build: declare @quantus/crypto as a ui-keyring dev dependency

The ML-DSA restore spec imports contextForSpec from it, and polkadot-dev's build refuses a package whose sources import something undeclared. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
feat!: ui-keyring holds post-quantum keys only
2026-09-16 21:13:56 +03:00 · 2026-09-16 21:13:01 +03:00 · 2026-09-15 14:15:02 +03:00 · 2026-09-15 11:28:03 +03:00 · 2026-09-15 11:08:43 +03:00 · 2026-09-15 10:40:52 +03:00
131 changed files with 496 additions and 305 deletions
--- a/.prettierrc.cjs
+++ b/.prettierrc.cjs
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 module.exports = require('@polkadot/dev/config/prettier.cjs');
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -13,3 +13,11 @@ logFilters:
 nodeLinker: node-modules

 yarnPath: .yarn/releases/yarn-4.5.1.cjs
+
+# @quantus packages come from the Gitea registry — safe as a whole-scope route
+# because we own every name in it. The forked @polkadot packages cannot be routed
+# the same way (most of that scope is unforked and lives on npm), so they are
+# pinned to tarball URLs in package.json resolutions instead.
+npmScopes:
+  quantus:
+    npmRegistryServer: "https://git.lair.cafe/api/packages/quantus/npm/"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,56 @@
 # CHANGELOG

+## 3.16.7 Mar 25, 2026
+
+Changes:
+
+- Bump common to 14.0.3 ([#860](https://github.com/polkadot-js/ui/pull/860))
+- Set headers for 2026 ([#859](https://github.com/polkadot-js/ui/pull/859))
+
+
+## 3.16.6 Dec 10, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#855](https://github.com/polkadot-js/ui/pull/855))
+
+
+## 3.16.5 Dec 10, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#855](https://github.com/polkadot-js/ui/pull/855))
+
+
+## 3.16.4 Nov 25, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#853](https://github.com/polkadot-js/ui/pull/853))
+
+
+## 3.16.3 Nov 12, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#850](https://github.com/polkadot-js/ui/pull/850))
+
+
+## 3.16.2 Oct 22, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#848](https://github.com/polkadot-js/ui/pull/848))
+
+
+## 3.16.1 Aug 27, 2025
+
+Changes:
+
+- 3.15.5 ([#846](https://github.com/polkadot-js/ui/pull/846))
+- Upgraded polkadot deps ([#845](https://github.com/polkadot-js/ui/pull/845))
+
+
 ## 3.15.4 Aug 13, 2025

 Changes:
--- a/4
+++ b/4
@@ -1,6 +1,6 @@
     735	Jaco                          	Adjust Vue peerDependency, >= 2.7 for defineComponent (#782)
-      38	Tarik Gul                     	3.14.1 (#835)
-      10	Arjun Porwal                  	3.15.4 (#844)
+      41	Tarik Gul                     	3.16.7 (#861)
+      22	Arjun Porwal                  	3.16.6 (#857)
       7	YJ                            	fix #224: decrease frame size to 1024, set multipart bool (#225)
       4	Antoine Estienne              	Refactor logic to better use prefix (#491)
       4	kwingram25                    	fix ff api url issue (#289)
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import baseConfig from '@polkadot/dev/config/eslint';
--- a/package.json
+++ b/package.json
@@ -14,10 +14,10 @@
  },
  "sideEffects": false,
  "type": "module",
-  "version": "3.15.4",
+  "version": "3.16.7",
  "versions": {
-    "git": "3.15.4",
-    "npm": "3.15.4"
+    "git": "3.16.7",
+    "npm": "3.16.7"
  },
  "workspaces": [
    "packages/*"
@@ -34,7 +34,7 @@
  },
  "devDependencies": {
    "@polkadot/dev": "^0.83.3",
-    "@polkadot/x-bundle": "^13.5.5",
+    "@polkadot/x-bundle": "^14.0.3",
    "@types/node": "^22.10.5",
    "react": "^18.2.0",
    "react-dom": "^18.2.0",
@@ -42,6 +42,9 @@
    "react-native": "^0.73.1"
  },
  "resolutions": {
+    "@polkadot/keyring": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Fkeyring/-/14.0.3-quantus.3/keyring-14.0.3-quantus.3.tgz",
+    "@polkadot/networks": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Fnetworks/-/14.0.3-quantus.3/networks-14.0.3-quantus.3.tgz",
+    "@polkadot/util-crypto": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Futil-crypto/-/14.0.3-quantus.3/util-crypto-14.0.3-quantus.3.tgz",
    "typescript": "5.5.4"
  }
 }
--- a/packages/react-identicon/package.json
+++ b/packages/react-identicon/package.json
@@ -18,14 +18,14 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.15.4",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/keyring": "^13.5.5",
-    "@polkadot/ui-settings": "3.15.4",
-    "@polkadot/ui-shared": "3.15.4",
-    "@polkadot/util": "^13.5.5",
-    "@polkadot/util-crypto": "^13.5.5",
+    "@polkadot/keyring": "^14.0.3",
+    "@polkadot/ui-settings": "3.16.7",
+    "@polkadot/ui-shared": "3.16.7",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "^14.0.3",
    "ethereum-blockies-base64": "^1.0.2",
    "jdenticon": "3.2.0",
    "react-copy-to-clipboard": "^5.1.0",
--- a/packages/react-identicon/src/Identicon.tsx
+++ b/packages/react-identicon/src/Identicon.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Prefix } from '@polkadot/util-crypto/address/types';
--- a/packages/react-identicon/src/bundle.ts
+++ b/packages/react-identicon/src/bundle.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export * from './icons/index.js';
--- a/packages/react-identicon/src/icons/Beachball.tsx
+++ b/packages/react-identicon/src/icons/Beachball.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Props } from '../types.js';
--- a/packages/react-identicon/src/icons/Empty.tsx
+++ b/packages/react-identicon/src/icons/Empty.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Props } from '../types.js';
--- a/packages/react-identicon/src/icons/Ethereum.tsx
+++ b/packages/react-identicon/src/icons/Ethereum.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Props } from '../types.js';
--- a/packages/react-identicon/src/icons/Jdenticon.tsx
+++ b/packages/react-identicon/src/icons/Jdenticon.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Props } from '../types.js';
--- a/packages/react-identicon/src/icons/Polkadot.tsx
+++ b/packages/react-identicon/src/icons/Polkadot.tsx
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Copyright 2018 Paritytech via paritytech/oo7/polkadot-identicon
--- a/packages/react-identicon/src/icons/index.ts
+++ b/packages/react-identicon/src/icons/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export { Beachball } from './Beachball.js';
--- a/packages/react-identicon/src/index.ts
+++ b/packages/react-identicon/src/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import './packageDetect.js';
--- a/packages/react-identicon/src/packageDetect.ts
+++ b/packages/react-identicon/src/packageDetect.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev
--- a/packages/react-identicon/src/packageInfo.ts
+++ b/packages/react-identicon/src/packageInfo.ts
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev

-export const packageInfo = { name: '@polkadot/react-identicon', path: 'auto', type: 'auto', version: '3.15.4' };
+export const packageInfo = { name: '@polkadot/react-identicon', path: 'auto', type: 'auto', version: '3.16.7' };
--- a/packages/react-identicon/src/styled.ts
+++ b/packages/react-identicon/src/styled.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export { styled } from 'styled-components';
--- a/packages/react-identicon/src/types.ts
+++ b/packages/react-identicon/src/types.ts
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type React from 'react';
--- a/packages/react-qr/package.json
+++ b/packages/react-qr/package.json
@@ -18,12 +18,12 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.15.4",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/ui-settings": "3.15.4",
-    "@polkadot/util": "^13.5.5",
-    "@polkadot/util-crypto": "^13.5.5",
+    "@polkadot/ui-settings": "3.16.7",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "^14.0.3",
    "@zxing/browser": "^0.1.5",
    "@zxing/library": "^0.21.2",
    "qrcode-generator": "^1.4.4",
--- a/packages/react-qr/src/Display.tsx
+++ b/packages/react-qr/src/Display.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import React, { useEffect, useMemo, useRef, useState } from 'react';
--- a/packages/react-qr/src/DisplayAddress.tsx
+++ b/packages/react-qr/src/DisplayAddress.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import React, { useMemo } from 'react';
--- a/packages/react-qr/src/DisplayPayload.tsx
+++ b/packages/react-qr/src/DisplayPayload.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import React, { useMemo } from 'react';
--- a/packages/react-qr/src/NetworkSpecs.tsx
+++ b/packages/react-qr/src/NetworkSpecs.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { NetworkSpecsStruct } from '@polkadot/ui-settings/types';
--- a/packages/react-qr/src/Scan.tsx
+++ b/packages/react-qr/src/Scan.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { BrowserQRCodeReader, type IScannerControls } from '@zxing/browser';
--- a/packages/react-qr/src/ScanAddress.tsx
+++ b/packages/react-qr/src/ScanAddress.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { HexString } from '@polkadot/util/types';
--- a/packages/react-qr/src/ScanSignature.tsx
+++ b/packages/react-qr/src/ScanSignature.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { HexString } from '@polkadot/util/types';
--- a/packages/react-qr/src/bundle.ts
+++ b/packages/react-qr/src/bundle.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export { QrDisplayAddress } from './DisplayAddress.js';
--- a/packages/react-qr/src/constants.ts
+++ b/packages/react-qr/src/constants.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export const ADDRESS_PREFIX = 'substrate';
--- a/packages/react-qr/src/index.ts
+++ b/packages/react-qr/src/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import './packageDetect.js';
--- a/packages/react-qr/src/packageDetect.ts
+++ b/packages/react-qr/src/packageDetect.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev
--- a/packages/react-qr/src/packageInfo.ts
+++ b/packages/react-qr/src/packageInfo.ts
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev

-export const packageInfo = { name: '@polkadot/react-qr', path: 'auto', type: 'auto', version: '3.15.4' };
+export const packageInfo = { name: '@polkadot/react-qr', path: 'auto', type: 'auto', version: '3.16.7' };
--- a/packages/react-qr/src/qrcode.ts
+++ b/packages/react-qr/src/qrcode.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import _qrcode from 'qrcode-generator';
--- a/packages/react-qr/src/styled.ts
+++ b/packages/react-qr/src/styled.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export { styled } from 'styled-components';
--- a/packages/react-qr/src/util.spec.ts
+++ b/packages/react-qr/src/util.spec.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 /// <reference types="@polkadot/dev-test/globals.d.ts" />
--- a/packages/react-qr/src/util.ts
+++ b/packages/react-qr/src/util.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { isString, u8aConcat, u8aToU8a } from '@polkadot/util';
--- a/packages/reactnative-identicon/package.json
+++ b/packages/reactnative-identicon/package.json
@@ -18,12 +18,12 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.15.4",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/ui-shared": "3.15.4",
-    "@polkadot/util": "^13.5.5",
-    "@polkadot/util-crypto": "^13.5.5",
+    "@polkadot/ui-shared": "3.16.7",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "^14.0.3",
    "react-native-svg": "^14.1.0",
    "tslib": "^2.8.1"
  },
--- a/packages/reactnative-identicon/src/Identicon.tsx
+++ b/packages/reactnative-identicon/src/Identicon.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Prefix } from '@polkadot/util-crypto/address/types';
--- a/packages/reactnative-identicon/src/bundle.ts
+++ b/packages/reactnative-identicon/src/bundle.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export * from './icons/index.js';
--- a/packages/reactnative-identicon/src/icons/Empty.tsx
+++ b/packages/reactnative-identicon/src/icons/Empty.tsx
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Props } from '../types.js';
--- a/packages/reactnative-identicon/src/icons/Polkadot.tsx
+++ b/packages/reactnative-identicon/src/icons/Polkadot.tsx
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Circle as CircleType } from '@polkadot/ui-shared/icons/types';
--- a/packages/reactnative-identicon/src/icons/index.ts
+++ b/packages/reactnative-identicon/src/icons/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export { default as Empty } from './Empty.js';
--- a/packages/reactnative-identicon/src/index.ts
+++ b/packages/reactnative-identicon/src/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import './packageDetect.js';
--- a/packages/reactnative-identicon/src/packageDetect.ts
+++ b/packages/reactnative-identicon/src/packageDetect.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev
--- a/packages/reactnative-identicon/src/packageInfo.ts
+++ b/packages/reactnative-identicon/src/packageInfo.ts
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev

-export const packageInfo = { name: '@polkadot/reactnative-identicon', path: 'auto', type: 'auto', version: '3.15.4' };
+export const packageInfo = { name: '@polkadot/reactnative-identicon', path: 'auto', type: 'auto', version: '3.16.7' };
--- a/packages/reactnative-identicon/src/types.ts
+++ b/packages/reactnative-identicon/src/types.ts
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export interface Props {
--- a/packages/ui-keyring/package.json
+++ b/packages/ui-keyring/package.json
@@ -17,19 +17,20 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.15.4",
+  "version": "3.16.7-quantus.3",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/keyring": "^13.5.5",
-    "@polkadot/ui-settings": "3.15.4",
-    "@polkadot/util": "^13.5.5",
-    "@polkadot/util-crypto": "^13.5.5",
+    "@polkadot/keyring": "14.0.3-quantus.3",
+    "@polkadot/ui-settings": "3.16.7",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "14.0.3-quantus.3",
    "mkdirp": "^3.0.1",
    "rxjs": "^7.8.1",
    "store": "^2.0.12",
    "tslib": "^2.8.1"
  },
  "devDependencies": {
+    "@quantus/crypto": "^0.3.0",
    "@types/mkdirp": "^2.0.0",
    "@types/store": "^2.0.5"
  },
--- a/packages/ui-keyring/src/Base.ts
+++ b/packages/ui-keyring/src/Base.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { KeyringInstance, KeyringPair } from '@polkadot/keyring/types';
@@ -125,8 +125,9 @@ export class Base {
      this.setDevMode(options.isDevelopment);
    }

-    // set Ethereum state
-    this.#isEthereum = keyring.type === 'ethereum';
+    // Never Ethereum: the keyring holds only ML-DSA keys (quantus/common#6). Kept
+    // as a property so callers written against upstream still read a boolean.
+    this.#isEthereum = false;

    this.#keyring = keyring;
    this._genesisHash = options.genesisHash && (
--- a/packages/ui-keyring/src/Keyring.dilithium.spec.ts
+++ b/packages/ui-keyring/src/Keyring.dilithium.spec.ts
@@ -0,0 +1,94 @@
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import type { KeyringPair$Json } from '@polkadot/keyring/types';
+
+import { contextForSpec } from '@quantus/crypto';
+
+import { Keyring as BaseKeyring } from '@polkadot/keyring';
+import { dilithiumVerify } from '@polkadot/util-crypto';
+
+import { Keyring } from './Keyring.js';
+
+// crystal_alice, from the chain's dev genesis — a raw 32-byte seed straight into
+// ML-DSA-87 keygen. The address is what `quantus developer create-test-wallets`
+// prints, i.e. an independent implementation.
+const ALICE = 'qzk1Nxai3dZD9Cn5kwGcgL6mKxsfxwqdis7kDQJ52aJS2vSn7';
+const PASSWORD = 'not a good password';
+const MESSAGE = new Uint8Array([0x75, 0x69]);
+
+function backup (): KeyringPair$Json {
+  const base = new BaseKeyring({ ss58Format: 189, type: 'dilithium87' });
+
+  return base
+    .addFromSeed(new Uint8Array(32), { name: 'crystal_alice' }, 'dilithium87')
+    .toJson(PASSWORD);
+}
+
+// `loadAll` initialises `@polkadot/ui-settings`, which is a module singleton, so
+// it may be called once per *process* — not per instance. One keyring for the
+// whole file, loaded once.
+const uiKeyring = new Keyring();
+
+uiKeyring.loadAll({ ss58Format: 189, store: undefined, type: 'dilithium87' });
+
+describe('ui-keyring restoreAccount', (): void => {
+  // Before the fix this constructed a pair whose "public key" was
+  // decodeAddress(json.address) — i.e. a Poseidon2 hash of the public key, passed
+  // off as the key itself. It did not throw; it produced a pair that was simply
+  // wrong.
+  it('restores an ML-DSA account to the right address', (): void => {
+    const pair = uiKeyring.restoreAccount(backup(), PASSWORD);
+
+    expect(pair.address).toEqual(ALICE);
+    expect(pair.publicKey.length).toEqual(2592);
+    expect(pair.addressRaw.length).toEqual(32);
+  });
+
+  it('restores an account that can sign for its own address', (): void => {
+    const pair = uiKeyring.restoreAccount(backup(), PASSWORD);
+
+    pair.decodePkcs8(PASSWORD);
+
+    const context = contextForSpec(148);
+    const signature = pair.sign(MESSAGE, { context });
+
+    expect(dilithiumVerify(MESSAGE, signature, pair.addressRaw, 'dilithium87', context)).toEqual(true);
+  });
+
+  it('fails on a wrong password without half-restoring', (): void => {
+    expect(() => uiKeyring.restoreAccount(backup(), 'wrong')).toThrow();
+  });
+
+  // The address field sits outside the encrypted blob. For the curve schemes a
+  // tampered one cannot decode at all; here it decodes cleanly and would yield an
+  // account displaying an address its key does not control.
+  it('rejects JSON whose address does not match its key', (): void => {
+    const base = new BaseKeyring({ ss58Format: 189, type: 'dilithium87' });
+    const other = base.addFromSeed(new Uint8Array(32).fill(3), {}, 'dilithium87');
+
+    expect(() => uiKeyring.restoreAccount({ ...backup(), address: other.address }, PASSWORD)).toThrow(/does not match the address/);
+  });
+
+  // quantus/common#6: a backup of a quantum-unsafe key is refused with the
+  // reason, not decoded. This is the JSON a polkadot{.js} export of an ed25519
+  // account carries.
+  it('refuses a polkadot{.js} backup of a quantum-unsafe key, saying why', (): void => {
+    const json = {
+      address: '5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY',
+      encoded: '0x00',
+      encoding: { content: ['pkcs8', 'sr25519'], type: ['scrypt', 'xsalsa20-poly1305'], version: '3' },
+      meta: { name: 'polkadot account' }
+    } as unknown as KeyringPair$Json;
+
+    expect(() => uiKeyring.restoreAccount(json, PASSWORD)).toThrow(/sr25519 keys are not quantum-safe and cannot be held here/);
+  });
+
+  it('refuses a file that does not record its key type', (): void => {
+    const json = { ...backup(), encoding: { content: 'pkcs8', type: 'none', version: '0' } } as unknown as KeyringPair$Json;
+
+    expect(() => uiKeyring.restoreAccount(json, PASSWORD)).toThrow(/does not record its key type/);
+  });
+});
--- a/packages/ui-keyring/src/Keyring.ts
+++ b/packages/ui-keyring/src/Keyring.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta } from '@polkadot/keyring/types';
@@ -8,10 +8,9 @@ import type { KeypairType } from '@polkadot/util-crypto/types';
 import type { AddressSubject, SingleAddress } from './observable/types.js';
 import type { CreateResult, KeyringAddress, KeyringAddressType, KeyringItemType, KeyringJson, KeyringJson$Meta, KeyringOptions, KeyringPairs$Json, KeyringStruct } from './types.js';

-import { createPair } from '@polkadot/keyring';
 import { chains } from '@polkadot/ui-settings';
 import { bnToBn, hexToU8a, isFunction, isHex, isString, objectSpread, stringify, stringToU8a, u8aSorted, u8aToString } from '@polkadot/util';
-import { base64Decode, createKeyMulti, jsonDecrypt, jsonEncrypt } from '@polkadot/util-crypto';
+import { createKeyMulti, jsonDecrypt, jsonEncrypt } from '@polkadot/util-crypto';

 import { env } from './observable/env.js';
 import { KeyringOption } from './options/index.js';
@@ -21,7 +20,7 @@ import { accountKey, accountRegex, addressKey, addressRegex, contractKey, contra
 const RECENT_EXPIRY = 24 * 60 * 60;

 // No accounts (or test accounts) should be loaded until after the chain determination.
-// Chain determination occurs outside of Keyring. Loading `keyring.loadAll({ type: 'ed25519' | 'sr25519' })` is triggered
+// Chain determination occurs outside of Keyring. Loading `keyring.loadAll({ type: 'dilithium65' | 'dilithium87' })` is triggered
 // from the API after the chain is received
 export class Keyring extends Base implements KeyringStruct {
  public readonly keyringOption = new KeyringOption();
@@ -327,15 +326,18 @@ export class Keyring extends Base implements KeyringStruct {
  }

  public restoreAccount (json: KeyringPair$Json, password: string): KeyringPair {
-    const cryptoType = Array.isArray(json.encoding.content) ? json.encoding.content[1] : 'ed25519';
-    const encType = Array.isArray(json.encoding.type) ? json.encoding.type : [json.encoding.type];
-    const pair = createPair(
-      { toSS58: this.encodeAddress, type: cryptoType as KeypairType },
-      { publicKey: this.decodeAddress(json.address, true) },
-      json.meta,
-      isHex(json.encoded) ? hexToU8a(json.encoded) : base64Decode(json.encoded),
-      encType
-    );
+    // Version-0 JSON predates recording the key type, so it cannot be an ML-DSA
+    // account. Upstream guessed ed25519; this keyring cannot hold one.
+    if (!Array.isArray(json.encoding.content)) {
+      throw new Error('This account file does not record its key type, so it is not an ML-DSA account and cannot be restored here');
+    }
+
+    // Through the keyring rather than createPair directly, so a restore gets the
+    // same refusal as every other entry point: a polkadot{.js} backup of an
+    // sr25519 or ed25519 account is told it is not quantum-safe, not decoded.
+    // createFromJson also carries the address as an account id until the real
+    // public key is decrypted, and checks the two agree when it is.
+    const pair = this.keyring.createFromJson(json, true);

    // unlock, save account and then lock (locking cleans secretKey, so needs to be last)
    pair.decodePkcs8(password);
--- a/packages/ui-keyring/src/bundle.ts
+++ b/packages/ui-keyring/src/bundle.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { Keyring } from './Keyring.js';
--- a/packages/ui-keyring/src/defaults.ts
+++ b/packages/ui-keyring/src/defaults.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { decodeAddress } from '@polkadot/keyring';
--- a/packages/ui-keyring/src/index.ts
+++ b/packages/ui-keyring/src/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import './packageDetect.js';
--- a/packages/ui-keyring/src/json.d.ts
+++ b/packages/ui-keyring/src/json.d.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Be able to import json in TS
--- a/packages/ui-keyring/src/observable/accounts.ts
+++ b/packages/ui-keyring/src/observable/accounts.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { accountKey } from '../defaults.js';
--- a/packages/ui-keyring/src/observable/addresses.ts
+++ b/packages/ui-keyring/src/observable/addresses.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { addressKey } from '../defaults.js';
--- a/packages/ui-keyring/src/observable/contracts.ts
+++ b/packages/ui-keyring/src/observable/contracts.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { contractKey } from '../defaults.js';
--- a/packages/ui-keyring/src/observable/env.ts
+++ b/packages/ui-keyring/src/observable/env.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { BehaviorSubject } from 'rxjs';
--- a/packages/ui-keyring/src/observable/genericSubject.ts
+++ b/packages/ui-keyring/src/observable/genericSubject.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { KeypairType } from '@polkadot/util-crypto/types';
--- a/packages/ui-keyring/src/observable/index.ts
+++ b/packages/ui-keyring/src/observable/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { SubjectInfo } from './types.js';
--- a/packages/ui-keyring/src/observable/types.ts
+++ b/packages/ui-keyring/src/observable/types.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { BehaviorSubject } from 'rxjs';
--- a/packages/ui-keyring/src/options/index.ts
+++ b/packages/ui-keyring/src/options/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Subscription } from 'rxjs';
--- a/packages/ui-keyring/src/options/item.ts
+++ b/packages/ui-keyring/src/options/item.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { KeyringSectionOption } from './types.js';
--- a/packages/ui-keyring/src/options/types.ts
+++ b/packages/ui-keyring/src/options/types.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { KeyringItemType, KeyringStruct } from '../types.js';
--- a/packages/ui-keyring/src/packageDetect.ts
+++ b/packages/ui-keyring/src/packageDetect.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev
--- a/packages/ui-keyring/src/packageInfo.ts
+++ b/packages/ui-keyring/src/packageInfo.ts
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev

-export const packageInfo = { name: '@polkadot/ui-keyring', path: 'auto', type: 'auto', version: '3.15.4' };
+export const packageInfo = { name: '@polkadot/ui-keyring', path: 'auto', type: 'auto', version: '3.16.7-quantus.3' };
--- a/packages/ui-keyring/src/stores/Browser.ts
+++ b/packages/ui-keyring/src/stores/Browser.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { KeyringJson, KeyringStore } from '../types.js';
--- a/packages/ui-keyring/src/stores/File.ts
+++ b/packages/ui-keyring/src/stores/File.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { KeyringJson, KeyringStore } from '../types.js';
--- a/packages/ui-keyring/src/stores/index.ts
+++ b/packages/ui-keyring/src/stores/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export { BrowserStore } from './Browser.js';
--- a/packages/ui-keyring/src/types.ts
+++ b/packages/ui-keyring/src/types.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { KeyringInstance as BaseKeyringInstance, KeyringOptions as KeyringOptionsBase, KeyringPair, KeyringPair$Json, KeyringPair$Meta } from '@polkadot/keyring/types';
--- a/packages/ui-settings/package.json
+++ b/packages/ui-settings/package.json
@@ -18,11 +18,11 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.15.4",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/networks": "^13.5.5",
-    "@polkadot/util": "^13.5.5",
+    "@polkadot/networks": "^14.0.3",
+    "@polkadot/util": "^14.0.3",
    "eventemitter3": "^5.0.1",
    "store": "^2.0.12",
    "tslib": "^2.8.1"
--- a/packages/ui-settings/src/Settings.ts
+++ b/packages/ui-settings/src/Settings.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Endpoint, EndpointType, Option, SettingsStruct } from './types.js';
--- a/packages/ui-settings/src/bundle.ts
+++ b/packages/ui-settings/src/bundle.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { Settings, settings } from './Settings.js';
--- a/packages/ui-settings/src/defaults/chains.ts
+++ b/packages/ui-settings/src/defaults/chains.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { selectableNetworks } from '@polkadot/networks';
--- a/packages/ui-settings/src/defaults/crypto.ts
+++ b/packages/ui-settings/src/defaults/crypto.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Option } from '../types.js';
--- a/packages/ui-settings/src/defaults/endpoints.ts
+++ b/packages/ui-settings/src/defaults/endpoints.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Option } from '../types.js';
--- a/packages/ui-settings/src/defaults/index.ts
+++ b/packages/ui-settings/src/defaults/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Option } from '../types.js';
--- a/packages/ui-settings/src/defaults/ledger.ts
+++ b/packages/ui-settings/src/defaults/ledger.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Option } from '../types.js';
--- a/packages/ui-settings/src/defaults/ss58.ts
+++ b/packages/ui-settings/src/defaults/ss58.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Option } from '../types.js';
--- a/packages/ui-settings/src/defaults/type.ts
+++ b/packages/ui-settings/src/defaults/type.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // matches https://polkadot.js.org & https://*.polkadot.io
--- a/packages/ui-settings/src/defaults/ui.ts
+++ b/packages/ui-settings/src/defaults/ui.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Option } from '../types.js';
--- a/packages/ui-settings/src/index.ts
+++ b/packages/ui-settings/src/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import { settings } from './bundle.js';
--- a/packages/ui-settings/src/packageDetect.ts
+++ b/packages/ui-settings/src/packageDetect.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev
--- a/packages/ui-settings/src/packageInfo.ts
+++ b/packages/ui-settings/src/packageInfo.ts
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Do not edit, auto-generated by @polkadot/dev

-export const packageInfo = { name: '@polkadot/ui-settings', path: 'auto', type: 'auto', version: '3.15.4' };
+export const packageInfo = { name: '@polkadot/ui-settings', path: 'auto', type: 'auto', version: '3.16.7' };
--- a/packages/ui-settings/src/types.ts
+++ b/packages/ui-settings/src/types.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export interface Option {
--- a/packages/ui-shared/package.json
+++ b/packages/ui-shared/package.json
@@ -18,15 +18,15 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.15.4",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
    "colord": "^2.9.3",
    "tslib": "^2.8.1"
  },
  "devDependencies": {
-    "@polkadot/util": "^13.5.5",
-    "@polkadot/util-crypto": "^13.5.5",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "^14.0.3",
    "@types/xmlserializer": "^0.6.6",
    "xmlserializer": "^0.6.1"
  },
--- a/packages/ui-shared/src/bundle.ts
+++ b/packages/ui-shared/src/bundle.ts
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2018-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 export * from './icons/index.js';
--- a/packages/ui-shared/src/icons/beachball/colors.spec.ts
+++ b/packages/ui-shared/src/icons/beachball/colors.spec.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 /// <reference types="@polkadot/dev-test/globals.d.ts" />
--- a/packages/ui-shared/src/icons/beachball/colors.ts
+++ b/packages/ui-shared/src/icons/beachball/colors.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Copyright 2016 Dan Finlay
--- a/packages/ui-shared/src/icons/beachball/container.spec.ts
+++ b/packages/ui-shared/src/icons/beachball/container.spec.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 /// <reference types="@polkadot/dev-test/globals.d.ts" />
--- a/packages/ui-shared/src/icons/beachball/container.ts
+++ b/packages/ui-shared/src/icons/beachball/container.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Copyright 2016 Dan Finlay
--- a/packages/ui-shared/src/icons/beachball/defaults.ts
+++ b/packages/ui-shared/src/icons/beachball/defaults.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Copyright 2016 Dan Finlay
--- a/packages/ui-shared/src/icons/beachball/demo.ts
+++ b/packages/ui-shared/src/icons/beachball/demo.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Copyright 2016 Dan Finlay
--- a/packages/ui-shared/src/icons/beachball/index.spec.ts
+++ b/packages/ui-shared/src/icons/beachball/index.spec.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 /// <reference types="@polkadot/dev-test/globals.d.ts" />
--- a/packages/ui-shared/src/icons/beachball/index.ts
+++ b/packages/ui-shared/src/icons/beachball/index.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Copyright 2016 Dan Finlay
--- a/packages/ui-shared/src/icons/beachball/seeder.spec.ts
+++ b/packages/ui-shared/src/icons/beachball/seeder.spec.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 /// <reference types="@polkadot/dev-test/globals.d.ts" />
--- a/packages/ui-shared/src/icons/beachball/seeder.ts
+++ b/packages/ui-shared/src/icons/beachball/seeder.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 import type { Seeder } from './types.js';
--- a/packages/ui-shared/src/icons/beachball/shape/circle.spec.ts
+++ b/packages/ui-shared/src/icons/beachball/shape/circle.spec.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 /// <reference types="@polkadot/dev-test/globals.d.ts" />
--- a/packages/ui-shared/src/icons/beachball/shape/circle.ts
+++ b/packages/ui-shared/src/icons/beachball/shape/circle.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0

 // Copyright 2016 Dan Finlay
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
rob thijssen	160d97c19b	build: declare @quantus/crypto as a ui-keyring dev dependency Some checks failed Lock Threads / lock (push) Has been cancelled Details The ML-DSA restore spec imports contextForSpec from it, and polkadot-dev's build refuses a package whose sources import something undeclared. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-16 21:13:56 +03:00
rob thijssen	c7c23b7958	feat!: ui-keyring holds post-quantum keys only Follows quantus/common#6, which removed ed25519, sr25519, ecdsa and ethereum from the keyring (forks at 14.0.3-quantus.3). - restoreAccount now goes through keyring.createFromJson instead of building the pair itself. A restored backup therefore gets the same refusal as every other entry point: a polkadot{.js} export of an sr25519 or ed25519 account is told "<type> keys are not quantum-safe and cannot be held here", not decoded. - Version-0 JSON, which does not record its key type and so cannot be ML-DSA, is refused. Upstream guessed ed25519. - isEthereum is always false; it's kept so callers written against upstream still read a boolean. - loadAll already skips, with a warning, any stored account the keyring refuses, so a profile holding an old classical account still starts. The spec that pinned sr25519 restore as unchanged is replaced by the two refusals. ui-keyring 3.16.7-quantus.3, on the quantus.3 forks. yarn test 47 passing; lint clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-16 21:13:01 +03:00
rob thijssen	2d6a9ad1b3	build: consume the forks at 14.0.3-quantus.2 Some checks failed Lock Threads / lock (push) Has been cancelled Details Picks up the networks fix (the quantum-safe gate moving out of the library list, which made @polkadot/api importable again) and Heisenberg's corrected HEI symbol. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-15 14:15:02 +03:00
rob thijssen	18105d3ced	build: pin the forked packages at 14.0.3-quantus.1 Follows the rename in quantus/common. The point is not tidiness: with the forks numbered 14.0.3, a missing resolution here would have been satisfied from npm by the unforked upstream package, installing cleanly and silently dropping Quantus support. Now it fails with "No candidates found" — verified by removing the @polkadot/networks resolution and running an install. Refs quantus/extension#2 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-15 11:28:03 +03:00
rob thijssen	f2a1ab3a72	build: consume the forked @polkadot packages from the registry, drop the scaffolding Removes every workaround the symlink approach needed, and reverts tsconfig to upstream's exactly. The three forked packages — @polkadot/{networks,util-crypto,keyring} — are now pinned to Gitea tarball URLs in resolutions. @polkadot/util is not, because this fork does not modify it; it comes from npm like the rest of the scope. Tarball URLs rather than routing the @polkadot scope to Gitea, because the scope is mostly not forked: routing it would send yarn looking for dozens of packages that are not there. @quantus is routed as a whole scope in .yarnrc.yml, which is safe because we own every name in it. Four things go away, all of which existed for one reason — node resolves a portal or link symlink to its realpath, after which @polkadot/util-crypto resolved inside common's tree, where it is a workspace source directory with no exports map: - resolutions pointing four packages at ../common/packages//build - tsconfig.base.json `.d.ts` path mappings, needed because NodeNext will not infer an extension for a bare path and looked for a `types` directory - tsconfig.json overriding those with a runtime `.js` view, because @polkadot/dev-ts reads that file and tried to import a declaration file as a module - --preserve-symlinks in the test scripts Also drops fflate and @quantus/crypto from ui-keyring's devDependencies; they were there only because `link:` does not install its target's dependencies. `yarn lint` now reports 0 errors, down from 25 on pristine upstream. Those were no-unsafe-assignment and no-unsafe-argument on values that were `any` purely because the types did not resolve. Refs quantus/extension#2, quantus/ui#1 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-15 11:08:43 +03:00
rob thijssen	ec1399f3f3	fix(ui-keyring): restoreAccount cannot rebuild an ML-DSA public key from an address The mirror of the same mistake in keyring.createFromJson, fixed the same way. restoreAccount passed `decodeAddress(json.address)` as the public key. For the curve schemes that is correct — the address is the public key. An ML-DSA account id is a one-way Poseidon2 hash, so this constructed a pair whose "public key" was a hash of the public key. It did not throw; it produced a pair that was simply wrong. The public key is in `json.encoded`, still encrypted, and the pair is returned locked with callers reading `pair.address` off it long before a password appears. So it now passes an accountId — carried as data, used for the address while locked, and checked against the real key once decodePkcs8 supplies one. That check matters here as much as in the keyring: the address field sits outside the encrypted blob, so a tampered one decodes cleanly and yields an account displaying an address its key cannot sign for. The 'ed25519' fallback for version-0 JSON is left alone. Those files predate the crypto type being recorded and are by definition not Quantus, so the guess is safe — but it is commented, because quantus/common#6 removes ed25519 from KeypairType and this becomes a refusal. Build plumbing, all of it dev-time only and all replaced by publishing these packages to a registry (quantus/extension#2): Resolutions point @polkadot/{keyring,util-crypto,networks,util} at the sibling `common` checkout's build output, and @quantus/crypto at `wasm`. tsconfig.base.json gains `.d.ts` path mappings for them. Without these, node resolves the portal symlink to its realpath and `@polkadot/util-crypto` then resolves inside common's* tree, where it is the workspace source directory with no exports map — so EncryptedJson silently fails to resolve and KeyringPair$Json loses `encoded` and `encoding`. The `*.d.ts` substitution has to come first because NodeNext will not infer an extension for a bare path, and looks for a `types` directory instead of `types.d.ts`. tsconfig.json overrides those with the runtime `.js` view, because @polkadot/dev-ts reads that file and would otherwise import a declaration file as a module ("Debug Failure. Output generation failed"). tsc reads tsconfig.build.json, which extends the base directly, so each gets the view it needs. The test script sets --preserve-symlinks, which yarn itself warns is required for portals: without it the realpath problem above recurs at runtime. Incidentally, `yarn lint` errors drop from 25 to 8 — resolving those types removed a pile of `any`. The remaining 8 are upstream's own, in loadContract and allowGenesis, and are left alone. Refs quantus/ui#1 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-15 10:40:52 +03:00
github-actions[bot]	1d667d4dc0	[CI Skip] release/stable 3.16.7 Some checks failed Lock Threads / lock (push) Has been cancelled Details skip-checks: true	2026-03-26 19:24:07 +00:00
Tarik Gul	c60975d532	3.16.7 (#861 ) * 3.16.7 * Update Changelog	2026-03-26 21:22:47 +02:00
github-actions[bot]	816d22019b	[CI Skip] bump/beta 3.16.7-1-x skip-checks: true	2026-03-26 13:29:51 +00:00
Tarik Gul	ddca14ece2	Bump common to 14.0.3 (#860 )	2026-03-26 15:28:34 +02:00
github-actions[bot]	f5e26741da	[CI Skip] bump/beta 3.16.7-0-x skip-checks: true	2026-03-13 13:57:53 +00:00
Tarik Gul	c5ab15118d	Set headers for 2026 (#859 ) * Set headers for 2026 * remaining headers	2026-03-13 15:56:35 +02:00
github-actions[bot]	2e00b6e4e4	[CI Skip] release/stable 3.16.6 skip-checks: true	2025-12-10 06:42:02 +00:00
Arjun Porwal	8b483c6a1a	3.16.6 (#857 )	2025-12-10 12:10:43 +05:30
github-actions[bot]	1339b6291b	[CI Skip] release/stable 3.16.5 skip-checks: true	2025-12-10 04:58:38 +00:00
Arjun Porwal	0b69a66b73	3.16.5 (#856 )	2025-12-10 10:27:22 +05:30
github-actions[bot]	ccb870aec2	[CI Skip] bump/beta 3.16.5-0-x skip-checks: true	2025-12-10 04:49:08 +00:00
Arjun Porwal	73221469a3	chore: bump polkadot-js deps (#855 )	2025-12-10 10:17:49 +05:30
github-actions[bot]	95fccdfc30	[CI Skip] release/stable 3.16.4 skip-checks: true	2025-11-25 11:56:32 +00:00
Arjun Porwal	078133bc5a	3.16.4 (#854 )	2025-11-25 17:25:15 +05:30
github-actions[bot]	c2c4b1a89a	[CI Skip] bump/beta 3.16.4-0-x skip-checks: true	2025-11-25 11:36:11 +00:00
Arjun Porwal	f52e4e5096	chore: bump deps (#853 )	2025-11-25 17:04:53 +05:30
github-actions[bot]	292cb319c3	[CI Skip] release/stable 3.16.3 skip-checks: true	2025-11-12 06:32:14 +00:00
Arjun Porwal	c16d40d3b7	3.16.3 (#851 )	2025-11-12 12:00:59 +05:30
github-actions[bot]	9dd1a86b19	[CI Skip] bump/beta 3.16.3-0-x skip-checks: true	2025-11-12 06:22:10 +00:00
Arjun Porwal	e9dea3bb8a	chore: bump deps (#850 )	2025-11-12 11:50:51 +05:30
github-actions[bot]	b1f6ca7b95	[CI Skip] release/stable 3.16.2 skip-checks: true	2025-10-22 12:19:51 +00:00
Arjun Porwal	06449c3ecb	3.16.2 (#849 )	2025-10-22 09:18:33 -03:00
github-actions[bot]	62f6cb363e	[CI Skip] bump/beta 3.16.2-0-x skip-checks: true	2025-10-22 12:11:49 +00:00
Arjun Porwal	062d88d9a6	chore: upgrade deps (#848 )	2025-10-22 17:40:20 +05:30
github-actions[bot]	9697a311cc	[CI Skip] release/stable 3.16.1 skip-checks: true	2025-08-27 12:53:15 +00:00
Arjun Porwal	f125830e2c	3.16.1 (#847 ) * 3.16.1 * 3.16.1	2025-08-27 09:52:00 -03:00
Arjun Porwal	4b5d6b7205	3.15.5 (#846 )	2025-08-27 17:45:12 +05:30
github-actions[bot]	c92ff8e3c7	[CI Skip] bump/beta 3.15.5-0-x skip-checks: true	2025-08-27 12:07:51 +00:00
Arjun Porwal	d974af4c00	chore: upgrade polkadot deps (#845 )	2025-08-27 17:36:27 +05:30