chore(deps): bump github.com/tempoxyz/mpp-go from 0.1.2 to 0.2.0 in /conformance/adapters/go in the go-dependencies group

[dependabot]

Bumps the go-dependencies group in /conformance/adapters/go with 1 update: github.com/tempoxyz/mpp-go.

Updates github.com/tempoxyz/mpp-go from 0.1.2 to 0.2.0

Release notes

Sourced from github.com/tempoxyz/mpp-go's releases.

v0.2.0

What's Changed

• test: convert tests to testify assertions by @​brendanjryan in tempoxyz/mpp-go#48
• fix(server): require default challenge expiry by @​EfeDurmaz16 in tempoxyz/mpp-go#39
• docs: describe idempotent POST charge external IDs by @​EfeDurmaz16 in tempoxyz/mpp-go#36
• chore(deps): bump actions/checkout from 6 to 6.0.2 in the actions group by @​dependabot[bot] in tempoxyz/mpp-go#52
• chore(deps): bump github.com/redis/go-redis/v9 from 9.19.0 to 9.20.0 in the go-deps group by @​dependabot[bot] in tempoxyz/mpp-go#53
• feat: wallet-bound proof signatures by @​stevencartavia in tempoxyz/mpp-go#57
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the actions group by @​dependabot[bot] in tempoxyz/mpp-go#56
• feat: add server body digest and route scope conformance by @​figtracer in tempoxyz/mpp-go#55
• fix: reject padded Tempo calldata by @​brendanjryan in tempoxyz/mpp-go#70
• fix(server): mark paid responses Cache-Control: private by @​EfeDurmaz16 in tempoxyz/mpp-go#37
• fix(mpp): align Problem Details with core spec by @​betterclever in tempoxyz/mpp-go#67
• ci: make changelog check read-only by @​brendanjryan in tempoxyz/mpp-go#71
• test: align invalid challenge middleware statuses by @​brendanjryan in tempoxyz/mpp-go#72
• fix(server): reject multiple Payment credentials by @​betterclever in tempoxyz/mpp-go#66
• Release github.com/tempoxyz/mpp-go@0.2.0 by @​github-actions[bot] in tempoxyz/mpp-go#51

New Contributors

• @​EfeDurmaz16 made their first contribution in tempoxyz/mpp-go#39
• @​stevencartavia made their first contribution in tempoxyz/mpp-go#57
• @​figtracer made their first contribution in tempoxyz/mpp-go#55
• @​betterclever made their first contribution in tempoxyz/mpp-go#67

Full Changelog: tempoxyz/mpp-go@v0.1.2...v0.2.0

Changelog

Sourced from github.com/tempoxyz/mpp-go's changelog.

github.com/tempoxyz/mpp-go@0.2.0

Minor Changes

• Bind server charge challenges to request bodies and framework route scope. (by @​figtracer, #55)

Patch Changes

• Convert Go tests to use testify assertions. (by @​BrendanRyan, #48)
• Run the pull request changelog check with read-only permissions so forked PRs can pass after adding a changelog. (by @​BrendanRyan, #71)
• Reject credentials that omit expires when verifying challenges with the default expiry policy. (by @​EfeBaranDurmaz, #39)
• Reject padded Tempo transfer calldata by requiring exact TIP-20 ABI lengths during shared calldata matching and server-side transaction validation. (by @​BrendanRyan, #70)
• Align middleware invalid-challenge test expectations with the core problem details status code. (by @​BrendanRyan, #72)
• Align spec-listed MPP Problem Details type URIs with the canonical https://paymentauth.org/problems/ base URI, and return 402 for malformed credentials and invalid challenges. (by @​PranjalPaliwal, #67)
• Reject requests that include multiple Authorization: Payment credentials instead of silently selecting the first credential. (by @​PranjalPaliwal, #66)
• Mark paid server responses that include Payment-Receipt as Cache-Control: private. (by @​EfeBaranDurmaz, #37)
• Wallet-bind Tempo zero-amount proofs to close cross-account replay. The EIP-712 Proof message now leads with the payer account address (then challengeId, realm) and the MPP domain version is "3". Verifiers rebuild the digest from the credential source, so client and server must both use v3. ProofTypedDataHash now takes an account common.Address; ProofTypedData exposes the typed data.
• Note: v3 is not yet interoperable with the mppx (TypeScript) SDK, which still uses v2 (Proof = [challengeId, realm], no account). (by @​stevencartavia, #57)

Commits

• 41c35ed Release github.com/tempoxyz/mpp-go@0.2.0 (#51)
• 6b714d4 Reject multiple Payment credentials (#66)
• 9fe600d test: align invalid challenge middleware statuses (#72)
• a93da5a ci: make changelog check read-only (#71)
• 1bc23e2 Align Problem Details with core spec (#67)
• 6b2a5e1 fix(server): mark paid responses Cache-Control: private (#37)
• 0990936 fix: reject padded Tempo calldata (#70)
• f9a9ac4 feat: add server body digest and route scope conformance (#55)
• 3ea7a37 chore(deps): bump actions/checkout in the actions group (#56)
• 712c022 feat: wallet-bound proof signatures (#57)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​tempoxyz/​mpp-go@​v0.1.2 ⏵ v0.2.0	+1

View full report