Prepare release: 0.13.3 (#2387)

Automated changes by
[create-pull-request](https://github.com/peter-evans/create-pull-request)
GitHub action

Co-authored-by: steebchen <steebchen@users.noreply.github.com>

Author: tarrencev

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.13.3] - 2026-02-06
+
+### ✨ New Features
+- **@cartridge/controller**: Added starterpack play callback functionality enabling custom game launch behavior and improved gaming integration (#2362)
+- **@cartridge/controller**: Added specialized controller toast notifications with improved messaging and user feedback for iframe-embedded applications (#2358)
+
+### 🚀 Improvements
+- **@cartridge/keychain**: Enhanced iframe connect flow with automatic Storage Access API request for improved cross-domain authentication in WebView environments (#2374)
+- **@cartridge/keychain**: Tightened Capacitor origin verification to only auto-verify localhost, requiring explicit authorization for custom hostnames in presets for enhanced security (#2375)
+- **@cartridge/controller**: Improved policy handling with canonical sorting before hashing to ensure consistent policy processing and prevent non-deterministic merkle root calculations (#2359)
+- **@cartridge/controller**: Enhanced preset verification for Capacitor environments with better validation and support for capacitor:// scheme (#2369)
+
+### 🐛 Bug Fixes
+- **@cartridge/controller**: Added ApprovalPolicy support to controller toWasmPolicies for proper merkle root calculation across different connectors, fixing session registration mismatches (#2372)
+- **@cartridge/controller**: Fixed aggregate contracts display on unverified session to properly group methods into "Approve <game>" expendable cards (#2304)
+- **@cartridge/controller**: Fixed controller re-initialization issues by reusing existing controller instances to prevent duplicate iframes and message channels (#2360)
+- **@cartridge/controller**: Fixed chain ID lookup to support non-Cartridge chain configurations for better multi-chain compatibility (#2361)
+- **@cartridge/keychain**: Fixed Coinbase sandbox configuration to ensure proper sandbox environment setup (#2371)
+- **@cartridge/keychain**: Fixed password login button alignment with primary theme for consistent UI styling (#2385)
+
 ## [0.13.2] - 2026-02-06
 
 ### 🐛 Bug Fixes

examples/capacitor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartridge-capacitor-example",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "private": true,
   "type": "module",
   "scripts": {

examples/next/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cartridge/controller-example-next",
   "private": true,
-  "version": "0.13.2",
+  "version": "0.13.3",
   "scripts": {
     "dev": "env-cmd -f .env.dev next dev -p 3002",
     "dev:live": "env-cmd -f .env.live next dev -p 3002",

examples/node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartridge-node-example",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Example of using Cartridge session controller with Node.js",
   "type": "module",
   "scripts": {

examples/svelte/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cartridge/controller-example-svelte",
-	"version": "0.13.2",
+	"version": "0.13.3",
 	"private": true,
 	"scripts": {
 		"dev": "vite dev",

output.txt

@@ -1,6 +1,6 @@
 {
   "name": "@cartridge/connector",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Cartridge Controller Connector",
   "repository": {
     "type": "git",

packages/connector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cartridge/controller",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Cartridge Controller",
   "repository": {
     "type": "git",

packages/controller/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cartridge/eslint",
   "private": true,
-  "version": "0.13.2",
+  "version": "0.13.3",
   "type": "module",
   "exports": {
     ".": "./index.js"

packages/eslint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cartridge/keychain",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "private": true,
   "type": "module",
   "scripts": {