[ralyodio]

Bumps @profullstack/x402-gateway to ^0.11.0 (and @profullstack/throttle to ^0.3.3 where used).

• x402 v2 transport headers: PAYMENT-REQUIRED on every 402, proofs read from PAYMENT-SIGNATURE or X-PAYMENT, PAYMENT-RESPONSE on a sale (old body offer and X-PAYMENT unchanged).
• Every sale sends CoinPay metadata {property, resource_path, payer, user_agent, ip_hash}; onSale gets the same.
• The 402 sales page offers a Buy a day pass button (CoinPay hosted checkout, any coin or PayPal) once CoinPay serves /api/checkout/sessions; hidden until then.

Release: https://github.com/profullstack/x402-gateway/releases/tag/v0.11.0

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​x402-gateway@​0.10.1 ⏵ 0.11.0	+9		+1	+1

View full report

[github-actions]

ThreatCrush Security Scan

38 finding(s)

MEDIUM: 32 | LOW: 6

Severity	Rule	Location
MEDIUM	sql-template-interpolation	apps/web/app/api/bounties/[id]/claim/route.ts:18
MEDIUM	sql-template-interpolation	apps/web/app/api/bounties/[id]/claim/route.ts:34
MEDIUM	sql-template-interpolation	apps/web/app/api/bounties/[id]/claim/route.ts:43
MEDIUM	sql-template-interpolation	apps/web/app/api/bounties/route.ts:81
MEDIUM	sql-template-interpolation	apps/web/app/api/coupons/route.ts:68
MEDIUM	sql-template-interpolation	apps/web/app/api/coupons/route.ts:75
MEDIUM	sql-template-interpolation	apps/web/app/api/coupons/vote/route.ts:31
MEDIUM	sql-template-interpolation	apps/web/app/api/coupons/vote/route.ts:33
MEDIUM	sql-template-interpolation	apps/web/app/api/stores/[slug]/route.ts:9
MEDIUM	sql-template-interpolation	apps/web/app/api/webhooks/crawlproof/route.ts:83
MEDIUM	sql-template-interpolation	apps/web/app/api/webhooks/crawlproof/route.ts:90
MEDIUM	js-open-redirect	apps/web/app/bounties/new/page.tsx:57
MEDIUM	js-unescaped-html-sink	apps/web/app/coupons/[id]/page.tsx:57
MEDIUM	js-unescaped-html-sink	apps/web/app/layout.tsx:89
MEDIUM	sql-template-interpolation	apps/web/app/stores/[slug]/page.tsx:16
MEDIUM	js-unescaped-html-sink	apps/web/components/PitFooter.tsx:24
MEDIUM	sql-template-interpolation	apps/web/lib/bbs-post.ts:164
MEDIUM	sql-template-interpolation	apps/web/lib/flipp-sync.ts:445
MEDIUM	sql-template-interpolation	apps/web/lib/inbound-email.ts:573
MEDIUM	sql-template-interpolation	apps/web/lib/inbound-email.ts:643
MEDIUM	sql-template-interpolation	apps/web/lib/mcp-tools.ts:81
MEDIUM	sql-template-interpolation	apps/web/lib/members.ts:54
MEDIUM	sql-template-interpolation	apps/web/lib/nichedb-sync.ts:186
MEDIUM	sql-template-interpolation	apps/web/lib/nichedb-sync.ts:206
MEDIUM	sql-template-interpolation	apps/web/lib/reddit-sync.ts:336
MEDIUM	sql-template-interpolation	apps/web/lib/reddit-sync.ts:355
MEDIUM	sql-template-interpolation	apps/web/lib/reddit-sync.ts:361
MEDIUM	sql-template-interpolation	apps/web/lib/reveal-coupon.ts:115
MEDIUM	sql-template-interpolation	apps/web/lib/reveal-coupon.ts:170
MEDIUM	sh-predictable-temp-path	apps/web/public/install.sh:37
MEDIUM	sh-predictable-temp-path	apps/web/public/install.sh:39
MEDIUM	sql-template-interpolation	apps/web/scripts/migrate.mjs:192
LOW	sql-template-interpolation	test/bbs-post.test.mjs:129
LOW	sql-template-interpolation	test/bbs-post.test.mjs:143
LOW	sql-template-interpolation	test/bbs-post.test.mjs:164
LOW	sql-template-interpolation	test/inbound-email.test.mjs:139
LOW	sql-template-interpolation	test/reveal-sweep.test.mjs:69
LOW	sql-template-interpolation	test/reveal-sweep.test.mjs:112

Snippets are redacted; ThreatCrush never prints matched credential material.