Skip to content

Bump the "weekly-dependencies" group with 4 updates across multiple ecosystems - #212

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/weekly_dependencies-7bc91e5089
Open

Bump the "weekly-dependencies" group with 4 updates across multiple ecosystems#212
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/weekly_dependencies-7bc91e5089

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the weekly-dependencies group in /conformance/adapters/ruby with 2 updates: mpp-rb and sorbet-runtime.

Updates mpp-rb from 0.1.4 to 0.1.5

Commits
  • f4ca538 Merge pull request #57 from stripe/release/v0.1.5
  • 79e5844 Bump version to 0.1.5
  • 5a46f3e Merge pull request #59 from bensandler-stripe/bensandler/multi-method-compose
  • f8a082c Bind composed payments to their request scope
  • cca6943 Merge pull request #56 from stripe/fix/tempo-relay-decode-request
  • 0d06b6d fix: decode Tempo relay challenge.request before calling Tempo API
  • 565c1a1 Merge pull request #55 from stripe/feat/tempo-relay-support
  • 910e6cc feat: delegate Tempo charges to an MPP relay
  • 622655e Merge pull request #53 from stripe/feat/tempo-hosted-fee-payer
  • 7239d8d Merge pull request #52 from stripe/examples/tempo-proof-endpoint
  • Additional commits viewable in compare view

Updates sorbet-runtime from 0.6.13433 to 0.6.13454

Release notes

Sourced from sorbet-runtime's releases.

sorbet 0.6.13453.20260827153016-8b0a71ff8

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13453', :group => :development
gem 'sorbet-runtime', '0.6.13453'

sorbet 0.6.13452.20260827121448-b0e749cd0

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13452', :group => :development
gem 'sorbet-runtime', '0.6.13452'

sorbet 0.6.13451.20260827114157-c8a7b977e

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13451', :group => :development
gem 'sorbet-runtime', '0.6.13451'

sorbet 0.6.13450.20260827112108-257c924ba

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13450', :group => :development
gem 'sorbet-runtime', '0.6.13450'

sorbet 0.6.13449.20260826113755-1b9d41e16

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13449', :group => :development
gem 'sorbet-runtime', '0.6.13449'

sorbet 0.6.13448.20260826140853-26a713681

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13448', :group => :development
gem 'sorbet-runtime', '0.6.13448'

sorbet 0.6.13447.20260826102833-3f35a9cc3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13447', :group => :development
gem 'sorbet-runtime', '0.6.13447'

sorbet 0.6.13446.20260826092600-a46765e7c

... (truncated)

Commits

Bumps the weekly-dependencies group in /conformance with 2 updates: mppx and @types/node.

Updates mppx from 0.8.18 to 0.9.0

Release notes

Sourced from mppx's releases.

mppx@0.9.0

Minor Changes

  • c23eaf0: Removed machineUSD charge and session flows, requiring servers that advertise machineUSD to remove that configuration before upgrading.

Patch Changes

  • 9582c40: Routed hosted Tempo fee-payer fills through the configured withFeePayer transport and broadcast completed transactions through the default RPC transport.
  • d343aae: Added preparePayment for inspecting a selected client payment before creating and attaching its credential.
  • 7ce3160: Added the V8 coverage provider required by the configured test coverage command.
  • 5e10359: Fixed concurrent HTML builds sharing a temporary directory.
  • 4e4810a: Added a requiresAuth server option that used Payment-Authorization for Payment credentials.
  • 1a36a5e: Added HTTP headers to remote Tempo fee-payer configuration.
  • 07c59cf: Added dual MPP/x402 wrappers for Express, Hono, Next.js, and MCP, backed by official x402 adapters and native MPP protocol handling. Exposed Tempo and source-chain MPP payments for compatible EVM requirements; x402 Fastify and Axios compatibility adapters were deferred.

mppx@0.8.19

Patch Changes

  • 0850f5d: Preserved configured fee tokens for hosted server-driven Tempo session settlement and close transactions.
Changelog

Sourced from mppx's changelog.

0.9.0

Minor Changes

  • c23eaf0: Removed machineUSD charge and session flows, requiring servers that advertise machineUSD to remove that configuration before upgrading.

Patch Changes

  • 9582c40: Routed hosted Tempo fee-payer fills through the configured withFeePayer transport and broadcast completed transactions through the default RPC transport.
  • d343aae: Added preparePayment for inspecting a selected client payment before creating and attaching its credential.
  • 7ce3160: Added the V8 coverage provider required by the configured test coverage command.
  • 5e10359: Fixed concurrent HTML builds sharing a temporary directory.
  • 4e4810a: Added a requiresAuth server option that used Payment-Authorization for Payment credentials.
  • 1a36a5e: Added HTTP headers to remote Tempo fee-payer configuration.
  • 07c59cf: Added dual MPP/x402 wrappers for Express, Hono, Next.js, and MCP, backed by official x402 adapters and native MPP protocol handling. Exposed Tempo and source-chain MPP payments for compatible EVM requirements; x402 Fastify and Axios compatibility adapters were deferred.

0.8.19

Patch Changes

  • 0850f5d: Preserved configured fee tokens for hosted server-driven Tempo session settlement and close transactions.
Commits

Updates @types/node from 26.2.0 to 26.4.0

Commits

Bumps the weekly-dependencies group with 1 update: astral-sh/setup-uv.

Updates astral-sh/setup-uv from 7.6.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table>

... (truncated)

Commits

Bumps the weekly-dependencies group in /conformance/adapters/rust with 1 update: mpp.

Updates mpp from 0.11.0 to 0.12.0

Release notes

Sourced from mpp's releases.

v0.12.0

Minor Changes

  • Accept asynchronous Alloy signers for Tempo fee sponsorship and session closing,
  • enabling remote KMS, HSM, and MPC-backed server keys. (by @​BrendanRyan, #399)
  • Added automatic native TIP-1034 channel top-ups before session vouchers exceed the current deposit, with credentials bound to each active WebSocket challenge across reconnects. (by @​BrendanRyan, #399)
  • Support Tempo Wallet P-256 access keys for charge payments and expose the
  • shared store.json loader for native command-line clients. (by @​BrendanRyan, #399)
  • Add route-bound machineUSD session channels and atomic settlement into the
  • merchant's configured stablecoin. (by @​BrendanRyan, #399)
  • Add atomic stablecoin auto-swaps for native TIP-1034 session opens and top-ups,
  • including the required Stablecoin DEX approval for charge and session payments. (by @​BrendanRyan, #399)
  • Add a Charge-only payment provider backed by the canonical Tempo Accounts
  • store.json, with lazy access-key selection and no separate signing mode. (by @​BrendanRyan, #399)
  • Add separate non-mutating charge validation and terminal broadcast APIs, retaining verification as a compatibility alias and falling back to legacy method implementations. Add TempoRelayConfig and TempoBuilder::relay for delegating Tempo charge credential validation and finalization to Tempo API or a compatible MPP relay. Relay requests normalize the echoed challenge request, derive deterministic broadcast idempotency keys, validate returned receipts, and hide private relay failures. Add an Axum charge-relay example dogfooded against Tempo Moderato. (by @​BrendanRyan, #399)

Patch Changes

  • Return a fresh body-bound payment challenge when request-body credential verification fails. (by @​BrendanRyan, #399)
  • Pinned the Tempo dependency to the coordinated 7690815 revision. (by @​BrendanRyan, #399)
  • Use the SDK-independent mpp_ prefix for Stripe PaymentIntent idempotency keys. (by @​BrendanRyan, #399)
  • Continue retrying distinct charge challenges within the configured payment
  • retry limit, matching MPPx and allowing sponsored servers to rotate challenges
  • that were rejected before settlement. (by @​BrendanRyan, #399)
  • Match MPPx and Tempo fee sponsorship by encoding P-256 charge and TIP-1034 management credentials as sender-signed 0x78 envelopes. (by @​BrendanRyan, #399)
  • Authorize canonical application WebSockets with their advertised opening amount,
  • and provide a top-up-aware authorization path for full reusable channels. (by @​BrendanRyan, #399)
  • Reject payment challenges containing malformed RFC 3339 expires timestamps during header parsing. (by @​BrendanRyan, #399)
  • Pinned an updated Tempo dependency revision and reworked the one-time authorization test to sign the key authorization with a real root signer. (by @​BrendanRyan, #399)
  • Preserve method-specific receipt fields when parsing and serializing payment receipts. (by @​BrendanRyan, #399)
  • Mark successful body-bound payment responses as private while preserving existing
  • Cache-Control directives, preventing shared caches from storing payment receipts. (by @​BrendanRyan, #399)
  • Updated the pinned tempo-alloy git revision. (by @​BrendanRyan, #399)
  • Only attach payment receipts to successful responses from Tower middleware and Axum handlers. (by @​BrendanRyan, #399)
  • Reject payment challenges whose method identifier contains characters other
  • than lowercase ASCII letters. Reject payment challenges reached through a
  • cross-origin redirect before a credential can be created or sent. (by @​BrendanRyan, #399)
  • Reject Payment challenges containing an unterminated quoted-string parameter. (by @​BrendanRyan, #399)
  • Resolve persisted Tempo Wallet key authorizations against the Account Keychain before signing. Already-authorized access keys now omit the one-time authorization instead of failing fresh charge or session transactions with KeyAlreadyExists. (by @​BrendanRyan, #399)
  • Send payment credential retries directly to the final same-origin response URL after redirects. (by @​BrendanRyan, #399)
  • Use the bootstrapped Tempo localnet image for reproducible integration tests. (by @​BrendanRyan, #399)
  • Allowed Tempo signature variants without primitive key metadata while safely rejecting unsupported proof signatures. (by @​BrendanRyan, #399)
  • Update the Tempo SDK revision so fee-payer relays can select the transaction fee token. (by @​BrendanRyan, #399)
  • Load pending Accounts SDK key authorizations from the shared Tempo Wallet store so native Rust clients can provision a fresh access key with their first transaction. Open a fresh session after access-key rotation instead of trying to reuse a channel bound to the previous voucher signer. (by @​BrendanRyan, #399)

... (truncated)

Changelog

Sourced from mpp's changelog.

0.12.0 (2026-08-27)

Minor Changes

  • Accept asynchronous Alloy signers for Tempo fee sponsorship and session closing,
  • enabling remote KMS, HSM, and MPC-backed server keys. (by @​BrendanRyan, #399)
  • Added automatic native TIP-1034 channel top-ups before session vouchers exceed the current deposit, with credentials bound to each active WebSocket challenge across reconnects. (by @​BrendanRyan, #399)
  • Support Tempo Wallet P-256 access keys for charge payments and expose the
  • shared store.json loader for native command-line clients. (by @​BrendanRyan, #399)
  • Add route-bound machineUSD session channels and atomic settlement into the
  • merchant's configured stablecoin. (by @​BrendanRyan, #399)
  • Add atomic stablecoin auto-swaps for native TIP-1034 session opens and top-ups,
  • including the required Stablecoin DEX approval for charge and session payments. (by @​BrendanRyan, #399)
  • Add a Charge-only payment provider backed by the canonical Tempo Accounts
  • store.json, with lazy access-key selection and no separate signing mode. (by @​BrendanRyan, #399)
  • Add separate non-mutating charge validation and terminal broadcast APIs, retaining verification as a compatibility alias and falling back to legacy method implementations. Add TempoRelayConfig and TempoBuilder::relay for delegating Tempo charge credential validation and finalization to Tempo API or a compatible MPP relay. Relay requests normalize the echoed challenge request, derive deterministic broadcast idempotency keys, validate returned receipts, and hide private relay failures. Add an Axum charge-relay example dogfooded against Tempo Moderato. (by @​BrendanRyan, #399)

Patch Changes

  • Return a fresh body-bound payment challenge when request-body credential verification fails. (by @​BrendanRyan, #399)
  • Pinned the Tempo dependency to the coordinated 7690815 revision. (by @​BrendanRyan, #399)
  • Use the SDK-independent mpp_ prefix for Stripe PaymentIntent idempotency keys. (by @​BrendanRyan, #399)
  • Continue retrying distinct charge challenges within the configured payment
  • retry limit, matching MPPx and allowing sponsored servers to rotate challenges
  • that were rejected before settlement. (by @​BrendanRyan, #399)
  • Match MPPx and Tempo fee sponsorship by encoding P-256 charge and TIP-1034 management credentials as sender-signed 0x78 envelopes. (by @​BrendanRyan, #399)
  • Authorize canonical application WebSockets with their advertised opening amount,
  • and provide a top-up-aware authorization path for full reusable channels. (by @​BrendanRyan, #399)
  • Reject payment challenges containing malformed RFC 3339 expires timestamps during header parsing. (by @​BrendanRyan, #399)
  • Pinned an updated Tempo dependency revision and reworked the one-time authorization test to sign the key authorization with a real root signer. (by @​BrendanRyan, #399)
  • Preserve method-specific receipt fields when parsing and serializing payment receipts. (by @​BrendanRyan, #399)
  • Mark successful body-bound payment responses as private while preserving existing
  • Cache-Control directives, preventing shared caches from storing payment receipts. (by @​BrendanRyan, #399)
  • Updated the pinned tempo-alloy git revision. (by @​BrendanRyan, #399)
  • Only attach payment receipts to successful responses from Tower middleware and Axum handlers. (by @​BrendanRyan, #399)
  • Reject payment challenges whose method identifier contains characters other
  • than lowercase ASCII letters. Reject payment challenges reached through a
  • cross-origin redirect before a credential can be created or sent. (by @​BrendanRyan, #399)
  • Reject Payment challenges containing an unterminated quoted-string parameter. (by @​BrendanRyan, #399)
  • Resolve persisted Tempo Wallet key authorizations against the Account Keychain before signing. Already-authorized access keys now omit the one-time authorization instead of failing fresh charge or session transactions with KeyAlreadyExists. (by @​BrendanRyan, #399)
  • Send payment credential retries directly to the final same-origin response URL after redirects. (by @​BrendanRyan, #399)
  • Use the bootstrapped Tempo localnet image for reproducible integration tests. (by @​BrendanRyan, #399)
  • Allowed Tempo signature variants without primitive key metadata while safely rejecting unsupported proof signatures. (by @​BrendanRyan, #399)
  • Update the Tempo SDK revision so fee-payer relays can select the transaction fee token. (by @​BrendanRyan, #399)
  • Load pending Accounts SDK key authorizations from the shared Tempo Wallet store so native Rust clients can provision a fresh access key with their first transaction. Open a fresh session after access-key rotation instead of trying to reuse a channel bound to the previous voucher signer. (by @​BrendanRyan, #399)
Commits
  • 965692a chore: release v0.12.0 (#320)
  • 3c75742 fix: restrict payment receipts to successful responses (#399)
  • 217578f ci: open the release PR via github-sts (#398)
  • d441d53 ci(dependabot): approve and merge updates via github-sts (#397)
  • fadc88c fix: Credential retries ignore the final same-origin response URL (#396)
  • 50a0845 test: use bootstrapped Tempo localnet (#395)
  • 175bea7 fix: support additional tempo signatures (#391)
  • 85c62c5 chore(deps): bump tempo-alloy to 1.11.0 (#393)
  • 1162fc9 feat(tempo): support async server signers (#389)
  • bf3dfcb feat: add split charge validation and Tempo relay (#373)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the weekly-dependencies group
9ab6d17 
Bumps the weekly-dependencies group in /conformance/adapters/ruby with 2 updates: [mpp-rb](https://github.com/stripe/mpp-rb) and [sorbet-runtime](https://github.com/sorbet/sorbet).


Updates `mpp-rb` from 0.1.4 to 0.1.5
- [Commits](stripe/mpp-rb@v0.1.4...v0.1.5)

Updates `sorbet-runtime` from 0.6.13433 to 0.6.13454
- [Release notes](https://github.com/sorbet/sorbet/releases)
- [Commits](https://github.com/sorbet/sorbet/commits)
chore(deps): bump the weekly-dependencies group

Bumps the weekly-dependencies group in /conformance with 2 updates: [mppx](https://github.com/wevm/mppx) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `mppx` from 0.8.18 to 0.9.0
- [Release notes](https://github.com/wevm/mppx/releases)
- [Changelog](https://github.com/wevm/mppx/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/mppx/compare/mppx@0.8.18...mppx@0.9.0)

Updates `@types/node` from 26.2.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)
chore(deps): bump astral-sh/setup-uv in the weekly-dependencies group

Bumps the weekly-dependencies group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `astral-sh/setup-uv` from 7.6.0 to 10.0.1
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@37802ad...20cfd1b)
chore(deps): bump mpp

Bumps the weekly-dependencies group in /conformance/adapters/rust with 1 update: [mpp](https://github.com/tempoxyz/mpp-rs).


Updates `mpp` from 0.11.0 to 0.12.0
- [Release notes](https://github.com/tempoxyz/mpp-rs/releases)
- [Changelog](https://github.com/tempoxyz/mpp-rs/blob/main/CHANGELOG.md)
- [Commits](tempoxyz/mpp-rs@v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: mpp-rb
  dependency-version: 0.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: weekly-dependencies
- dependency-name: sorbet-runtime
  dependency-version: 0.6.13454
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: weekly-dependencies
- dependency-name: mppx
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: weekly-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: weekly-dependencies
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: weekly-dependencies
- dependency-name: mpp
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: weekly-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Aug 31, 2026
@socket-security

socket-security Bot commented Aug 31, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​types/​node@​26.2.0 ⏵ 26.4.0100 +110081 +196100
Updatedcargo/​mpp@​0.11.0 ⏵ 0.12.096 +1100100 +8100100
Updatednpm/​mppx@​0.8.18 ⏵ 0.9.09910010098100
Updatedgem/​mpp-rb@​0.1.4 ⏵ 0.1.599100100 +1100100
Updatedgem/​sorbet-runtime@​0.6.13433 ⏵ 0.6.13454100100100100100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants