v4.134.0

Email

• Set who may write to a mailbox first. r.email.updateMailbox(projectId, { inbound_policy, inbound_allowlist }) and run402 email update <mailbox> --inbound-policy <reply_only|allowlist|open> [--inbound-allowlist <entry,...>] set a mailbox's first-contact policy. reply_only (the default) accepts only replies to mail the mailbox sent, allowlist also accepts first contact from exact addresses or *@domain entries, and open accepts anyone. footer_policy is now optional; an update names at least one setting. Mailbox reads carry inbound_policy and inbound_allowlist.
• Up to 100 attachments per send. The platform's cap rose from 5 to 100 attachments per message, still 15 MB each and 15 MB together (decoded). The SDK and CLI references now state these numbers (they said 5 and 7 MB). A send over the cap is a 400 VALIDATION_FAILED with details { field, limit, received }.

Security

• @x402/* 2.29.0. The paid-request stack (the SDK's optional peers, the CLI and MCP dependencies) moves from 2.28.0 to 2.29.0, which replaces zod 3 (GHSA-mrhx-c7xc-m3w5, memory exhaustion validating oversized collections) with zod 4.6.7.