build: declare @quantus/crypto as a ui-keyring dev dependency

The ML-DSA restore spec imports contextForSpec from it, and polkadot-dev's
build refuses a package whose sources import something undeclared.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f

.github/workflows/pr-any.yml

@@ -11,8 +11,8 @@ jobs:
     env:
       YARN_ENABLE_SCRIPTS: false
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-node@v3
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
       with:
         node-version: 'lts/*'
     - name: ${{ matrix.step }}

.github/workflows/push-master.yml

@@ -18,11 +18,11 @@ jobs:
       GH_RELEASE_GITHUB_API_TOKEN: ${{ secrets.GH_PAT_BOT }}
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
         token: ${{ secrets.GH_PAT_BOT }}
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
       with:
         node-version: 'lts/*'
     - name: ${{ matrix.step }}

.prettierrc.cjs

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 module.exports = require('@polkadot/dev/config/prettier.cjs');

.yarnrc.yml

@@ -12,4 +12,12 @@ logFilters:
 
 nodeLinker: node-modules
 
-yarnPath: .yarn/releases/yarn-4.1.0.cjs
+yarnPath: .yarn/releases/yarn-4.5.1.cjs
+
+# @quantus packages come from the Gitea registry — safe as a whole-scope route
+# because we own every name in it. The forked @polkadot packages cannot be routed
+# the same way (most of that scope is unforked and lives on npm), so they are
+# pinned to tarball URLs in package.json resolutions instead.
+npmScopes:
+  quantus:
+    npmRegistryServer: "https://git.lair.cafe/api/packages/quantus/npm/"

CHANGELOG.md

@@ -1,5 +1,200 @@
 # CHANGELOG
 
+## 3.16.7 Mar 25, 2026
+
+Changes:
+
+- Bump common to 14.0.3 ([#860](https://github.com/polkadot-js/ui/pull/860))
+- Set headers for 2026 ([#859](https://github.com/polkadot-js/ui/pull/859))
+
+
+## 3.16.6 Dec 10, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#855](https://github.com/polkadot-js/ui/pull/855))
+
+
+## 3.16.5 Dec 10, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#855](https://github.com/polkadot-js/ui/pull/855))
+
+
+## 3.16.4 Nov 25, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#853](https://github.com/polkadot-js/ui/pull/853))
+
+
+## 3.16.3 Nov 12, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#850](https://github.com/polkadot-js/ui/pull/850))
+
+
+## 3.16.2 Oct 22, 2025
+
+Changes:
+
+- Upgraded polkadot-js dependencies ([#848](https://github.com/polkadot-js/ui/pull/848))
+
+
+## 3.16.1 Aug 27, 2025
+
+Changes:
+
+- 3.15.5 ([#846](https://github.com/polkadot-js/ui/pull/846))
+- Upgraded polkadot deps ([#845](https://github.com/polkadot-js/ui/pull/845))
+
+
+## 3.15.4 Aug 13, 2025
+
+Changes:
+
+- Upgraded polkadot deps ([#843](https://github.com/polkadot-js/ui/pull/843))
+
+
+## 3.15.3 July 30, 2025
+
+Changes:
+
+- Update Beachball.tsx to remove duplication in strict mode ([#840](https://github.com/polkadot-js/ui/pull/840))
+- Bump polkadot deps ([#841](https://github.com/polkadot-js/ui/pull/841))
+
+
+## 3.15.2 July 2, 2025
+
+Changes:
+
+- Upgraded polkadot deps ([#838](https://github.com/polkadot-js/ui/pull/838))
+
+
+## 3.15.1 Jun 18, 2025
+
+Changes:
+
+- Upgraded polkadot deps ([#831](https://github.com/polkadot-js/ui/pull/831))
+
+
+## 3.14.1 May 23, 2025
+
+Changes:
+
+- Add the type field to external keypair accounts ([#833](https://github.com/polkadot-js/ui/pull/833))
+- Upgrade polkadot-js/common to 13.5.1 ([#834](https://github.com/polkadot-js/ui/pull/834))
+
+
+## 3.13.1 Apr 16, 2025
+
+Changes:
+
+- Add key validation for FileStore ([#830](https://github.com/polkadot-js/ui/pull/830))
+- Upgraded polkadot deps ([#831](https://github.com/polkadot-js/ui/pull/831))
+
+
+## 3.12.2 Feb 18, 2025
+
+Changes:
+
+- Bump dev to v0.83.2 ([#827](https://github.com/polkadot-js/ui/pull/827))
+- Bump common to v13.4.3 ([#828](https://github.com/polkadot-js/ui/pull/828))
+
+
+## 3.12.1 Jan 8, 2025
+
+Changes:
+
+- Upgrade common to 13.3.1 ([#824](https://github.com/polkadot-js/ui/pull/824))
+- Bump dev w/ ts ([#823](https://github.com/polkadot-js/ui/pull/823))
+- Update headers to 2025 ([#822](https://github.com/polkadot-js/ui/pull/822))
+
+
+## 3.11.3 Nov 12, 2024
+
+Changes:
+
+- Upgrade polkadot/common to 13.2.3 ([817](https://github.com/polkadot-js/ui/pull/#))
+- Bump dev to 0.82.1 w/ tslib ([#816](https://github.com/polkadot-js/ui/pull/816))
+
+
+## 3.11.2 Oct 30, 2024
+
+Changes:
+
+- Upgrade polkadot/common to 13.2.2 ([#814](https://github.com/polkadot-js/ui/pull/814))
+
+
+## 3.11.1 Oct 23, 2024
+
+Changes:
+
+- Upgrade polkadot/common to 13.2.1 ([#811](https://github.com/polkadot-js/ui/pull/811))
+- Bump yarn to 4.5.1 ([#812](https://github.com/polkadot-js/ui/pull/812))
+- Bump dev 0.81.2 ([#810](https://github.com/polkadot-js/ui/pull/810))
+  - Correctly exports CJS and ESM
+
+
+## 3.10.1 Sep 20, 2024
+
+Changes:
+
+- Upgrade polkadot/common to 13.1.1 ([#808](https://github.com/polkadot-js/ui/pull/808))
+- Bump yarn to 4.4.0 ([#806](https://github.com/polkadot-js/ui/pull/806))
+
+
+## 3.9.1 Aug 13, 2024
+
+Changes:
+
+- Upgrade @polkadot/dev to 0.79.3 ([#803](https://github.com/polkadot-js/ui/pull/803))
+- Add chainSpecific option for ledger ([#804](https://github.com/polkadot-js/ui/pull/804))
+
+
+## 3.8.3 July 31, 2024
+
+Changes:
+
+- Fix Qr Scanner (Thanks to https://github.com/ryanleecode)
+
+
+## 3.8.2 July 22, 2024
+
+Changes:
+
+- Fix ledgerApp bug, and remove legacy
+
+
+## 3.8.1 July 22, 2024
+
+Changes:
+
+- Add new ledger app settings
+
+
+## 3.7.1 July 13, 2024
+
+Changes:
+
+- Upgrade polkadot/common 13.0.2
+- Bump yarn to 4.3.1
+
+
+## 3.6.6 Apr 17, 2024
+
+Contributed:
+
+- Add compatibility layer for H160 addresses (Thanks to https://github.com/vikiival)
+
+Changes:
+
+- Update ci checkout and setup_node to v4
+- Bump yarn to 4.1.1
+
+
 ## 3.6.5 Feb 28, 2024
 
 Changes

CONTRIBUTORS

@@ -1,14 +1,17 @@
      735	Jaco                          	Adjust Vue peerDependency, >= 2.7 for defineComponent (#782)
+      41	Tarik Gul                     	3.16.7 (#861)
+      22	Arjun Porwal                  	3.16.6 (#857)
        7	YJ                            	fix #224: decrease frame size to 1024, set multipart bool (#225)
        4	Antoine Estienne              	Refactor logic to better use prefix (#491)
        4	kwingram25                    	fix ff api url issue (#289)
        4	Thibaut Sardan                	store hardware wallets (#431)
        3	Luke Sugiura                  	remove language options (#244)
        3	Stefanie Doll                 	Replace isUndefined util with explicit typeof check (#107)
-       3	Tarik Gul                     	3.6.5 (#785)
        2	Drew Stone                    	Add Edgeware testnet and mainnet updated endpoints (#274)
        2	Hanwen Cheng                  	allow qr to scan seed qr (#330)
        2	Nikos Kontakis                	Fix undefined process error that may appear when using ui (#524)
+       2	Valentin Fernandez            	3.12.2
+       2	Viki Val                      	Add compatibility layer for H160 addresses (#789)
        2	Vlad Proshchavaiev            	Add Subsocial to ss58 defaults (#358)
        2	Xiliang Chen                  	Update UNfrastructure node label (#160)
        2	雪霁                            	Batch export patch up (#455)
@@ -28,9 +31,10 @@
        1	Luke Schoen                   	Fix typo in heading (#114)
        1	Nantian                       	fix bigint type (#510)
        1	Nikhil Ranjan                 	Updated to valid javascript (#271)
+       1	Niklas P                      	Update Beachball.tsx to remove duplication in strict mode (#840)
        1	omahs                         	Fix: typos (#709)
+       1	Ryan Lee                      	fix: qr-code (#801)
        1	Shawn Tabrizi                 	Add a new `notification` setting (#498)
-       1	Viki Val                      	:bug: identicon has isAlternative both as data and prop (#668)
        1	Wei Tang                      	Add Kulupu to the network selection list (#254)
        1	WoeOm                         	add darwinia ss58 (#379)
        1	yuhui1208                     	[Stores] make FileStroe read key safely  (#338)

eslint.config.js

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import baseConfig from '@polkadot/dev/config/eslint';

package.json

@@ -6,7 +6,7 @@
   },
   "homepage": "https://github.com/polkadot-js/ui#readme",
   "license": "Apache-2.0",
-  "packageManager": "yarn@4.1.0",
+  "packageManager": "yarn@4.5.1",
   "private": true,
   "repository": {
     "type": "git",
@@ -14,10 +14,10 @@
   },
   "sideEffects": false,
   "type": "module",
-  "version": "3.6.5",
+  "version": "3.16.7",
   "versions": {
-    "git": "3.6.5",
-    "npm": "3.6.5"
+    "git": "3.16.7",
+    "npm": "3.16.7"
   },
   "workspaces": [
     "packages/*"
@@ -33,15 +33,18 @@
     "test:one": "polkadot-dev-run-test --env browser"
   },
   "devDependencies": {
-    "@polkadot/dev": "^0.78.3",
-    "@polkadot/x-bundle": "^12.6.2",
-    "@types/node": "^20.10.5",
+    "@polkadot/dev": "^0.83.3",
+    "@polkadot/x-bundle": "^14.0.3",
+    "@types/node": "^22.10.5",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "react-is": "^18.2.0",
     "react-native": "^0.73.1"
   },
   "resolutions": {
-    "typescript": "^5.3.3"
+    "@polkadot/keyring": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Fkeyring/-/14.0.3-quantus.3/keyring-14.0.3-quantus.3.tgz",
+    "@polkadot/networks": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Fnetworks/-/14.0.3-quantus.3/networks-14.0.3-quantus.3.tgz",
+    "@polkadot/util-crypto": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Futil-crypto/-/14.0.3-quantus.3/util-crypto-14.0.3-quantus.3.tgz",
+    "typescript": "5.5.4"
   }
 }

packages/react-identicon/package.json

@@ -18,19 +18,19 @@
     "./packageDetect.cjs"
   ],
   "type": "module",
-  "version": "3.6.5",
+  "version": "3.16.7",
   "main": "index.js",
   "dependencies": {
-    "@polkadot/keyring": "^12.6.2",
-    "@polkadot/ui-settings": "3.6.5",
-    "@polkadot/ui-shared": "3.6.5",
-    "@polkadot/util": "^12.6.2",
-    "@polkadot/util-crypto": "^12.6.2",
+    "@polkadot/keyring": "^14.0.3",
+    "@polkadot/ui-settings": "3.16.7",
+    "@polkadot/ui-shared": "3.16.7",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "^14.0.3",
     "ethereum-blockies-base64": "^1.0.2",
     "jdenticon": "3.2.0",
     "react-copy-to-clipboard": "^5.1.0",
     "styled-components": "^6.1.1",
-    "tslib": "^2.6.2"
+    "tslib": "^2.8.1"
   },
   "devDependencies": {
     "@types/react-copy-to-clipboard": "^5.0.7",

packages/react-identicon/src/Identicon.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Prefix } from '@polkadot/util-crypto/address/types';

packages/react-identicon/src/bundle.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export * from './icons/index.js';

packages/react-identicon/src/icons/Beachball.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Props } from '../types.js';
@@ -10,9 +10,12 @@ import { beachballIcon } from '@polkadot/ui-shared';
 function Identicon ({ address, className = '', size, style = {} }: Props): React.ReactElement<Props> {
   const updateElem = useCallback(
     (node: HTMLDivElement): void => {
-      node?.appendChild(
-        beachballIcon(address, { isAlternative: false, size })
-      );
+      if (node) {
+        node.innerHTML = '';
+        node.appendChild(
+          beachballIcon(address, { isAlternative: false, size })
+        );
+      }
     },
     [address, size]
   );

packages/react-identicon/src/icons/Empty.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Props } from '../types.js';

packages/react-identicon/src/icons/Ethereum.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Props } from '../types.js';

packages/react-identicon/src/icons/Jdenticon.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Props } from '../types.js';

packages/react-identicon/src/icons/Polkadot.tsx

@@ -1,4 +1,4 @@
-// Copyright 2018-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2018 Paritytech via paritytech/oo7/polkadot-identicon

packages/react-identicon/src/icons/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export { Beachball } from './Beachball.js';

packages/react-identicon/src/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import './packageDetect.js';

packages/react-identicon/src/packageDetect.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev

packages/react-identicon/src/packageInfo.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev
 
-export const packageInfo = { name: '@polkadot/react-identicon', path: 'auto', type: 'auto', version: '3.6.5' };
+export const packageInfo = { name: '@polkadot/react-identicon', path: 'auto', type: 'auto', version: '3.16.7' };

packages/react-identicon/src/styled.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export { styled } from 'styled-components';

packages/react-identicon/src/types.ts

@@ -1,4 +1,4 @@
-// Copyright 2018-2024 @polkadot/react-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type React from 'react';

packages/react-qr/package.json

@@ -18,19 +18,17 @@
     "./packageDetect.cjs"
   ],
   "type": "module",
-  "version": "3.6.5",
+  "version": "3.16.7",
   "main": "index.js",
   "dependencies": {
-    "@polkadot/ui-settings": "3.6.5",
-    "@polkadot/util": "^12.6.2",
-    "@polkadot/util-crypto": "^12.6.2",
+    "@polkadot/ui-settings": "3.16.7",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "^14.0.3",
+    "@zxing/browser": "^0.1.5",
+    "@zxing/library": "^0.21.2",
     "qrcode-generator": "^1.4.4",
-    "react-qr-reader": "^2.2.1",
     "styled-components": "^6.1.1",
-    "tslib": "^2.6.2"
-  },
-  "devDependencies": {
-    "@types/react-qr-reader": "^2.1.7"
+    "tslib": "^2.8.1"
   },
   "peerDependencies": {
     "@polkadot/util": "*",

packages/react-qr/src/Display.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import React, { useEffect, useMemo, useRef, useState } from 'react';

packages/react-qr/src/DisplayAddress.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import React, { useMemo } from 'react';

packages/react-qr/src/DisplayPayload.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import React, { useMemo } from 'react';

packages/react-qr/src/NetworkSpecs.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { NetworkSpecsStruct } from '@polkadot/ui-settings/types';

packages/react-qr/src/Scan.tsx

@@ -1,8 +1,8 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import React, { useCallback, useMemo } from 'react';
-import Reader from 'react-qr-reader';
+import { BrowserQRCodeReader, type IScannerControls } from '@zxing/browser';
+import React, { useCallback, useEffect, useMemo, useRef } from 'react';
 
 import { styled } from './styled.js';
 import { createImgSize } from './util.js';
@@ -23,6 +23,9 @@ const DEFAULT_ERROR = (error: Error): void => {
 };
 
 function Scan ({ className = '', delay = DEFAULT_DELAY, onError = DEFAULT_ERROR, onScan, size, style = {} }: Props): React.ReactElement<Props> {
+  const videoRef = useRef<HTMLVideoElement>(null);
+  const controlsRef = useRef<IScannerControls | null>(null);
+
   const containerStyle = useMemo(
     () => createImgSize(size),
     [size]
@@ -33,21 +36,52 @@ function Scan ({ className = '', delay = DEFAULT_DELAY, onError = DEFAULT_ERROR,
     [onError]
   );
 
-  const _onScan = useCallback(
-    (data: string | null) => data && onScan(data),
-    [onScan]
-  );
+  useEffect(() => {
+    const codeReader = new BrowserQRCodeReader();
+
+    const startScanning = async () => {
+      try {
+        const videoInputDevices = await BrowserQRCodeReader.listVideoInputDevices();
+        const selectedDeviceId = videoInputDevices[0].deviceId;
+
+        controlsRef.current = await codeReader.decodeFromVideoDevice(
+          selectedDeviceId,
+          videoRef.current ?? undefined,
+          (result, error) => {
+            if (result) {
+              onScan(result.getText());
+            }
+
+            if (error && !(error instanceof Error)) {
+              _onError(new Error(error));
+            }
+          }
+        );
+      } catch (error) {
+        _onError(error instanceof Error ? error : new Error('Unknown error occurred'));
+      }
+    };
+
+    // eslint-disable-next-line @typescript-eslint/no-misused-promises
+    const timeoutId = setTimeout(startScanning, delay);
+
+    return () => {
+      clearTimeout(timeoutId);
+
+      if (controlsRef.current) {
+        controlsRef.current.stop();
+      }
+    };
+  }, [onScan, _onError, delay]);
 
   return (
     <StyledDiv
       className={className}
       style={containerStyle}
     >
-      <Reader
+      <video
         className='ui--qr-Scan'
-        delay={delay}
-        onError={_onError}
-        onScan={_onScan}
+        ref={videoRef}
         style={style}
       />
     </StyledDiv>
@@ -60,10 +94,6 @@ const StyledDiv = styled.div`
     height: 100%;
     transform: matrix(-1, 0, 0, 1, 0, 0);
     width: 100%;
-
-    video {
-      margin: 0;
-    }
   }
 `;
 

packages/react-qr/src/ScanAddress.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { HexString } from '@polkadot/util/types';

packages/react-qr/src/ScanSignature.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { HexString } from '@polkadot/util/types';

packages/react-qr/src/bundle.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export { QrDisplayAddress } from './DisplayAddress.js';

packages/react-qr/src/constants.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export const ADDRESS_PREFIX = 'substrate';

packages/react-qr/src/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import './packageDetect.js';

packages/react-qr/src/packageDetect.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev

packages/react-qr/src/packageInfo.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev
 
-export const packageInfo = { name: '@polkadot/react-qr', path: 'auto', type: 'auto', version: '3.6.5' };
+export const packageInfo = { name: '@polkadot/react-qr', path: 'auto', type: 'auto', version: '3.16.7' };

packages/react-qr/src/qrcode.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import _qrcode from 'qrcode-generator';

packages/react-qr/src/styled.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export { styled } from 'styled-components';

packages/react-qr/src/util.spec.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 /// <reference types="@polkadot/dev-test/globals.d.ts" />

packages/react-qr/src/util.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { isString, u8aConcat, u8aToU8a } from '@polkadot/util';

packages/reactnative-identicon/package.json

@@ -18,14 +18,14 @@
     "./packageDetect.cjs"
   ],
   "type": "module",
-  "version": "3.6.5",
+  "version": "3.16.7",
   "main": "index.js",
   "dependencies": {
-    "@polkadot/ui-shared": "3.6.5",
-    "@polkadot/util": "^12.6.2",
-    "@polkadot/util-crypto": "^12.6.2",
+    "@polkadot/ui-shared": "3.16.7",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "^14.0.3",
     "react-native-svg": "^14.1.0",
-    "tslib": "^2.6.2"
+    "tslib": "^2.8.1"
   },
   "devDependencies": {
     "@types/react-native": "^0.72.8"

packages/reactnative-identicon/src/Identicon.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Prefix } from '@polkadot/util-crypto/address/types';

packages/reactnative-identicon/src/bundle.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export * from './icons/index.js';

packages/reactnative-identicon/src/icons/Empty.tsx

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Props } from '../types.js';

packages/reactnative-identicon/src/icons/Polkadot.tsx

@@ -1,4 +1,4 @@
-// Copyright 2018-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Circle as CircleType } from '@polkadot/ui-shared/icons/types';

packages/reactnative-identicon/src/icons/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export { default as Empty } from './Empty.js';

packages/reactnative-identicon/src/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import './packageDetect.js';

packages/reactnative-identicon/src/packageDetect.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev

packages/reactnative-identicon/src/packageInfo.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev
 
-export const packageInfo = { name: '@polkadot/reactnative-identicon', path: 'auto', type: 'auto', version: '3.6.5' };
+export const packageInfo = { name: '@polkadot/reactnative-identicon', path: 'auto', type: 'auto', version: '3.16.7' };

packages/reactnative-identicon/src/types.ts

@@ -1,4 +1,4 @@
-// Copyright 2018-2024 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export interface Props {

packages/ui-keyring/package.json

@@ -17,19 +17,20 @@
     "./packageDetect.cjs"
   ],
   "type": "module",
-  "version": "3.6.5",
+  "version": "3.16.7-quantus.3",
   "main": "index.js",
   "dependencies": {
-    "@polkadot/keyring": "^12.6.2",
-    "@polkadot/ui-settings": "3.6.5",
-    "@polkadot/util": "^12.6.2",
-    "@polkadot/util-crypto": "^12.6.2",
+    "@polkadot/keyring": "14.0.3-quantus.3",
+    "@polkadot/ui-settings": "3.16.7",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "14.0.3-quantus.3",
     "mkdirp": "^3.0.1",
     "rxjs": "^7.8.1",
     "store": "^2.0.12",
-    "tslib": "^2.6.2"
+    "tslib": "^2.8.1"
   },
   "devDependencies": {
+    "@quantus/crypto": "^0.3.0",
     "@types/mkdirp": "^2.0.0",
     "@types/store": "^2.0.5"
   },

packages/ui-keyring/src/Base.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeyringInstance, KeyringPair } from '@polkadot/keyring/types';
@@ -125,8 +125,9 @@ export class Base {
       this.setDevMode(options.isDevelopment);
     }
 
-    // set Ethereum state
-    this.#isEthereum = keyring.type === 'ethereum';
+    // Never Ethereum: the keyring holds only ML-DSA keys (quantus/common#6). Kept
+    // as a property so callers written against upstream still read a boolean.
+    this.#isEthereum = false;
 
     this.#keyring = keyring;
     this._genesisHash = options.genesisHash && (

packages/ui-keyring/src/Keyring.dilithium.spec.ts

@@ -0,0 +1,94 @@
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import type { KeyringPair$Json } from '@polkadot/keyring/types';
+
+import { contextForSpec } from '@quantus/crypto';
+
+import { Keyring as BaseKeyring } from '@polkadot/keyring';
+import { dilithiumVerify } from '@polkadot/util-crypto';
+
+import { Keyring } from './Keyring.js';
+
+// crystal_alice, from the chain's dev genesis — a raw 32-byte seed straight into
+// ML-DSA-87 keygen. The address is what `quantus developer create-test-wallets`
+// prints, i.e. an independent implementation.
+const ALICE = 'qzk1Nxai3dZD9Cn5kwGcgL6mKxsfxwqdis7kDQJ52aJS2vSn7';
+const PASSWORD = 'not a good password';
+const MESSAGE = new Uint8Array([0x75, 0x69]);
+
+function backup (): KeyringPair$Json {
+  const base = new BaseKeyring({ ss58Format: 189, type: 'dilithium87' });
+
+  return base
+    .addFromSeed(new Uint8Array(32), { name: 'crystal_alice' }, 'dilithium87')
+    .toJson(PASSWORD);
+}
+
+// `loadAll` initialises `@polkadot/ui-settings`, which is a module singleton, so
+// it may be called once per *process* — not per instance. One keyring for the
+// whole file, loaded once.
+const uiKeyring = new Keyring();
+
+uiKeyring.loadAll({ ss58Format: 189, store: undefined, type: 'dilithium87' });
+
+describe('ui-keyring restoreAccount', (): void => {
+  // Before the fix this constructed a pair whose "public key" was
+  // decodeAddress(json.address) — i.e. a Poseidon2 hash of the public key, passed
+  // off as the key itself. It did not throw; it produced a pair that was simply
+  // wrong.
+  it('restores an ML-DSA account to the right address', (): void => {
+    const pair = uiKeyring.restoreAccount(backup(), PASSWORD);
+
+    expect(pair.address).toEqual(ALICE);
+    expect(pair.publicKey.length).toEqual(2592);
+    expect(pair.addressRaw.length).toEqual(32);
+  });
+
+  it('restores an account that can sign for its own address', (): void => {
+    const pair = uiKeyring.restoreAccount(backup(), PASSWORD);
+
+    pair.decodePkcs8(PASSWORD);
+
+    const context = contextForSpec(148);
+    const signature = pair.sign(MESSAGE, { context });
+
+    expect(dilithiumVerify(MESSAGE, signature, pair.addressRaw, 'dilithium87', context)).toEqual(true);
+  });
+
+  it('fails on a wrong password without half-restoring', (): void => {
+    expect(() => uiKeyring.restoreAccount(backup(), 'wrong')).toThrow();
+  });
+
+  // The address field sits outside the encrypted blob. For the curve schemes a
+  // tampered one cannot decode at all; here it decodes cleanly and would yield an
+  // account displaying an address its key does not control.
+  it('rejects JSON whose address does not match its key', (): void => {
+    const base = new BaseKeyring({ ss58Format: 189, type: 'dilithium87' });
+    const other = base.addFromSeed(new Uint8Array(32).fill(3), {}, 'dilithium87');
+
+    expect(() => uiKeyring.restoreAccount({ ...backup(), address: other.address }, PASSWORD)).toThrow(/does not match the address/);
+  });
+
+  // quantus/common#6: a backup of a quantum-unsafe key is refused with the
+  // reason, not decoded. This is the JSON a polkadot{.js} export of an ed25519
+  // account carries.
+  it('refuses a polkadot{.js} backup of a quantum-unsafe key, saying why', (): void => {
+    const json = {
+      address: '5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY',
+      encoded: '0x00',
+      encoding: { content: ['pkcs8', 'sr25519'], type: ['scrypt', 'xsalsa20-poly1305'], version: '3' },
+      meta: { name: 'polkadot account' }
+    } as unknown as KeyringPair$Json;
+
+    expect(() => uiKeyring.restoreAccount(json, PASSWORD)).toThrow(/sr25519 keys are not quantum-safe and cannot be held here/);
+  });
+
+  it('refuses a file that does not record its key type', (): void => {
+    const json = { ...backup(), encoding: { content: 'pkcs8', type: 'none', version: '0' } } as unknown as KeyringPair$Json;
+
+    expect(() => uiKeyring.restoreAccount(json, PASSWORD)).toThrow(/does not record its key type/);
+  });
+});

packages/ui-keyring/src/Keyring.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta } from '@polkadot/keyring/types';
@@ -8,10 +8,9 @@ import type { KeypairType } from '@polkadot/util-crypto/types';
 import type { AddressSubject, SingleAddress } from './observable/types.js';
 import type { CreateResult, KeyringAddress, KeyringAddressType, KeyringItemType, KeyringJson, KeyringJson$Meta, KeyringOptions, KeyringPairs$Json, KeyringStruct } from './types.js';
 
-import { createPair } from '@polkadot/keyring';
 import { chains } from '@polkadot/ui-settings';
 import { bnToBn, hexToU8a, isFunction, isHex, isString, objectSpread, stringify, stringToU8a, u8aSorted, u8aToString } from '@polkadot/util';
-import { base64Decode, createKeyMulti, jsonDecrypt, jsonEncrypt } from '@polkadot/util-crypto';
+import { createKeyMulti, jsonDecrypt, jsonEncrypt } from '@polkadot/util-crypto';
 
 import { env } from './observable/env.js';
 import { KeyringOption } from './options/index.js';
@@ -21,7 +20,7 @@ import { accountKey, accountRegex, addressKey, addressRegex, contractKey, contra
 const RECENT_EXPIRY = 24 * 60 * 60;
 
 // No accounts (or test accounts) should be loaded until after the chain determination.
-// Chain determination occurs outside of Keyring. Loading `keyring.loadAll({ type: 'ed25519' | 'sr25519' })` is triggered
+// Chain determination occurs outside of Keyring. Loading `keyring.loadAll({ type: 'dilithium65' | 'dilithium87' })` is triggered
 // from the API after the chain is received
 export class Keyring extends Base implements KeyringStruct {
   public readonly keyringOption = new KeyringOption();
@@ -33,7 +32,7 @@ export class Keyring extends Base implements KeyringStruct {
   };
 
   public addExternal (address: string | Uint8Array, meta: KeyringPair$Meta = {}): CreateResult {
-    const pair = this.keyring.addFromAddress(address, objectSpread<KeyringJson$Meta>({}, meta, { isExternal: true }), null);
+    const pair = this.keyring.addFromAddress(address, objectSpread<KeyringJson$Meta>({}, meta, { isExternal: true }), null, meta?.type);
 
     return {
       json: this.saveAccount(pair),
@@ -327,15 +326,18 @@ export class Keyring extends Base implements KeyringStruct {
   }
 
   public restoreAccount (json: KeyringPair$Json, password: string): KeyringPair {
-    const cryptoType = Array.isArray(json.encoding.content) ? json.encoding.content[1] : 'ed25519';
-    const encType = Array.isArray(json.encoding.type) ? json.encoding.type : [json.encoding.type];
-    const pair = createPair(
-      { toSS58: this.encodeAddress, type: cryptoType as KeypairType },
-      { publicKey: this.decodeAddress(json.address, true) },
-      json.meta,
-      isHex(json.encoded) ? hexToU8a(json.encoded) : base64Decode(json.encoded),
-      encType
-    );
+    // Version-0 JSON predates recording the key type, so it cannot be an ML-DSA
+    // account. Upstream guessed ed25519; this keyring cannot hold one.
+    if (!Array.isArray(json.encoding.content)) {
+      throw new Error('This account file does not record its key type, so it is not an ML-DSA account and cannot be restored here');
+    }
+
+    // Through the keyring rather than createPair directly, so a restore gets the
+    // same refusal as every other entry point: a polkadot{.js} backup of an
+    // sr25519 or ed25519 account is told it is not quantum-safe, not decoded.
+    // createFromJson also carries the address as an account id until the real
+    // public key is decrypted, and checks the two agree when it is.
+    const pair = this.keyring.createFromJson(json, true);
 
     // unlock, save account and then lock (locking cleans secretKey, so needs to be last)
     pair.decodePkcs8(password);

packages/ui-keyring/src/bundle.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { Keyring } from './Keyring.js';

packages/ui-keyring/src/defaults.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { decodeAddress } from '@polkadot/keyring';

packages/ui-keyring/src/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import './packageDetect.js';

packages/ui-keyring/src/json.d.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Be able to import json in TS

packages/ui-keyring/src/observable/accounts.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { accountKey } from '../defaults.js';

packages/ui-keyring/src/observable/addresses.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { addressKey } from '../defaults.js';

packages/ui-keyring/src/observable/contracts.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { contractKey } from '../defaults.js';

packages/ui-keyring/src/observable/env.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { BehaviorSubject } from 'rxjs';

packages/ui-keyring/src/observable/genericSubject.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeypairType } from '@polkadot/util-crypto/types';

packages/ui-keyring/src/observable/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { SubjectInfo } from './types.js';

packages/ui-keyring/src/observable/types.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { BehaviorSubject } from 'rxjs';

packages/ui-keyring/src/options/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Subscription } from 'rxjs';

packages/ui-keyring/src/options/item.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeyringSectionOption } from './types.js';

packages/ui-keyring/src/options/types.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeyringItemType, KeyringStruct } from '../types.js';

packages/ui-keyring/src/packageDetect.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev

packages/ui-keyring/src/packageInfo.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev
 
-export const packageInfo = { name: '@polkadot/ui-keyring', path: 'auto', type: 'auto', version: '3.6.5' };
+export const packageInfo = { name: '@polkadot/ui-keyring', path: 'auto', type: 'auto', version: '3.16.7-quantus.3' };

packages/ui-keyring/src/stores/Browser.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeyringJson, KeyringStore } from '../types.js';

packages/ui-keyring/src/stores/File.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeyringJson, KeyringStore } from '../types.js';
@@ -19,6 +19,28 @@ export class FileStore implements KeyringStore {
     this.#path = path;
   }
 
+  private validateKey (key: string): boolean {
+    // Make sure the key has a .json extension
+    if (!key.endsWith('.json')) {
+      console.error('Non-JSON file requested: ', key);
+
+      return false;
+    }
+
+    // Remove '.json'
+    const keyWithoutExtension = key.slice(0, -5);
+    // Only allow alphanumeric characters, hyphens, and underscores in the base filename
+    const safeKeyRegex = /^[a-zA-Z0-9_-]+$/;
+
+    if (!safeKeyRegex.test(keyWithoutExtension)) {
+      console.error('Invalid key format detected: ', key);
+
+      return false;
+    }
+
+    return true;
+  }
+
   public all (fn: (key: string, value: KeyringJson) => void): void {
     fs
       .readdirSync(this.#path)
@@ -51,6 +73,10 @@ export class FileStore implements KeyringStore {
   }
 
   private _getPath (key: string): string {
+    if (!this.validateKey(key)) {
+      throw new Error('Invalid key format');
+    }
+
     return path.join(this.#path, key);
   }
 

packages/ui-keyring/src/stores/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export { BrowserStore } from './Browser.js';

packages/ui-keyring/src/types.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeyringInstance as BaseKeyringInstance, KeyringOptions as KeyringOptionsBase, KeyringPair, KeyringPair$Json, KeyringPair$Meta } from '@polkadot/keyring/types';

packages/ui-settings/package.json

@@ -18,14 +18,14 @@
     "./packageDetect.cjs"
   ],
   "type": "module",
-  "version": "3.6.5",
+  "version": "3.16.7",
   "main": "index.js",
   "dependencies": {
-    "@polkadot/networks": "^12.6.2",
-    "@polkadot/util": "^12.6.2",
+    "@polkadot/networks": "^14.0.3",
+    "@polkadot/util": "^14.0.3",
     "eventemitter3": "^5.0.1",
     "store": "^2.0.12",
-    "tslib": "^2.6.2"
+    "tslib": "^2.8.1"
   },
   "devDependencies": {
     "@types/store": "^2.0.5"

packages/ui-settings/src/Settings.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Endpoint, EndpointType, Option, SettingsStruct } from './types.js';
@@ -8,7 +8,7 @@ import store from 'store';
 
 import { hasProcess, isUndefined } from '@polkadot/util';
 
-import { CAMERA, CAMERA_DEFAULT, CRYPTOS, CRYPTOS_ETH, CRYPTOS_LEDGER, ENDPOINT_DEFAULT, ENDPOINTS, ICON_DEFAULT, ICONS, LANGUAGE_DEFAULT, LEDGER_CONN, LEDGER_CONN_DEFAULT, LOCKING, LOCKING_DEFAULT, METADATA_UP, METADATA_UP_DEFAULT, NOTIFICATION_DEFAULT, PREFIX_DEFAULT, PREFIXES, STORAGE, STORAGE_DEFAULT, UIMODE_DEFAULT, UIMODES, UITHEME_DEFAULT, UITHEMES } from './defaults/index.js';
+import { CAMERA, CAMERA_DEFAULT, CRYPTOS, CRYPTOS_ETH, CRYPTOS_LEDGER, ENDPOINT_DEFAULT, ENDPOINTS, ICON_DEFAULT, ICONS, LANGUAGE_DEFAULT, LEDGER_APP, LEDGER_APP_DEFAULT, LEDGER_CONN, LEDGER_CONN_DEFAULT, LOCKING, LOCKING_DEFAULT, METADATA_UP, METADATA_UP_DEFAULT, NOTIFICATION_DEFAULT, PREFIX_DEFAULT, PREFIXES, STORAGE, STORAGE_DEFAULT, UIMODE_DEFAULT, UIMODES, UITHEME_DEFAULT, UITHEMES } from './defaults/index.js';
 
 type ChangeCallback = (settings: SettingsStruct) => void;
 type OnTypes = 'change';
@@ -35,6 +35,8 @@ export class Settings implements SettingsStruct {
 
   #icon: string;
 
+  #ledgerApp: string;
+
   #ledgerConn: string;
 
   #locking: string;
@@ -60,6 +62,7 @@ export class Settings implements SettingsStruct {
     this.#apiUrl = (typeof settings.apiUrl === 'string' && settings.apiUrl) || (hasProcess && process.env?.['WS_URL']) || (ENDPOINT_DEFAULT.value as string);
     this.#apiType = { param: this.#apiUrl, type: 'json-rpc' as EndpointType };
     this.#camera = withDefault(CAMERA, settings.camera, CAMERA_DEFAULT);
+    this.#ledgerApp = withDefault(LEDGER_APP, settings.ledgerApp, LEDGER_APP_DEFAULT);
     this.#ledgerConn = withDefault(LEDGER_CONN, settings.ledgerConn, LEDGER_CONN_DEFAULT);
     this.#i18nLang = settings.i18nLang || LANGUAGE_DEFAULT;
     this.#icon = settings.icon || ICON_DEFAULT;
@@ -96,6 +99,10 @@ export class Settings implements SettingsStruct {
     return this.#notification;
   }
 
+  public get ledgerApp (): string {
+    return this.#ledgerApp;
+  }
+
   public get ledgerConn (): string {
     return this.#ledgerConn;
   }
@@ -144,6 +151,10 @@ export class Settings implements SettingsStruct {
     return ICONS;
   }
 
+  public get availableLedgerApp (): Option[] {
+    return LEDGER_APP;
+  }
+
   public get availableLedgerConn (): Option[] {
     return LEDGER_CONN;
   }
@@ -183,6 +194,7 @@ export class Settings implements SettingsStruct {
       camera: this.#camera,
       i18nLang: this.#i18nLang,
       icon: this.#icon,
+      ledgerApp: this.#ledgerApp,
       ledgerConn: this.#ledgerConn,
       locking: this.#locking,
       metadataUp: this.#metadataUp,
@@ -199,6 +211,7 @@ export class Settings implements SettingsStruct {
     this.#apiUrl = settings.apiUrl || this.#apiUrl;
     this.#camera = settings.camera || this.#camera;
     this.#ledgerConn = settings.ledgerConn || this.#ledgerConn;
+    this.#ledgerApp = settings.ledgerApp || this.#ledgerApp;
     this.#i18nLang = settings.i18nLang || this.#i18nLang;
     this.#icon = settings.icon || this.#icon;
     this.#locking = settings.locking || this.#locking;

packages/ui-settings/src/bundle.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { Settings, settings } from './Settings.js';

packages/ui-settings/src/defaults/chains.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { selectableNetworks } from '@polkadot/networks';

packages/ui-settings/src/defaults/crypto.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Option } from '../types.js';

packages/ui-settings/src/defaults/endpoints.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Option } from '../types.js';

packages/ui-settings/src/defaults/index.ts

@@ -1,11 +1,11 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Option } from '../types.js';
 
 export { CRYPTOS, CRYPTOS_ETH, CRYPTOS_LEDGER } from './crypto.js';
 export { ENDPOINT_DEFAULT, ENDPOINTS } from './endpoints.js';
-export { LEDGER_CONN, LEDGER_CONN_DEFAULT } from './ledger.js';
+export { LEDGER_APP, LEDGER_APP_DEFAULT, LEDGER_CONN, LEDGER_CONN_DEFAULT } from './ledger.js';
 export { PREFIX_DEFAULT, PREFIXES } from './ss58.js';
 export { ICON_DEFAULT, ICON_DEFAULT_HOST, ICONS, NOTIFICATION_DEFAULT, UIMODE_DEFAULT, UIMODES, UITHEME_DEFAULT, UITHEMES } from './ui.js';
 

packages/ui-settings/src/defaults/ledger.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Option } from '../types.js';
@@ -28,3 +28,23 @@ export const LEDGER_CONN: Option[] = [
     value: 'hid'
   }
 ];
+
+export const LEDGER_APP_DEFAULT = 'generic';
+
+export const LEDGER_APP: Option[] = [
+  {
+    info: 'generic',
+    text: 'Use the Ledger Polkadot Generic App',
+    value: 'generic'
+  },
+  {
+    info: 'migration',
+    text: 'Use the Ledger Migration App',
+    value: 'migration'
+  },
+  {
+    info: 'chainSpecific',
+    text: 'Use the Chain Specific Ledger App',
+    value: 'chainSpecific'
+  }
+];

packages/ui-settings/src/defaults/ss58.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Option } from '../types.js';

packages/ui-settings/src/defaults/type.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // matches https://polkadot.js.org & https://*.polkadot.io

packages/ui-settings/src/defaults/ui.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Option } from '../types.js';

packages/ui-settings/src/index.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { settings } from './bundle.js';

packages/ui-settings/src/packageDetect.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev

packages/ui-settings/src/packageInfo.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev
 
-export const packageInfo = { name: '@polkadot/ui-settings', path: 'auto', type: 'auto', version: '3.6.5' };
+export const packageInfo = { name: '@polkadot/ui-settings', path: 'auto', type: 'auto', version: '3.16.7' };

packages/ui-settings/src/types.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export interface Option {
@@ -14,6 +14,7 @@ export interface SettingsStruct {
   camera: string;
   i18nLang: string;
   icon: string;
+  ledgerApp: string;
   ledgerConn: string;
   locking: string;
   metadataUp: string;

packages/ui-shared/package.json

@@ -18,15 +18,15 @@
     "./packageDetect.cjs"
   ],
   "type": "module",
-  "version": "3.6.5",
+  "version": "3.16.7",
   "main": "index.js",
   "dependencies": {
     "colord": "^2.9.3",
-    "tslib": "^2.6.2"
+    "tslib": "^2.8.1"
   },
   "devDependencies": {
-    "@polkadot/util": "^12.6.2",
-    "@polkadot/util-crypto": "^12.6.2",
+    "@polkadot/util": "^14.0.3",
+    "@polkadot/util-crypto": "^14.0.3",
     "@types/xmlserializer": "^0.6.6",
     "xmlserializer": "^0.6.1"
   },

packages/ui-shared/src/bundle.ts

@@ -1,4 +1,4 @@
-// Copyright 2018-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2018-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export * from './icons/index.js';

packages/ui-shared/src/icons/beachball/LICENSE

@@ -1,7 +1,7 @@
 Apache-2.0 License (Apache-2.0)
 
 Copyright 2016 Dan Finlay
-Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+Copyright 2017-2025 @polkadot/ui-shared authors & contributors
 
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above

packages/ui-shared/src/icons/beachball/colors.spec.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 /// <reference types="@polkadot/dev-test/globals.d.ts" />

packages/ui-shared/src/icons/beachball/colors.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2016 Dan Finlay

packages/ui-shared/src/icons/beachball/container.spec.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 /// <reference types="@polkadot/dev-test/globals.d.ts" />

packages/ui-shared/src/icons/beachball/container.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2016 Dan Finlay

packages/ui-shared/src/icons/beachball/defaults.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2016 Dan Finlay

packages/ui-shared/src/icons/beachball/demo.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2016 Dan Finlay

packages/ui-shared/src/icons/beachball/index.spec.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2024 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 /// <reference types="@polkadot/dev-test/globals.d.ts" />
@@ -17,7 +17,7 @@ describe('identicon', (): void => {
     ).toEqual(
       // with original color ...
       // '<div xmlns="http://www.w3.org/1999/xhtml" class="" style="background: white; border-radius: 128px; display: inline-block; height: 256px; margin: 0px; overflow: hidden; padding: 0px; width: 256px;"><div class="" style="background: rgb(20, 20, 20); border-radius: 128px; display: inline-block; height: 256px; margin: 0px; overflow: hidden; padding: 0px; width: 256px;"><svg xmlns="http://www.w3.org/2000/svg" x="0" y="0" width="256" height="256"><circle cx="128" cy="140.8" r="128" fill="hsl(212.10000000000002, 65.6%, 55.5%)"/><circle cx="128" cy="153.6" r="102.4" fill="hsl(9.800000000000011, 90.7%, 57.6%)"/><circle cx="128" cy="166.4" r="76.8" fill="hsl(345, 85.7%, 86.3%)"/><circle cx="128" cy="179.2" r="51.2" fill="hsl(261.9, 100%, 87.3%)"/><circle cx="128" cy="192" r="25.6" fill="hsl(345, 100%, 25.1%)"/></svg></div></div>'
-      '<div xmlns="http://www.w3.org/1999/xhtml" class="" style="background: white; border-radius: 128px; display: inline-block; height: 256px; margin: 0px; overflow: hidden; padding: 0px; width: 256px;"><div class="" style="background: rgb(26, 26, 26); border-radius: 128px; display: inline-block; height: 256px; margin: 0px; overflow: hidden; padding: 0px; width: 256px;"><svg xmlns="http://www.w3.org/2000/svg" x="0" y="0" width="256" height="256"><circle cx="128" cy="140.8" r="128" fill="hsl(212, 66%, 55%)"/><circle cx="128" cy="153.6" r="102.4" fill="hsl(10, 91%, 58%)"/><circle cx="128" cy="166.4" r="76.8" fill="hsl(345, 86%, 86%)"/><circle cx="128" cy="179.2" r="51.2" fill="hsl(262, 100%, 87%)"/><circle cx="128" cy="192" r="25.6" fill="hsl(345, 100%, 25%)"/></svg></div></div>'
+      '<div xmlns="http://www.w3.org/1999/xhtml" class="" style="background: white; border-radius: 128px; display: inline-block; height: 256px; margin: 0px; overflow: hidden; padding: 0px; width: 256px;"><div class="" style="background: rgb(255, 167, 26); border-radius: 128px; display: inline-block; height: 256px; margin: 0px; overflow: hidden; padding: 0px; width: 256px;"><svg xmlns="http://www.w3.org/2000/svg" x="0" y="0" width="256" height="256"><circle cx="128" cy="140.8" r="128" fill="hsl(212, 66%, 55%)"/><circle cx="128" cy="153.6" r="102.4" fill="hsl(10, 91%, 58%)"/><circle cx="128" cy="166.4" r="76.8" fill="hsl(345, 86%, 86%)"/><circle cx="128" cy="179.2" r="51.2" fill="hsl(262, 100%, 87%)"/><circle cx="128" cy="192" r="25.6" fill="hsl(345, 100%, 25%)"/></svg></div></div>'
     );
   });
 
@@ -30,7 +30,7 @@ describe('identicon', (): void => {
     ).toEqual(
       // with original color ...
       // '<div xmlns="http://www.w3.org/1999/xhtml" class="testClass" style="background: white; border-radius: 50px; display: block; height: 100px; margin: 0px; overflow: hidden; padding: 0px; width: 100px;"><div class="" style="background: rgb(20, 20, 20); border-radius: 50px; display: inline-block; height: 100px; margin: 0px; overflow: hidden; padding: 0px; width: 100px;"><svg xmlns="http://www.w3.org/2000/svg" x="0" y="0" width="100" height="100"><circle cx="50" cy="55" r="50" fill="hsl(212.10000000000002, 65.6%, 55.5%)"/><circle cx="50" cy="60" r="40" fill="hsl(9.800000000000011, 90.7%, 57.6%)"/><circle cx="50" cy="65" r="30" fill="hsl(345, 85.7%, 86.3%)"/><circle cx="50" cy="70" r="20" fill="hsl(261.9, 100%, 87.3%)"/><circle cx="50" cy="75" r="10" fill="hsl(345, 100%, 25.1%)"/></svg></div></div>'
-      '<div xmlns="http://www.w3.org/1999/xhtml" class="testClass" style="background: white; border-radius: 50px; display: block; height: 100px; margin: 0px; overflow: hidden; padding: 0px; width: 100px;"><div class="" style="background: rgb(26, 26, 26); border-radius: 50px; display: inline-block; height: 100px; margin: 0px; overflow: hidden; padding: 0px; width: 100px;"><svg xmlns="http://www.w3.org/2000/svg" x="0" y="0" width="100" height="100"><circle cx="50" cy="55" r="50" fill="hsl(212, 66%, 55%)"/><circle cx="50" cy="60" r="40" fill="hsl(10, 91%, 58%)"/><circle cx="50" cy="65" r="30" fill="hsl(345, 86%, 86%)"/><circle cx="50" cy="70" r="20" fill="hsl(262, 100%, 87%)"/><circle cx="50" cy="75" r="10" fill="hsl(345, 100%, 25%)"/></svg></div></div>'
+      '<div xmlns="http://www.w3.org/1999/xhtml" class="testClass" style="background: white; border-radius: 50px; display: block; height: 100px; margin: 0px; overflow: hidden; padding: 0px; width: 100px;"><div class="" style="background: rgb(255, 167, 26); border-radius: 50px; display: inline-block; height: 100px; margin: 0px; overflow: hidden; padding: 0px; width: 100px;"><svg xmlns="http://www.w3.org/2000/svg" x="0" y="0" width="100" height="100"><circle cx="50" cy="55" r="50" fill="hsl(212, 66%, 55%)"/><circle cx="50" cy="60" r="40" fill="hsl(10, 91%, 58%)"/><circle cx="50" cy="65" r="30" fill="hsl(345, 86%, 86%)"/><circle cx="50" cy="70" r="20" fill="hsl(262, 100%, 87%)"/><circle cx="50" cy="75" r="10" fill="hsl(345, 100%, 25%)"/></svg></div></div>'
     );
   });
 });