chore(deps): merge renovate bumps and fix pako/babel breakage

.tool-versions

@@ -1,3 +1,2 @@
 pnpm 11.20.0
 nodejs 24.14.1
-

CHANGELOG.md

@@ -22,6 +22,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Combined Renovate dependency bump**: Merged the age-eligible pieces of [#1557](https://github.com/aptos-labs/explorer/pull/1557), [#1672](https://github.com/aptos-labs/explorer/pull/1672), [#1676](https://github.com/aptos-labs/explorer/pull/1676), and [#1677](https://github.com/aptos-labs/explorer/pull/1677). Kept only versions that already satisfy both the Aikido Safe Chain 48h floor and pnpm `minimumReleaseAge` (5 days), with no `minimumReleaseAgeExclude` entries. Direct: `@scure/base` `2.3.0`, `pako` `3.0.1` (named exports; `ungzip(..., { toText: true })` for published Move source), `react-hook-form` `7.85.0`. Dropped the deprecated `@types/pako` stub (pako 3 ships its own types). Transitive overrides: `@babel/core` `8.0.1`, `undici` `8.10.0`, `uuid` `14.0.1`. Babel 8 dropped its default export and made `createConfigItem()` callback-only; a pnpm patch restores a default namespace (TanStack Start) and synchronous `createConfigItem` (SVGR). Left in-window bumps for a later PR (`@aptos-labs/ts-sdk` `7.3.0`, Biome `2.5.8`, TanStack Router/Start patches, `esbuild` `0.28.2`, pnpm `11.21.0`).
+
 - **Non-major dependency refresh**: Bumped age-eligible direct dependencies (5-day `minimumReleaseAge`) including MUI `9.0.1` → `9.3.1`, React `19.2.5` → `19.2.8`, Vite `8.2.0` → `8.2.1`, Biome `2.4.9` → `2.5.7` (`recommended: true` migrated to `preset: "recommended"`), Vitest / `@vitest/coverage-v8` `4.1.4` / `^4.1.6` → pinned `4.1.10`, TanStack Query `5.100.11` → `5.101.4`, TanStack Router/Start patch line (`react-router` `1.170.23`, `react-start` `1.168.40`, `router-plugin` `1.168.27`, `router-cli` `1.167.25`), Playwright `1.59.1` → `1.62.1`, `react-hook-form` `7.74.0` → `7.84.0`, `date-fns` `4.4.0`, `es-toolkit` `1.50.0`, `@tanstack/react-virtual` `3.14.9`, `@netlify/vite-plugin-tanstack-start` `1.3.17`, and matching type packages. Transitive overrides: `axios@1.19.0`, `js-yaml@5.2.3`, `postcss@8.5.26`, `h3@2.0.1-rc.26`. pnpm `11.9.0` → `11.20.0`. GitHub Actions: `actions/checkout` `v7.0.1`, `pnpm/action-setup` `v6.0.10`. The `@netlify/edge-functions-dev` `duplex: "half"` fetch patch was retargeted from `1.0.16` to `1.0.23` to match the new plugin tree. Majors and packages newer than five days (including `@aptos-labs/ts-sdk` `7.3.0` and Biome `2.5.8`) were left for a later bump.
 
 - **TypeScript 6 → 7 upgrade**: Bumped `typescript` from `6.0.3` to `7.0.2`, the native Go-based compiler. `pnpm lint` / `tsc --noEmit` now use the TypeScript 7 `tsc` binary (typically much faster type-checking). No `tsconfig.json` or source changes were required; Vite 8 / Biome do not depend on the legacy TypeScript programmatic API, so the side-by-side `@typescript/typescript6` compatibility package is not needed for this repo.

app/pages/Transaction/Tabs/Components/useEntryFunctionArgNames.test.ts

@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 import {Hex} from "@aptos-labs/ts-sdk";
 import {renderHook} from "@testing-library/react";
-import pako from "pako";
+import {gzip} from "pako";
 import {afterEach, describe, expect, it, vi} from "vitest";
 
 const packagesMock = vi.fn(
@@ -15,7 +15,7 @@ import {useEntryFunctionArgNames} from "./useEntryFunctionArgNames";
 
 /** Move source is stored gzip-compressed hex (see `transformCode`). */
 function gzipHex(source: string): string {
-  return Hex.fromHexInput(pako.gzip(source)).toString();
+  return Hex.fromHexInput(gzip(source)).toString();
 }
 
 function withPackages(moduleName: string, source: string) {

app/utils/utils.ts

@@ -9,7 +9,7 @@ import type {
   AdapterWallet,
 } from "@aptos-labs/wallet-adapter-react";
 import {differenceInMilliseconds, format} from "date-fns";
-import pako from "pako";
+import {ungzip} from "pako";
 import type {Types} from "~/types/aptos";
 
 /**
@@ -181,8 +181,8 @@ export async function fetchJsonResponse(url: string) {
  */
 export function transformCode(source: string): string {
   try {
-    return pako.ungzip(Hex.fromHexString(source).toUint8Array(), {
-      to: "string",
+    return ungzip(Hex.fromHexString(source).toUint8Array(), {
+      toText: true,
     });
   } catch {
     return "";

app/utils/utilsCoverage.test.ts

@@ -1,6 +1,8 @@
 // Covers additional utils exports not yet in utils.test.ts
 // FEAT-DATA-004 (identicon seed), FEAT-ROUTING-003 (entity helpers),
 // FEAT-TXN-002 (transaction sorting), FEAT-WALLET-001 (wallet sorting)
+import {Hex} from "@aptos-labs/ts-sdk";
+import {gzip} from "pako";
 import {describe, expect, it} from "vitest";
 import {
   assertNever,
@@ -11,6 +13,7 @@ import {
   isValidUrl,
   sortPetraFirst,
   sortTransactions,
+  transformCode,
 } from "./utils";
 
 describe("FEAT-ROUTING-003 — isValidStruct", () => {
@@ -109,6 +112,19 @@ describe("isValidUrl", () => {
   });
 });
 
+describe("FEAT-MODULES-001 — transformCode", () => {
+  it("ungzips on-chain Move source stored as gzipped hex", () => {
+    // Covers FEAT-MODULES-001 — published module source is gzip-compressed hex
+    const source = "module 0x1::coin { public fun ping() {} }";
+    const hex = Hex.fromHexInput(gzip(source)).toString();
+    expect(transformCode(hex)).toBe(source);
+  });
+
+  it("returns empty string for invalid gzip payload", () => {
+    expect(transformCode("0xdeadbeef")).toBe("");
+  });
+});
+
 describe("FEAT-MODULES-004 — getBytecodeSizeInKB", () => {
   it("returns a number for hex bytecode", () => {
     const hex = `0x${"ab".repeat(512)}`;

docs/FEATURES_SPECIFICATION.md

@@ -442,7 +442,7 @@ Both search surfaces share their input tokens (placeholder, helper text, debounc
 | Sub-tab | URL segment | Content |
 |---------|-------------|---------|
 | Packages | `packages` | Package sidebar, `MovePackageManifest`, version-aware via ledger version. |
-| Code | `code` | Module selector, `ModuleHeader` (entry fn count, bytecode size), source vs decompiled Move vs disassembly. |
+| Code | `code` | Module selector, `ModuleHeader` (entry fn count, bytecode size), source vs decompiled Move vs disassembly. Published source is gzip-decompressed from on-chain module source hex (`transformCode`). |
 | Run | `run` | Wallet-connected entry function execution forms (type args, args, ANS address resolution, `useSubmitTransaction`). Disabled for historical versions. |
 | View | `view` | View function calls via `view` API with result display/copy. Disabled for historical versions. |
 
@@ -457,7 +457,7 @@ Both search surfaces share their input tokens (placeholder, helper text, debounc
 | Aspect | Detail |
 |--------|--------|
 | **Condition** | Publish history has ≥ 2 versions. |
-| **Display** | Side-by-side diff of module source between versions. |
+| **Display** | Side-by-side diff of module source between versions. Source is gzip-decompressed from on-chain module source hex (`transformCode`). |
 
 ### FEAT-MODULES-004 — Move Decompiler
 
@@ -1339,7 +1339,7 @@ top of the HTML site.
 | `app/utils/routeRedirects.test.ts` | FEAT-ACCOUNT-012 (entity default tab redirects for all route types), FEAT-TOKEN-004 (legacy numeric redirect), FEAT-VALIDATORS-006 (validators/validators-enhanced redirects), FEAT-SEARCH-001 (header search navigation), FEAT-WALLET-002 (wallet network mismatch), FEAT-ACCOUNT-002 (DeFi portfolio URLs) |
 | `app/utils/walletNetwork.test.ts` | FEAT-WALLET-002 (loopback RPC + `custom` vs explorer `local` for non-Petra) |
 | `app/utils/rateLimiter.test.ts` | FEAT-RATELIMIT-002 (rate limit error detection, URL endpoint extraction) |
-| `app/utils/utilsCoverage.test.ts` | FEAT-ROUTING-003 (isValidStruct), FEAT-TXN-002 (sortTransactions), FEAT-WALLET-001 (sortPetraFirst), FEAT-MODULES-004 (bytecode size), FEAT-MODULES-001 (param names, function line numbers), isValidUrl, assertNever |
+| `app/utils/utilsCoverage.test.ts` | FEAT-ROUTING-003 (isValidStruct), FEAT-TXN-002 (sortTransactions), FEAT-WALLET-001 (sortPetraFirst), FEAT-MODULES-004 (bytecode size), FEAT-MODULES-001 (param names, function line numbers, gzip `transformCode`), isValidUrl, assertNever |
 | `app/data/bannedCollections.test.ts` | FEAT-ACCOUNT-008 (scam collection detection: registry shape, hex keys, reason strings) |
 | `app/data/knownAddresses.test.ts` | FEAT-DATA-002 (known address system: labels, branding, fallback), FEAT-DATA-005 (emojicoin registry address) |
 | `app/pages/Validators/validatorTabs.test.ts` | FEAT-VALIDATORS-001 (tab enum values, uniqueness) |

package.json

@@ -16,7 +16,7 @@
     "@mui/icons-material": "9.3.1",
     "@mui/material": "9.3.1",
     "@noble/hashes": "2.3.0",
-    "@scure/base": "2.2.0",
+    "@scure/base": "2.3.0",
     "@tanstack/react-query": "5.101.4",
     "@tanstack/react-router": "1.170.23",
     "@tanstack/react-start": "1.168.40",
@@ -31,12 +31,12 @@
     "es-toolkit": "1.50.0",
     "highlightjs-move": "0.3.0",
     "js-cookie": "3.0.8",
-    "pako": "2.1.0",
+    "pako": "3.0.1",
     "react": "19.2.8",
     "react-chartjs-2": "5.3.1",
     "react-dom": "19.2.8",
     "react-helmet-async": "3.0.0",
-    "react-hook-form": "7.84.0",
+    "react-hook-form": "7.85.0",
     "react-simple-maps": "3.0.0",
     "react-syntax-highlighter": "16.1.1"
   },
@@ -94,7 +94,6 @@
     "@testing-library/react": "16.3.2",
     "@types/js-cookie": "3.0.6",
     "@types/jsdom": "30.0.0",
-    "@types/pako": "2.0.4",
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.4",
     "@types/react-simple-maps": "3.0.6",

patches/@babel__core@8.0.1.patch

@@ -0,0 +1,52 @@
+diff --git a/lib/default-export.js b/lib/default-export.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..aa8944a8aba35c9ccefd972ddf497186a86d9d69
+--- /dev/null
++++ b/lib/default-export.js
+@@ -0,0 +1,5 @@
++// Compatibility shim: Babel 8 dropped the default export. TanStack Start
++// (and other Babel 7 consumers) still do `import babel from "@babel/core"`.
++export * from "./index.js";
++import * as Babel from "./index.js";
++export default Babel;
+diff --git a/lib/index-shared.js b/lib/index-shared.js
+index 83c4f65164c77943fd311cc4b0b803b6461367ca..f2e09ab61ec7f081e3746961b7e2b6cb3a8d58d3 100644
+--- a/lib/index-shared.js
++++ b/lib/index-shared.js
+@@ -2238,9 +2238,12 @@ function createConfigItem(target, options, callback) {
+   if (callback !== undefined) {
+     beginHiddenCallStack(createConfigItemRunner.errback)(target, options, callback);
+   } else if (typeof options === "function") {
+-    beginHiddenCallStack(createConfigItemRunner.errback)(target, undefined, callback);
++    beginHiddenCallStack(createConfigItemRunner.errback)(target, undefined, options);
+   } else {
+-    throw new Error("Starting from Babel 8.0.0, the 'createConfigItem' function expects a callback. If you need to call it synchronously, please use 'createConfigItemSync'.");
++    // Babel 7 compatibility: SVGR and other Babel 7 callers still invoke
++    // createConfigItem() synchronously. Babel 8 renamed that to
++    // createConfigItemSync(); keep the old signature working.
++    return beginHiddenCallStack(createConfigItemRunner.sync)(target, options);
+   }
+ }
+
+diff --git a/package.json b/package.json
+index 2a628e373acd7d506a4235c367f78e7ccfbaaab0..f54b1909e1a0d078d7f6ec5ef1df3e61116d06e5 100644
+--- a/package.json
++++ b/package.json
+@@ -2,7 +2,7 @@
+   "name": "@babel/core",
+   "version": "8.0.1",
+   "description": "Babel compiler core.",
+-  "main": "./lib/index.js",
++  "main": "./lib/default-export.js",
+   "author": "The Babel Team (https://babel.dev/team)",
+   "license": "MIT",
+   "publishConfig": {
+@@ -74,7 +74,7 @@
+   "exports": {
+     ".": {
+       "types": "./lib/index.d.ts",
+-      "default": "./lib/index.js"
++      "default": "./lib/default-export.js"
+     },
+     "./package.json": "./package.json"
+   },