The Rainbow wallet exact-pins its dependencies as a security posture: https://github.com/rainbow-me/rainbow/blob/2c38c133cc20648f4de1089674d2e85c8d7c5dc5/.yarnrc.yml#L3
In rainbow-me/rainbow#6946 (Polymarket integration, merged 2026-01-06), the wallet's @ethersproject/* block was bumped from 5.7.x to 5.8.0:
https://github.com/rainbow-me/rainbow/blob/2c38c133cc20648f4de1089674d2e85c8d7c5dc5/package.json#L152-L170
This package, pinned in the wallet at:
https://github.com/rainbow-me/rainbow/blob/2c38c133cc20648f4de1089674d2e85c8d7c5dc5/package.json#L184
With exact pins on both sides, yarn cannot dedupe. The wallet's lockfile resolves both 5.7.x and 5.8.0 in parallel, doubling those packages in the bundle. rainbow-me/rainbow#6737 reports the resulting duplication.
The Rainbow wallet exact-pins its dependencies as a security posture: https://github.com/rainbow-me/rainbow/blob/2c38c133cc20648f4de1089674d2e85c8d7c5dc5/.yarnrc.yml#L3
In rainbow-me/rainbow#6946 (Polymarket integration, merged 2026-01-06), the wallet's
@ethersproject/*block was bumped from 5.7.x to 5.8.0:https://github.com/rainbow-me/rainbow/blob/2c38c133cc20648f4de1089674d2e85c8d7c5dc5/package.json#L152-L170
This package, pinned in the wallet at:
https://github.com/rainbow-me/rainbow/blob/2c38c133cc20648f4de1089674d2e85c8d7c5dc5/package.json#L184
With exact pins on both sides, yarn cannot dedupe. The wallet's lockfile resolves both 5.7.x and 5.8.0 in parallel, doubling those packages in the bundle. rainbow-me/rainbow#6737 reports the resulting duplication.