Skip to content

chore(deps): @profullstack/x402-gateway ^0.15.2, old browsers get the script challenge - #115

Merged
ralyodio merged 1 commit into
masterfrom
chore/x402-gateway-0.15.2
Oct 28, 2026
Merged

ralyodio merged 1 commit into
masterfrom
chore/x402-gateway-0.15.2

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

x402-gateway 0.15.2 (profullstack/x402-gateway#27): a desktop browser two years behind its auto-updates now gets the script challenge (16-bit proof of work) when it asks for a page, instead of a 402 straight away. A person on an old office Chrome can read. A caller that won't run the script, or asks for JSON, is still sold a pass. Headless and listed crawlers are unchanged. Lockfile-only bump.

🤖 Generated with Claude Code

… script challenge

A desktop Chrome two years behind was answered 402 on every content page;
0.15.2 gives it the script challenge first, so a person on an old office
machine reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​profullstack/​x402-gateway@​0.15.1 ⏵ 0.15.284 +1100100 +197 +1100

View full report

@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 6

Severity Rule Location
HIGH sh-unquoted-expansion-destructive public/install.sh:67
HIGH sh-remote-script-execution public/install.sh:89
MEDIUM sh-remote-script-execution public/install.sh:133
MEDIUM js-open-redirect src/app/numbers/page.tsx:180
MEDIUM js-open-redirect src/components/inbox-client.tsx:35
MEDIUM js-unescaped-html-sink src/components/pit-footer.tsx:17
LOW secret-generic-credential src/lib/providers/__tests__/twilio.test.ts:24
LOW secret-generic-credential src/lib/providers/__tests__/twilio.test.ts:46
LOW secret-generic-credential src/lib/providers/__tests__/twilio.test.ts:60
LOW secret-generic-credential src/lib/providers/__tests__/twilio.test.ts:78
LOW secret-generic-credential supabase/config.toml:287
LOW secret-generic-credential supabase/config.toml:319

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 24c3034 into master Oct 28, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant