feat(statics): onboard 8 new tokens as ungated tokens - verified

Add SOL tokens: sol:agri (AgriDex), sol:usdc.a (USDC.a Bridged ART20)
Add ETH tokens: eth:ags (Silver Standard), eth:aus (Gold Standard),
eth:reya (Reya), eth:usdp (USDP Stablecoin), eth:grtx (GreatX)
Add OP token: opeth:perp (Perpetual Protocol)
Add all corresponding OFC equivalent tokens

All tokens added to UnderlyingAsset enum in base.ts.
All ETH contract addresses verified as lowercase.
SOL tokens verified to use Token Program (not Token2022).
Decimals verified: SOL tokens (6), ETH tokens (4, 6, 18), OP token (18).
USDP and USDC.a marked with STABLECOIN feature.

CLOSES TICKET: WIN-8782

Author: manojkumar138

.github/workflows/audit-api-spec.yaml

@@ -68,7 +68,6 @@ jobs:
       - name: Checkout PR
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Find and checkout merge base

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [20.x, 22.x, 24.x]
+        node-version: [20.x, 22.x]
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.gitignore

@@ -18,4 +18,3 @@ modules/**/pack-scoped/
 coverage
 /.direnv/
 .claude/
-.cursor/

.iyarc

@@ -1,13 +0,0 @@
-# Excluded because:
-# - Lerna requires tar v6, but no patched v6 exists (fix only in v7.5.3)
-# - Forcing tar v7.5.3 breaks lerna's packDirectory API
-# - This CVE affects archive EXTRACTION (unpacking malicious symlinks/hardlinks)
-# - Lerna only uses tar for PACKING
-GHSA-8qq5-rm4j-mr97
-
-# Excluded because:
-# - Transitive dependency through lerna and yeoman-generator, which currently pin tar to a
-#   < 7.5.4 range; We only use their tar integration for
-#   archive PACKING, not extraction,
-GHSA-r6q2-hw4h-h46w
-

.nvmrc

@@ -1 +1 @@
-24.13.0
+22.18.0

CLAUDE.md

@@ -65,11 +65,6 @@ yarn compile
 # Build for development
 yarn compile-dbg
 ```
-
-## Dual ESM/CJS Builds
-
-For modules that need browser support (especially those using `@bitgo/wasm-utxo`), see [docs/esm.md](docs/esm.md) for the dual ESM/CJS build pattern.
-
 ## Code Style
 
 ### Commits
@@ -128,4 +123,4 @@ This will generate the necessary boilerplate for a new coin implementation.
 
 ## Node.js Version Support
 
-BitGoJS supports Node.js versions >=20 and <25, with NPM >=3.10.10.
+BitGoJS supports Node.js versions >=20 and <23, with NPM >=3.10.10.

CODEOWNERS

@@ -60,7 +60,7 @@
 /modules/sdk-coin-baby/ @BitGo/ethalt-team
 /modules/sdk-coin-bera/ @BitGo/ethalt-team
 /modules/sdk-coin-bsc/ @BitGo/ethalt-team
-/modules/sdk-coin-canton/ @BitGo/ethalt-team
+/module/sdk-coin-canton/ @BitGo/ethalt-team
 /modules/sdk-coin-coredao/ @BitGo/ethalt-team
 /modules/sdk-coin-cosmos/ @BitGo/ethalt-team
 /modules/sdk-coin-cronos/ @BitGo/ethalt-team
@@ -104,7 +104,7 @@
 # Examples
 /examples/ @BitGo/ethalt-team
 /examples/ts/btc/ @BitGo/btc-team
-/examples/ts/stablecoin @Bitgo/stablecoins
+/examples/ts/stablecoin @Bitgo/gousd-team
 
 # Trade
 /modules/sdk-core/src/bitgo/address-book/ @BitGo/prime

DEVELOPERS.md

@@ -1,7 +1,7 @@
 # Requirements
 
 - yarn version 1 (classic)
-- node version >=20 and <25
+- node version >=20 and <23
 
 # Installing
 
@@ -180,7 +180,7 @@ Engines should be set to the following:
 ```json
 {
   "engines": {
-    "node": ">=20 <25",
+    "node": ">=20 <23",
     "npm": ">=3.10.10"
   }
 }

Dockerfile

@@ -2,7 +2,7 @@
 # An elaborated scheme to build all the dependencies of all packages first in a cached layer
 # https://stackoverflow.com/a/63142468/134409
 # https://medium.com/@emilefugulin/building-a-sane-docker-image-for-typescript-lerna-and-prisma-2-76d8ff9926e4
-FROM node:22.22.0-bookworm-slim@sha256:f86be15afa9a8277608e141ce2a8aa55d3d9c40845921b8511f4fb7897be2554 AS filter-packages-json
+FROM node:22.16.0-bookworm-slim@sha256:2f3571619daafc6b53232ebf2fcc0817c1e64795e92de317c1684a915d13f1a5 AS filter-packages-json
 LABEL maintainer="Developer Relations <developer-relations-team@bitgo.com>"
 
 COPY package.json yarn.lock lerna.json ./
@@ -12,7 +12,7 @@ COPY modules ./modules
 # delete all the non package.json files under `./modules/`
 RUN find modules \! -name "package.json" -mindepth 2 -maxdepth 2 -print | xargs rm -rf
 
-FROM node:22.22.0-bookworm-slim@sha256:f86be15afa9a8277608e141ce2a8aa55d3d9c40845921b8511f4fb7897be2554 AS builder
+FROM node:22.16.0-bookworm-slim@sha256:2f3571619daafc6b53232ebf2fcc0817c1e64795e92de317c1684a915d13f1a5 AS builder
 RUN apt-get update && apt-get install -y git python3 make g++ libtool autoconf automake
 WORKDIR /tmp/bitgo
 COPY --from=filter-packages-json /tmp/bitgo .
@@ -31,7 +31,7 @@ RUN \
     rm -r modules/*/src
 
 
-FROM node:22.22.0-bookworm-slim@sha256:f86be15afa9a8277608e141ce2a8aa55d3d9c40845921b8511f4fb7897be2554
+FROM node:22.16.0-bookworm-slim@sha256:2f3571619daafc6b53232ebf2fcc0817c1e64795e92de317c1684a915d13f1a5
 RUN apt-get update && apt-get install -y tini
 # copy the root node_modules to the bitgo-express parent node_modules
 COPY --from=builder /tmp/bitgo/node_modules  /var/node_modules/
@@ -109,7 +109,6 @@ COPY --from=builder /tmp/bitgo/modules/sdk-coin-stt /var/modules/sdk-coin-stt/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-stx /var/modules/sdk-coin-stx/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-sui /var/modules/sdk-coin-sui/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-tao /var/modules/sdk-coin-tao/
-COPY --from=builder /tmp/bitgo/modules/sdk-coin-tempo /var/modules/sdk-coin-tempo/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-tia /var/modules/sdk-coin-tia/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-ton /var/modules/sdk-coin-ton/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-trx /var/modules/sdk-coin-trx/
@@ -208,7 +207,6 @@ cd /var/modules/sdk-coin-stt && yarn link && \
 cd /var/modules/sdk-coin-stx && yarn link && \
 cd /var/modules/sdk-coin-sui && yarn link && \
 cd /var/modules/sdk-coin-tao && yarn link && \
-cd /var/modules/sdk-coin-tempo && yarn link && \
 cd /var/modules/sdk-coin-tia && yarn link && \
 cd /var/modules/sdk-coin-ton && yarn link && \
 cd /var/modules/sdk-coin-trx && yarn link && \
@@ -310,7 +308,6 @@ RUN cd /var/bitgo-express && \
     yarn link @bitgo/sdk-coin-stx && \
     yarn link @bitgo/sdk-coin-sui && \
     yarn link @bitgo/sdk-coin-tao && \
-    yarn link @bitgo/sdk-coin-tempo && \
     yarn link @bitgo/sdk-coin-tia && \
     yarn link @bitgo/sdk-coin-ton && \
     yarn link @bitgo/sdk-coin-trx && \

README.md

@@ -51,7 +51,7 @@ BitGoJS currently provides support for the following Node versions per package.j
 
 ```
 "engines": {
-  "node": ">=20 <25",
+  "node": ">=20 <23",
   "npm": ">=3.10.10"
 }
 ```
@@ -62,7 +62,6 @@ As each Node LTS version reaches its end-of-life we will exclude that version fr
 
 - `20`
 - `22`
-- `24`
 
 JavaScript package managers should allow you to install this package with any version of Node, with, at most, a warning if your version of Node does not fall within the range specified by our node engines property. If you encounter issues installing this package on a supported version of Node, please report the issue to us.