diff --git a/.changeset/eip55-warnings.md b/.changeset/eip55-warnings.md deleted file mode 100644 index a1815f8..0000000 --- a/.changeset/eip55-warnings.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -'@signinwithethereum/siwe': minor -'@signinwithethereum/siwe-parser': minor ---- - -Accept unchecksummed addresses with a warning; verify signatures regardless of address case - -**Parsing no longer rejects all-lowercase or all-uppercase addresses.** Previously, any address that wasn't properly EIP-55 checksummed produced a parse error. Now only *mixed-case* addresses with an incorrect checksum fail — all-lowercase and all-uppercase addresses parse successfully and surface a non-fatal warning on the new `warnings: string[]` field of `ParsedMessage` and `SiweMessage`. Applications that want strict behavior can check `message.warnings.length === 0` after construction. - -**Verification is case-insensitive for EOA signature recovery.** The recovered address (always EIP-55) is compared to the message address without regard to case, so messages carrying a lowercase or uppercase address verify correctly against a wallet signature. - -**Object-constructed messages are normalized to EIP-55.** `new SiweMessage({ address: '0xabc...' })` stores the checksummed form so the emitted message — and the bytes presented to the signer — are spec-compliant. A warning is still recorded when the input needed normalization. Mixed-case inputs with an incorrect checksum throw. Messages constructed from a raw string preserve the address verbatim so signature re-construction matches what the wallet signed. - -**New exports from `@signinwithethereum/siwe-parser`:** - -- `classifyAddressCase(address)` — returns `'valid-checksum' | 'unchecksummed' | 'invalid-checksum'` -- `toChecksumAddress(address)` — canonical EIP-55 encoder (accepts any-case input) -- `AddressCaseStatus` type - -**Error message reworded** — mixed-case addresses with a bad checksum now report `invalid EIP-55 address checksum` (was `invalid EIP-55 address`). diff --git a/packages/siwe-parser/CHANGELOG.md b/packages/siwe-parser/CHANGELOG.md index 3a482b7..117e9f3 100644 --- a/packages/siwe-parser/CHANGELOG.md +++ b/packages/siwe-parser/CHANGELOG.md @@ -1,5 +1,24 @@ # @signinwithethereum/siwe-parser +## 4.2.0 + +### Minor Changes + +- [`66f5176`](https://github.com/signinwithethereum/siwe/commit/66f51766ad0a2404797fc5031af061c5708c7829) Thanks [@jwahdatehagh](https://github.com/jwahdatehagh)! - Accept unchecksummed addresses with a warning; verify signatures regardless of address case + + **Parsing no longer rejects all-lowercase or all-uppercase addresses.** Previously, any address that wasn't properly EIP-55 checksummed produced a parse error. Now only _mixed-case_ addresses with an incorrect checksum fail — all-lowercase and all-uppercase addresses parse successfully and surface a non-fatal warning on the new `warnings: string[]` field of `ParsedMessage` and `SiweMessage`. Applications that want strict behavior can check `message.warnings.length === 0` after construction. + + **Verification is case-insensitive for EOA signature recovery.** The recovered address (always EIP-55) is compared to the message address without regard to case, so messages carrying a lowercase or uppercase address verify correctly against a wallet signature. + + **Object-constructed messages are normalized to EIP-55.** `new SiweMessage({ address: '0xabc...' })` stores the checksummed form so the emitted message — and the bytes presented to the signer — are spec-compliant. A warning is still recorded when the input needed normalization. Mixed-case inputs with an incorrect checksum throw. Messages constructed from a raw string preserve the address verbatim so signature re-construction matches what the wallet signed. + + **New exports from `@signinwithethereum/siwe-parser`:** + - `classifyAddressCase(address)` — returns `'valid-checksum' | 'unchecksummed' | 'invalid-checksum'` + - `toChecksumAddress(address)` — canonical EIP-55 encoder (accepts any-case input) + - `AddressCaseStatus` type + + **Error message reworded** — mixed-case addresses with a bad checksum now report `invalid EIP-55 address checksum` (was `invalid EIP-55 address`). + ## 4.1.0 ### Minor Changes diff --git a/packages/siwe-parser/package.json b/packages/siwe-parser/package.json index 869acea..30205b7 100644 --- a/packages/siwe-parser/package.json +++ b/packages/siwe-parser/package.json @@ -1,6 +1,6 @@ { "name": "@signinwithethereum/siwe-parser", - "version": "4.1.0", + "version": "4.2.0", "type": "module", "description": "Parse Messages that conform to EIP-4361: Sign in with Ethereum (SIWE)", "main": "dist/parsers.cjs", diff --git a/packages/siwe/CHANGELOG.md b/packages/siwe/CHANGELOG.md index a1b0f06..57a1118 100644 --- a/packages/siwe/CHANGELOG.md +++ b/packages/siwe/CHANGELOG.md @@ -1,5 +1,29 @@ # @signinwithethereum/siwe +## 4.2.0 + +### Minor Changes + +- [`66f5176`](https://github.com/signinwithethereum/siwe/commit/66f51766ad0a2404797fc5031af061c5708c7829) Thanks [@jwahdatehagh](https://github.com/jwahdatehagh)! - Accept unchecksummed addresses with a warning; verify signatures regardless of address case + + **Parsing no longer rejects all-lowercase or all-uppercase addresses.** Previously, any address that wasn't properly EIP-55 checksummed produced a parse error. Now only _mixed-case_ addresses with an incorrect checksum fail — all-lowercase and all-uppercase addresses parse successfully and surface a non-fatal warning on the new `warnings: string[]` field of `ParsedMessage` and `SiweMessage`. Applications that want strict behavior can check `message.warnings.length === 0` after construction. + + **Verification is case-insensitive for EOA signature recovery.** The recovered address (always EIP-55) is compared to the message address without regard to case, so messages carrying a lowercase or uppercase address verify correctly against a wallet signature. + + **Object-constructed messages are normalized to EIP-55.** `new SiweMessage({ address: '0xabc...' })` stores the checksummed form so the emitted message — and the bytes presented to the signer — are spec-compliant. A warning is still recorded when the input needed normalization. Mixed-case inputs with an incorrect checksum throw. Messages constructed from a raw string preserve the address verbatim so signature re-construction matches what the wallet signed. + + **New exports from `@signinwithethereum/siwe-parser`:** + - `classifyAddressCase(address)` — returns `'valid-checksum' | 'unchecksummed' | 'invalid-checksum'` + - `toChecksumAddress(address)` — canonical EIP-55 encoder (accepts any-case input) + - `AddressCaseStatus` type + + **Error message reworded** — mixed-case addresses with a bad checksum now report `invalid EIP-55 address checksum` (was `invalid EIP-55 address`). + +### Patch Changes + +- Updated dependencies [[`66f5176`](https://github.com/signinwithethereum/siwe/commit/66f51766ad0a2404797fc5031af061c5708c7829)]: + - @signinwithethereum/siwe-parser@4.2.0 + ## 4.1.0 ### Minor Changes diff --git a/packages/siwe/package.json b/packages/siwe/package.json index 3c38927..6bd9bdb 100644 --- a/packages/siwe/package.json +++ b/packages/siwe/package.json @@ -1,6 +1,6 @@ { "name": "@signinwithethereum/siwe", - "version": "4.1.0", + "version": "4.2.0", "type": "module", "description": "Sign in with Ethereum (SIWE)", "main": "dist/siwe.cjs",