Merge pull request #35 from vaibhavmule/fix/cve-2025-66478-nextjs-security-update

- Update Next.js from ^15 to ^15.5.7 (patched version)
- Update eslint-config-next from 15.0.3 to 15.5.7 to match
- Addresses critical security vulnerability CVE-2025-66478
- Reference: https://nextjs.org/blog/CVE-2025-66478

bin/index.js

@@ -8,7 +8,6 @@ let projectName = null;
 let autoAcceptDefaults = false;
 let apiKey = null;
 let noWallet = false;
-let noTunnel = false;
 let sponsoredSigner = false;
 let seedPhrase = null;
 let returnUrl = null;
@@ -54,10 +53,6 @@ if (yIndex !== -1) {
       noWallet = true;
       args.splice(i, 1); // Remove the flag
       i--; // Adjust index since we removed 1 element
-    } else if (arg === '--no-tunnel') {
-      noTunnel = true;
-      args.splice(i, 1); // Remove the flag
-      i--; // Adjust index since we removed 1 element
     } else if (arg === '--sponsored-signer') {
       sponsoredSigner = true;
       args.splice(i, 1); // Remove the flag
@@ -99,7 +94,7 @@ if (autoAcceptDefaults && !projectName) {
   process.exit(1);
 }
 
-init(projectName, autoAcceptDefaults, apiKey, noWallet, noTunnel, sponsoredSigner, seedPhrase, returnUrl).catch((err) => {
+init(projectName, autoAcceptDefaults, apiKey, noWallet, sponsoredSigner, seedPhrase, returnUrl).catch((err) => {
   console.error('Error:', err);
   process.exit(1);
 });

bin/init.js

@@ -68,7 +68,6 @@ export async function init(
   autoAcceptDefaults = false,
   apiKey = null,
   noWallet = false,
-  noTunnel = false,
   sponsoredSigner = false,
   seedPhrase = null,
   returnUrl = null
@@ -251,7 +250,6 @@ export async function init(
       tags: [],
       buttonText: 'Launch Mini App',
       useWallet: !noWallet,
-      useTunnel: true,
       enableAnalytics: true,
       seedPhrase: seedPhraseValue,
       useSponsoredSigner: useSponsoredSignerValue,
@@ -361,24 +359,6 @@ export async function init(
       answers.useWallet = walletAnswer.useWallet;
     }
 
-    // Ask about localhost vs tunnel
-    if (noTunnel) {
-      answers.useTunnel = false;
-    } else {
-      const hostingAnswer = await inquirer.prompt([
-        {
-          type: 'confirm',
-          name: 'useTunnel',
-          message:
-            'Would you like to test on mobile and/or test the app with Warpcast developer tools?\n' +
-            `⚠️ ${yellow}${italic}Both mobile testing and the Warpcast debugger require setting up a tunnel to serve your app from localhost to the broader internet.\n${reset}` +
-            'Configure a tunnel for mobile testing and/or Warpcast developer tools?',
-          default: true,
-        },
-      ]);
-      answers.useTunnel = hostingAnswer.useTunnel;
-    }
-
     // Ask about Sign In With Neynar (SIWN) - requires seed phrase
     if (seedPhrase) {
       // If --seed-phrase flag is used, validate it
@@ -515,7 +495,8 @@ export async function init(
     '@farcaster/miniapp-wagmi-connector': '^1.0.0',
     '@farcaster/mini-app-solana': '>=0.0.17 <1.0.0',
     '@farcaster/quick-auth': '>=0.0.7 <1.0.0',
-    '@neynar/react': '^1.2.13',
+    '@neynar/react': '^1.2.15',
+    '@pigment-css/react': '^0.0.30',
     '@radix-ui/react-label': '^2.1.1',
     '@solana/wallet-adapter-react': '^0.15.38',
     '@tanstack/react-query': '^5.61.0',
@@ -525,7 +506,7 @@ export async function init(
     dotenv: '^16.4.7',
     'lucide-react': '^0.469.0',
     mipd: '^0.0.7',
-    next: '^15',
+    next: '^15.5.7',
     react: '^19',
     'react-dom': '^19',
     'tailwind-merge': '^2.6.0',
@@ -544,9 +525,8 @@ export async function init(
     "@vercel/sdk": "^1.9.0",
     "crypto": "^1.0.1",
     "eslint": "^8",
-    "eslint-config-next": "15.0.3",
+    "eslint-config-next": "15.5.7",
     "inquirer": "^10.2.2",
-    "localtunnel": "^2.0.2",
     "pino-pretty": "^13.0.0",
     "postcss": "^8",
     "tailwindcss": "^3.4.1",
@@ -755,7 +735,6 @@ export async function init(
         `\nNEXTAUTH_SECRET="${crypto.randomBytes(32).toString('hex')}"`
       );
     }
-    fs.appendFileSync(envPath, `\nUSE_TUNNEL="${answers.useTunnel}"`);
     if (answers.useSponsoredSigner) {
       fs.appendFileSync(envPath, `\nSPONSOR_SIGNER="true"`);
     }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@neynar/create-farcaster-mini-app",
-  "version": "1.8.8",
+  "version": "1.8.15",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@neynar/create-farcaster-mini-app",
-      "version": "1.8.8",
+      "version": "1.8.15",
       "dependencies": {
         "dotenv": "^16.4.7",
         "inquirer": "^12.4.3",
@@ -614,9 +614,9 @@
       "license": "MIT"
     },
     "node_modules/@openapitools/openapi-generator-cli": {
-      "version": "2.23.1",
-      "resolved": "https://registry.npmjs.org/@openapitools/openapi-generator-cli/-/openapi-generator-cli-2.23.1.tgz",
-      "integrity": "sha512-Kd5EZqzbcIXf6KRlpUrheHMzQNRHsJWzAGrm4ncWCNhnQl+Mh6TsFcqq+hIetgiFCknWBH6cZ2f37SxPxaon4w==",
+      "version": "2.25.0",
+      "resolved": "https://registry.npmjs.org/@openapitools/openapi-generator-cli/-/openapi-generator-cli-2.25.0.tgz",
+      "integrity": "sha512-u/3VAbF8c68AXBgm8nBAdDPLPW/KgrtHz28yemf92zNB0iDZFGdRUX2W80Lzf177g6ctYLz0GIPHCOU0LTJegQ==",
       "dev": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
@@ -625,13 +625,13 @@
         "@nestjs/common": "11.1.6",
         "@nestjs/core": "11.1.6",
         "@nuxtjs/opencollective": "0.3.2",
-        "axios": "1.11.0",
+        "axios": "1.12.2",
         "chalk": "4.1.2",
         "commander": "8.3.0",
-        "compare-versions": "4.1.4",
+        "compare-versions": "6.1.1",
         "concurrently": "9.2.1",
         "console.table": "0.10.0",
-        "fs-extra": "11.3.1",
+        "fs-extra": "11.3.2",
         "glob": "11.0.3",
         "inquirer": "8.2.7",
         "proxy-agent": "6.5.0",
@@ -896,9 +896,9 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.11.0.tgz",
-      "integrity": "sha512-1Lx3WLFQWm3ooKDYZD1eXmoGO9fxYQjrycfHFC8P0sCfQVXyROp0p9PFWBehewBOdCwHc+f/b8I0fMto5eSfwA==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.12.2.tgz",
+      "integrity": "sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1153,9 +1153,9 @@
       }
     },
     "node_modules/compare-versions": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/compare-versions/-/compare-versions-4.1.4.tgz",
-      "integrity": "sha512-FemMreK9xNyL8gQevsdRMrvO4lFCkQP7qbuktn1q8ndcNk1+0mz7lgE7b/sNvbhVgY4w6tMN1FDp6aADjqw2rw==",
+      "version": "6.1.1",
+      "resolved": "https://registry.npmjs.org/compare-versions/-/compare-versions-6.1.1.tgz",
+      "integrity": "sha512-4hm4VPpIecmlg59CHXnRDnqGplJFrbLG4aFEl5vl6cK1u76ws3LLvX7ikFnTDl5vo39sjWD6AaDPYodJp/NNHg==",
       "dev": true,
       "license": "MIT"
     },
@@ -1589,9 +1589,9 @@
       }
     },
     "node_modules/fs-extra": {
-      "version": "11.3.1",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.1.tgz",
-      "integrity": "sha512-eXvGGwZ5CL17ZSwHWd3bbgk7UUpF6IFHtP57NYYakPvHOs8GDgDe5KJI36jIJzDkJ6eJjuzRA8eBQb6SkKue0g==",
+      "version": "11.3.2",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.2.tgz",
+      "integrity": "sha512-Xr9F6z6up6Ws+NjzMCZc6WXg2YFRlrLP9NQDO3VQrWrfiojdhS56TzueT88ze0uBdCTwEIhQ3ptnmKeWGFAe0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neynar/create-farcaster-mini-app",
-  "version": "1.8.13",
+  "version": "1.9.1",
   "type": "module",
   "private": false,
   "access": "public",

scripts/dev.js

@@ -1,4 +1,3 @@
-import localtunnel from 'localtunnel';
 import { spawn } from 'child_process';
 import { createServer } from 'net';
 import dotenv from 'dotenv';
@@ -11,7 +10,6 @@ dotenv.config({ path: '.env.local' });
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(path.normalize(path.join(__dirname, '..')));
 
-let tunnel;
 let nextDev;
 let isCleaningUp = false;
 
@@ -88,7 +86,7 @@ async function startDev() {
   const isPortInUse = await checkPort(port);
   if (isPortInUse) {
     console.error(`Port ${port} is already in use. To find and kill the process using this port:\n\n` +
-      (process.platform === 'win32' 
+      (process.platform === 'win32'
         ? `1. Run: netstat -ano | findstr :${port}\n` +
           '2. Note the PID (Process ID) from the output\n' +
           '3. Run: taskkill /PID <PID> /F\n'
@@ -97,52 +95,20 @@ async function startDev() {
     process.exit(1);
   }
 
-  const useTunnel = process.env.USE_TUNNEL === 'true';
-  let miniAppUrl;
+  const miniAppUrl = `http://localhost:${port}`;
 
-  if (useTunnel) {
-    // Start localtunnel and get URL
-    tunnel = await localtunnel({ port: port });
-    let ip;
-    try {
-      ip = await fetch('https://ipv4.icanhazip.com').then(res => res.text()).then(ip => ip.trim());
-    } catch (error) {
-      console.error('Error getting IP address:', error);
-    }
+  console.log(`
+💻 Your mini app is running at: ${miniAppUrl}
 
-    miniAppUrl = tunnel.url;
-    console.log(`
-🌐 Local tunnel URL: ${tunnel.url}
+🌐 To test with the Farcaster preview tool:
 
-💻 To test on desktop:
-   1. Open the localtunnel URL in your browser: ${tunnel.url}
-   2. Enter your IP address in the password field${ip ? `: ${ip}` : ''} (note that this IP may be incorrect if you are using a VPN)
-   3. Click "Click to Submit" -- your mini app should now load in the browser
-   4. Navigate to the Warpcast Mini App Developer Tools: https://warpcast.com/~/developers
-   5. Enter your mini app URL: ${tunnel.url}
-   6. Click "Preview" to launch your mini app within Warpcast (note that it may take ~10 seconds to load)
-
-
-❗️ You will not be able to load your mini app in Warpcast until    ❗️
-❗️ you submit your IP address in the localtunnel password field ❗️
-
-
-📱 To test in Warpcast mobile app:
-   1. Open Warpcast on your phone
-   2. Go to Settings > Developer > Mini Apps
-   4. Enter this URL: ${tunnel.url}
-   5. Click "Preview" (note that it may take ~10 seconds to load)
-`);
-  } else {
-    miniAppUrl = `http://localhost:${port}`;
-    console.log(`
-💻 To test your mini app:
-   1. Open the Warpcast Mini App Developer Tools: https://warpcast.com/~/developers
-   2. Scroll down to the "Preview Mini App" tool
-   3. Enter this URL: ${miniAppUrl}
-   4. Click "Preview" to test your mini app (note that it may take ~5 seconds to load the first time)
-`);
-  }
+   1. Create a free ngrok account at https://ngrok.com/download/mac-os
+   2. Download and install ngrok following the instructions
+   3. In a NEW terminal window, run: ngrok http ${port}
+   4. Copy the forwarding URL (e.g., https://xxxx-xx-xx-xx-xx.ngrok-free.app)
+   5. Navigate to: https://farcaster.xyz/~/developers/mini-apps/preview
+   6. Enter your ngrok URL and click "Preview" to test your mini app
+`)
   
   // Start next dev with appropriate configuration
   const nextBin = path.normalize(path.join(projectRoot, 'node_modules', '.bin', 'next'));
@@ -181,15 +147,6 @@ async function startDev() {
           console.log('Note: Next.js process already terminated');
         }
       }
-      
-      if (tunnel) {
-        try {
-          await tunnel.close();
-          console.log('🌐 Tunnel closed');
-        } catch (e) {
-          console.log('Note: Tunnel already closed');
-        }
-      }
 
       // Force kill any remaining processes on the specified port
       await killProcessOnPort(port);
@@ -204,9 +161,6 @@ async function startDev() {
   process.on('SIGINT', cleanup);
   process.on('SIGTERM', cleanup);
   process.on('exit', cleanup);
-  if (tunnel) {
-    tunnel.on('close', cleanup);
-  }
 }
 
 startDev().catch(console.error); 

src/components/ui/wallet/SendEth.tsx

@@ -2,7 +2,7 @@
 
 import { useCallback, useMemo } from "react";
 import { useAccount, useSendTransaction, useWaitForTransactionReceipt } from "wagmi";
-import { base } from "wagmi/chains";
+import { arbitrum, base, mainnet, optimism, polygon, scroll, shape, zkSync, zora } from "wagmi/chains";
 import { Button } from "../Button";
 import { truncateAddress } from "../../../lib/truncateAddress";
 import { renderError } from "../../../lib/errorUtils";
@@ -44,18 +44,37 @@ export function SendEth() {
   // --- Computed Values ---
   /**
    * Determines the recipient address based on the current chain.
-   * 
-   * Uses different protocol guild addresses for different chains:
-   * - Base: 0x32e3C7fD24e175701A35c224f2238d18439C7dBC
-   * - Other chains: 0xB3d8d7887693a9852734b4D25e9C0Bb35Ba8a830
-   * 
+   *
+   * Uses different protocol guild addresses for different chains.
+   * Defaults to Ethereum mainnet address if chain is not recognized.
+   * Addresses are taken from the protocol guilds documentation: https://protocol-guild.readthedocs.io/en/latest/
+   *
    * @returns string - The recipient address for the current chain
    */
   const protocolGuildRecipientAddress = useMemo(() => {
-    // Protocol guild address
-    return chainId === base.id
-      ? "0x32e3C7fD24e175701A35c224f2238d18439C7dBC"
-      : "0xB3d8d7887693a9852734b4D25e9C0Bb35Ba8a830";
+    switch (chainId) {
+      case mainnet.id:
+        return "0x25941dC771bB64514Fc8abBce970307Fb9d477e9";
+      case arbitrum.id:
+        return "0x7F8DCFd764bA8e9B3BA577dC641D5c664B74c47b";
+      case base.id:
+        return "0xd16713A5D4Eb7E3aAc9D2228eB72f6f7328FADBD";
+      case optimism.id:
+        return "0x58ae0925077527a87D3B785aDecA018F9977Ec34";
+      case polygon.id:
+        return "0xccccEbdBdA2D68bABA6da99449b9CA41Dba9d4FF";
+      case scroll.id:
+        return "0xccccEbdBdA2D68bABA6da99449b9CA41Dba9d4FF";
+      case shape.id:
+        return "0x700fccD433E878F1AF9B64A433Cb2E09f5226CE8";
+      case zkSync.id:
+        return "0x9fb5F754f5222449F98b904a34494cB21AADFdf8";
+      case zora.id:
+        return "0x32e3C7fD24e175701A35c224f2238d18439C7dBC";
+      default:
+        // Default to Ethereum mainnet address
+        return "0x25941dC771bB64514Fc8abBce970307Fb9d477e9";
+    }
   }, [chainId]);
 
   // --- Handlers ---