fix: replace expired Viem preview

[gakonst]

Summary

• replace the expired pkg.pr.new/viem@4880 tarball with published viem@2.55.8
• bump ox to the version required by that Viem release
• preserve subscription key-authorization validation with the newer primitive-signature types
• bump brace-expansion to 5.0.8 to clear the current high-severity audit failure

The published Viem tag contains the merged relay fee-payer signature fix from wevm/viem#4880. The expired preview currently makes clean MPPx installs and PR CI fail with ERR_PNPM_FETCH_404; the stale brace override independently fails the current audit.

Validation

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high — no known vulnerabilities
• pnpm check:ci
• pnpm check:types
• VITE_TEMPO_NETWORK=none pnpm exec vp test --project node src/tempo/subscription/KeyAuthorization.test.ts (10 passed)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/mppx@714

commit: 4b9a0d8

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	viem@​2.55.8
	ox@​0.14.32

View full report

[gakonst]

Merged into #713 via 492ed16; closing this standalone PR.