chore(deps): settle set to mppx 0.17.0, viem 2.57.14, @solana/kit 8.6.0; release 3.1.8

osv-scanner.toml

@@ -15,3 +15,17 @@ ecosystem = "npm"
 effectiveUntil = 2027-01-24
 vulnerability.ignore = true
 reason = "GHSA-mrhx-c7xc-m3w5 has no zod 3.x fix and the x402 and cdp-sdk dev dependencies still require zod ^3. The published bundle carries only mppx's zod 4.6.7."
+
+# minimatch: GHSA-g3hv-75wg-m249 (DoS through globparts amplification) is fixed
+# only in 11.0.1; no 10.x release carries it. Every copy in this lock is lint
+# tooling (eslint and its config-array, typescript-eslint's typescript-estree,
+# eslint-plugin-import-x) matching patterns we write ourselves, and none of it
+# ships in the published package. Their ^10 ranges do not admit 11. Remove the
+# entry when its parents' latest releases admit 11.
+[[PackageOverrides]]
+name = "minimatch"
+version = "10.2.6"
+ecosystem = "npm"
+effectiveUntil = 2027-01-31
+vulnerability.ignore = true
+reason = "No fixed 10.x; pulled at ^10 by eslint, @eslint/config-array, typescript-estree and eslint-plugin-import-x; lint tooling only, not in the published package."

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/commerce",
-  "version": "3.1.7",
+  "version": "3.1.8",
   "description": "Agentic commerce SDK: identity middleware (Hono, Express, Fastify, Next.js, Web Fetch) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -152,7 +152,7 @@
   "overrides": {
     "@x402/core": "2.29.0",
     "axios": "^1.20.0",
-    "viem": "2.57.13"
+    "viem": "2.57.14"
   },
   "peerDependencies": {
     "@solana/kit": ">=8.0.0 <9.0.0",
@@ -194,30 +194,30 @@
     "@a2a-js/sdk": "^1.3.0",
     "@coinbase/x402": "^2.1.0",
     "@eslint/js": "^10.0.1",
-    "@solana/kit": "^8.5.0",
+    "@solana/kit": "^8.6.0",
     "@solana/mpp": "^0.7.0",
     "@types/express": "^5.0.6",
-    "@types/node": "^26.6.5",
+    "@types/node": "^26.6.6",
     "@vitest/coverage-v8": "^5.0.5",
     "@x402/core": "2.29.0",
     "@x402/evm": "2.29.0",
     "@x402/extensions": "2.29.0",
     "dotenv": "^18.0.9",
-    "eslint": "^10.13.0",
+    "eslint": "^10.14.0",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-unused-imports": "^4.4.1",
     "express": "^5.3.0",
     "fastify": "^5.12.7",
-    "hono": "^4.13.13",
+    "hono": "^4.13.16",
     "ioredis": "^6.0.0",
-    "jose": "^6.2.13",
-    "knip": "^6.43.0",
+    "jose": "^6.2.14",
+    "knip": "^6.44.1",
     "lefthook": "^2.2.2",
-    "mppx": "0.16.0",
+    "mppx": "0.17.0",
     "tsup": "^9.0.0",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.72.1",
-    "viem": "2.57.13",
+    "viem": "2.57.14",
     "vitest": "^5.0.5"
   },
   "packageManager": "bun@1.4.4"

src/middleware/express.ts

@@ -6,6 +6,8 @@ import {
 } from './_core';
 import type { NextFunction, Request, RequestHandler, Response } from 'express';
 
+export type { RateLimitCoreOptions } from './_core';
+
 export interface RateLimitExpressOptions extends RateLimitCoreOptions {
   /** Bucket key resolver. Default: first hop of `x-forwarded-for`, else req.ip, else `'unknown'`. */
   keyResolver?: (req: Request) => string;

src/middleware/fastify.ts

@@ -6,6 +6,8 @@ import {
 } from './_core';
 import type { FastifyReply, FastifyRequest, preHandlerHookHandler } from 'fastify';
 
+export type { RateLimitCoreOptions } from './_core';
+
 export interface RateLimitFastifyOptions extends RateLimitCoreOptions {
   /** Bucket key resolver. Default: first hop of `x-forwarded-for`, else `req.ip`, else `'unknown'`. */
   keyResolver?: (req: FastifyRequest) => string;

src/middleware/hono.ts

@@ -6,6 +6,8 @@ import {
 } from './_core';
 import type { Context, MiddlewareHandler, Next } from 'hono';
 
+export type { RateLimitCoreOptions } from './_core';
+
 export interface RateLimitHonoOptions extends RateLimitCoreOptions {
   /** Bucket key resolver. Default: first hop of `x-forwarded-for`, else `'unknown'`. */
   keyResolver?: (c: Context) => string;

src/middleware/web.ts

@@ -5,6 +5,8 @@ import {
   type RateLimitCoreOptions,
 } from './_core';
 
+export type { RateLimitCoreOptions } from './_core';
+
 export interface RateLimitWebOptions extends RateLimitCoreOptions {
   /** Bucket key resolver. Default: first hop of `x-forwarded-for`, else `'unknown'`. */
   keyResolver?: (req: Request) => string;