[ralyodio]

Bumps @profullstack/x402-gateway to ^0.11.0 (and @profullstack/throttle to ^0.3.3 where used).

• x402 v2 transport headers: PAYMENT-REQUIRED on every 402, proofs read from PAYMENT-SIGNATURE or X-PAYMENT, PAYMENT-RESPONSE on a sale (old body offer and X-PAYMENT unchanged).
• Every sale sends CoinPay metadata {property, resource_path, payer, user_agent, ip_hash}; onSale gets the same.
• The 402 sales page offers a Buy a day pass button (CoinPay hosted checkout, any coin or PayPal) once CoinPay serves /api/checkout/sessions; hidden until then.

Release: https://github.com/profullstack/x402-gateway/releases/tag/v0.11.0

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

57 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 12 | LOW: 44

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	scripts/scan-all-skills.ts:38
MEDIUM	js-open-redirect	src/app/agent-login/AgentLoginForm.tsx:38
MEDIUM	js-unescaped-html-sink	src/app/blog/[slug]/page.tsx:80
MEDIUM	js-open-redirect	src/app/checkout/CheckoutClient.tsx:77
MEDIUM	js-open-redirect	src/app/dashboard/subscription/page.tsx:101
MEDIUM	js-open-redirect	src/app/dashboard/subscription/page.tsx:113
MEDIUM	js-unescaped-html-sink	src/app/page.tsx:70
MEDIUM	js-unescaped-html-sink	src/app/pricing/page.tsx:84
MEDIUM	js-open-redirect	src/components/funding/FundingClient.tsx:138
MEDIUM	js-open-redirect	src/components/gigs/BuyNowButton.tsx:106
MEDIUM	js-unescaped-html-sink	src/components/layout/PitFooter.tsx:25
MEDIUM	js-dynamic-code-execution	src/lib/skills/metadata-extract.ts:300
MEDIUM	js-dynamic-code-execution	src/lib/skills/security-scan.ts:48
LOW	secret-generic-credential	cli/src/commands/auth.test.ts:66
LOW	secret-generic-credential	cli/src/commands/auth.test.ts:85
LOW	secret-generic-api-key	docs/agents/integration-guide.md:893
LOW	secret-generic-credential	src/app/api/auth/agent-register/route.test.ts:27
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:53
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:68
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:87
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:158
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:180
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:197
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:208
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:247
LOW	secret-generic-credential	src/app/api/gigs/[id]/buy/route.test.ts:48
LOW	secret-generic-credential	src/app/api/gigs/[id]/buy/route.test.ts:99
LOW	secret-generic-credential	src/app/api/gigs/[id]/buy/route.test.ts:158
LOW	secret-generic-credential	src/app/api/orders/[id]/release/route.test.ts:18
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:212
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:223
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:239
LOW	secret-generic-credential	src/lib/api.test.ts:126
LOW	secret-generic-credential	src/lib/api.test.ts:131
LOW	js-dynamic-code-execution	src/lib/skills/composite-scanner.test.ts:106
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:36
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:44
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:66
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:81
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:94
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:103
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:118
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:144
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:162
LOW	js-dynamic-code-execution	src/lib/skills/security-scan.test.ts:28
LOW	js-dynamic-code-execution	src/lib/skills/url-import.test.ts:178
LOW	js-dynamic-code-execution	src/lib/skills/url-import.test.ts:191
LOW	secret-jwt	src/lib/supabase/service.test.ts:16
LOW	secret-jwt	src/lib/supabase/service.test.ts:40
LOW	secret-generic-credential	src/lib/validations.test.ts:148

…and 7 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​throttle@​0.3.2 ⏵ 0.3.3	+2			+2
	@​profullstack/​x402-gateway@​0.10.1 ⏵ 0.11.0	+9		+1	+1

View full report