Skip to content

v2.1.1

Latest
Latest

Choose a tag to compare

View all tags
@boboliu-1010 boboliu-1010 released this 30 Oct 08:06
v2.1.1
2e42194
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.1.1 — Native Zod 4 Security Update

  • Adopt official x402 Core, EVM, extensions, and transports at 2.29.0 with native Zod 4 to address GHSA-mrhx-c7xc-m3w5.
  • Release @bankofai/x402-tron and @bankofai/x402-tron-extensions at 2.1.1. Upgrade both together and install their exact @x402/core@2.29.0 peer.
  • Release BOA Core at 2.0.0: its public /schemas API uses Zod 4. Schema consumers must use Zod 4 and error.issues; the Zod 3 error.errors alias is removed.
  • Bound payment-option arrays at 1,024 entries and reject oversized collections before validating individual elements.
  • Fix the Next.js adapter's native Node ESM import using next/server.js.

Other package versions: MCP 1.1.1; Express, Fastify, Hono, and Next.js 1.1.3; Axios and Fetch 1.1.1.

See the migration guide for installation and compatibility details.

Validation

  • Node.js 24.22.1 / pnpm 11.1.1: all 10 packages built; 1,499 unit tests, 31 integration tests, and 6 example tests passed. Three credential-dependent Nile integration tests were skipped.

  • Stable tarballs passed strict TypeScript consumer checks, 84 ESM/CommonJS imports, 40 security assertions, and six payment/signature fixtures.

  • Local beta testing covered real Nile payments and Gateway delivery, including Agent Wallet 3.1.0-beta.1. This is not a production deployment or mainnet acceptance claim.

  • All 10 npm package versions, latest tags, and SHA-512 tarball integrity values were verified against the main-commit artifacts. Published registry consumers passed strict ESM/CommonJS types, all 84 public entry imports, 40 security assertions, and six payment/signature fixtures.

Dependency audit scope

This release addresses GHSA-mrhx-c7xc-m3w5 through native Zod 4. The resolved workspace dependency/peer tree still reports 6 critical, 45 high, 77 moderate, and 9 low audit findings, unchanged from the pre-versioning develop baseline. It is not an audit-clean release; assess framework and application dependency exposure separately.

Assets 13
Loading