Take x402 2.19.0 in the lock, which an earlier merge dropped - #112
Merged
Conversation
The bump was written and reviewed but never landed: the branch carrying it was PR'd at the commit before it, so main kept resolving 2.18.0 while the PR body said otherwise. 2.19.0 fixes path normalization in x402_http_server_base, where decoding percent-escapes globally let a decoded byte create a segment boundary the router never saw, so a wildcard tail carrying a decoded line feed failed to match its own route and skipped payment verification and settlement. Scope is our own test and dev resolution only. The declared range is x402>=2.9,<3 and is unchanged, so consumers installing the x402 extra already resolve 2.19.0 or newer; nothing published was affected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lands the
x4022.18.0 to 2.19.0 lock bump that was written and reviewed earlier today but never actually merged: the branch carrying it was PR'd at the commit before it, so main kept resolving 2.18.0 while that PR's body said the bump was included. Caught while pruning stale branches, by comparing branch content against main rather than trusting ancestry (squash merges rewrite SHAs, so "not fully merged" proves nothing either way).2.19.0 is a security fix.
x402_http_server_basenormalized a request path by decoding percent-escapes globally, so a decoded byte could create a segment boundary the router never saw, and a wildcard tail carrying a decoded line feed failed to match its own route, skipping payment verification and settlement outright. 2.19.0 decodes one segment at a time and re-escapes any separator a decode yields.Scope is our own test and dev resolution only. The declared range is
x402[evm,fastapi]>=2.9,<3and is unchanged, so anyone installing thex402extra already resolves 2.19.0 or newer. Nothing published was affected, and no release is needed for this.Type of change
Public API
None. Lockfile only; the declared dependency range does not move.
Test plan
ruff checkclean,ty check agentscore_commerce/clean,pytest tests/1861 passed / 4 skipped with coverage 95.35% against the 95% floor, all against the upgraded lock.Checklist