fixed

• Use constant-time comparison for OTP verification to prevent timing side-channel attacks (#74)

@metamask/mobile-wallet-protocol-wallet-client 0.3.0

Changed

• Validate connection mode at client construction time (#75)
• BREAKING: Drop Node 18 support, require Node 20+ (#76)

Fixed

• Replace Math.random() with crypto.getRandomValues() for OTP generation (#73)
• Validate peer public keys during session creation (#70)
• Fix client stuck in CONNECTING state when session creation fails (#70)