chore(deps): bump @icp-sdk/core from 5.4.0 to 6.1.0

[dependabot]

Bumps @icp-sdk/core from 5.4.0 to 6.1.0.

Release notes

Sourced from @​icp-sdk/core's releases.

v6.1.0 (2026-08-03)

Feat

• Revamp Agent.readState (#1375)

v6.0.0 (2026-07-06)

Feat

• wire the delegation permissions field through Delegation (#1366)
• effective subnet ID (#1360)
• support URLs with path components (#1361)

Changelog

Sourced from @​icp-sdk/core's changelog.

v6.1.0 (2026-08-03)

Feat

• Revamp Agent.readState (#1375)

v6.0.0 (2026-07-06)

Feat

• wire the delegation permissions field through Delegation (#1366)
• effective subnet ID (#1360)
• support URLs with path components (#1361)

Commits

• cb5e25e chore: release v6.1.0 (#1383)
• 78da43e feat: Revamp Agent.readState (#1375)
• eac56b8 chore: release v6.0.0 (#1374)
• 93f06fd feat: wire the delegation permissions field through Delegation (#1366)
• 3d2c107 feat!: effective subnet ID (#1360)
• ecad008 feat: support URLs with path components (#1361)
• See full diff in compare view

[dominicwilliams]

Decision: declining this one for now — evaluated, not ignored. @icp-sdk/core 6.1.0 itself checks out in isolation (build green, the ledger-verifier gate 6/6, the display-integrity and security batteries pass, and a full certificate-validated ledger verification ran clean on a live venue with it forced in). The blocker is upstream: @icp-sdk/auth@8.0.3 — the latest — peer-pins @icp-sdk/core@^5, so npm ci hard-fails on ERESOLVE, and our frontend build deliberately uses npm ci for supply-chain pinning, so the deploy path refuses the bump on every target. Adopting would mean --legacy-peer-deps/overrides against the SDK's own declared incompatibility, which defeats the pinning gate.

We re-evaluate the moment an @icp-sdk/auth release accepts core ^6; until then the range stays ^5.3.0. Closing — thanks, Dependabot. (Same note as the siblings: the mirror is a force-synced snapshot, so PRs against it can't merge in place; the bump will arrive from upstream when it lands.)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.