Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 3 updates - #271

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-73a8ed4810
Open

chore(deps): bump the production-dependencies group across 1 directory with 3 updates#271
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-73a8ed4810

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 3 updates in the / directory: mppx, undici and viem.

Updates mppx from 0.12.0 to 0.13.4

Release notes

Sourced from mppx's releases.

mppx@0.13.4

Patch Changes

  • a732d24: Fixed tempo/session settlement failing after confirmation when a lagging RPC replica served the readback; settle read channel state at the receipt's block. Confirmed checkpoint failures were also reported.
  • d27f02d: Fixed tempo/session onSessionSettlement double-counting a retried settlement after a failed checkpoint; delta now comes from the receipt's deltaPaid. Exported SettlementCheckpointError as tempo.SettlementCheckpointError from mppx/server.
  • a732d24: Changed tempo/session to serve charged requests when a scheduled settlement's lease claim, JSON-RPC rate limit, internal RPC error or receipt wait failed transiently; the next settlement collected the charge.
  • bbbec69: Added a fresh HMAC-bound issuance nonce to server-generated payment challenges while preserving route metadata checks.
  • 53c394a: Prevented CLI validation probes from following redirects.
  • 99b6e08: Prevented WebSocket payment authorization after cancellation and settled interrupted connection attempts.

mppx@0.13.3

Patch Changes

  • 06dc781: Fixed tempo/session reopening a channel when a broadcast close failed ambiguously. The pending-close marker stayed until the close transaction expired, and a later voucher or close cleared it once the chain showed the channel still open.
  • 55c3c26: Changed tempo/session to serve a charged request when its scheduled settlement hit a transport or RPC failure; the next settlement collected the charge. Reverts and configuration errors still failed the request.
  • c22cf1a: Fixed tempo/session failing a charged request when its settlement confirmed but the channel store could not record it. settle raised SettlementCheckpointError with the transaction hash instead.
  • 6921631: Fixed scheduled tempo/session settlement marking charges accepted while the settlement transaction was pending as settled. settle recorded the spend and units read with the submitted voucher instead.
  • 55c3c26: Added onSessionSettlementFailure to tempo.session(), called with the chain, channel, error and trigger (scheduled or close) when a scheduled settlement or close transaction fails.

mppx@0.13.2

Patch Changes

  • ac542e3: Enforced offer eligibility before settling native transport credentials.
  • 3b08fc4: Fixed tempo/charge releasing another request's replay marker when a transaction's final hash collided with an already-claimed hash, which let a settled transaction pass replay protection again.
  • 9856cd2: Disabled automatic redirects on credential-bearing fetch retries to prevent payment credential disclosure.
  • 5c81137: Used verified token decimals when enforcing persistent CLI session deposit limits.

mppx@0.13.1

Patch Changes

  • ec6c6cf: Added paired Elysia lifecycle hooks that wrapped actual route responses for streaming metering. Rejected streaming payments registered with only a beforeHandle hook and required Elysia 1.2.0 or newer.
  • 86dddc8: Stopped emitting payment-success events when authorization reused existing access without verifying a new credential.
  • e60b7ea: Settled previously accepted vouchers when terminal voucher processing detected a pending channel close, using the existing shared scheduled-settlement claim. Kept standalone validation free of settlement side effects.
  • cfb4bff: Reserved stream charges atomically in shared channel state and released or expired unused reservations.
Changelog

Sourced from mppx's changelog.

0.13.4

Patch Changes

  • a732d24: Fixed tempo/session settlement failing after confirmation when a lagging RPC replica served the readback; settle read channel state at the receipt's block. Confirmed checkpoint failures were also reported.
  • d27f02d: Fixed tempo/session onSessionSettlement double-counting a retried settlement after a failed checkpoint; delta now comes from the receipt's deltaPaid. Exported SettlementCheckpointError as tempo.SettlementCheckpointError from mppx/server.
  • a732d24: Changed tempo/session to serve charged requests when a scheduled settlement's lease claim, JSON-RPC rate limit, internal RPC error or receipt wait failed transiently; the next settlement collected the charge.
  • bbbec69: Added a fresh HMAC-bound issuance nonce to server-generated payment challenges while preserving route metadata checks.
  • 53c394a: Prevented CLI validation probes from following redirects.
  • 99b6e08: Prevented WebSocket payment authorization after cancellation and settled interrupted connection attempts.

0.13.3

Patch Changes

  • 06dc781: Fixed tempo/session reopening a channel when a broadcast close failed ambiguously. The pending-close marker stayed until the close transaction expired, and a later voucher or close cleared it once the chain showed the channel still open.
  • 55c3c26: Changed tempo/session to serve a charged request when its scheduled settlement hit a transport or RPC failure; the next settlement collected the charge. Reverts and configuration errors still failed the request.
  • c22cf1a: Fixed tempo/session failing a charged request when its settlement confirmed but the channel store could not record it. settle raised SettlementCheckpointError with the transaction hash instead.
  • 6921631: Fixed scheduled tempo/session settlement marking charges accepted while the settlement transaction was pending as settled. settle recorded the spend and units read with the submitted voucher instead.
  • 55c3c26: Added onSessionSettlementFailure to tempo.session(), called with the chain, channel, error and trigger (scheduled or close) when a scheduled settlement or close transaction fails.

0.13.2

Patch Changes

  • ac542e3: Enforced offer eligibility before settling native transport credentials.
  • 3b08fc4: Fixed tempo/charge releasing another request's replay marker when a transaction's final hash collided with an already-claimed hash, which let a settled transaction pass replay protection again.
  • 9856cd2: Disabled automatic redirects on credential-bearing fetch retries to prevent payment credential disclosure.
  • 5c81137: Used verified token decimals when enforcing persistent CLI session deposit limits.

0.13.1

Patch Changes

  • ec6c6cf: Added paired Elysia lifecycle hooks that wrapped actual route responses for streaming metering. Rejected streaming payments registered with only a beforeHandle hook and required Elysia 1.2.0 or newer.
  • 86dddc8: Stopped emitting payment-success events when authorization reused existing access without verifying a new credential.
  • e60b7ea: Settled previously accepted vouchers when terminal voucher processing detected a pending channel close, using the existing shared scheduled-settlement claim. Kept standalone validation free of settlement side effects.
  • cfb4bff: Reserved stream charges atomically in shared channel state and released or expired unused reservations.

0.13.0

Minor Changes

  • e6f903f: Required shared replay storage for Stripe Tempo payment methods.
  • 44b9115: Removed the deprecated legacy session client exports.

Patch Changes

  • e73cd68: Fixed Node server responses so streams stopped when clients disconnected.
  • eb888ab: Fixed server request handling so bodies were bounded and backpressured.

... (truncated)

Commits
  • d8d800f chore: version packages (#1019)
  • a732d24 fix(tempo): serve transient settlement failures and read back at the receipt ...
  • 53c394a fix(cli): reject redirects during endpoint validation (#1021)
  • 99b6e08 fix(session): honor cancellation before WebSocket authorization (#1022)
  • bbbec69 fix(server): randomize payment challenge issuance (#996)
  • d27f02d fix(tempo): report settlement deltas from the receipt and export SettlementCh...
  • 59de230 chore: version packages (#1015)
  • c22cf1a fix(tempo): keep confirmed settlements successful when their checkpoint fails...
  • 06dc781 fix(tempo): keep ambiguous session closes pending and reconcile expired ones ...
  • 55c3c26 feat(tempo): report failed session settlements and serve retryable failures (...
  • Additional commits viewable in compare view

Updates undici from 8.10.2 to 8.11.2

Release notes

Sourced from undici's releases.

v8.11.2

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.11.1...v8.11.2

v8.11.1

What's Changed

Full Changelog: nodejs/undici@v8.11.0...v8.11.1

v8.11.0

What's Changed

... (truncated)

Commits

Updates viem from 2.57.1 to 2.57.4

Release notes

Sourced from viem's releases.

viem@2.57.4

Patch Changes

viem@2.57.3

Patch Changes

viem@2.57.2

Patch Changes

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 18, 2026
@socket-security

socket-security Bot commented Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedundici@​8.10.2 ⏵ 8.11.293100100 +198100
Updatedviem@​2.57.1 ⏵ 2.57.497100100 +198 +1100
Addedmppx@​0.13.49910010098100

View full report

claude[bot]
claude Bot reviewed Oct 18, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reviewed this dependency bump and didn't find any bugs. mppx is the payment library this wallet CLI is built on, and it moves to a new 0.x minor version, so a human look is still worthwhile.

What was reviewed:

  • package.json: all three versions are still pinned exactly. The mppx 0.12.0 → 0.13.4 bump changes payment-flow behavior: challenges now carry an HMAC issuance nonce, credential-bearing retries no longer follow redirects, and session settlement handling changed. These changes reach the code in src/request (charge.ts, session.ts, session-topup.ts, challenge.ts) and src/commands/transfer.
  • pnpm-lock.yaml: accounts@ 0.21.0 still depends on mppx 0.12.0, so two mppx versions now sit side by side in the tree. Check that no mppx objects or types are passed between accounts and the CLI's own mppx 0.13.4.
  • The release notes in the PR only cover 0.13.1–0.13.4. The 0.13.0 notes, where any breaking changes would be listed, don't appear there.
Extended reasoning...

The change touches only package.json and pnpm-lock.yaml. It bumps mppx (0.12.0 to 0.13.4), undici and viem, and adds transitive packages such as a second mppx, ox, zod 4.6.6 and eventsource-parser. No source code changes, but mppx handles payment credentials, challenges and session settlement in this wallet CLI, which is a security-sensitive area. The 0.x minor bump changes how challenges, redirects and settlement behave, and the lockfile now holds two mppx versions. Those two facts mean a human should confirm CI and the payment flows still work, which is why this is deferred rather than approved.

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
9788a02 
…y with 3 updates

Bumps the production-dependencies group with 3 updates in the / directory: [mppx](https://github.com/wevm/mppx), [undici](https://github.com/nodejs/undici) and [viem](https://github.com/wevm/viem).


Updates `mppx` from 0.12.0 to 0.13.4
- [Release notes](https://github.com/wevm/mppx/releases)
- [Changelog](https://github.com/wevm/mppx/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/mppx/compare/mppx@0.12.0...mppx@0.13.4)

Updates `undici` from 8.10.2 to 8.11.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.10.2...v8.11.2)

Updates `viem` from 2.57.1 to 2.57.4
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.57.1...viem@2.57.4)

---
updated-dependencies:
- dependency-name: mppx
  dependency-version: 0.13.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 8.11.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: viem
  dependency-version: 2.57.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-73a8ed4810 branch from ed03346 to 9788a02 Compare October 19, 2026 10:08

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claude claude[bot] claude[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants