Bump the "weekly-dependencies" group with 5 updates across multiple ecosystems

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the weekly-dependencies group with 3 updates in the /conformance directory: mppx, @types/node and tsx.

Updates mppx from 0.8.18 to 0.9.2

Release notes

Sourced from mppx's releases.

mppx@0.9.2

Patch Changes

• 14e8b25: Added CLI support for selecting and paying x402 payment challenges.
• 5cbc5e4: Added request-scoped PaymentIntent customer, receipt email, and Tax calculation options, with fallback recording without rejected optional fields for completed crypto payments.
• b12e65b: Fixed framework adapters to preserve multi-method intent challenges.
• f13f800: Added a machine-payment metadata field to every Stripe PaymentIntent created by mppx.
• 9dd9969: Added opt-in Stripe-hosted Tempo fee sponsorship to stripe.create() using the configured Stripe client.

mppx@0.9.1

Patch Changes

• a33ff0a: Added MACH as a charge currency with stablecoin gas fallback and preserved session recovery.
• c74d2ce: Added request-scoped PaymentIntent metadata to Stripe machine payment charge handlers, and exposed pre-transform request input to payment-success callbacks.
• 2735c65: Fixed MCP payment errors to use the specification-defined JSON-RPC codes and retry verification challenges.

mppx@0.9.0

Minor Changes

• c23eaf0: Removed machineUSD charge and session flows, requiring servers that advertise machineUSD to remove that configuration before upgrading.

Patch Changes

• 9582c40: Routed hosted Tempo fee-payer fills through the configured withFeePayer transport and broadcast completed transactions through the default RPC transport.
• d343aae: Added preparePayment for inspecting a selected client payment before creating and attaching its credential.
• 7ce3160: Added the V8 coverage provider required by the configured test coverage command.
• 5e10359: Fixed concurrent HTML builds sharing a temporary directory.
• 4e4810a: Added a requiresAuth server option that used Payment-Authorization for Payment credentials.
• 1a36a5e: Added HTTP headers to remote Tempo fee-payer configuration.
• 07c59cf: Added dual MPP/x402 wrappers for Express, Hono, Next.js, and MCP, backed by official x402 adapters and native MPP protocol handling. Exposed Tempo and source-chain MPP payments for compatible EVM requirements; x402 Fastify and Axios compatibility adapters were deferred.

mppx@0.8.19

Patch Changes

• 0850f5d: Preserved configured fee tokens for hosted server-driven Tempo session settlement and close transactions.

Changelog

Sourced from mppx's changelog.

0.9.2

Patch Changes

• 14e8b25: Added CLI support for selecting and paying x402 payment challenges.
• 5cbc5e4: Added request-scoped PaymentIntent customer, receipt email, and Tax calculation options, with fallback recording without rejected optional fields for completed crypto payments.
• b12e65b: Fixed framework adapters to preserve multi-method intent challenges.
• f13f800: Added a machine-payment metadata field to every Stripe PaymentIntent created by mppx.
• 9dd9969: Added opt-in Stripe-hosted Tempo fee sponsorship to stripe.create() using the configured Stripe client.

0.9.1

Patch Changes

• a33ff0a: Added MACH as a charge currency with stablecoin gas fallback and preserved session recovery.
• c74d2ce: Added request-scoped PaymentIntent metadata to Stripe machine payment charge handlers, and exposed pre-transform request input to payment-success callbacks.
• 2735c65: Fixed MCP payment errors to use the specification-defined JSON-RPC codes and retry verification challenges.

0.9.0

Minor Changes

• c23eaf0: Removed machineUSD charge and session flows, requiring servers that advertise machineUSD to remove that configuration before upgrading.

Patch Changes

• 9582c40: Routed hosted Tempo fee-payer fills through the configured withFeePayer transport and broadcast completed transactions through the default RPC transport.
• d343aae: Added preparePayment for inspecting a selected client payment before creating and attaching its credential.
• 7ce3160: Added the V8 coverage provider required by the configured test coverage command.
• 5e10359: Fixed concurrent HTML builds sharing a temporary directory.
• 4e4810a: Added a requiresAuth server option that used Payment-Authorization for Payment credentials.
• 1a36a5e: Added HTTP headers to remote Tempo fee-payer configuration.
• 07c59cf: Added dual MPP/x402 wrappers for Express, Hono, Next.js, and MCP, backed by official x402 adapters and native MPP protocol handling. Exposed Tempo and source-chain MPP payments for compatible EVM requirements; x402 Fastify and Axios compatibility adapters were deferred.

0.8.19

Patch Changes

• 0850f5d: Preserved configured fee tokens for hosted server-driven Tempo session settlement and close transactions.

Commits

• 91a7dbe chore: version packages (#853)
• 1e3a3cf chore(deps): bump changesets/action in the github-actions group (#854)
• b12e65b fix: preserve multi-rail challenges in framework adapters (#857)
• 14e8b25 feat(cli): support x402 payment challenges (#850)
• 9dd9969 feat(stripe): add opt-in hosted Tempo fee payer (#842)
• 5cbc5e4 Additional Payment Intent Options (#858)
• f13f800 feat(stripe): mark machine payment intents (#851)
• 31fdbe3 chore: version packages (#847)
• c74d2ce feat: add request-scoped payment intent options (#849)
• 2735c65 fix: align MCP payment error codes with spec (#846)
• Additional commits viewable in compare view

Updates @types/node from 26.2.0 to 26.4.1

Commits

• See full diff in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• See full diff in compare view

Bumps the weekly-dependencies group with 1 update in the /conformance/adapters/rust directory: mpp.

Updates mpp from 0.11.0 to 0.12.0

Release notes

Sourced from mpp's releases.

v0.12.0

Minor Changes

• Accept asynchronous Alloy signers for Tempo fee sponsorship and session closing,
• enabling remote KMS, HSM, and MPC-backed server keys. (by @​BrendanRyan, #399)
• Added automatic native TIP-1034 channel top-ups before session vouchers exceed the current deposit, with credentials bound to each active WebSocket challenge across reconnects. (by @​BrendanRyan, #399)
• Support Tempo Wallet P-256 access keys for charge payments and expose the
• shared store.json loader for native command-line clients. (by @​BrendanRyan, #399)
• Add route-bound machineUSD session channels and atomic settlement into the
• merchant's configured stablecoin. (by @​BrendanRyan, #399)
• Add atomic stablecoin auto-swaps for native TIP-1034 session opens and top-ups,
• including the required Stablecoin DEX approval for charge and session payments. (by @​BrendanRyan, #399)
• Add a Charge-only payment provider backed by the canonical Tempo Accounts
• store.json, with lazy access-key selection and no separate signing mode. (by @​BrendanRyan, #399)
• Add separate non-mutating charge validation and terminal broadcast APIs, retaining verification as a compatibility alias and falling back to legacy method implementations. Add TempoRelayConfig and TempoBuilder::relay for delegating Tempo charge credential validation and finalization to Tempo API or a compatible MPP relay. Relay requests normalize the echoed challenge request, derive deterministic broadcast idempotency keys, validate returned receipts, and hide private relay failures. Add an Axum charge-relay example dogfooded against Tempo Moderato. (by @​BrendanRyan, #399)

Patch Changes

• Return a fresh body-bound payment challenge when request-body credential verification fails. (by @​BrendanRyan, #399)
• Pinned the Tempo dependency to the coordinated 7690815 revision. (by @​BrendanRyan, #399)
• Use the SDK-independent mpp_ prefix for Stripe PaymentIntent idempotency keys. (by @​BrendanRyan, #399)
• Continue retrying distinct charge challenges within the configured payment
• retry limit, matching MPPx and allowing sponsored servers to rotate challenges
• that were rejected before settlement. (by @​BrendanRyan, #399)
• Match MPPx and Tempo fee sponsorship by encoding P-256 charge and TIP-1034 management credentials as sender-signed 0x78 envelopes. (by @​BrendanRyan, #399)
• Authorize canonical application WebSockets with their advertised opening amount,
• and provide a top-up-aware authorization path for full reusable channels. (by @​BrendanRyan, #399)
• Reject payment challenges containing malformed RFC 3339 expires timestamps during header parsing. (by @​BrendanRyan, #399)
• Pinned an updated Tempo dependency revision and reworked the one-time authorization test to sign the key authorization with a real root signer. (by @​BrendanRyan, #399)
• Preserve method-specific receipt fields when parsing and serializing payment receipts. (by @​BrendanRyan, #399)
• Mark successful body-bound payment responses as private while preserving existing
• Cache-Control directives, preventing shared caches from storing payment receipts. (by @​BrendanRyan, #399)
• Updated the pinned tempo-alloy git revision. (by @​BrendanRyan, #399)
• Only attach payment receipts to successful responses from Tower middleware and Axum handlers. (by @​BrendanRyan, #399)
• Reject payment challenges whose method identifier contains characters other
• than lowercase ASCII letters. Reject payment challenges reached through a
• cross-origin redirect before a credential can be created or sent. (by @​BrendanRyan, #399)
• Reject Payment challenges containing an unterminated quoted-string parameter. (by @​BrendanRyan, #399)
• Resolve persisted Tempo Wallet key authorizations against the Account Keychain before signing. Already-authorized access keys now omit the one-time authorization instead of failing fresh charge or session transactions with KeyAlreadyExists. (by @​BrendanRyan, #399)
• Send payment credential retries directly to the final same-origin response URL after redirects. (by @​BrendanRyan, #399)
• Use the bootstrapped Tempo localnet image for reproducible integration tests. (by @​BrendanRyan, #399)
• Allowed Tempo signature variants without primitive key metadata while safely rejecting unsupported proof signatures. (by @​BrendanRyan, #399)
• Update the Tempo SDK revision so fee-payer relays can select the transaction fee token. (by @​BrendanRyan, #399)
• Load pending Accounts SDK key authorizations from the shared Tempo Wallet store so native Rust clients can provision a fresh access key with their first transaction. Open a fresh session after access-key rotation instead of trying to reuse a channel bound to the previous voucher signer. (by @​BrendanRyan, #399)

• feat: add canonical application WebSocket transport by @​gakonst in tempoxyz/mpp-rs#316
• fix(tempo): align proof credentials with account-bound v3 by @​gakonst in tempoxyz/mpp-rs#318

... (truncated)

Changelog

Sourced from mpp's changelog.

0.12.0 (2026-08-27)

Minor Changes

• Accept asynchronous Alloy signers for Tempo fee sponsorship and session closing,
• enabling remote KMS, HSM, and MPC-backed server keys. (by @​BrendanRyan, #399)
• Added automatic native TIP-1034 channel top-ups before session vouchers exceed the current deposit, with credentials bound to each active WebSocket challenge across reconnects. (by @​BrendanRyan, #399)
• Support Tempo Wallet P-256 access keys for charge payments and expose the
• shared store.json loader for native command-line clients. (by @​BrendanRyan, #399)
• Add route-bound machineUSD session channels and atomic settlement into the
• merchant's configured stablecoin. (by @​BrendanRyan, #399)
• Add atomic stablecoin auto-swaps for native TIP-1034 session opens and top-ups,
• including the required Stablecoin DEX approval for charge and session payments. (by @​BrendanRyan, #399)
• Add a Charge-only payment provider backed by the canonical Tempo Accounts
• store.json, with lazy access-key selection and no separate signing mode. (by @​BrendanRyan, #399)
• Add separate non-mutating charge validation and terminal broadcast APIs, retaining verification as a compatibility alias and falling back to legacy method implementations. Add TempoRelayConfig and TempoBuilder::relay for delegating Tempo charge credential validation and finalization to Tempo API or a compatible MPP relay. Relay requests normalize the echoed challenge request, derive deterministic broadcast idempotency keys, validate returned receipts, and hide private relay failures. Add an Axum charge-relay example dogfooded against Tempo Moderato. (by @​BrendanRyan, #399)

Patch Changes

• Return a fresh body-bound payment challenge when request-body credential verification fails. (by @​BrendanRyan, #399)
• Pinned the Tempo dependency to the coordinated 7690815 revision. (by @​BrendanRyan, #399)
• Use the SDK-independent mpp_ prefix for Stripe PaymentIntent idempotency keys. (by @​BrendanRyan, #399)
• Continue retrying distinct charge challenges within the configured payment
• retry limit, matching MPPx and allowing sponsored servers to rotate challenges
• that were rejected before settlement. (by @​BrendanRyan, #399)
• Match MPPx and Tempo fee sponsorship by encoding P-256 charge and TIP-1034 management credentials as sender-signed 0x78 envelopes. (by @​BrendanRyan, #399)
• Authorize canonical application WebSockets with their advertised opening amount,
• and provide a top-up-aware authorization path for full reusable channels. (by @​BrendanRyan, #399)
• Reject payment challenges containing malformed RFC 3339 expires timestamps during header parsing. (by @​BrendanRyan, #399)
• Pinned an updated Tempo dependency revision and reworked the one-time authorization test to sign the key authorization with a real root signer. (by @​BrendanRyan, #399)
• Preserve method-specific receipt fields when parsing and serializing payment receipts. (by @​BrendanRyan, #399)
• Mark successful body-bound payment responses as private while preserving existing
• Cache-Control directives, preventing shared caches from storing payment receipts. (by @​BrendanRyan, #399)
• Updated the pinned tempo-alloy git revision. (by @​BrendanRyan, #399)
• Only attach payment receipts to successful responses from Tower middleware and Axum handlers. (by @​BrendanRyan, #399)
• Reject payment challenges whose method identifier contains characters other
• than lowercase ASCII letters. Reject payment challenges reached through a
• cross-origin redirect before a credential can be created or sent. (by @​BrendanRyan, #399)
• Reject Payment challenges containing an unterminated quoted-string parameter. (by @​BrendanRyan, #399)
• Resolve persisted Tempo Wallet key authorizations against the Account Keychain before signing. Already-authorized access keys now omit the one-time authorization instead of failing fresh charge or session transactions with KeyAlreadyExists. (by @​BrendanRyan, #399)
• Send payment credential retries directly to the final same-origin response URL after redirects. (by @​BrendanRyan, #399)
• Use the bootstrapped Tempo localnet image for reproducible integration tests. (by @​BrendanRyan, #399)
• Allowed Tempo signature variants without primitive key metadata while safely rejecting unsupported proof signatures. (by @​BrendanRyan, #399)
• Update the Tempo SDK revision so fee-payer relays can select the transaction fee token. (by @​BrendanRyan, #399)
• Load pending Accounts SDK key authorizations from the shared Tempo Wallet store so native Rust clients can provision a fresh access key with their first transaction. Open a fresh session after access-key rotation instead of trying to reuse a channel bound to the previous voucher signer. (by @​BrendanRyan, #399)

Commits

• 965692a chore: release v0.12.0 (#320)
• 3c75742 fix: restrict payment receipts to successful responses (#399)
• 217578f ci: open the release PR via github-sts (#398)
• d441d53 ci(dependabot): approve and merge updates via github-sts (#397)
• fadc88c fix: Credential retries ignore the final same-origin response URL (#396)
• 50a0845 test: use bootstrapped Tempo localnet (#395)
• 175bea7 fix: support additional tempo signatures (#391)
• 85c62c5 chore(deps): bump tempo-alloy to 1.11.0 (#393)
• 1162fc9 feat(tempo): support async server signers (#389)
• bf3dfcb feat: add split charge validation and Tempo relay (#373)
• Additional commits viewable in compare view

Bumps the weekly-dependencies group with 1 update in the /conformance/adapters/python directory: pympp[tempo].

Updates pympp[tempo] from 0.10.1 to 0.11.0

Release notes

Sourced from pympp[tempo]'s releases.

v0.11.0

Minor Changes

• Added a VerifiableIntent protocol with separate validate and broadcast hooks plus bound Mpp.validate_credential() and Mpp.broadcast_credential() APIs, introduced a Relay adapter that delegates Tempo charge validation and finalization to the Tempo API relay (surfacing only safe machine-readable error codes and retryable 402 challenges on decline), and added a runnable charge-relay FastAPI example with a payer client. Relay idempotency keys use the pympp_ namespace, existing Stripe idempotency behavior remains unchanged, and Python validation details use snake_case. (by @​ParvAhuja, #204)
• Added configurable max_payment_retries parameter to PaymentTransport and Client, allowing callers to override the default retry limit of 3 instead of relying on a hardcoded constant. (by @​mpp-agricola[bot], #223)

Patch Changes

• Fixed currency validation during challenge matching by introducing a _method_accepts_currency helper that enforces case-insensitive currency comparison when a method has a configured currency constraint. Applied the check in both PaymentRuntime and McpClient challenge matching and credential creation paths. (by @​DerekCofausper, #232)
• Added MACH as a supported Tempo charge currency and selected a supported stablecoin with enough balance to cover unsponsored MACH transaction fees. (by @​ParvAhuja, #237)
• Fixed payment challenge request and opaque serialization to use RFC 8785 JSON Canonicalization Scheme (JCS) via the rfc8785 library, replacing ad-hoc json.dumps calls across HTTP and MCP transports. This ensures challenge IDs are reproducible from the exact bytes emitted on the wire, including non-ASCII characters and JCS number formatting. (by @​BrendanRyan, #235)
• Fixed initial requests to advertise supported payment methods via the Accept-Payment header, derived from the configured payment methods and their intents. Existing Accept-Payment headers are preserved when explicitly set by the caller. (by @​mpp-agricola[bot], #225)
• Fixed verify_or_challenge raising TypeError when a challenge carried a timezone-naive expires value. A naive timestamp parsed successfully but could not be compared to an aware now, surfacing as a server error instead of a fail-closed rejection; it is now rejected like any other invalid expires. (by @​BrendanRyan, #234)
• Reverted early termination on repeated actionable challenges, allowing the payment transport to retry payment even when the same challenge ID is received multiple times. (by @​mpp-agricola[bot], #224)
• Changed Stripe PaymentIntent and Tempo relay idempotency keys to use the SDK-independent mpp_ prefix while preserving their existing suffix construction. (by @​ParvAhuja, #220)
• Added a requires_auth server option that uses Payment-Authorization for Payment credentials so Authorization remains available for application authentication. (by @​RyanAubrey, #230)
• Used the bootstrapped Tempo localnet image for reproducible integration tests, replacing the dynamic latest tag pull-and-cache approach with a pinned tempo-localnet image digest. Removed the dev-key-based account funding fallback in favour of exclusively using the localnet faucet via tempo_fundAddress. (by @​BrendanRyan, #226)
• Fixed challenge selection to match on both method name and intent, preventing methods from being incorrectly matched to challenges with unsupported intents. Added intents property to the Method protocol to declare which payment intents each method supports. (by @​mpp-agricola[bot], #216)

• fix: Challenge selection ignores the intent by @​mpp-agricola[bot] in tempoxyz/pympp#216
• fix: support Core Metadata 2.5 releases by @​parvahuja in tempoxyz/pympp#218
• fix: preserve release changelog attribution by @​parvahuja in tempoxyz/pympp#219
• feat: add Tempo relay and verifiable intents by @​parvahuja in tempoxyz/pympp#204
• fix: use mpp idempotency prefix by @​parvahuja in tempoxyz/pympp#220
• fix: Repeated actionable challenges terminate payment handling early by @​mpp-agricola[bot] in tempoxyz/pympp#224
• test: use bootstrapped Tempo localnet by @​brendanjryan in tempoxyz/pympp#226
• ci(dependabot): approve and merge updates via github-sts by @​sds in tempoxyz/pympp#227
• ci: open the release PR via github-sts by @​sds in tempoxyz/pympp#228
• feat(server): compose payment handlers by @​bensandler-stripe in tempoxyz/pympp#229
• fix: Initial requests do not advertise supported payment methods by @​mpp-agricola[bot] in tempoxyz/pympp#225
• fix: Automatic payment retry limit is fixed by @​mpp-agricola[bot] in tempoxyz/pympp#223
• feat: add requires_auth so Payment credentials use Payment-Authorization by @​raubrey-stripe in tempoxyz/pympp#230
• fix: validate configured currency during challenge matching by @​decofe in tempoxyz/pympp#232
• feat(server): add payment method hooks by @​bensandler-stripe in tempoxyz/pympp#231
• fix(server): reject timezone-naive expires instead of raising by @​brendanjryan in tempoxyz/pympp#234
• fix: Challenge selection ignores the offered intent by @​mpp-agricola[bot] in tempoxyz/pympp#212
• fix: canonicalize challenge-bound JSON by @​brendanjryan in tempoxyz/pympp#235
• feat(tempo): support MACH charges by @​parvahuja in tempoxyz/pympp#237
• chore: release v0.11.0 by @​github-actions[bot] in tempoxyz/pympp#217

New Contributors

• @​sds made their first contribution in tempoxyz/pympp#227
• @​raubrey-stripe made their first contribution in tempoxyz/pympp#230

Full Changelog: tempoxyz/pympp@v0.10.1...v0.11.0

Changelog

Sourced from pympp[tempo]'s changelog.

0.11.0 (2026-08-28)

Minor Changes

• Added a VerifiableIntent protocol with separate validate and broadcast hooks plus bound Mpp.validate_credential() and Mpp.broadcast_credential() APIs, introduced a Relay adapter that delegates Tempo charge validation and finalization to the Tempo API relay (surfacing only safe machine-readable error codes and retryable 402 challenges on decline), and added a runnable charge-relay FastAPI example with a payer client. Relay idempotency keys use the pympp_ namespace, existing Stripe idempotency behavior remains unchanged, and Python validation details use snake_case. (by @​ParvAhuja, #204)
• Added configurable max_payment_retries parameter to PaymentTransport and Client, allowing callers to override the default retry limit of 3 instead of relying on a hardcoded constant. (by @​mpp-agricola[bot], #223)

Patch Changes

• Fixed currency validation during challenge matching by introducing a _method_accepts_currency helper that enforces case-insensitive currency comparison when a method has a configured currency constraint. Applied the check in both PaymentRuntime and McpClient challenge matching and credential creation paths. (by @​DerekCofausper, #232)
• Added MACH as a supported Tempo charge currency and selected a supported stablecoin with enough balance to cover unsponsored MACH transaction fees. (by @​ParvAhuja, #237)
• Fixed payment challenge request and opaque serialization to use RFC 8785 JSON Canonicalization Scheme (JCS) via the rfc8785 library, replacing ad-hoc json.dumps calls across HTTP and MCP transports. This ensures challenge IDs are reproducible from the exact bytes emitted on the wire, including non-ASCII characters and JCS number formatting. (by @​BrendanRyan, #235)
• Fixed initial requests to advertise supported payment methods via the Accept-Payment header, derived from the configured payment methods and their intents. Existing Accept-Payment headers are preserved when explicitly set by the caller. (by @​mpp-agricola[bot], #225)
• Fixed verify_or_challenge raising TypeError when a challenge carried a timezone-naive expires value. A naive timestamp parsed successfully but could not be compared to an aware now, surfacing as a server error instead of a fail-closed rejection; it is now rejected like any other invalid expires. (by @​BrendanRyan, #234)
• Reverted early termination on repeated actionable challenges, allowing the payment transport to retry payment even when the same challenge ID is received multiple times. (by @​mpp-agricola[bot], #224)
• Changed Stripe PaymentIntent and Tempo relay idempotency keys to use the SDK-independent mpp_ prefix while preserving their existing suffix construction. (by @​ParvAhuja, #220)
• Added a requires_auth server option that uses Payment-Authorization for Payment credentials so Authorization remains available for application authentication. (by @​RyanAubrey, #230)
• Used the bootstrapped Tempo localnet image for reproducible integration tests, replacing the dynamic latest tag pull-and-cache approach with a pinned tempo-localnet image digest. Removed the dev-key-based account funding fallback in favour of exclusively using the localnet faucet via tempo_fundAddress. (by @​BrendanRyan, #226)
• Fixed challenge selection to match on both method name and intent, preventing methods from being incorrectly matched to challenges with unsupported intents. Added intents property to the Method protocol to declare which payment intents each method supports. (by @​mpp-agricola[bot], #216)

Commits

• e514a95 chore: release v0.11.0 (#217)
• 41a6491 feat(tempo): support MACH charges (#237)
• baf6d98 fix: canonicalize challenge-bound JSON (#235)
• c473c06 fix: Challenge selection ignores the offered intent (#212)
• c86294a fix(server): reject timezone-naive expires instead of raising (#234)
• f0152b7 feat(server): add payment method hooks (#231)
• 05b0e1f fix: validate configured currency during challenge matching (#232)
• 17117b3 feat: add requires_auth so Payment credentials use Payment-Authorization (#230)
• 8bb447c fix: Automatic payment retry limit is fixed (#223)
• 95cdd3d fix: Initial requests do not advertise supported payment methods (#225)
• Additional commits viewable in compare view

Bumps the weekly-dependencies group with 2 updates in the /conformance/adapters/ruby directory: mpp-rb and sorbet-runtime.

Updates mpp-rb from 0.1.4 to 0.1.6

Commits

• 33d1466 Merge pull request #69 from stripe/release/v0.1.6
• bd8bb70 Bump version to 0.1.6
• f906d96 Merge pull request #68 from stripe/fix/tempo-replay-store-default
• 5b6ee63 fix(tempo): keep the raw-hash claim while rebasing to the chain hash
• 4433b0f fix(tempo): rebase pull-flow reservations onto the chain hash
• 9f1f7b5 test(tempo): cover default credential replay through server.charge
• 24cf77c fix(tempo): enable replay protection by default
• 72cf0dd Merge pull request #65 from bensandler-stripe/bensandler/machine-payment-meta...
• 0a573ee feat(stripe): mark machine payment intents
• 7ee89c6 Merge pull request #64 from stripe/feat/requires-auth-header
• Additional commits viewable in compare view

Updates sorbet-runtime from 0.6.13433 to 0.6.13480

Release notes

Sourced from sorbet-runtime's releases.

sorbet 0.6.13479.20260903171452-acc70d659

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13479', :group => :development
gem 'sorbet-runtime', '0.6.13479'

sorbet 0.6.13478.20260903164634-fd2a20787

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13478', :group => :development
gem 'sorbet-runtime', '0.6.13478'

sorbet 0.6.13477.20260903152022-210c9a913

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13477', :group => :development
gem 'sorbet-runtime', '0.6.13477'

sorbet 0.6.13476.20260903151459-6c248f30f

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13476', :group => :development
gem 'sorbet-runtime', '0.6.13476'

sorbet 0.6.13475.20260903131317-b0d8000a6

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13475', :group => :development
gem 'sorbet-runtime', '0.6.13475'

sorbet 0.6.13474.20260903114246-2fcf1d7e6

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13474', :group => :development
gem 'sorbet-runtime', '0.6.13474'

sorbet 0.6.13473.20260902233827-0af591c08

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13473', :group => :development
gem 'sorbet-runtime', '0.6.13473'

sorbet 0.6.13472.20260902222748-080eb6d6f

... (truncated)

Commits

• See full diff in compare view

Bumps the weekly-dependencies group with 1 update in the /conformance/adapters/java directory: com.stripe:mpp-java.

Updates com.stripe:mpp-java from 0.1.3 to 0.1.4

Commits

• ca57f09 Merge pull request #29 from stripe/raubrey/release-0.1.4
• 7613b4a chore: release 0.1.4
• ff7f369 Merge pull request #27 from stripe/fix/tempo-bind-hash-to-payer
• 90dc890 fix(tempo): bind hash credentials to the paying challenge
• 2fe0a4b Merge pull request #24 from stripe/ksn/tempo-replay-protection
• 92e9a14 refactor(tempo): rename replay claim API to tryClaim
• 32e93c0 refactor: make replay store chain-neutral
• bb6cd82 refactor(tempo): keep replay store change parity-focused
• 5d6c681 refactor(tempo): narrow replay store contract
• 6753123 fix(tempo): prevent transaction hash replay
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​node@​26.2.0 ⏵ 26.4.1	+1		+1
	npm/​tsx@​4.23.12 ⏵ 4.23.13
	cargo/​mpp@​0.11.0 ⏵ 0.12.0	+1		+8
	npm/​mppx@​0.8.18 ⏵ 0.9.2			+1
	gem/​mpp-rb@​0.1.4 ⏵ 0.1.6			+1
	gem/​sorbet-runtime@​0.6.13433 ⏵ 0.6.13480	+1
	pypi/​pympp@​0.10.1 ⏵ 0.11.0	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Recently published: gem mpp-rb published 6 days ago Location: Package overview From: conformance/adapters/ruby/Gemfile.lock → gem/mpp-rb@0.1.6 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/mpp-rb@0.1.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: gem sorbet-runtime published 3 days ago Location: Package overview From: conformance/adapters/ruby/Gemfile.lock → gem/sorbet-runtime@0.6.13480 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/sorbet-runtime@0.6.13480. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm @types/node published 6 days ago Location: Package overview From: conformance/package-lock.json → npm/@types/node@26.4.1 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@types/node@26.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm mppx published 5 days ago Location: Package overview From: conformance/package-lock.json → npm/mppx@0.9.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mppx@0.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm tsx published last week Location: Package overview From: conformance/package-lock.json → npm/tsx@4.23.13 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tsx@4.23.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report