Skip to content

minhoyoo-iotrust/WAIaaS

v2.15.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ai-agent blockchain crypto defi ethereum llm-tools
+7 more
mcp mcp-server model-context-protocol self-custody solana wallet wallet-as-a-service

Summary

AI summary

Add Ripple (XRPL) ledger support with new adapters, schema extensions, UI elements, migrations, and auto‑provisioning of mainnet wallets.

Full changelog

2.15.0 (2026-04-20)

Features

  • 01-01: extend buildContractCall() with OfferCreate/OfferCancel routing (135ed5e)
  • 01-02: add OfferCreate/OfferCancel CONTRACT_CALL parsing to tx-parser (1d67639)
  • 02-01: add OfferBuilder with currency amount conversion and reserve validation (b75b003)
  • 02-01: add XrplOrderbookClient RPC wrapper for orderbook queries (b334932)
  • 02-01: add Zod input schemas for 5 XRPL DEX actions (bf58b9e)
  • 02-02: extend buildContractCall for TrustSet + register XrplDexProvider (d1b37ac)
  • 02-02: implement XrplDexProvider with 5 actions (0448d7b)
  • 02-03: register xrpl_dex in builtin-metadata and setting keys (2b77125)
  • 03-01: resolveEffectiveAmountUsd XRPL DEX calldata parsing (92f86d8)
  • 03-02: Admin UI transaction type labels + XRPL DEX display (b360587)
  • 459-01: create Tauri spike project with @reown/appkit integration (a924e7a)
  • 460-01: Tauri 2 project scaffolding + SidecarManager implementation (8fb9b4e)
  • 460-02: SEA binary build pipeline + native-loader + dynamic port output (6c4e8ca)
  • 460-03: splash -> daemon start -> WebView navigate integration (85b4173)
  • 461-01: add 4-layer tree-shaking config and CI bundle verification (2aae71b)
  • 461-01: add quit_app IPC command, isDesktop() detection, and TS bridge wrappers (24b43f1)
  • 461-02: add system tray module with 3-color icons, context menu, and 30s health polling (43412e7)
  • 461-02: integrate system tray in main.rs with tray-icon and image-png features (00b1116)
  • 462-01: Setup Wizard orchestrator + App.tsx dynamic import integration (7c19769)
  • 462-01: wizard store + 5 step components for Desktop Setup Wizard (b4b89af)
  • 462-02: WalletConnect QR connector + modal via daemon REST API (Plan B) (7153984)
  • 462-03: wire Owner step to WalletConnect QR modal via dynamic imports (5cb0c99)
  • 463-01: integrate Tauri updater plugin with Ed25519 signing config (17ce11b)
  • 463-02: add 3-platform desktop release CI workflow (bff990d)
  • 463-03: add auto-update UI with UpdateBanner and update-checker (3348fa3)
  • 465-01: add download page with OS detection and GitHub API integration (14c6373)
  • 466-01: add Desktop App distribution channels to SUBMISSION_KIT (48ef4ad)
  • 466-01: add Download link to site navigation and sitemap (d8b8efd)
  • 467-01: add DB v61 migration with signing primary partial unique index (6567dac)
  • 467-02: add exclusive signing toggle to WalletAppService (cab2d96)
  • 467-02: transition PresetAutoSetupService from preferred_wallet to signing_enabled (c9bd1e1)
  • 468-01: transition SignRequestBuilder to wallet_type + signing_enabled=1 query (35d1589)
  • 469-01: wallet_type group layout + signing radio buttons (8156083)
  • 470-01: extend core chain enums, constants, and RPC defaults for ripple (e33e08b)
  • 470-01: register ripple ChainType and XRPL NetworkTypes in shared SSoT (9374c44)
  • 470-02: register XRPL CAIP-2 chain IDs and CAIP-19 asset identifiers (d7329e5)
  • 470-03: add ripple chain stub to AdapterPool with RPC config key mapping (ccd91f4)
  • 470-03: DB v62 migration -- add ripple chain and XRPL networks to CHECK constraints (8963385)
  • 471-01: scaffold @waiaas/adapter-ripple package with RippleAdapter, KeyStore ripple support, and XRPL RPC config (e67f737)
  • 471-02: wire AdapterPool for ripple chain and add unit tests (8d304fc)
  • 472-01: implement getTokenInfo, getAssets Trust Lines, and tx-parser IOU precision (e79678a)
  • 472-01: implement Trust Line currency utils, TrustSet, and IOU transfer (b3b2fc5)
  • 473-01: add ripple support to getNativeTokenInfo and NFT indexer (2a685ed)
  • 473-01: implement XLS-20 NFT adapter and core schema extension (b30e07b)
  • 473-02: add Ripple chain support to Admin UI wallet creation and RPC settings (3fdd7bd)
  • 473-02: extend OpenAPI and SDK chain enums with ripple (916adc4)
  • daemon,admin: add test sign request for wallet apps (#450) (d46e79e)
  • daemon,push-relay: fix #459 session wallet query, fix #460 static_fields wiring (521b7ac)
  • desktop: auto-provision 3 mainnet wallets on first boot (issue 497) (babf10e)
  • desktop: auto-provision 3 mainnet wallets on first boot (issue 497) (1852c62)
  • desktop: auto-provision mainnet wallets (issue 497) (ce1d2e3)
  • integrate Dev.to blog posts into waiaas.ai/blog (f9e74bb)
  • push-relay: add Pushwoosh extra_fields config (issue 499) (105e561)
  • push-relay: add Pushwoosh extra_fields config for notification payload (issue 499) (e3a30d1)
  • push-relay: enhance debug logging for push payloads and sign responses (#458) (745fcee)
  • settings: enable XRPL DEX provider by default (a3c7f86)
  • XRP Ledger mainnet support (v33.6) (79fc0c4)

Bug Fixes

  • adapter-ripple: fix typecheck error in test mock casts (b294075)
  • adapter-ripple: remove unused variable declarations in test file (18f4b25)
  • adapter-ripple: use default import for xrpl CJS module to fix ESM named export failure (#481) (e7fbc18)
  • add missing type field to tauri.conf.json extra-file in release-please config (590d0dc)
  • add subscription staggering and ILogger injection for IncomingTxMonitor (#429, #430) (f129a3c)
  • admin,push-relay: resolve issues 432-436 (1ba3cb8)
  • admin,push-relay: resolve issues 432-436 (0280d2e)
  • ci: add required sections to xrpl-dex UAT scenario (831367c)
  • ci: add workspace build step to desktop release pipeline (#471) (689a974)
  • ci: add xrpl-dex to E2E provider coverage map (08e0b6a)
  • ci: disable Windows desktop build, restore release-please version sync (#472) (a8d5a02)
  • ci: exclude desktop-v tags from RC auto-detection in promote workflow (7167eef)
  • ci: fix release pipeline startup_failure (a43930b)
  • ci: install desktop deps separately and use npx --prefix (#472) (91c6519)
  • ci: mark desktop RC releases as prerelease on GitHub (20eab21)
  • ci: mark desktop RC releases as prerelease on GitHub (#476) (535c70f)
  • ci: merge approval-gate into deploy job to eliminate double approval (#470) (9a8a2f5)
  • ci: read version from package.json instead of GitHub Releases API (#457) (b73449e)
  • ci: register xrpl-dex scenario defi-17 in UAT index (83359b6)
  • ci: remove misplaced cross-package test from actions package (0a382cd)
  • ci: remove tauriScript to let tauri-action install CLI itself (#472) (ce9c2d9)
  • ci: replace global npm upgrade with npx npm@11 in release workflow (b07cc20)
  • ci: replace global npm upgrade with npx npm@11 in release workflow (616eec9)
  • ci: restore environment: production on deploy job for npm OIDC auth (75c4dc1)
  • ci: scope desktop build to daemon/CLI packages only (#472) (b94bb37)
  • ci: update enum SSoT expected counts for ripple chain (d1ccce6)
  • ci: update enum SSoT expected counts for xrpl_dex settings (79e433c)
  • ci: use correct package name @waiaas/desktop in turbo filter (#472) (03bfcd6)
  • ci: use npx tauri instead of pnpm tauri for CLI resolution (#472) (5cf1804)
  • ci: use pnpm --filter instead of turbo --filter for desktop build (#472) (1f17747)
  • ci: use RELEASE_PAT for release-please auto-merge and add synchronize trigger (0a7706f)
  • ci: use turbo --filter=@waiaas/cli... for scoped SEA build (#472) (33cf737)
  • concise error messages for viem errors + register issue #431 (b9cd4cc)
  • daemon,admin,push-relay: resolve issues 451-452 — sign request push body and toast args (e24940c)
  • daemon,admin: resolve issues 437-442 (81e7405)
  • daemon,wallet-sdk: add owner address to test sign request (#462) and remove ntfy remnants (#463) (81092e7)
  • daemon: add missing ripple-keypairs dependency for XRP wallet creation (b4f42c8)
  • daemon: extract buildSignRequestPushPayload helper to fix #461 base64 format bug (7788c66)
  • daemon: fix #461 admin test sign request base64 format bug (1981a78)
  • daemon: promote startup step logs from debug to info level (75d5ec8)
  • daemon: remove OpenAPI body schema from test-sign-request to allow empty body (d8e63d1)
  • daemon: replace periodic position sync with startup-once + action-triggered (#455) (290fed4)
  • daemon: replace periodic position sync with startup-once + action-triggered (#455) (d6c462c)
  • daemon: resolve issue 449 — use subscription_token for Push Relay routing (42ebfb8)
  • daemon: resolve issues 443-444 — approval timeout policy passthrough and hot-reload (441a431)
  • daemon: resolve issues 446-448 — DELAY cancel keyboard and TX_QUEUED notification enrichment (c1e97ba)
  • daemon: send flat SignRequest fields in Push Relay payload (#456) (8c1d0e5)
  • DB migration column order, MCP race condition, desktop dev mode (32e3ebb)
  • db: use explicit column lists in v62 migration to fix column order mismatch (#480) (8d3b499)
  • defer PositionTracker sync and increase stagger delay (#431) (ca8613d)
  • desktop build pipeline — issues #472 #473 #474 (f399203)
  • desktop: add beforeDevCommand and redesign tray icons (1232089)
  • desktop: add icon.ico/icon.icns and remove Apple signing env (#472) (3fe9779)
  • desktop: add legacy Solana deps to esbuild external list (#472) (7705b2f)
  • desktop: add remaining Solana transitive deps to esbuild external (#472) (b46972e)
  • desktop: add sodium-native direct require intercept in SEA shim (issue 493) (9d29a35)
  • desktop: add sodium-native direct require intercept in SEA shim (issue 493) (a6e3689)
  • desktop: auto-login with bootstrap recovery.key (issue 491) (0e1da94)
  • desktop: auto-login with bootstrap recovery.key (issue 491) (8dd5bec)
  • desktop: auto-login with bootstrap recovery.key (issue 491) (b0cd47f)
  • desktop: decouple desktop version from release-please (#472) (950e8c6)
  • desktop: re-authenticate via recovery.key after session timeout (issue 498) (7f6841b)
  • desktop: re-authenticate via recovery.key after session timeout (issue 498) (bd3f7d6)
  • desktop: re-authenticate via recovery.key after session timeout (issue 498) (19f3c0f)
  • desktop: remove Owner step from Setup Wizard (issue 495) (cdbbcb9)
  • desktop: remove Owner step from Setup Wizard (issue 495) (1d6ef56)
  • desktop: remove Owner step from wizard (issue 495) (1ab299f)
  • desktop: replace placeholder icons with favicon-based icon set (#474) (d0980c3)
  • desktop: SEA createRequire strip + Module._load intercept (issue 494) (7cf66d0)
  • desktop: set Ed25519 updater public key in tauri.conf.json (#472) (8bfc4bf)
  • desktop: skip wizard + default environment mainnet (issue 496) (23b2f17)
  • desktop: skip wizard entirely + default environment mainnet (issue 496) (d7afc89)
  • desktop: skip wizard entirely on Desktop (issue 496) (3cdcba7)
  • desktop: skip wizard entirely on Desktop (issue 496) (1629951)
  • desktop: sodium-native SEA shim intercept (issue 493) (7f5a03b)
  • desktop: strip createRequire in SEA bundle + Module._load intercept (issue 494) (4b3f93d)
  • desktop: strip createRequire in SEA bundle + Module._load intercept (issue 494) (f43a3fa)
  • desktop: unbrick v2.14.0 first-launch (issues 485-490) (a696425)
  • desktop: unbrick v2.14.0 first-launch (issues 485-490) (c0e7db9)
  • desktop: unbrick v2.14.0 first-launch (issues 485-490) (03d8182)
  • desktop: update Windows API calls for windows crate v0.58 (#472) (2759796)
  • desktop: use fixed port 3100 instead of dynamic port 0 (#473) (46dd1b2)
  • desktop: wizard wallet auth + SSoT chain multi-select (issue 492) (aad812e)
  • desktop: wizard wallet auth + SSoT chain multi-select (issue 492) (eab69ef)
  • extract concise one-line error messages from viem errors (#429) (1aed766)
  • IncomingTxMonitor startup stability and auto-merge CI (596805b)
  • lint: rename unused catch variables to _err in RippleAdapter (a51a92a)
  • mcp: await registerActionProviderTools before server.connect (#479) (4d1d822)
  • mcp: extract PKG_VERSION to version.ts to avoid ESM circular import (8ab3f9f)
  • mcp: resolve tools/list empty array and inject dynamic version (#477, #478) (07a41f2)
  • mcp: resolve tools/list empty array and inject dynamic version (#477, #478) (cffc072)
  • promote v2.12.0-rc.16 to stable 2.12.0 (95b33a0)
  • promote v2.13.0-rc.8 to stable 2.13.0 (ab194d2)
  • promote v2.14.0-rc.4 to stable 2.14.0 (c4804c9)
  • promote v2.14.0-rc.4 to stable 2.14.0 (acf8d35)
  • promote v2.15.0-rc.6 to stable 2.15.0 (71591f2)
  • promote v2.15.0-rc.6 to stable 2.15.0 (4db14b2)
  • push-relay: make extra_fields optional in constructor (c7f9ead)
  • push-relay: make extra_fields optional in PushwooshProvider constructor (5c3309e)
  • release-please: track adapter-ripple package.json version (b4d0caf)
  • release: add adapter-ripple to smoke test packing list (e48c437)
  • release: add adapter-ripple to smoke test packing list (fbc1867)
  • release: include adapter-ripple in Dockerfile and release pipeline (ae5670c)
  • release: include adapter-ripple in Dockerfile and release pipeline (23df43d)
  • remove build script from desktop-spike to unblock CI (bf21754)
  • resolve issues #422-#428 — DeFi UAT fixes, RPC pool seeding, DCent swap corrections (885531d)
  • resolve issues #469 #470 #471 (1547af0)
  • resolve open issues #456, #457, #458 (ff0d22c)
  • resolve open issues #459 session wallet query, #460 push relay static_fields (ae308fb)
  • resolve open issues #462-#464 — owner address, ntfy cleanup, docs update (825f4aa)
  • resolve open issues 437-452 (c6cb6d7)
  • security: update openclaw for GHSA-f6pf-4gjx-c94r (762bbd4)
  • security: update openclaw to >=2026.3.28 for GHSA-f6pf-4gjx-c94r (f30d660)
  • signing: add missing API key to sendViaRelay and fix base64 response parsing (3848624)
  • signing: add missing API key to sendViaRelay and fix base64 response parsing (#465, #466, #467) (038ee36)
  • site,solana: resolve Dev.to CDN cache and Solana WS 429 flood (#453, #454) (f2275dd)
  • site,solana: resolve Dev.to CDN cache and Solana WS 429 flood (#453, #454) (888c902)
  • site: add state=all to Dev.to API query to include all published posts (88930f0)
  • site: bypass Dev.to CDN cache with API key authentication (9fc4bab)
  • site: pass API key to individual Dev.to article fetches (a6675ee)
  • site: replace Korean fallback text with English on download page (4f4a8ee)
  • solana: resolve eslint no-this-alias and no-unsafe-function-type errors (187be72)
  • solana: resolve require-yield lint errors in test async iterables (54fc046)
  • update pnpm-lock.yaml for Tauri desktop dependencies (f3b5c94)
  • wallet-sdk: simplify decodeInlineData to restore 100% coverage (7780a24)
  • XRPL stabilization — ripple-keypairs dep, ESM import fix, DEX default enable (32efa47)
  • xrpl: resolve 3 critical XRPL bugs and add token registry support (4e881c8)
  • xrpl: resolve 3 critical XRPL bugs and add token registry support (fc65b22)

Security Fixes

  • dep: update openclaw to >=2026.3.28 for GHSA-f6pf-4gjx-c94r

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track minhoyoo-iotrust/WAIaaS

Get notified when new releases ship.

Sign up free

About minhoyoo-iotrust/WAIaaS

Self-hosted wallet-as-a-service for AI agents. 60 tools for multi-chain crypto: transfers, DeFi (swap, lend, stake, bridge, perp, yield), NFTs, smart contracts, transaction signing, and x402 payments. Solana + EVM with session auth and spending policies.

All releases →

Beta — feedback welcome: [email protected]