diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 9464c4e..64e0684 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.6.2"
+  ".": "1.7.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d8e6f22..cd13c28 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## [1.7.0](https://github.com/aibtcdev/x402-api/compare/v1.6.2...v1.7.0) (2026-04-29)
+
+
+### Features
+
+* **payments:** adopt native boring-tx state machine ([#107](https://github.com/aibtcdev/x402-api/issues/107)) ([04c5a6a](https://github.com/aibtcdev/x402-api/commit/04c5a6a48ecf4e11003f067a9a42ab3e0c0ab380))
+
+
+### Bug Fixes
+
+* **deps:** upgrade lodash to 4.18.0 to patch CVE-2026-4800 ([#110](https://github.com/aibtcdev/x402-api/issues/110)) ([60ac45a](https://github.com/aibtcdev/x402-api/commit/60ac45a189d99dd6dbfe1b7047645667674a739d))
+
 ## [1.6.2](https://github.com/aibtcdev/x402-api/compare/v1.6.1...v1.6.2) (2026-04-16)
 
 
diff --git a/package-lock.json b/package-lock.json
index 92044e5..0aa032d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "x402-api",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "x402-api",
-      "version": "1.6.2",
+      "version": "1.7.0",
       "hasInstallScript": true,
       "dependencies": {
         "@aibtc/tx-schemas": "^1.0.0",
diff --git a/package.json b/package.json
index 0c9cad2..4667b7d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "x402-api",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "private": true,
   "scripts": {
     "dev": "npm run wrangler -- dev",