chore(deps): bump the minor-patch group with 9 updates

[dependabot]

Bumps the minor-patch group with 9 updates:

Package	From	To
@agent-score/sdk	2.7.4	2.7.5
@solana/kit	7.0.0	7.1.0
@x402/core	2.21.0	2.22.0
@x402/evm	2.21.0	2.22.0
@x402/extensions	2.21.0	2.22.0
fastify	5.11.3	5.12.0
hono	4.13.1	4.13.2
jose	6.2.8	6.2.9
knip	6.32.1	6.32.2

Updates @agent-score/sdk from 2.7.4 to 2.7.5

Release notes

Sourced from @​agent-score/sdk's releases.

v2.7.5

What's Changed

• Bump to 2.7.5: type operator_handle on the assess response by @​vvillait88 in agentscore/node-sdk#74

Full Changelog: agentscore/node-sdk@v2.7.4...v2.7.5

Commits

• 54ac78b Bump to 2.7.5: type operator_handle on the assess response (#74)
• See full diff in compare view

Updates @solana/kit from 7.0.0 to 7.1.0

Release notes

Sourced from @​solana/kit's releases.

v7.1.0

@​solana/kit

v7.1.0 (2026-08-14)

Minor Changes

• [@solana/errors, @solana/kit, @solana/react, @solana/subscribable] #1811 7022c26 Thanks @​mcintyre94! - Add bridgeStoreToAsyncIterable to @solana/subscribable

  bridgeStoreToAsyncIterable adapts a ReactiveStreamStore into the pull-based AsyncIterable contract that consumers like TanStack Query's experimental_streamedQuery expect. It is now a public export of @solana/subscribable (and re-exported from @solana/kit). It was previously an internal helper of @solana/react, but it is not React- or TanStack-specific and is useful to any consumer that needs to drive a stream store by for await-ing it.

  The bridge only observes the store — consistent with the rest of the ecosystem, the caller owns the store's lifecycle (connect() it yourself, bound to the same signal, and reset() it when done). The bridge subscribes, seeds from the store's current snapshot, yields values, and unsubscribes when iteration ends.

  It throws the new SOLANA_ERROR__SUBSCRIBABLE__STREAM_CLOSED_WITHOUT_ERROR when a store closes in an error state with a nullish payload. This is the error useSubscriptionQuery and useTrackedDataQuery now surface in that case; the SWR bridge is unaffected.

• [@solana/errors, @solana/offchain-messages] #1888 14a3e5b Thanks @​mcintyre94! - Add an assertOffchainMessageV1Equal helper that asserts that a version 1 offchain message you received from an untrusted signer (eg. a wallet) is the message you expected it to sign. Verifying a signature proves only that the signer produced it over the bytes it handed back, not that those bytes represent the message you asked for, so assert this before verifying signatures with verifyOffchainMessageEnvelope. The helper compares the content and the required signatories, and reports each kind of mismatch with its own error code: the new SOLANA_ERROR__OFFCHAIN_MESSAGE__CONTENT_DOES_NOT_MATCH_EXPECTED and SOLANA_ERROR__OFFCHAIN_MESSAGE__REQUIRED_SIGNATORIES_DO_NOT_MATCH_EXPECTED. Required signatories are compared without regard to order, since a decoded message lists them in the order the specification mandates while yours may be in any order. It accepts an OffchainMessageV1 rather than the OffchainMessage union that decoding produces, so narrow the decoded message to a version 1 message before calling it.

• [@solana/instruction-plans] #1915 9e7daea Thanks @​mcintyre94! - Let the createTransactionPlanExecutor callback return the context of a successful result

  The executeTransactionMessage callback may now return the context that a successful result should carry, instead of a Signature or a Transaction. When it does, that context is used as-is: nothing is derived from it, and in particular getSignatureFromTransaction is never called on your behalf.

  const transactionPlanExecutor = createTransactionPlanExecutor({
    executeTransactionMessage: async (context, message) => {
      const transaction = await signTransactionMessageWithSigners(message);
      context.transaction = transaction;
  +   const signature = getSignatureFromTransaction(transaction);
      await sendAndConfirmTransaction(transaction, { commitment: 'confirmed' });
  -   return transaction;
  +   return { signature, transaction };
    },
  });

  Since a successful result always carries a signature, a returned context must include one — a callback that declares a custom context and forgets a property of it now fails to compile, rather than producing a result whose context is typed but undefined at runtime. That signature is also how the executor tells a returned context apart from a returned Transaction, which keeps its signatures in a signatures map and therefore never has one.

  The mutable context argument is unchanged and still serves the failure path: whatever the callback stores on it before it throws is preserved in the resulting FailedSingleTransactionPlanResult. On success the two are merged, with the returned context taking precedence, so a property stored but not returned is still reported.

  Returning a Signature or a Transaction is deprecated. Both still behave exactly as before — a returned signature is stored as context.signature, and a returned transaction is stored as context.transaction with its signature derived from it — and IDEs now flag those call sites, because createTransactionPlanExecutor gained a deprecated overload that only matches callbacks returning those types. Note that a config declared as TransactionPlanExecutorConfig up front is not flagged, since that type permits either return style.

  Prefer returning a context, since deriving a signature from a transaction throws SOLANA_ERROR__TRANSACTION__FEE_PAYER_SIGNATURE_MISSING when the fee payer slot is empty. An executor that deliberately produces partially signed transactions — signed by an authority, to be paid for and submitted by a relayer later — can now succeed by returning its own signature alongside the transaction. Dropping the signature from a successful result's context altogether remains impossible, since SuccessfulSingleTransactionPlanResult guarantees one.

  Failure handling is unchanged, including the signature still derived from a transaction left on the context when the callback throws. Since the callback never returned anything in that case, there is nothing to bypass that derivation, so a callback working with fee-payer-unsigned transactions should avoid storing them on the context — otherwise deriving a signature from one replaces the error it meant to report.

• [@solana/kit] #1898 4a5f717 Thanks @​lorisleiva! - Add helpers to create client interfaces from a raw Rpc

  Add createClientWithGetMinimumBalanceFromRpc, createClientWithFetchAccountsFromRpc and createClientWithInterfacesFromRpc to @solana/kit. These convenience helpers let consumers that only have a raw Rpc object construct the corresponding client interfaces (ClientWithGetMinimumBalance and ClientWithFetchAccounts) without assembling a full Kit client. createClientWithInterfacesFromRpc fills in whichever interfaces the RPC supports and narrows its return type accordingly.

• [@solana/kit] #1824 b47feb6 Thanks @​mcintyre94! - Re-export @solana/promises from @solana/kit

... (truncated)

Commits

• 661554c Version Packages (#1830)
• 8c9eece Fix getBitArrayEncoder returning the wrong next offset (#1911)
• 9e7daea Let transaction plan executors return a result context (#1915)
• 80b3756 fix: stop upcasting token balance uiAmount and related numerics to bigint...
• 82c4ceb fix: stop upcasting transaction version to bigint (#1917)
• 03bd803 Add a note in CLAUDE.md about docs using published packages (#1916)
• 9d6be07 Stop inflating every release to a major via the @solana/react peer dependen...
• 0eff23c Bump jscodeshift from 17.3.0 to 17.4.0 (#1908)
• 7b52c7e Bump react-test-renderer from 19.2.7 to 19.2.8 (#1904)
• b2f9a3c Bump @​changesets/cli from 2.31.0 to 2.31.1 (#1903)
• Additional commits viewable in compare view

Updates @x402/core from 2.21.0 to 2.22.0

Commits

• c8247c4 chore: version typescript packages  (#3128)
• a98c19d chore: version python package  (#3129)
• a52417e chore(go): release (#3130)
• 0b79a6a Update docs/schemes/exact.mdx (#3127)
• 37412e7 fix(ts): escape backslashes in normalizePath instead of folding them to "/" (...
• 927fea8 feat(svm): make facilitator transaction limits operator-configurable (#3120)
• 1d15062 E2e refactor (#2976)
• 1601942 fix(ts/py): path normalization (#3073)
• e6f354c label networks in prs (#3090)
• 2c83d1c Update docs/core-concepts/network-and-token-support.mdx (#3108)
• Additional commits viewable in compare view

Updates @x402/evm from 2.21.0 to 2.22.0

Commits

• c8247c4 chore: version typescript packages  (#3128)
• a98c19d chore: version python package  (#3129)
• a52417e chore(go): release (#3130)
• 0b79a6a Update docs/schemes/exact.mdx (#3127)
• 37412e7 fix(ts): escape backslashes in normalizePath instead of folding them to "/" (...
• 927fea8 feat(svm): make facilitator transaction limits operator-configurable (#3120)
• 1d15062 E2e refactor (#2976)
• 1601942 fix(ts/py): path normalization (#3073)
• e6f354c label networks in prs (#3090)
• 2c83d1c Update docs/core-concepts/network-and-token-support.mdx (#3108)
• Additional commits viewable in compare view

Updates @x402/extensions from 2.21.0 to 2.22.0

Commits

• c8247c4 chore: version typescript packages  (#3128)
• a98c19d chore: version python package  (#3129)
• a52417e chore(go): release (#3130)
• 0b79a6a Update docs/schemes/exact.mdx (#3127)
• 37412e7 fix(ts): escape backslashes in normalizePath instead of folding them to "/" (...
• 927fea8 feat(svm): make facilitator transaction limits operator-configurable (#3120)
• 1d15062 E2e refactor (#2976)
• 1601942 fix(ts/py): path normalization (#3073)
• e6f354c label networks in prs (#3090)
• 2c83d1c Update docs/core-concepts/network-and-token-support.mdx (#3108)
• Additional commits viewable in compare view

Updates fastify from 5.11.3 to 5.12.0

Release notes

Sourced from fastify's releases.

v5.12.0

What's Changed

• chore(sponsor): add testmu ai by @​Eomm in fastify/fastify#6922
• docs: add per-route logging for Google Cloud Functions by @​slegarraga in fastify/fastify#6907
• test: remove @​sinonjs/fake-timers by @​climba03003 in fastify/fastify#6934
• [Backport 5.x] fix: remove raw response headers by @​github-actions[bot] in fastify/fastify#6939
• [Backport 5.x] test: use process-warning spyWarning for testing by @​github-actions[bot] in fastify/fastify#6945
• [Backport 5.x] feat: add Reply.prototype.mediaType by @​github-actions[bot] in fastify/fastify#6946
• [Backport 5.x] fix(content-type): return undefined for invalid media types by @​github-actions[bot] in fastify/fastify#6947

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

Commits

• 27d1fec Bumped v5.12.0
• 430dd4e fix(content-type): return undefined for invalid media types (#6942) (#6947)
• fd5fe53 feat: add Reply.prototype.mediaType (#6932) (#6946)
• cd04a49 test: use process-warning spyWarning for testing (#6887) (#6945)
• b9e5402 fix: remove raw response headers (#6860) (#6939)
• e1fc825 test: remove @​sinonjs/fake-timers (#6934)
• 2e81c38 docs: add per-route logging for Google Cloud Functions (#6907)
• f87eb61 chore(sponsor): add testmu ai (#6922)
• See full diff in compare view

Updates hono from 4.13.1 to 4.13.2

Release notes

Sourced from hono's releases.

v4.13.2

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
• fix(client): serialize multiple cookies correctly in honojs/hono#5202
• fix(etag): stabilize digest across stream chunks in honojs/hono#5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
• perf(cors): pre-join static array header options during initialization in honojs/hono#5210
• fix(client): send falsy JSON bodies in honojs/hono#5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

Commits

• 41bdc42 4.13.2
• 6ea514d feat(secure-headers): add missing W3C Permissions-Policy directives (#5214)
• 329b6f4 fix(client): send falsy JSON bodies (#5215)
• a1e4ac7 perf(cors): pre-join static array header options during initialization (#5210)
• d982f63 fix(url): strip trailing question mark correctly for optional params with reg...
• 26de731 fix(etag): stabilize digest across stream chunks (#5205)
• 7075369 Revert " fix(etag): resolve incorrect incremental hashing for chunked respons...
• f2a72d3 fix(client): serialize multiple cookies correctly (#5202)
• 8a5852d fix(etag): resolve incorrect incremental hashing for chunked responses (#5199)
• 765d13b fix(jsx): render async children of document metadata tags instead of [object ...
• Additional commits viewable in compare view

Updates jose from 6.2.8 to 6.2.9

Release notes

Sourced from jose's releases.

v6.2.9

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

Changelog

Sourced from jose's changelog.

6.2.9 (2026-08-15)

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

Commits

• f3a3c78 chore(release): 6.2.9
• 33bf832 fix(types): undeprecate PBES2 p2c parameter
• 6ed19a6 fix: reject a JWE whose generated Key Management Parameters collide
• 944840d ci: use shared release workflows
• 05bccf2 chore: bump packages
• f7392d1 test: account for workerd nodejs_compat flag default changes
• 4e944be ci: drop the wait-for-npm machinery
• 4285b6f chore(deps-dev): bump undici
• cb114ec chore: cleanup after release
• See full diff in compare view

Updates knip from 6.32.1 to 6.32.2

Release notes

Sourced from knip's releases.

Release 6.32.2

• Support oxfmt.config.mts (#1933) (795900191dc75eec8d1e717b866bf57e1e2912cc) - thanks @​joealden!
• Support oxlint.config.mts (#1934) (531e2dc7c1d8bf31babea0068c34391182ec2d50) - thanks @​joealden!
• Fix Supported lint-staged Configs (#1935) (f9c755e414ed10baa4d01af8ddac6d04cb8d5617) - thanks @​joealden!
• Update dependencies (95f7c529f918dd9e1a84f92c68d064738977b825)
• Update sentry snapshot (ea7929fcbd6b323c8bdd9252ac57017feeb29ecf)

Commits

• 196a11a Release knip@6.32.2
• 95f7c52 Update dependencies
• f9c755e Fix Supported lint-staged Configs (#1935)
• 531e2dc Support oxlint.config.mts (#1934)
• 7959001 Support oxfmt.config.mts (#1933)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions