chore!: use @icp-sdk/core in imports (#4455)

* use @icp-sdk/core instead

* fix vite dedupe

* revert local candid

* bump candid_parser

* pin serde to avoid dependency mess

* clippy

* update a bunch of references

* libobjc is ok because its part of macos by default

* use new response-verification commit

* ignore advisory

* changelog

* fmt

* update frontend canister

* warn is now warning

* cleanup

Author: viviveevee

.github/workflows/audit.yml

@@ -35,6 +35,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions-rust-lang/audit@v1
         with:
+          # RUSTSEC-2026-0001
           # TODO: remove this once the fix is backported to rkyv v0.7
           # https://github.com/rkyv/rkyv/issues/644
-          ignore: RUSTSEC-2026-0001
+
+          # RUSTSEC-2024-0437
+          # Ok to ignore because it is only used in the monorepo, which forbids using the affected type.
+
+          ignore: RUSTSEC-2026-0001,RUSTSEC-2024-0437

.github/workflows/publish.yml

@@ -86,7 +86,7 @@ jobs:
       - name: Check dynamically-linked libraries (macos)
         run: |
           ACTUAL="$(otool -L ${{ matrix.binary_path }}/dfx | awk 'NR > 1{ print $1 }' | grep -v /System/Library/Frameworks | sort | awk -v d=" " '{s=(NR==1?s:s d)$0}END{printf "%s",s}')"
-          EXPECTED="/usr/lib/libSystem.B.dylib /usr/lib/libc++.1.dylib /usr/lib/libiconv.2.dylib"
+          EXPECTED="/usr/lib/libSystem.B.dylib /usr/lib/libc++.1.dylib /usr/lib/libiconv.2.dylib /usr/lib/libobjc.A.dylib"
           echo "Dynamically-linked libraries:"
           echo "  Actual:   $ACTUAL"
           echo "  Expected: $EXPECTED"

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 # UNRELEASED
 
+### chore!: `dfx generate` now imports `@icp-sdk/core` instead of `@dfinity/` packages
+
+It is possible to restore the previous behavior by replacing uses of `dfx generate` with e.g. `dfx generate && find src/declarations -type f -exec perl -i -pe 's|@dfinity/|@icp-sdk/core/|g' {} +`.
+Most projects will want to substitute this in the frontend's `package.json`, in the `"prebuild"` step.
+
 ### feat: support for canister ID migration
 
 Canister ID migration can be performed using `dfx canister migrate-id`
@@ -31,6 +36,11 @@ This incorporates the following executed proposals:
 - [139766](https://dashboard.internetcomputer.org/proposal/139766)
 - [139674](https://dashboard.internetcomputer.org/proposal/139674)
 
+### Frontend canister
+
+- Module hash: 2830d9934ea6ec87e35e3a8b56dda562a3b09c1f94cd1fa3c0db3c2e41a4340c
+- https://github.com/dfinity/sdk/pull/4455
+
 # 0.30.2
 
 ### Frontend canister