thirdweb@5.121.0

Minor Changes

• #8887 133e57d Thanks @0xFirekeeper! - Redirect-based in-app wallet logins now include and verify a one-time state value before AutoConnect consumes auth material returned in the URL, tying the returned token back to a flow the page actually started. Added a readUrlToken option to AutoConnect / useAutoConnect to opt out of reading wallet auth material from the URL entirely.

Patch Changes

• #8886 e4fba08 Thanks @blockgroot! - Fix: EIP1193.toProvider()'s removeListener is no longer a no-op. Previously, removeListener discarded the unsubscribe function returned by wallet.subscribe(), so listeners registered via provider.on(...) (e.g. accountsChanged, chainChanged, disconnect) could never actually be detached — they kept firing after callers (such as wagmi connectors) believed they had unsubscribed. removeListener now tracks and invokes the correct unsubscribe function per (event, listener) pair.

• #8807 8c521aa Thanks @Yash094! - Fix: injected wallets (e.g. MetaMask) no longer fire a spurious "disconnect" event for transient EIP-1193 error code 1013 ("disconnected, will reconnect"). Previously, MetaMask's temporary disconnect during chain changes or RPC hiccups would trigger the thirdweb disconnect subscriber and tear down wallet state, causing unexpected logouts. The onDisconnect handler now ignores code-1013 errors and lets MetaMask reconnect automatically.

  Additionally, the WalletEmitterEvents["disconnect"] type is updated from never to WalletDisconnectError | undefined, so disconnect subscribers can inspect the underlying EIP-1193 error code and message when they need to distinguish disconnect causes.

• #8875 f411769 Thanks @SashaMIT! - Reject SIWE login payloads with an unparseable Not Before or Expiration Time instead of skipping the time-bound checks.