[dependabot]

Bumps the minor-and-patch group in /packages/sdk with 5 updates:

Package	From	To
@x402/fetch	2.28.0	2.29.0
@x402/stellar	2.28.0	2.29.0
viem	2.57.10	2.57.13
@types/node	26.6.5	26.6.6
@x402/core	2.28.0	2.29.0

Updates @x402/fetch from 2.28.0 to 2.29.0

Commits

• e4a0868 chore: version typescript packages  (#4036)
• bf8d857 chore(go): release (#4037)
• f22cb90 chore: version python package  (#4035)
• 374216b chore(ts): raise dependency floors for known CVEs (#3981)
• 443e3f4 fix(python): raise dependency floors for published security advisories (#3982)
• 14e83aa fix(go): upgrade SDK dependencies for published security advisories (#3984)
• 8065278 fix: upgrade zod to ^4.6.6 (GHSA-mrhx-c7xc-m3w5) (#3983)
• 8d81caf Add Canton Network exact scheme documentation (#4031)
• c5bed45 feat(canton): add @​x402/canton exact-scheme mechanism (#3242)
• db2c98e fix(avm): require canonical CAIP-2 networks (#3894)
• Additional commits viewable in compare view

Updates @x402/stellar from 2.28.0 to 2.29.0

Commits

• e4a0868 chore: version typescript packages  (#4036)
• bf8d857 chore(go): release (#4037)
• f22cb90 chore: version python package  (#4035)
• 374216b chore(ts): raise dependency floors for known CVEs (#3981)
• 443e3f4 fix(python): raise dependency floors for published security advisories (#3982)
• 14e83aa fix(go): upgrade SDK dependencies for published security advisories (#3984)
• 8065278 fix: upgrade zod to ^4.6.6 (GHSA-mrhx-c7xc-m3w5) (#3983)
• 8d81caf Add Canton Network exact scheme documentation (#4031)
• c5bed45 feat(canton): add @​x402/canton exact-scheme mechanism (#3242)
• db2c98e fix(avm): require canonical CAIP-2 networks (#3894)
• Additional commits viewable in compare view

Updates viem from 2.57.10 to 2.57.13

Release notes

Sourced from viem's releases.

viem@2.57.13

Patch Changes

• #5310 7e015cb1d72e6b54e4468d7dd60aa59a51fe8d9b Thanks @​BaronOdon! - Added Molibra chain.

• #5314 c0d52cdcb262744a64e742e4cf891cbbde9ccdc9 Thanks @​jxom! - viem/tempo: Keyed Relay.accounts stored configs by chain ID so account_getConfig no longer serves a config stored for another chain (configs stored under the previous key are no longer read), added a resolveConfig option that resolves and stores configs the store does not hold, and reduced round trips by reading the commitment without a prior block number request and writing each config once.

• #5332 de39e106022f313a16c3b7367d8330753748c516 Thanks @​jxom! - viem/tempo: Added signMessage and signTypedData support to Account.fromConfig configurable accounts, which sign the EIP-191 or EIP-712 digest with the same configurable signature envelope as sign.

• #5325 2220ab8f52cf7fcf5420502d30272175b49065ca Thanks @​Slokh! - viem/tempo: Fixed formatting of Tempo transactions whose nonce exceeds Number.MAX_SAFE_INTEGER (such as TIP-1106 expiring-nonce discriminators), which made getTransaction, getBlock with includeTransactions and waitForTransactionReceipt replacement checks throw IntegerOutOfRangeError. Formatted Tempo transactions now carry nonce as an exact bigint, matching ox.

• #5337 609f2bf5a127774904cbc9d97f0e9be7b45c3a7d Thanks @​jxom! - viem/tempo: Fixed Relay.feePayer not reporting base-fee floor rejections when the Tempo node returns fee cap less than base fee.

• #5336 35e551ed4189d28749f0d12e67177a10e574f4f0 Thanks @​jxom! - viem/tempo: Fixed fillTransaction returning a number nonce on Tempo transactions when a nonce was passed and no fee payer signed the filled transaction.

• #5330 1f9c2f00e6b18b194aa510ee09f4ae684af2e976 Thanks @​jxom! - Fixed watchEvent and watchContractEvent in the eth_getLogs fallback stalling for good when the blocks since the last poll exceeded the RPC Provider's block range, log count, or response size limit, repeating logs when an RPC node reported a lower block number, emitting logs from before a fromBlock past the latest block, ignoring fromBlock: 1n, and missing logs from the first polling interval without fromBlock.

viem@2.57.12

Patch Changes

• #5281 744f749bcd56fa0bc93efd0fcdc05125e0252c21 Thanks @​jxom! - Fixed getAbiItem overload resolution for arrays with a 0 in the element size (e.g. uint160[]) or the wrong fixed length, tuple objects with reordered keys, and ambiguous address[] overloads.

• #5304 918955e81ef333af521e3e3e1b3fe03cb5231bdf Thanks @​jxom! - Fixed serializeAuthorizationList and serializeTransaction to encode an EIP-7702 authorization yParity above 1 as is instead of normalizing it to 1, which changed the transaction hash.

• #5279 10ef1295f73362ea4f3c36b6655fef1cb04b397e Thanks @​jxom! - Fixed signatureToCompactSignature and compactSignatureToSignature for values shorter than 32 bytes and a legacy v with a chain id, and added errors for invalid v and high s.

• #5298 a69e96c8e89cc0398a6b918c392e24e3b615bee0 Thanks @​jxom! - Fixed getTimeToFinalize and waitToFinalize to also wait for the proof's dispute game to resolve and pass its finality delay, instead of only the proof maturity delay.

• #5282 52140fef00389781737477de205f82f71553b3c3 Thanks @​jxom! - Fixed http transport batches and getHttpRpcClient array requests mishandling a server that rejected the whole batch with a single error or returned fewer responses than requests.

• #5286 8e058ca71bf09c85d2a4669af5e98aeb5bc87e71 Thanks @​jxom! - Fixed the http transport to retry JSON-RPC errors from non-2xx responses by their HTTP status and Retry-After header, and exposed status and headers on RpcRequestError.

• #5300 485a9d922ffe00a3d2bc4bbfc6ef0262a85e9f45 Thanks @​jxom! - Fixed toFunctionSelector and toSignatureHash keeping the error keyword in string signatures like error Foo(uint256), which produced the wrong selector.

• #5283 b2b7a3b82fd52ad74f80075d5a25cd99750f754a Thanks @​jxom! - Added an even option to isHex that rejects hex values with an odd number of hex characters.

• #5303 d10dc3c203c63ec42abc2cd392fb7de4562cb591 Thanks @​jxom! - Fixed InsufficientFundsError not being raised for reth's EVM error: OutOfFunds node message.

• #5280 e7e0122fab41b6c43d1d03ffe395044d1445bcc0 Thanks @​jxom! - Fixed parseEventLogs args filters dropping logs whose string or bytes values were decoded from data or differed in hex case, and matching every partially decoded log.

• #5284 b3e39473523d7be57ec5f35f51cb416f16b6cbd2 Thanks @​jxom! - Added a replacement parameter to waitForTransactionReceipt that detects a replacement of a Transaction the node dropped before the wait first read it, and fixed onReplaced not being called for a replacement when confirmations is greater than 1.

• #5288 75ffe81d29d85bee3b895a5d7ae612675b625ee8 Thanks @​jxom! - Fixed request retries firing immediately for Retry-After headers in HTTP-date form or for delays longer than the 24.8-day timer limit.

• #5301 efda1c43147b85fdde5a9d5b88c4ffd5a9262073 Thanks @​jxom! - Fixed sendCalls dropping a call's dataSuffix when the call has no data.

• #5306 30833eca2ef352e2af34f577964b633823acc999 Thanks @​jxom! - Fixed importing viem, viem/actions, viem/chains, and other entrypoints under SES lockdown(), which threw Cannot assign to read only property 'call'.

• #5299 6c2278d129eb21b2928999fd2f5b28c233132f7d Thanks @​jxom! - Fixed createSiweMessage rejecting domains with a punycode (internationalized) top-level domain, such as example.xn--p1ai, and accepting top-level domain labels longer than 63 characters.

... (truncated)

Commits

• 6075b96 chore: version package (#5315)
• 609f2bf fix(tempo): detect fee cap less than base fee rejections in `Relay.feePayer...
• 35e551e fix(tempo): keep fillTransaction nonce as bigint when a nonce is requeste...
• 9a2b41b fix(tempo): carry exact bigint nonces and keep formatter types (#5335)
• 92e78aa chore(ci): consolidate pnpm setup actions (#5333)
• d18ea6d chore: raise viem/chains size limits
• 9f07ca9 fix(tempo): keep nonce a number and add exact nonceExact (#5334)
• de39e10 feat(tempo): support signMessage and signTypedData on configurable accoun...
• 1f9c2f0 fix: event watchers stop delivering logs once eth_getLogs hits an RPC limit...
• dcd6198 chore: use vendored shared actions (#5328)
• Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates @x402/core from 2.28.0 to 2.29.0

Commits

• e4a0868 chore: version typescript packages  (#4036)
• bf8d857 chore(go): release (#4037)
• f22cb90 chore: version python package  (#4035)
• 374216b chore(ts): raise dependency floors for known CVEs (#3981)
• 443e3f4 fix(python): raise dependency floors for published security advisories (#3982)
• 14e83aa fix(go): upgrade SDK dependencies for published security advisories (#3984)
• 8065278 fix: upgrade zod to ^4.6.6 (GHSA-mrhx-c7xc-m3w5) (#3983)
• 8d81caf Add Canton Network exact scheme documentation (#4031)
• c5bed45 feat(canton): add @​x402/canton exact-scheme mechanism (#3242)
• db2c98e fix(avm): require canonical CAIP-2 networks (#3894)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Eras256]

Routine minor/patch dependency bump group, CI green. Approving.