Repository navigation
release(sdk): 0.17.0 - ship maxAmountPerPayment, closes #213 - #252
Merged
Merged
Conversation
Cuts the release issue #213 asked for. Three things ship together, all already merged to main and unreleased since 0.16.1: - initX402({ maxAmountPerPayment }) (#106) - the actual reason for this minor bump. - The local-dev default port fix (3001 -> 3002, from 3d440e7). - The facilitatorApiKey JSDoc comment that contradicted its own runtime check (14fc29a) - doc-only. - The zod GHSA-mrhx-c7xc-m3w5 override fix (f2179b0) - was only allowlisted before, now actually patched where resolvable. tsc build clean, 165 node:test + jest all pass, npm pack --dry-run shows only dist/ + README + package.json (no source, no .npmrc). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
M0nsxx
approved these changes
Nov 5, 2026
M0nsxx
left a comment
M0nsxx
left a comment
Collaborator
There was a problem hiding this comment.
Verified: maxAmountPerPayment matches issue #106 exactly, the port fix (3001→3002) correctly aligns with how master.ts actually starts the agent, the JSDoc contradiction fix is comment-only (no behavior change), and the zod override correctly patches GHSA-mrhx-c7xc-m3w5 through the mppx/viem chain while leaving @x402/core's own zod ^3.x alone (no patched 3.x exists, so that one stays allowlisted — correct, not an oversight). Approving.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #213.
initX402({ maxAmountPerPayment })(#106) has been documented in the README and sitting under## Unreleasedin the CHANGELOG since it merged - never actually published. This cuts the release, and picks up everything else that landed on main since 0.16.1 at the same time:facilitatorApiKeydoc comment that contradicted its own runtime check (comment-only)GHSA-mrhx-c7xc-m3w5override fix (was allowlisted before, now patched where resolvable)Verified before pushing:
tscbuild cleannode:test+ jest all passnpm pack --dry-run: onlydist/+README.md+package.json, no source, no.npmrc🤖 Generated with Claude Code