[dependabot]

Bumps the minor-and-patch group in /packages/cli with 2 updates: nirium and @x402/express.

Updates nirium from 0.16.1 to 0.17.0

Changelog

Sourced from nirium's changelog.

0.17.0 - 2026-11-05

Added

• initX402({ maxAmountPerPayment }) (#106): sets the @x402/core 2.28 per-payment cap (spendControls.maxAmountPerPayment) so APIs priced above $1 can be paid. Accepts '$5', '5' or 5; validated at initX402() time (positive amounts only, false is rejected). Without the option, behavior is unchanged: the default stays $1. Works with and without policy. The X402SpendCapError message now points to the option.

Fixed

• The default baseUrl (Agent constructor and its JSDoc example) was http://localhost:3001 - that's only the agent's own standalone fallback, a path the documented pnpm dev quickstart never takes (it runs on 3002 via master.ts). Now 3002, matching the quickstart everyone actually follows.
• The facilitatorApiKey JSDoc comment on X402ServeConfig said "Mainnet lo exige; testnet no" while the runtime check two lines below throws on both networks ("the facilitator rejects unauthenticated servers on testnet too") - directly contradicting the code it described. Same false claim in the README's quickstart comment. Comment-only; behavior was already correct.

Security

• @stellar/mpp > mppx > viem/abitype/incur > zod could resolve below 4.6.6 (patched) for GHSA-mrhx-c7xc-m3w5, previously only allowlisted rather than fixed. Every package on that chain already declares zod ^4.x in its own peerDependencies - nothing pinned it low, it just never got bumped. Added a scoped overrides entry (mppx, @stellar/mpp, viem) so the whole subtree resolves to a patched version; @x402/core's own zod ^3.x is untouched. @x402/core itself still requires zod ^3.24.2, which cannot resolve to 4.x - no patched 3.x release exists, so that one dependency stays allowlisted via audit-ci.

Commits

• See full diff in compare view

Updates @x402/express from 2.29.0 to 2.30.0

Commits

• 3414a56 chore: version typescript packages  (#4136)
• d95724b chore(go): release (#4138)
• 91806a3 chore: version python package  (#4137)
• 2884003 Pull request for mintlify/docs-update-1793816377937 (#4135)
• c349511 feat(ts): facilitator-managed voucher custody for EVM batch settlement (#4061)
• 0f41a8d fix(core): use phase-specific error codes for throwing gate hooks (#4133)
• 7c9d6ad fix(xrpl): enforce spend caps in issued-currency units (#4110)
• 8736fb7 Update docs/advanced-concepts/lifecycle-hooks.mdx (#4132)
• 29a8124 fix(core): fail closed when a gate hook throws (#3702)
• 58e667f fix(evm): return invalid_upto_evm_payload for malformed upto Permit2 payloads...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions