chore(deps): bump the npm-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the npm-dependencies group with 3 updates in the /conformance directory: mppx, @types/node and tsx.

Updates mppx from 0.7.0 to 0.8.5

Release notes

Sourced from mppx's releases.

mppx@0.8.5

Patch Changes

• 754b491: Added viem token definitions and token sets to make managing tokens simpler.

mppx@0.8.4

Patch Changes

• 3136195: Fixed Tempo auto-swap call building with viem@>=2.54 and hardened account balance metadata formatting.
• 86b6586: Fixed Stripe CLI live-mode Shared Payment Token creation. SPT requests now send the preview Stripe-Version header, live-mode requests target the issued-tokens endpoint with seller_details[network_business_profile], and restricted test keys (rk_test_...) are recognized as test mode.
• cdd989e: Added a mppx validate CLI command for discovering paid endpoints, validating payment challenges, checking malformed-credential handling, and exercising Tempo payment flows end to end.

mppx@0.8.3

Patch Changes

• be8a655: Fixed Tempo charge credential creation with viem@>=2.54 transfer call builders.

mppx@0.8.2

Patch Changes

• 80ed268: Added CLI selection of payable Tempo charge challenges and a currency override.
• 24ddf52: Filtered unsupported x402 accepts during HTTP client challenge extraction.
• 24ddcca: Rejected non-canonical fee-payer calldata and client-supplied access lists before sponsorship.
• 685f698: Fixed MCP payment-aware fetch retries for tool results with payment-required metadata.
• 8305a05: Added configurable incremental payment challenge retries for client fetch, defaulting to three.

mppx@0.8.1

Patch Changes

• 2c4086f: Disabled automatic CLI configuration discovery from local directories.
• 2158a40: Enforced sponsor fee policies before hosted fee-payer signing.
• ca8687b: Validated session open deposit and voucher amounts before sponsored broadcast.

mppx@0.8.0

Minor Changes

• daab9b8: Breaking: Collapsed McpClient.wrap and the in-place wrapClient variant into a single McpClient.wrap API on the mppx/mcp/client entrypoint.

  McpClient.wrap now adds payment handling to an MCP SDK client in place: the client is mutated and the same reference is returned, so surfaces that keep using the original client become payment-aware (e.g. when another SDK owns the client reference, like Cloudflare Agents). The MCP SDK callTool(params, resultSchema?, options?) signature is preserved, payment challenges are handled whether they arrive as payment-required errors or as tool results carrying org.paymentauth/payment-required metadata, and the config accepts orderChallenges and paymentPreferences alongside methods and onPaymentRequired. Calling wrap on the same client again replaces its payment configuration.

  Migration: move per-call options from the second argument to the third — mcp.callTool(params, undefined, { context, timeout }) — and replace the approval-first overload mcp.callTool(onPaymentRequired, params, options) with the onPaymentRequired option: mcp.callTool(params, undefined, { onPaymentRequired }) (pass null to bypass a configured hook). The MCP entrypoints moved to mppx/mcp/client and mppx/mcp/server; the mppx/mcp-sdk/* specifiers remain as aliases.

• e755222: Settled MCP-over-HTTP payment challenges in the same payment-aware fetch as HTTP 402s, so Transport.http() can extract JSON-RPC -32042 challenges and retry with credentials in MCP metadata.

• 18b57cc: Added a pluggable channelStore for persisting reusable payer session channels and removed the client-side authorizedSigner override so voucher authority is derived from the selected account.

Patch Changes

• 4c79a78: Rejected empty Payment challenge IDs during construction and deserialization.
• 7c38c17: Deprecated uppercase asset and chain aliases in favor of lowercase exports.
• 0e88d07: Corrected PaymentRequest documentation examples to use the exported namespace name.

... (truncated)

Changelog

Sourced from mppx's changelog.

0.8.5

Patch Changes

• 754b491: Added viem token definitions and token sets to make managing tokens simpler.

0.8.4

Patch Changes

• 3136195: Fixed Tempo auto-swap call building with viem@>=2.54 and hardened account balance metadata formatting.
• 86b6586: Fixed Stripe CLI live-mode Shared Payment Token creation. SPT requests now send the preview Stripe-Version header, live-mode requests target the issued-tokens endpoint with seller_details[network_business_profile], and restricted test keys (rk_test_...) are recognized as test mode.
• cdd989e: Added a mppx validate CLI command for discovering paid endpoints, validating payment challenges, checking malformed-credential handling, and exercising Tempo payment flows end to end.

0.8.3

Patch Changes

• be8a655: Fixed Tempo charge credential creation with viem@>=2.54 transfer call builders.

0.8.2

Patch Changes

• 80ed268: Added CLI selection of payable Tempo charge challenges and a currency override.
• 24ddf52: Filtered unsupported x402 accepts during HTTP client challenge extraction.
• 24ddcca: Rejected non-canonical fee-payer calldata and client-supplied access lists before sponsorship.
• 685f698: Fixed MCP payment-aware fetch retries for tool results with payment-required metadata.
• 8305a05: Added configurable incremental payment challenge retries for client fetch, defaulting to three.

0.8.1

Patch Changes

• 2c4086f: Disabled automatic CLI configuration discovery from local directories.
• 2158a40: Enforced sponsor fee policies before hosted fee-payer signing.
• ca8687b: Validated session open deposit and voucher amounts before sponsored broadcast.

0.8.0

Minor Changes

• daab9b8: Breaking: Collapsed McpClient.wrap and the in-place wrapClient variant into a single McpClient.wrap API on the mppx/mcp/client entrypoint.

  McpClient.wrap now adds payment handling to an MCP SDK client in place: the client is mutated and the same reference is returned, so surfaces that keep using the original client become payment-aware (e.g. when another SDK owns the client reference, like Cloudflare Agents). The MCP SDK callTool(params, resultSchema?, options?) signature is preserved, payment challenges are handled whether they arrive as payment-required errors or as tool results carrying org.paymentauth/payment-required metadata, and the config accepts orderChallenges and paymentPreferences alongside methods and onPaymentRequired. Calling wrap on the same client again replaces its payment configuration.

  Migration: move per-call options from the second argument to the third — mcp.callTool(params, undefined, { context, timeout }) — and replace the approval-first overload mcp.callTool(onPaymentRequired, params, options) with the onPaymentRequired option: mcp.callTool(params, undefined, { onPaymentRequired }) (pass null to bypass a configured hook). The MCP entrypoints moved to mppx/mcp/client and mppx/mcp/server; the mppx/mcp-sdk/* specifiers remain as aliases.

• e755222: Settled MCP-over-HTTP payment challenges in the same payment-aware fetch as HTTP 402s, so Transport.http() can extract JSON-RPC -32042 challenges and retry with credentials in MCP metadata.

• 18b57cc: Added a pluggable channelStore for persisting reusable payer session channels and removed the client-side authorizedSigner override so voucher authority is derived from the selected account.

... (truncated)

Commits

• a95ee20 chore: version packages (#611)
• 754b491 feat: support viem token sets (#608)
• 6419c44 ci: enforce changesets on pull requests (#610)
• 08a3d89 chore: version packages (#607)
• cdd989e docs: add validate command changeset (#609)
• 86b6586 fix(cli): stripe spt support (#605)
• 3136195 fix: support viem auto-swap calls (#606)
• 5f62a4b feat(cli): add mppx validate command for end-to-end server validation (#595)
• 2a80671 chore: version packages (#604)
• be8a655 fix(tempo): viem token call (#603)
• Additional commits viewable in compare view

Updates @types/node from 25.9.3 to 26.1.0

Commits

• See full diff in compare view

Updates tsx from 4.22.4 to 4.23.0

Release notes

Sourced from tsx's releases.

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 1dfad37 docs: cite esbuild's extension-resolution model in node notes
• 257bbbb fix: avoid redundant filesystem probes during module resolution
• c178197 feat: add multi-scenario startup benchmark suite
• 51800ac docs: add Node internals knowledge base (notes/node)
• a305f36 fix: isolate hook state per async module.register() registration
• ca501a9 chore: upgrade skills-npm to v1.2.0
• 596cd1f test: cover __dirname, __filename, & require.cache in CJS TS file
• 75d9bf0 test: lock in lenient ESM for ambiguous and CJS-typed packages
• 1472f3e test: cover ESM-syntax dependency with omitted "type" field
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​tsx@​4.22.4 ⏵ 4.23.0	-4		-10
	npm/​@​types/​node@​25.9.3 ⏵ 26.1.0	+1		+1
	npm/​mppx@​0.7.0 ⏵ 0.8.5			+1	+1

View full report