Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 5 updates - #69

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-edd41cda42
Open

chore(deps): bump the production-dependencies group across 1 directory with 5 updates#69
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-edd41cda42

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 5 updates in the / directory:

Package From To
accounts 0.14.11 0.15.3
incur 0.4.8 0.4.19
mppx 0.8.9 0.8.12
undici 8.5.0 8.7.0
viem 2.54.0 2.55.4

Updates accounts from 0.14.11 to 0.15.3

Release notes

Sourced from accounts's releases.

accounts@0.15.3

Patch Changes

  • 7480125: Forward fee payer URLs to JSON-RPC wallets.

accounts@0.15.2

Patch Changes

  • 9d2bdc8: Skipped EIP-6963 provider announcement when crypto.randomUUID is unavailable (e.g. insecure contexts).
  • 29776b4: Added { domains } form to the wallet_connect identity.email capability for restricting email entry to allowed domains.
  • 5351e1c: Added paradigm.xyz to the list of trusted hosts.

accounts@0.15.1

Patch Changes

  • 03c1161: Added string and { address } forms to the wallet_connect identity.email capability for requiring a specific email.

accounts@0.15.0

Minor Changes

  • 2cfca91: Updated viem (>=2.54.0) and ox (~0.14.30) for the config-id-free TIP-1061 multisig format, removing genesisConfigId from the multisig relay ResolveConfig, Operation, and Status shapes.

accounts@0.14.12

Patch Changes

  • 186b1f7: Added provider MPP account resolution parameters for locally managed access keys.
  • 2e092e9: Added exact access-key selection for provider-backed mppx parameters.
  • d5c0d66: Changed Mount.auto to allow trusted hosts to use iframe mounts without IntersectionObserver v2 support.
  • 98a8138: Added identity to Provider.create, minting verified-email id tokens from a configured OIDC issuer when local adapters fulfill wallet_connect.
  • 4aa479d: Add SIWE resources to wallet_connect auth challenges, support server-provided SIWE statements in Handler.auth, and preserve extra auth verify JSON fields.
Changelog

Sourced from accounts's changelog.

0.15.3

Patch Changes

  • 7480125: Forward fee payer URLs to JSON-RPC wallets.

0.15.2

Patch Changes

  • 9d2bdc8: Skipped EIP-6963 provider announcement when crypto.randomUUID is unavailable (e.g. insecure contexts).
  • 29776b4: Added { domains } form to the wallet_connect identity.email capability for restricting email entry to allowed domains.
  • 5351e1c: Added paradigm.xyz to the list of trusted hosts.

0.15.1

Patch Changes

  • 03c1161: Added string and { address } forms to the wallet_connect identity.email capability for requiring a specific email.

0.15.0

Minor Changes

  • 2cfca91: Updated viem (>=2.54.0) and ox (~0.14.30) for the config-id-free TIP-1061 multisig format, removing genesisConfigId from the multisig relay ResolveConfig, Operation, and Status shapes.

0.14.12

Patch Changes

  • 186b1f7: Added provider MPP account resolution parameters for locally managed access keys.
  • 2e092e9: Added exact access-key selection for provider-backed mppx parameters.
  • d5c0d66: Changed Mount.auto to allow trusted hosts to use iframe mounts without IntersectionObserver v2 support.
  • 98a8138: Added identity to Provider.create, minting verified-email id tokens from a configured OIDC issuer when local adapters fulfill wallet_connect.
  • 4aa479d: Add SIWE resources to wallet_connect auth challenges, support server-provided SIWE statements in Handler.auth, and preserve extra auth verify JSON fields.
Commits

Updates incur from 0.4.8 to 0.4.19

Release notes

Sourced from incur's releases.

incur@0.4.19

Patch Changes

  • 6c6bc6c: Added configurable MCP server names and titles.

    Cli.create("tapimo", { mcp: { name: "tempo", title: "Tempo MCP" } });

incur@0.4.18

Patch Changes

  • 1cc5c95: Prevented completed MCP JSON responses from retaining transport stream state.
  • 9f11871: Isolated stateless MCP requests, preventing cross-client response collisions and retained aborted requests.

incur@0.4.17

Patch Changes

  • 5b9647a: Delivered CTA suggestions in MCP tool result and error text, keeping _meta.cta for structured consumers.

  • eacc238: Added variadic positional arguments: a final z.array(...) args key collects all remaining positionals.

    Cli.create("my-cli").command("lint", {
  args: z.object({ paths: z.array(z.string()).describe("Files to lint") }),
  run: (c) => ({ count: c.args.paths.length }),
});

incur@0.4.16

Patch Changes

  • 8da2cfc: Fixed parsed global options missing from command handler contexts.

incur@0.4.15

Patch Changes

  • e6f51cd: Changed MCP servers to expose progressive tool discovery by default.

incur@0.4.14

Patch Changes

  • 539d0ac: Added compact and security OpenAPI config options for trimming generated command schemas and skipping credential option injection.
  • 4c0fc4b: Included OpenAPI operation descriptions in MCP tool descriptions by concatenating summary and description; CLI help keeps the short summary.

incur@0.4.13

Patch Changes

  • 20a6f42: Added MCP tool filtering via mcp: false on commands and root-level mcp.tools include/exclude patterns.
  • 3fecb7c: Added remote MCP servers as command sources via cli.command(name, { mcp }).
  • 11b7406: Added context.request for HTTP and MCP invocations and openapiConfig.forwardHeaders for propagating caller headers to upstream APIs.

... (truncated)

Changelog

Sourced from incur's changelog.

0.4.19

Patch Changes

  • 6c6bc6c: Added configurable MCP server names and titles.

    Cli.create("tapimo", { mcp: { name: "tempo", title: "Tempo MCP" } });

0.4.18

Patch Changes

  • 1cc5c95: Prevented completed MCP JSON responses from retaining transport stream state.
  • 9f11871: Isolated stateless MCP requests, preventing cross-client response collisions and retained aborted requests.

0.4.17

Patch Changes

  • 5b9647a: Delivered CTA suggestions in MCP tool result and error text, keeping _meta.cta for structured consumers.

  • eacc238: Added variadic positional arguments: a final z.array(...) args key collects all remaining positionals.

    Cli.create("my-cli").command("lint", {
  args: z.object({ paths: z.array(z.string()).describe("Files to lint") }),
  run: (c) => ({ count: c.args.paths.length }),
});

0.4.16

Patch Changes

  • 8da2cfc: Fixed parsed global options missing from command handler contexts.

0.4.15

Patch Changes

  • e6f51cd: Changed MCP servers to expose progressive tool discovery by default.

0.4.14

Patch Changes

  • 539d0ac: Added compact and security OpenAPI config options for trimming generated command schemas and skipping credential option injection.
  • 4c0fc4b: Included OpenAPI operation descriptions in MCP tool descriptions by concatenating summary and description; CLI help keeps the short summary.

... (truncated)

Commits

Updates mppx from 0.8.9 to 0.8.12

Release notes

Sourced from mppx's releases.

mppx@0.8.12

Patch Changes

  • 1afe397: Fixed legacy session auto-management reusing a cached channel after the account's authorizedSigner changed. The client now opens a new channel instead of emitting a voucher the escrow would reject.
  • 51f948e: Added payment-aware Tempo session streams to client fetch responses.

mppx@0.8.11

Patch Changes

  • be4452c: Exported SSE session controller helpers through Tempo server namespaces.
  • c40a0fc: Added continuous main snapshot releases.
  • 7207c0f: Added local Tempo charge fee-token selection with a pathUSD preference and an explicit override.
  • 98abd92: Extracted session SSE payment handling into a response-preserving driver.
  • 0679b0f: Added sender and final-envelope simulations before sponsored Tempo broadcasts.
Changelog

Sourced from mppx's changelog.

0.8.12

Patch Changes

  • 1afe397: Fixed legacy session auto-management reusing a cached channel after the account's authorizedSigner changed. The client now opens a new channel instead of emitting a voucher the escrow would reject.
  • 51f948e: Added payment-aware Tempo session streams to client fetch responses.

0.8.11

Patch Changes

  • be4452c: Exported SSE session controller helpers through Tempo server namespaces.
  • c40a0fc: Added continuous main snapshot releases.
  • 7207c0f: Added local Tempo charge fee-token selection with a pathUSD preference and an explicit override.
  • 98abd92: Extracted session SSE payment handling into a response-preserving driver.
  • 0679b0f: Added sender and final-envelope simulations before sponsored Tempo broadcasts.

0.8.10

Patch Changes

  • a6969b8: Added account resolution to Tempo session managers.
  • fa73305: mppx validate: retry on 422, resolve $ref in body generation, add --header/-H flag, fix x402 validation for non-EVM chains.
Commits
  • b4334f0 chore: version packages (#663)
  • 51f948e feat(session): handle SSE responses in fetch (#658)
  • 1afe397 fix(session): open a new channel when the authorizedSigner changes (#632)
  • 4aa8576 chore: version packages (#651)
  • f90b23a test: cover session management receipts (#662)
  • be4452c feat: export SSE session controller (#661)
  • 5a57e93 test: isolate CLI validation from live Tempo services (#659)
  • 0679b0f fix: preflight fee-sponsored Tempo transactions (#657)
  • 98abd92 refactor(session): extract SSE response driver (#655)
  • a556718 fix: run snapshot publish outside pnpm exec (#656)
  • Additional commits viewable in compare view

Updates undici from 8.5.0 to 8.7.0

Release notes

Sourced from undici's releases.

v8.7.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.6.0...v8.7.0

v8.6.0

What's Changed

... (truncated)

Commits
  • cb4c2f1 Bumped v8.7.0 (#5501)
  • a8d1a95 fix: auto-detect HTTP proxy tunneling (#5116)
  • cb30e58 fix: add static buildDispatch method to RedirectHandler type definition (#5442)
  • 0c08579 fix(h2): requeue request on GOAWAY'd session instead of crashing (#5453)
  • e5b3364 fix(h2): guard onResponse against a 'response' event delivered after completi...
  • c0007f4 docs: add reproduction guide and update bug report template (#5451)
  • e529cab fix: ignore an unparseable Set-Cookie Expires attribute (#5488)
  • 754742c fix(h2): destroy the stream on abort instead of relying on close() (#5462)
  • db34f5f fix(readable): ignore late consume chunks (#5375)
  • 4ea05a8 fix: reject non-ascii octets in validateCookiePath (#5452)
  • Additional commits viewable in compare view

Updates viem from 2.54.0 to 2.55.4

Release notes

Sourced from viem's releases.

viem@2.55.4

Patch Changes

viem@2.55.2

Patch Changes

viem@2.55.1

Patch Changes

viem@2.55.0

Minor Changes

Patch Changes

viem@2.54.6

Patch Changes

  • #4807 f1ac4480d0c1c6f29bf709f116068e903643ecad Thanks @​jxom! - viem/tempo: Supported calling token .call builders without a Client (restores the pre-2.54 call signature). When the Client is omitted, token must be a TIP20 token id or contract address, and formatted amounts require explicit decimals.

viem@2.54.5

Patch Changes

viem@2.54.4

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
6731072 
…y with 5 updates

Bumps the production-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [accounts](https://github.com/tempoxyz/accounts) | `0.14.11` | `0.15.3` |
| [incur](https://github.com/wevm/incur) | `0.4.8` | `0.4.19` |
| [mppx](https://github.com/wevm/mppx) | `0.8.9` | `0.8.12` |
| [undici](https://github.com/nodejs/undici) | `8.5.0` | `8.7.0` |
| [viem](https://github.com/wevm/viem) | `2.54.0` | `2.55.4` |



Updates `accounts` from 0.14.11 to 0.15.3
- [Release notes](https://github.com/tempoxyz/accounts/releases)
- [Changelog](https://github.com/tempoxyz/accounts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tempoxyz/accounts/compare/accounts@0.14.11...accounts@0.15.3)

Updates `incur` from 0.4.8 to 0.4.19
- [Release notes](https://github.com/wevm/incur/releases)
- [Changelog](https://github.com/wevm/incur/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/incur/compare/incur@0.4.8...incur@0.4.19)

Updates `mppx` from 0.8.9 to 0.8.12
- [Release notes](https://github.com/wevm/mppx/releases)
- [Changelog](https://github.com/wevm/mppx/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/mppx/compare/mppx@0.8.9...mppx@0.8.12)

Updates `undici` from 8.5.0 to 8.7.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.5.0...v8.7.0)

Updates `viem` from 2.54.0 to 2.55.4
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.54.0...viem@2.55.4)

---
updated-dependencies:
- dependency-name: accounts
  dependency-version: 0.15.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: incur
  dependency-version: 0.4.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: mppx
  dependency-version: 0.8.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: viem
  dependency-version: 2.55.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@socket-security

socket-security Bot commented Jul 27, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedincur@​0.4.197610010097100
Updatedaccounts@​0.14.11 ⏵ 0.15.3791009999 +2100
Updatedmppx@​0.7.0 ⏵ 0.8.128110010098 +1100
Addedundici@​8.7.09310010097100
Addedviem@​2.55.49710010098100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants