diff --git a/issues/upgrade-nostr-tools.md b/issues/upgrade-nostr-tools.md
index 6a743e67..3a0c2ba6 100644
--- a/issues/upgrade-nostr-tools.md
+++ b/issues/upgrade-nostr-tools.md
@@ -1,8 +1,8 @@
 # Upgrade nostr-tools
 
-- **Current Version:** 2.20.0
-- **Wanted Version:** 2.21.0
-- **Latest Version:** 2.21.0
+- **Current Version:** 2.19.4
+- **Wanted Version:** 2.20.0
+- **Latest Version:** 2.20.0
 
 **Status:** Skipped (Risky/Protocol)
-**Reason:** This is a cryptographic/protocol library. As per security guardrails, manual review is required before upgrading. The upgrade from 2.20 to 2.21 is minor but still falls under the "anything touching nostr-tools" policy.
+**Reason:** This is a cryptographic/protocol library. As per security guardrails, manual review is required before upgrading.
diff --git a/tests/nostr-login-permissions.test.mjs b/tests/nostr-login-permissions.test.mjs
index 1a81e753..0fa80c4c 100644
--- a/tests/nostr-login-permissions.test.mjs
+++ b/tests/nostr-login-permissions.test.mjs
@@ -313,7 +313,7 @@ test("NIP-07 login falls back when structured permissions fail", async () => {
     const pubkey = result.pubkey;
     assert.equal(pubkey, HEX_PUBKEY);
     assert.ok(env.enableCalls.length >= 2, "should retry with alternate payloads");
-    const [objectCall, stringCall, plainCall] = env.enableCalls;
+    const [objectCall, stringCall] = env.enableCalls;
     assert.ok(Array.isArray(objectCall?.permissions));
     assert.equal(
       typeof objectCall.permissions[0],