[vvillait88]

Summary

Release 3.1.3. This takes @agent-score/sdk 2.9.2 and relocks two transitive dependencies to clear their advisories:

• vite 8.2.2 to 8.3.4: clears three dev-server advisories (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw). vite only comes in through vitest.
• follow-redirects 1.16.0 to 1.16.1: clears GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c, two ways credential headers can survive a cross-origin redirect. It comes in through axios under @coinbase/x402, which this repo installs as a dev dependency. Merchants that accept x402 install @coinbase/x402 themselves, so their own lockfiles decide which follow-redirects they run.

The dependency range on @agent-score/sdk moves from ^2.9.1 to ^2.9.2, and the version moves to 3.1.3 so the release publishes.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged. No source files change.

Test plan

• bun run lint, bun run typecheck, bun run test (1637 passed, 4 skipped), bun run build. knip ran clean in the pre-push hook.
• osv-scanner on bun.lock: no issues found. Before this change it reported the vite and follow-redirects advisories.

Checklist

• Tests cover the new behavior, and the suite passes locally (no new behavior; the existing suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review: Release 3.1.3

Verdict: no blocking findings. Reviewed at head a8e870fb4e20fc5a7b3f883b199647510bdee83a, base daa1b39b11fc5cd5328fdb9627794ebaeeee831c (equal to current main).

Diff

• 2 files, 1 commit. package.json: version 3.1.2 to 3.1.3, @agent-score/sdk ^2.9.1 to ^2.9.2. Runtime dependencies holds only the sdk; no other runtime or peer range moved.
• bun.lock, every changed line read: root sdk range; @agent-score/sdk 2.9.1 to 2.9.2; vite 8.2.2 to 8.3.4; rolldown 1.2.6 to 1.2.14 plus its 15 platform bindings and rolldown/@oxc-project/types 0.147.0 to 0.154.0; postcss 8.5.26 to 8.5.31; nanoid 3.3.18 to 3.3.20; follow-redirects 1.16.0 to 1.16.1. Nothing else moved. Package count is unchanged (842 head and base, per osv-scanner).

Registry

• Lock integrity for sdk 2.9.2 sha512-qF4db6...kQ0UeIrpw== equals npm view @agent-score/sdk@2.9.2 dist.integrity.
• 3.1.3 is unreleased: v3.1.3 is absent from the repo tags (latest v3.1.2), and npm's version list ends at 3.1.2.

osv-scanner 2.7.0

• Base lock (positive control): 842 packages, 5 advisories across 2 packages, exit 1: follow-redirects 1.16.0 (GHSA-8r9p-f939-6h3c, GHSA-q3jh-wrc6-jgq8), vite 8.2.2 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw).
• Head lock: 842 packages, no issues, exit 0.

Claims in the body

• follow-redirects path, read from the lock graph: its only dependent is axios; axios's dependents are @coinbase/cdp-sdk (plus the root overrides entry and axios-retry's peer); @coinbase/cdp-sdk's only dependent is @coinbase/x402, which sits in devDependencies and not in peerDependencies. The source loads it through a dynamic import in src/payment/x402_server.ts with an install hint when it is missing, so "merchants install it themselves" is accurate.
• vite's dependents in the lock are vitest and @vitest/mocker only, so "vite only comes in through vitest" is accurate.

Hardcoded versions

• Grep of the head tree (excluding the lock) for 3.1.2, 3.1.3 and 2.9.1: the one hit is package.json. The User-Agent version comes from the build-time __VERSION__ define (src/core.ts), so nothing else needs a bump.

PR body

• Follows the repo template (Summary, Type of change, Public API, Test plan, Checklist). The two unticked checklist items each carry a reason. No em-dashes, ticket ids or session links in the title, body or commit.

Checks

All 9 rows pass: ci, node-compat (22, 24, 26), Dependency Scan, CodeQL, Analyze (actions), and both Analyze (javascript-typescript) runs.