build(deps): bump tronweb from 6.2.2 to 6.5.0

[dependabot]

Bumps tronweb from 6.2.2 to 6.5.0.

Release notes

Sourced from tronweb's releases.

v6.5.0

New Features

• Added trx.raw — chain reads without int64 precision loss

  Added a tronWeb.trx.raw namespace that mirrors the chain-reading methods of trx (getBalance, getAccount, getBlock, getTransaction, getTransactionInfo, getAccountResources, token / proposal / exchange queries, ...) but issues them as GET requests with int64_as_string=true (java-tron#6699). The node then serializes int64 / uint64 fields as JSON strings, so values above 2^53 - 1 (Number.MAX_SAFE_INTEGER) reach JavaScript without precision loss. Return types reflect this at compile time: int64 fields are typed (and arrive) as strings, via the new Types.Int64AsString / Types.Precise64 mapped types.

  • getCurrentBlock / getConfirmedCurrentBlock are rerouted in raw mode to the flag-honoring wallet/getblock?detail=true / walletsolidity/getblock?detail=true (getnowblock ignores the flag).
  • Reads that cannot take the flag keep returning numbers in both modes: getNodeInfo, listNodes, getBandwidthPrices, getEnergyPrices, getDelegatedResourceAccountIndexV2, getBrokerage / getUnconfirmedBrokerage, the deprecated getTransactionsToAddress / getTransactionsFromAddress / getTransactionsRelated, getSignWeight / getApprovedList, and getCurrentRefBlockParams (feeds local transaction building and must stay on the number path).
  • Requirements and caveats: the connected node must run a java-tron build that includes #6699 — older nodes ignore the flag and keep returning (possibly precision-lossy) numbers. Responses read via trx.raw must not be fed back into transaction-consuming endpoints (sendRawTransaction, getSignWeight, ...): the node rejects string-encoded int64 fields in request bodies.
  • The plugin system cannot override the raw sub-module.

Improvements

• multiSign verifies the transaction returned by getSignWeight

  When multiSign is called with a permissionId on a transaction that does not carry one yet, it refreshes the transaction through getSignWeight and previously adopted the fullNode's response unchecked. It now verifies that the returned transaction matches the one submitted (including the injected Permission_id) before signing, and throws Invalid transaction provided otherwise — a compromised or malicious fullNode can no longer substitute a different transaction for signing.

• Corrected Types.Proposal to match the node's JSON wire format

  Proposal.state is now typed as the enum-name string the node actually returns ('PENDING' | 'DISAPPROVED' | 'APPROVED' | 'CANCELED') instead of a numeric enum, and Proposal.parameters as the { key, value }[] array the node serializes instead of a key/value map. Runtime values are unchanged — the previous declarations did not match what getProposal / listProposals return; code type-checked against the old numeric state (e.g. state === 2) now fails to compile and should compare against the string form.

Changes

• Migrated the test stack from mocha / karma / chai / nyc to Vitest 4 (node suite plus a headless-Playwright browser suite). Vitest runs the TypeScript test sources directly and provisions test accounts in its globalSetup, so the build:test / newaccount npm scripts are gone; test, test:watch, coverage and test:browser are the remaining test scripts.

v6.4.0

New Features

• Typed read / write contract namespaces

  Added contract.read and contract.write namespaces for type-safe, ergonomic access to contract methods. Functions are split by state mutability: view / pure (constant call) functions are exposed under contract.read, while state-changing functions are exposed under contract.write. When an ABI is declared as const, function names and argument types are checked at compile time.

  • Call as contract.read.methodName([arg0, arg1, ...], options) / contract.write.methodName([arg0, arg1, ...], options).
  • The write account option is a private key: its derived address owns and signs the transaction, so a write can be issued from a non-default signer — including on an instance with no default key. A value that is not a private key is rejected. Treat this value as secret. For reads, a from option sets the caller address directly (validated as an address).
  • Validation errors (argument count, signer, call value, account) are surfaced as promise rejections.
  • ABI functions literally named read or write remain callable via the legacy flat surface (handled through a proxy).
  • Each function is additionally exposed under its full selector, e.g. contract.read['balanceOf(address)'] / contract.write['transfer(address,uint256)']. The selector form pins that exact overload, so same-arity overloads can be addressed unambiguously. Note: namespaces now enumerate each method under both its bare name and its selector, so Object.keys / for…in over contract.read / contract.write return two entries per function.

• Added utils.abi.encodeFunctionData

  Added utils.abi.encodeFunctionData(funcABI, args) to build smart contract calldata (function selector + encoded parameters). Validates argument count and supports TRON-specific handling of trcToken (kept in the selector, encoded as uint256).

• Added transactionBuilder.updateWitness

  Added transactionBuilder.updateWitness(address, url, options) to create a WitnessUpdateContract transaction that updates a witness node URL. Validates the address and the URL format / length (≤ 256).

Improvements

• Dropped Buffer in favor of TextEncoder / TextDecoder

... (truncated)

Changelog

Sourced from tronweb's changelog.

Change Log

6.5.0

New Features

• Added trx.raw — chain reads without int64 precision loss

  Added a tronWeb.trx.raw namespace that mirrors the chain-reading methods of trx (getBalance, getAccount, getBlock, getTransaction, getTransactionInfo, getAccountResources, token / proposal / exchange queries, ...) but issues them as GET requests with int64_as_string=true (java-tron#6699). The node then serializes int64 / uint64 fields as JSON strings, so values above 2^53 - 1 (Number.MAX_SAFE_INTEGER) reach JavaScript without precision loss. Return types reflect this at compile time: int64 fields are typed (and arrive) as strings, via the new Types.Int64AsString / Types.Precise64 mapped types.

  • getCurrentBlock / getConfirmedCurrentBlock are rerouted in raw mode to the flag-honoring wallet/getblock?detail=true / walletsolidity/getblock?detail=true (getnowblock ignores the flag).
  • Reads that cannot take the flag keep returning numbers in both modes: getNodeInfo, listNodes, getBandwidthPrices, getEnergyPrices, getDelegatedResourceAccountIndexV2, getBrokerage / getUnconfirmedBrokerage, the deprecated getTransactionsToAddress / getTransactionsFromAddress / getTransactionsRelated, getSignWeight / getApprovedList, and getCurrentRefBlockParams (feeds local transaction building and must stay on the number path).
  • Requirements and caveats: the connected node must run a java-tron build that includes #6699 — older nodes ignore the flag and keep returning (possibly precision-lossy) numbers. Responses read via trx.raw must not be fed back into transaction-consuming endpoints (sendRawTransaction, getSignWeight, ...): the node rejects string-encoded int64 fields in request bodies.
  • The plugin system cannot override the raw sub-module.

Improvements

• multiSign verifies the transaction returned by getSignWeight

  When multiSign is called with a permissionId on a transaction that does not carry one yet, it refreshes the transaction through getSignWeight and previously adopted the fullNode's response unchecked. It now verifies that the returned transaction matches the one submitted (including the injected Permission_id) before signing, and throws Invalid transaction provided otherwise — a compromised or malicious fullNode can no longer substitute a different transaction for signing.

• Corrected Types.Proposal to match the node's JSON wire format

  Proposal.state is now typed as the enum-name string the node actually returns ('PENDING' | 'DISAPPROVED' | 'APPROVED' | 'CANCELED') instead of a numeric enum, and Proposal.parameters as the { key, value }[] array the node serializes instead of a key/value map. Runtime values are unchanged — the previous declarations did not match what getProposal / listProposals return; code type-checked against the old numeric state (e.g. state === 2) now fails to compile and should compare against the string form.

Changes

• Migrated the test stack from mocha / karma / chai / nyc to Vitest 4 (node suite plus a headless-Playwright browser suite). Vitest runs the TypeScript test sources directly and provisions test accounts in its globalSetup, so the build:test / newaccount npm scripts are gone; test, test:watch, coverage and test:browser are the remaining test scripts.

6.4.0

New Features

• Typed read / write contract namespaces

  Added contract.read and contract.write namespaces for type-safe, ergonomic access to contract methods. Functions are split by state mutability: view / pure (constant call) functions are exposed under contract.read, while state-changing functions are exposed under contract.write. When an ABI is declared as const, function names and argument types are checked at compile time.

  • Call as contract.read.methodName([arg0, arg1, ...], options) / contract.write.methodName([arg0, arg1, ...], options).
  • The write account option is a private key: its derived address owns and signs the transaction, so a write can be issued from a non-default signer — including on an instance with no default key. A value that is not a private key is rejected. Treat this value as secret. For reads, a from option sets the caller address directly (validated as an address).
  • Validation errors (argument count, signer, call value, account) are surfaced as promise rejections.
  • ABI functions literally named read or write remain callable via the legacy flat surface (handled through a proxy).
  • Each function is additionally exposed under its full selector, e.g. contract.read['balanceOf(address)'] / contract.write['transfer(address,uint256)']. The selector form pins that exact overload, so same-arity overloads can be addressed unambiguously. Note: namespaces now enumerate each method under both its bare name and its selector, so Object.keys / for…in over contract.read / contract.write return two entries per function.

• Added utils.abi.encodeFunctionData

  Added utils.abi.encodeFunctionData(funcABI, args) to build smart contract calldata (function selector + encoded parameters). Validates argument count and supports TRON-specific handling of trcToken (kept in the selector, encoded as uint256).

• Added transactionBuilder.updateWitness

... (truncated)

Commits

• b189154 Merge pull request #718 from tronprotocol/release/v6.5.0
• cba0dbe Merge pull request #717 from Stan202310/release/v6.5.0
• b804f0f fix: normalize 0x prefix and hex casing in signTransaction signature dedup
• b8d6d99 fix: case-insensitive address comparison in multiSign permission checks
• 6e05917 chore: force absolute hooks path in install.sh
• 42b8c27 chore: upgrade ethers to 6.17.0 and drop obsolete overrides
• 6bfe752 chore: resolve git hooks dir via rev-parse --git-path in install.sh
• ad263e1 fix: reset props array after clearing stale properties in loadAbi
• 0ae454f chore: bump nanoid to 3.3.18 in lockfile
• e2556df fix: type BroadcastReturn.code as string to match node HTTP response
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)