Bump mppx from 0.4.6 to 0.4.11

[dependabot]

Bumps mppx from 0.4.6 to 0.4.11.

Release notes

Sourced from mppx's releases.

mppx@0.4.11

Patch Changes

• Fixed close voucher validation to reject vouchers equal to the on-chain settled amount. (GHSA-mv9j-8jvg-j8mr)
• Added Stripe credential replay protection via the Idempotent-Replayed header. (GHSA-8mhj-rffc-rcvw)

mppx@0.4.10

Patch Changes

• b4e1a3d: Add OpenAPI-first discovery tooling via mppx/discovery, framework discovery() helpers, and mppx discover validate.

  This also changes mppx/proxy discovery routes:

  • GET /openapi.json is now the canonical machine-readable discovery document.
  • GET /llms.txt remains available as the text-friendly discovery view.
  • Legacy /discover* routes now return 410 Gone.

• 70f6595: Fix two production session/SSE robustness issues.

  1. Accept exact voucher replays (cumulativeAmount == highestVoucherAmount) as idempotent success after signature verification, while still rejecting lower cumulative amounts and preserving monotonic state advancement rules.
  2. Prevent invalid null-body response wrapping in SSE receipt transport by returning 101/204/205/304 responses directly instead of stream-wrapping them.

• 3c713c9: tempo.session() now throws immediately at initialization if no viem Account is provided, instead of failing later with an opaque error during channel close. The error message includes an example fix.

mppx@0.4.9

Patch Changes

• d9b651d: Added Store.redis() adapter for standard Redis clients (ioredis, node-redis, Valkey) with BigInt-safe serialization.
• b69bbee: Fixed Express middleware hanging by constructing a Fetch Request directly from Express's req API.
• 7da6cfd: Fixed SSE header normalization.
• a2c6cc9: Skipped route amount/currency/recipient validation for topUp and voucher credentials. These POSTs carry no application body so the route's request hook may produce a different amount than the challenge echoed from the original request. The on-chain voucher signature is the real validation.

mppx@0.4.8

Patch Changes

• 99920d0: Updated validation.

mppx@0.4.7

Patch Changes

• 2a0b88e: Fixed cooperative close to sign the server-reported spent amount instead of the high-water mark (cumulativeAmount), preventing overcharging when actual usage was below the pre-authorized voucher amount.

Changelog

Sourced from mppx's changelog.

0.4.11

Patch Changes

• Fixed close voucher validation to reject vouchers equal to the on-chain settled amount. (GHSA-mv9j-8jvg-j8mr)
• Added Stripe credential replay protection via the Idempotent-Replayed header. (GHSA-8mhj-rffc-rcvw)

0.4.10

Patch Changes

• b4e1a3d: Add OpenAPI-first discovery tooling via mppx/discovery, framework discovery() helpers, and mppx discover validate.

  This also changes mppx/proxy discovery routes:

  • GET /openapi.json is now the canonical machine-readable discovery document.
  • GET /llms.txt remains available as the text-friendly discovery view.
  • Legacy /discover* routes now return 410 Gone.

• 70f6595: Fix two production session/SSE robustness issues.

  1. Accept exact voucher replays (cumulativeAmount == highestVoucherAmount) as idempotent success after signature verification, while still rejecting lower cumulative amounts and preserving monotonic state advancement rules.
  2. Prevent invalid null-body response wrapping in SSE receipt transport by returning 101/204/205/304 responses directly instead of stream-wrapping them.

• 3c713c9: tempo.session() now throws immediately at initialization if no viem Account is provided, instead of failing later with an opaque error during channel close. The error message includes an example fix.

0.4.9

Patch Changes

• d9b651d: Added Store.redis() adapter for standard Redis clients (ioredis, node-redis, Valkey) with BigInt-safe serialization.
• b69bbee: Fixed Express middleware hanging by constructing a Fetch Request directly from Express's req API.
• 7da6cfd: Fixed SSE header normalization.
• a2c6cc9: Skipped route amount/currency/recipient validation for topUp and voucher credentials. These POSTs carry no application body so the route's request hook may produce a different amount than the challenge echoed from the original request. The on-chain voucher signature is the real validation.

0.4.8

Patch Changes

• 99920d0: Updated validation. (GHSA-8x4m-qw58-3pcx)

0.4.7

Patch Changes

• 2a0b88e: Fixed cooperative close to sign the server-reported spent amount instead of the high-water mark (cumulativeAmount), preventing overcharging when actual usage was below the pre-authorized voucher amount.

Commits

• 8ce9f56 chore: up
• 6f4818f chore: viem version
• edebd24 chore: lint
• f5410ea chore: bump version
• b2b1a0b Merge commit from fork
• 9408824 Merge commit from fork
• 7055bd1 chore: format
• 24ab0f2 chore: version packages (#237)
• 7b17311 chore: changeset tweaks
• b4e1a3d feat: add OpenAPI-first discovery tooling (#235)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for mppx since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	mpp-proxy	a931635	Commit Preview URL Branch Preview URL	Mar 29 2026, 05:32 PM

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mppx@​0.4.6 ⏵ 0.4.11	+1	+75	+1	+2
	viem@​2.47.4 ⏵ 2.47.6				-1

View full report