encodeQR throws invalid border=0 with qr@0.6.0

[v1n35h]

Check existing issues

• I checked there isn't already an issue for the bug I encountered.

Cuer Version

0.0.3

Current Behavior

Cuer crashes at render with Error: invalid border=0 thrown from encodeQR.

Call stack: encodeQR → create (cuer/_dist/QrCode.js:4) → mountMemo → useMemo → Root.

Root cause: cuer's QrCode.create() calls encodeQR(value, 'raw', { border: 0, ... }), but qr@0.6.0 (released 2026-04-28 as
part of the "April 2026 audit") added stricter input validation that rejects border <= 0:

// node_modules/qr/index.js:1565
const border = _opts.border === undefined ? 2 : _opts.border;
if (!Number.isSafeInteger(border) || border <= 0)
  throw new Error(`invalid border=${border}`);

Because cuer's dependency range is "qr": "~0", any fresh npm install after 2026-04-28 resolves qr@0.6.0 and breaks. I hit it
via @rainbow-me/rainbowkit@2.2.11, whose WalletConnect connect view mounts .

Expected Behavior

Cuer renders the QR code without throwing. border: 0 was valid in qr@0.5.x and below; cuer should either pass a positive border
value (e.g. border: 1) and slice it off, or tighten its peer range to "qr": "~0.5" to avoid pulling 0.6.x.

Steps To Reproduce

1. npm create next-app@latest repro -- --ts --app --no-tailwind --src-dir=false --eslint --import-alias "@/*"

2. cd repro && npm i cuer

3. Render anywhere on a client page:

   "use client";
   import { Cuer } from "cuer";
   export default function Page() {
     return <Cuer value="wc:test@2?relay-protocol=irn&symKey=abc" />;
   }

4. npm run dev, open the page → runtime error: invalid border=0.

Reproduces with cuer@0.0.3 + qr@0.6.0 (the version npm picks today under the ~0 range).

Workaround: "overrides": { "qr": "0.5.5" } in package.json.

Link to Minimal Reproducible Example

https://stackblitz.com/edit/node-ezpj2br6?file=index.js

Anything else?

• cuer: 0.0.3

• qr (resolved transitive): 0.6.0

• @rainbow-me/rainbowkit: 2.2.11 (how I hit it in production)

• Node: v26.0.0

• Browser: Safari 14+ on macOS (also reproduces in Chrome — not browser-specific)

• OS: macOS 15

  The fix is one line in _dist/QrCode.js — either change border: 0 to border: 1 and adjust the grid slice, or omit border
  and slice the default 2-module quiet zone off. Happy to send a PR if useful.

[larrifax]

There's a PR for qr@0.6.0 compatibility at #11, doing the "grid slice" strategy you've mentioned.
Lets hope it gets merged soon 🤞

[yannickrocks]

Hit this via RainbowKit — adding the chain and a workaround for anyone landing here.

Chain: @rainbow-me/rainbowkit@2.2.11 → cuer@0.0.3 → qr: ~0 → resolves qr@0.6.0 on fresh installs. Every WalletConnect QR render then throws Error: invalid border=0 (cuer's QrCode.create hardcodes border: 0; qr 0.6.0 added quiet-zone validation rejecting border <= 0 — intended behavior per paulmillr/qr#36).

Worth noting: typecheck and next build stay green — this only fails at runtime in the browser, so it slips past CI.

Bisection: qr@0.5.5 is the last working version; 0.6.0 (published 2026-04-28) is the first that throws.

Workaround until the merged fix (#11) is released:

// package.json (pnpm)
"pnpm": { "overrides": { "qr": "0.5.5" } }

A release including #11 would resolve this — thanks!