From b345bf5ee1e8dc20673a3506de9921f8ab368a94 Mon Sep 17 00:00:00 2001 From: Giovanny Amador <219895655+Eras256@users.noreply.github.com> Date: Tue, 10 Nov 2026 14:30:50 -0600 Subject: [PATCH 1/2] fix(ci): green CI and Security Gate on main Two causes, both red on main since 5 Nov 2026: - SDK tests: 9 policy and spend-cap tests failed with NETWORK_FORBIDDEN on @x402/* 2.28.0. nirium-protocol/nirium runs the same test files green on 2.30.0. Bump @x402/fetch and @x402/stellar to ^2.30.0 and @stellar/stellar-sdk to ^16.4.1 in packages/sdk, the versions nirium already resolves. - pnpm audit: the follow-redirects override was >=1.16.1, but the fix for GHSA-mrwp-f3q8-3g9p is in 1.16.2. Set it to >=1.16.2 (the private source already had this). Checked in WSL with Node 22 and pnpm 9.12.2 from a clean frozen-lockfile install: SDK 118/118, CLI 61/61, web build OK, pnpm audit --audit-level=high exits 0. Co-Authored-By: Claude Opus 5.5 --- package.json | 2 +- packages/sdk/package.json | 6 +- pnpm-lock.yaml | 124 ++++++++++++++++++-------------------- 3 files changed, 63 insertions(+), 69 deletions(-) diff --git a/package.json b/package.json index 0a5b6a67..9aa247c4 100644 --- a/package.json +++ b/package.json @@ -46,7 +46,7 @@ "ws@8": "8.21.3", "source-map-js": ">=1.2.2", "proxy-addr": ">=2.0.8", - "follow-redirects": ">=1.16.1", + "follow-redirects": ">=1.16.2", "@modelcontextprotocol/sdk": ">=1.31.0", "zod@4": "^4.6.6", "body-parser": ">=2.4.0" diff --git a/packages/sdk/package.json b/packages/sdk/package.json index 2cfe1229..3d0c9049 100644 --- a/packages/sdk/package.json +++ b/packages/sdk/package.json @@ -35,9 +35,9 @@ }, "dependencies": { "@stellar/mpp": "^0.7.1", - "@stellar/stellar-sdk": "^16.3.0", - "@x402/fetch": "^2.28.0", - "@x402/stellar": "^2.28.0", + "@stellar/stellar-sdk": "^16.4.1", + "@x402/fetch": "^2.30.0", + "@x402/stellar": "^2.30.0", "mppx": "^0.6.31", "viem": "^2.55.19", "ws": "^8.21.3" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1b5984c8..493931b9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -29,7 +29,7 @@ overrides: ws@8: 8.21.3 source-map-js: '>=1.2.2' proxy-addr: '>=2.0.8' - follow-redirects: '>=1.16.1' + follow-redirects: '>=1.16.2' '@modelcontextprotocol/sdk': '>=1.31.0' zod@4: ^4.6.6 body-parser: '>=2.4.0' @@ -216,7 +216,7 @@ importers: version: 0.13.0 '@stellar/mpp': specifier: ^0.7.1 - version: 0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7))) + version: 0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76))) '@stellar/stellar-sdk': specifier: ^14.0.0 version: 14.6.1 @@ -255,7 +255,7 @@ importers: version: 9.0.3 mppx: specifier: ^0.6.31 - version: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) + version: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)) node-cron: specifier: ^3.0.3 version: 3.0.3 @@ -378,16 +378,16 @@ importers: dependencies: '@stellar/mpp': specifier: ^0.7.1 - version: 0.7.1(@stellar/stellar-sdk@16.3.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7))) + version: 0.7.1(@stellar/stellar-sdk@16.4.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7))) '@stellar/stellar-sdk': - specifier: ^16.3.0 - version: 16.3.1 + specifier: ^16.4.1 + version: 16.4.1 '@x402/fetch': - specifier: ^2.28.0 - version: 2.28.0 + specifier: ^2.30.0 + version: 2.30.0 '@x402/stellar': - specifier: ^2.28.0 - version: 2.28.0 + specifier: ^2.30.0 + version: 2.30.0 mppx: specifier: ^0.6.31 version: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) @@ -1382,9 +1382,6 @@ packages: '@noble/ed25519@3.1.0': resolution: {integrity: sha512-pfcObRY3CtvwfaG9Mt5XqZdKmAQppl37tHUeuBhDUbiwJBCVY4/A4lbMvb1xKhMDx96AqAqZpMWuBX1HulhX4g==} - '@noble/ed25519@3.2.0': - resolution: {integrity: sha512-criDgRlnUA09hchYrTy/JUWPIEap5rZxQe6wDWzRx51oWWpDRcUpuNzlgPxDJaOK6AsW9c0wKcj3rKRv6t+bPQ==} - '@noble/hashes@1.3.2': resolution: {integrity: sha512-MVC8EAQp7MvEcm30KWENFjgR+Mkmf+D189XJTkFIlwohU5hcBbn1ZkKq7KVTi2Hme3PMGF390DaL52beVrIihQ==} engines: {node: '>= 16'} @@ -3173,6 +3170,9 @@ packages: '@x402/core@2.28.0': resolution: {integrity: sha512-Da/7zKxCKqpBoB4Msc9tFgkAv7tJTD8nG+DSSm+QdXAyJS4PQsmgVSKe17rDJTtlu0pwNbLcOje6MyQ6kaDkig==} + '@x402/core@2.30.0': + resolution: {integrity: sha512-gvMxCum2QlNI6jI/3NL1jdrmOgtX9sWEWxSIOmeI67/5ndOJvYOtP7JZLSO8o8af+O+A+Vhhjza1NCda0yVppg==} + '@x402/core@2.9.0': resolution: {integrity: sha512-IqPITHYx6XHlgLPtparuKKwoB+3wQdgt0F+WUH1e3WHMeiWdp+xTtQDy+6yOKuObNFI1S1iVbQFz0GivR/Vv3w==} @@ -3215,8 +3215,8 @@ packages: '@x402/fetch@2.17.0': resolution: {integrity: sha512-iy6ar1JTgs4gzdlc2q2Z7nuL5keBkQhoD4v5niVlTwLoivVvHnAA0p/wK5WTWRrJ1b+el8pthkjFS0Jc3nMIIg==} - '@x402/fetch@2.28.0': - resolution: {integrity: sha512-kF5IjZIz/izg2TD/Zav+SVj0jtC0zBDfE7WcKCnMZWIsZcLCyL2GgvwXCn7CCSsNjpQ/z3Rz4OqTCA4AaeKySQ==} + '@x402/fetch@2.30.0': + resolution: {integrity: sha512-rEC8CHQN5ZFn2W9b1mZ8ZvRyEw9Zkc5LuuVXo1CBU9w3PCtQO3c7+ChS7Ht9MvF66JTicK3ja0KgUF+fpChvNA==} '@x402/fetch@2.9.0': resolution: {integrity: sha512-/ocFWG5aTftCabW4CWXLZjafzTwkmW+c7u4lzXLegJ7F8Fkciw6yyzrQ+R4Rsm6F6TH0pGzo545Yc7n7z5UNlA==} @@ -3229,6 +3229,10 @@ packages: resolution: {integrity: sha512-H/P46YVVEvJmnXlss8fJBNGgjaLkp3pWJ6PH2uOJY+jVemugUoQPArwtQKNovEV2BnF0gnJ+sdaRg+4Gucu6jQ==} engines: {node: '>=22.0.0'} + '@x402/stellar@2.30.0': + resolution: {integrity: sha512-XpLbvLesgK8c1EuFRBsJ3fVtBd5csBkjXJ5jQYrFgp+jH0r27bWqoMzSzo5uBdvXv0iQddk+ju6ahqG+F99L3g==} + engines: {node: '>=22.0.0'} + '@xrplf/isomorphic@1.0.1': resolution: {integrity: sha512-0bIpgx8PDjYdrLFeC3csF305QQ1L7sxaWnL5y71mCvhenZzJgku9QsA+9QCXBC1eNYtxWO/xR91zrXJy2T/ixg==} engines: {node: '>=16.0.0'} @@ -4145,10 +4149,6 @@ packages: resolution: {integrity: sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg==} engines: {node: '>=18.0.0'} - eventsource-parser@3.1.1: - resolution: {integrity: sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==} - engines: {node: '>=18.0.0'} - eventsource@2.0.2: resolution: {integrity: sha512-IzUmBGPR3+oUG9dUeXynyNmf91/3zUSJg1lCktzKw47OXuhco54U3r9B7O4XX+Rb1Itm9OZ2b0RkTs10bICOxA==} engines: {node: '>=12.0.0'} @@ -4161,10 +4161,6 @@ packages: resolution: {integrity: sha512-2GuF51iuHX6A9xdTccMTsNb7VO0lHZihApxhvQzJB5A03DvHDd2FQepodbMaztPBmBcE/ox7o2gqaxGhYB9LhQ==} engines: {node: '>=20.0.0'} - eventsource@4.1.1: - resolution: {integrity: sha512-D6bTRWh6KahHTK/m4WnjPQyEinNPf9eFLEZSEoj7d6fTibspnAVYfzHvirL7u/aoX5d9YYfIkBVAhmigUELk9w==} - engines: {node: '>=20.0.0'} - evp_bytestokey@1.0.3: resolution: {integrity: sha512-/f2Go4TognH/KvCISP7OUsHn85hT9nUkxxA9BEWxFn+Oj9o8ZNLm/40hdlgSLyuOimsrTKLUMEorQexp/aPQeA==} @@ -4269,8 +4265,8 @@ packages: resolution: {integrity: sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==} engines: {node: '>=8'} - follow-redirects@1.16.1: - resolution: {integrity: sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==} + follow-redirects@1.16.3: + resolution: {integrity: sha512-toOSoqN6d51Wjf1aOFJYcoVv1aND9rj/CwjLU0Vz40oDuSpWDayCeKe4JpL5NL0WdFvoOOCI3BRo69HahjbR1A==} engines: {node: '>=4.0'} peerDependencies: debug: '*' @@ -6066,10 +6062,6 @@ packages: resolution: {integrity: sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==} engines: {node: '>= 18'} - smol-toml@1.9.1: - resolution: {integrity: sha512-j7WyPdf0CJoutMzMoPLF/bVXHtKZIT9Rb4eGeEbWw8X2t5oirjPgpL+OpaENZrILYaXqYwnVH+qgUwVbl+pUJQ==} - engines: {node: '>= 18'} - socks-proxy-agent@8.0.5: resolution: {integrity: sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==} engines: {node: '>= 14'} @@ -6468,10 +6460,6 @@ packages: resolution: {integrity: sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==} engines: {node: '>=18'} - uint8array-extras@1.6.0: - resolution: {integrity: sha512-8iAasVS4wUx0gPLjH8Xtz2PeDzTSiy8QiLGu2DT3X5GU+egFEQhpnbtkehbAwjvDcxIERmCYcysiODFmE3Ud0Q==} - engines: {node: '>=18'} - uint8array-tools@0.0.8: resolution: {integrity: sha512-xS6+s8e0Xbx++5/0L+yyexukU7pz//Yg6IHg3BKhXotg1JcYtgxVcUctQ0HxLByiJzpAkNFawz1Nz5Xadzo82g==} engines: {node: '>=14.0.0'} @@ -8143,8 +8131,6 @@ snapshots: '@noble/ed25519@3.1.0': {} - '@noble/ed25519@3.2.0': {} - '@noble/hashes@1.3.2': {} '@noble/hashes@1.3.3': {} @@ -9643,16 +9629,16 @@ snapshots: mppx: 0.5.11(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) zod: 4.6.7 - '@stellar/mpp@0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)))': + '@stellar/mpp@0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)))': dependencies: '@stellar/stellar-sdk': 14.6.1 - mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)) + mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)) zod: 4.6.7 - '@stellar/mpp@0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)))': + '@stellar/mpp@0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)))': dependencies: '@stellar/stellar-sdk': 14.6.1 - mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) + mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)) zod: 4.6.7 '@stellar/mpp@0.7.1(@stellar/stellar-sdk@16.3.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)))': @@ -9661,6 +9647,12 @@ snapshots: mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) zod: 4.6.7 + '@stellar/mpp@0.7.1(@stellar/stellar-sdk@16.4.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)))': + dependencies: + '@stellar/stellar-sdk': 16.4.1 + mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) + zod: 4.6.7 + '@stellar/stellar-base@14.0.1': dependencies: '@noble/curves': 1.9.7 @@ -9728,18 +9720,18 @@ snapshots: '@stellar/stellar-sdk@16.4.1': dependencies: - '@noble/ed25519': 3.2.0 - '@noble/hashes': 2.4.0 + '@noble/ed25519': 3.1.0 + '@noble/hashes': 2.2.0 '@stellar/js-xdr': 4.0.0 axios: 1.20.0 base32.js: 0.1.0 bignumber.js: 11.1.5 buffer: 6.0.3 commander: 14.0.3 - eventsource: 4.1.1 + eventsource: 4.1.0 feaxios: 0.0.23 - smol-toml: 1.9.1 - uint8array-extras: 1.6.0 + smol-toml: 1.8.0 + uint8array-extras: 1.5.0 transitivePeerDependencies: - debug - supports-color @@ -10982,6 +10974,10 @@ snapshots: dependencies: zod: 3.25.76 + '@x402/core@2.30.0': + dependencies: + zod: 4.6.7 + '@x402/core@2.9.0': dependencies: zod: 3.25.76 @@ -11076,9 +11072,9 @@ snapshots: dependencies: '@x402/core': 2.17.0 - '@x402/fetch@2.28.0': + '@x402/fetch@2.30.0': dependencies: - '@x402/core': 2.28.0 + '@x402/core': 2.30.0 '@x402/fetch@2.9.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)': dependencies: @@ -11106,6 +11102,14 @@ snapshots: - debug - supports-color + '@x402/stellar@2.30.0': + dependencies: + '@stellar/stellar-sdk': 16.4.1 + '@x402/core': 2.30.0 + transitivePeerDependencies: + - debug + - supports-color + '@xrplf/isomorphic@1.0.1(bufferutil@4.1.0)(utf-8-validate@6.0.6)': dependencies: '@noble/hashes': 1.8.0 @@ -11283,7 +11287,7 @@ snapshots: axios@1.20.0: dependencies: - follow-redirects: 1.16.1 + follow-redirects: 1.16.3 form-data: 4.0.6 https-proxy-agent: 5.0.1 proxy-from-env: 2.1.0 @@ -12080,8 +12084,6 @@ snapshots: eventsource-parser@3.0.6: {} - eventsource-parser@3.1.1: {} - eventsource@2.0.2: {} eventsource@3.0.7: @@ -12092,10 +12094,6 @@ snapshots: dependencies: eventsource-parser: 3.0.6 - eventsource@4.1.1: - dependencies: - eventsource-parser: 3.1.1 - evp_bytestokey@1.0.3: dependencies: md5.js: 1.3.5 @@ -12241,7 +12239,7 @@ snapshots: locate-path: 5.0.0 path-exists: 4.0.0 - follow-redirects@1.16.1: {} + follow-redirects@1.16.3: {} for-each@0.3.5: dependencies: @@ -13638,11 +13636,11 @@ snapshots: transitivePeerDependencies: - typescript - mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)): + mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)): dependencies: incur: 0.4.11 ox: 0.14.27(typescript@5.9.3)(zod@4.6.7) - viem: 2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76) + viem: 2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76) zod: 4.6.7 optionalDependencies: '@modelcontextprotocol/sdk': 1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76) @@ -13651,14 +13649,14 @@ snapshots: transitivePeerDependencies: - typescript - mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)): + mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)): dependencies: incur: 0.4.11 ox: 0.14.27(typescript@5.9.3)(zod@4.6.7) - viem: 2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76) + viem: 2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76) zod: 4.6.7 optionalDependencies: - '@modelcontextprotocol/sdk': 1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7) + '@modelcontextprotocol/sdk': 1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76) express: 5.2.1 hono: 4.13.5 transitivePeerDependencies: @@ -13780,8 +13778,8 @@ snapshots: dependencies: '@stellar/mpp': 0.7.1(@stellar/stellar-sdk@16.3.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7))) '@stellar/stellar-sdk': 16.3.1 - '@x402/fetch': 2.28.0 - '@x402/stellar': 2.28.0 + '@x402/fetch': 2.30.0 + '@x402/stellar': 2.30.0 mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) viem: 2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7) ws: 8.21.3(bufferutil@4.1.0)(utf-8-validate@6.0.6) @@ -14642,8 +14640,6 @@ snapshots: smol-toml@1.8.0: {} - smol-toml@1.9.1: {} - socks-proxy-agent@8.0.5: dependencies: agent-base: 7.1.4 @@ -15036,8 +15032,6 @@ snapshots: uint8array-extras@1.5.0: {} - uint8array-extras@1.6.0: {} - uint8array-tools@0.0.8: {} uint8arrays@3.1.1: From 68633bb4d69b3e68881b5717c75a7bcd7ae7bdd3 Mon Sep 17 00:00:00 2001 From: Giovanny Amador <219895655+Eras256@users.noreply.github.com> Date: Tue, 10 Nov 2026 14:34:57 -0600 Subject: [PATCH 2/2] fix(ci): keep the lockfile change to packages/sdk only `pnpm update` had also re-resolved the agent placeholder's mppx peer from zod 4 to zod 3. Regenerated with `pnpm install --lockfile-only` instead, so the only importer that changes is packages/sdk. Same results: SDK 118/118, CLI 61/61, pnpm audit exits 0. Co-Authored-By: Claude Opus 5.5 --- pnpm-lock.yaml | 74 ++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 56 insertions(+), 18 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 493931b9..d530101b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -216,7 +216,7 @@ importers: version: 0.13.0 '@stellar/mpp': specifier: ^0.7.1 - version: 0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76))) + version: 0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7))) '@stellar/stellar-sdk': specifier: ^14.0.0 version: 14.6.1 @@ -255,7 +255,7 @@ importers: version: 9.0.3 mppx: specifier: ^0.6.31 - version: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)) + version: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) node-cron: specifier: ^3.0.3 version: 3.0.3 @@ -1382,6 +1382,9 @@ packages: '@noble/ed25519@3.1.0': resolution: {integrity: sha512-pfcObRY3CtvwfaG9Mt5XqZdKmAQppl37tHUeuBhDUbiwJBCVY4/A4lbMvb1xKhMDx96AqAqZpMWuBX1HulhX4g==} + '@noble/ed25519@3.2.0': + resolution: {integrity: sha512-criDgRlnUA09hchYrTy/JUWPIEap5rZxQe6wDWzRx51oWWpDRcUpuNzlgPxDJaOK6AsW9c0wKcj3rKRv6t+bPQ==} + '@noble/hashes@1.3.2': resolution: {integrity: sha512-MVC8EAQp7MvEcm30KWENFjgR+Mkmf+D189XJTkFIlwohU5hcBbn1ZkKq7KVTi2Hme3PMGF390DaL52beVrIihQ==} engines: {node: '>= 16'} @@ -3215,6 +3218,9 @@ packages: '@x402/fetch@2.17.0': resolution: {integrity: sha512-iy6ar1JTgs4gzdlc2q2Z7nuL5keBkQhoD4v5niVlTwLoivVvHnAA0p/wK5WTWRrJ1b+el8pthkjFS0Jc3nMIIg==} + '@x402/fetch@2.28.0': + resolution: {integrity: sha512-kF5IjZIz/izg2TD/Zav+SVj0jtC0zBDfE7WcKCnMZWIsZcLCyL2GgvwXCn7CCSsNjpQ/z3Rz4OqTCA4AaeKySQ==} + '@x402/fetch@2.30.0': resolution: {integrity: sha512-rEC8CHQN5ZFn2W9b1mZ8ZvRyEw9Zkc5LuuVXo1CBU9w3PCtQO3c7+ChS7Ht9MvF66JTicK3ja0KgUF+fpChvNA==} @@ -4149,6 +4155,10 @@ packages: resolution: {integrity: sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg==} engines: {node: '>=18.0.0'} + eventsource-parser@3.1.1: + resolution: {integrity: sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==} + engines: {node: '>=18.0.0'} + eventsource@2.0.2: resolution: {integrity: sha512-IzUmBGPR3+oUG9dUeXynyNmf91/3zUSJg1lCktzKw47OXuhco54U3r9B7O4XX+Rb1Itm9OZ2b0RkTs10bICOxA==} engines: {node: '>=12.0.0'} @@ -4161,6 +4171,10 @@ packages: resolution: {integrity: sha512-2GuF51iuHX6A9xdTccMTsNb7VO0lHZihApxhvQzJB5A03DvHDd2FQepodbMaztPBmBcE/ox7o2gqaxGhYB9LhQ==} engines: {node: '>=20.0.0'} + eventsource@4.1.1: + resolution: {integrity: sha512-D6bTRWh6KahHTK/m4WnjPQyEinNPf9eFLEZSEoj7d6fTibspnAVYfzHvirL7u/aoX5d9YYfIkBVAhmigUELk9w==} + engines: {node: '>=20.0.0'} + evp_bytestokey@1.0.3: resolution: {integrity: sha512-/f2Go4TognH/KvCISP7OUsHn85hT9nUkxxA9BEWxFn+Oj9o8ZNLm/40hdlgSLyuOimsrTKLUMEorQexp/aPQeA==} @@ -6062,6 +6076,10 @@ packages: resolution: {integrity: sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==} engines: {node: '>= 18'} + smol-toml@1.9.1: + resolution: {integrity: sha512-j7WyPdf0CJoutMzMoPLF/bVXHtKZIT9Rb4eGeEbWw8X2t5oirjPgpL+OpaENZrILYaXqYwnVH+qgUwVbl+pUJQ==} + engines: {node: '>= 18'} + socks-proxy-agent@8.0.5: resolution: {integrity: sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==} engines: {node: '>= 14'} @@ -6460,6 +6478,10 @@ packages: resolution: {integrity: sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==} engines: {node: '>=18'} + uint8array-extras@1.6.0: + resolution: {integrity: sha512-8iAasVS4wUx0gPLjH8Xtz2PeDzTSiy8QiLGu2DT3X5GU+egFEQhpnbtkehbAwjvDcxIERmCYcysiODFmE3Ud0Q==} + engines: {node: '>=18'} + uint8array-tools@0.0.8: resolution: {integrity: sha512-xS6+s8e0Xbx++5/0L+yyexukU7pz//Yg6IHg3BKhXotg1JcYtgxVcUctQ0HxLByiJzpAkNFawz1Nz5Xadzo82g==} engines: {node: '>=14.0.0'} @@ -8131,6 +8153,8 @@ snapshots: '@noble/ed25519@3.1.0': {} + '@noble/ed25519@3.2.0': {} + '@noble/hashes@1.3.2': {} '@noble/hashes@1.3.3': {} @@ -9629,16 +9653,16 @@ snapshots: mppx: 0.5.11(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) zod: 4.6.7 - '@stellar/mpp@0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)))': + '@stellar/mpp@0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)))': dependencies: '@stellar/stellar-sdk': 14.6.1 - mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)) + mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)) zod: 4.6.7 - '@stellar/mpp@0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)))': + '@stellar/mpp@0.7.1(@stellar/stellar-sdk@14.6.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)))': dependencies: '@stellar/stellar-sdk': 14.6.1 - mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)) + mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) zod: 4.6.7 '@stellar/mpp@0.7.1(@stellar/stellar-sdk@16.3.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)))': @@ -9720,18 +9744,18 @@ snapshots: '@stellar/stellar-sdk@16.4.1': dependencies: - '@noble/ed25519': 3.1.0 - '@noble/hashes': 2.2.0 + '@noble/ed25519': 3.2.0 + '@noble/hashes': 2.4.0 '@stellar/js-xdr': 4.0.0 axios: 1.20.0 base32.js: 0.1.0 bignumber.js: 11.1.5 buffer: 6.0.3 commander: 14.0.3 - eventsource: 4.1.0 + eventsource: 4.1.1 feaxios: 0.0.23 - smol-toml: 1.8.0 - uint8array-extras: 1.5.0 + smol-toml: 1.9.1 + uint8array-extras: 1.6.0 transitivePeerDependencies: - debug - supports-color @@ -11072,6 +11096,10 @@ snapshots: dependencies: '@x402/core': 2.17.0 + '@x402/fetch@2.28.0': + dependencies: + '@x402/core': 2.28.0 + '@x402/fetch@2.30.0': dependencies: '@x402/core': 2.30.0 @@ -12084,6 +12112,8 @@ snapshots: eventsource-parser@3.0.6: {} + eventsource-parser@3.1.1: {} + eventsource@2.0.2: {} eventsource@3.0.7: @@ -12094,6 +12124,10 @@ snapshots: dependencies: eventsource-parser: 3.0.6 + eventsource@4.1.1: + dependencies: + eventsource-parser: 3.1.1 + evp_bytestokey@1.0.3: dependencies: md5.js: 1.3.5 @@ -13636,11 +13670,11 @@ snapshots: transitivePeerDependencies: - typescript - mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)): + mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)): dependencies: incur: 0.4.11 ox: 0.14.27(typescript@5.9.3)(zod@4.6.7) - viem: 2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76) + viem: 2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76) zod: 4.6.7 optionalDependencies: '@modelcontextprotocol/sdk': 1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76) @@ -13649,14 +13683,14 @@ snapshots: transitivePeerDependencies: - typescript - mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76)): + mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)): dependencies: incur: 0.4.11 ox: 0.14.27(typescript@5.9.3)(zod@4.6.7) - viem: 2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76) + viem: 2.55.0(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@3.25.76) zod: 4.6.7 optionalDependencies: - '@modelcontextprotocol/sdk': 1.32.1(@cfworker/json-schema@4.1.1)(zod@3.25.76) + '@modelcontextprotocol/sdk': 1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7) express: 5.2.1 hono: 4.13.5 transitivePeerDependencies: @@ -13778,8 +13812,8 @@ snapshots: dependencies: '@stellar/mpp': 0.7.1(@stellar/stellar-sdk@16.3.1)(mppx@0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7))) '@stellar/stellar-sdk': 16.3.1 - '@x402/fetch': 2.30.0 - '@x402/stellar': 2.30.0 + '@x402/fetch': 2.28.0 + '@x402/stellar': 2.28.0 mppx: 0.6.31(@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(zod@4.6.7))(express@5.2.1)(hono@4.13.5)(typescript@5.9.3)(viem@2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7)) viem: 2.56.1(bufferutil@4.1.0)(typescript@5.9.3)(utf-8-validate@6.0.6)(zod@4.6.7) ws: 8.21.3(bufferutil@4.1.0)(utf-8-validate@6.0.6) @@ -14640,6 +14674,8 @@ snapshots: smol-toml@1.8.0: {} + smol-toml@1.9.1: {} + socks-proxy-agent@8.0.5: dependencies: agent-base: 7.1.4 @@ -15032,6 +15068,8 @@ snapshots: uint8array-extras@1.5.0: {} + uint8array-extras@1.6.0: {} + uint8array-tools@0.0.8: {} uint8arrays@3.1.1: