Skip to content

chore(deps): bump the rust-dependencies group in /conformance/adapters/rust with 2 updates#64

Merged
brendanjryan merged 1 commit into
mainfrom
dependabot/cargo/conformance/adapters/rust/rust-dependencies-6251e089a8
Jul 20, 2026
Merged

chore(deps): bump the rust-dependencies group in /conformance/adapters/rust with 2 updates#64
brendanjryan merged 1 commit into
mainfrom
dependabot/cargo/conformance/adapters/rust/rust-dependencies-6251e089a8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the rust-dependencies group in /conformance/adapters/rust with 2 updates: mpp and serde.

Updates mpp from 0.10.4 to 0.11.0

Release notes

Sourced from mpp's releases.

v0.11.0

Minor Changes

  • Validate the credential source on the Tempo hash-credential verification path. The server now parses the did:pkh:eip155 source before reserving the transaction hash, requires TIP-20 transfers to originate from the declared source address (falling back to the receipt sender when no source is provided), and rejects malformed or chain-mismatched sources with a uniform error. Adds ChargeMethod::with_validate_sender to authorize smart-account / relayer flows where the on-chain transfer sender differs from the declared source. (by @​DerekCofausper, #315)
  • Added a structured reason: Option<PaymentFailureReason> field to PaymentFailedContext, marked the struct #[non_exhaustive], and added PaymentFailedContext::new() and with_reason() constructors. Downstream callers should construct it via new() and destructure it with .. so future field additions remain non-breaking. (by @​DerekCofausper, #315)
  • Sponsored (fee-payer) charges now dry-run the co-signed transaction via tempo_simulateV1 before broadcasting. If the transaction would revert on-chain, the sponsor rejects it instead of paying gas for a failing transaction. The check fails closed: if the simulation RPC is unavailable, the charge is rejected. (by @​DerekCofausper, #315)
  • Added TIP-1034 Tempo session client primitives for descriptor-backed channels, precompile ABI helpers, voucher signing, and fee-sponsored session opens. (by @​DerekCofausper, #315)

Patch Changes

  • Added configurable incremental 402 challenge retries for HTTP clients. (by @​DerekCofausper, #315)
  • Rejected oversized WWW-Authenticate request parameters before decoding payment challenges. (by @​DerekCofausper, #315)
  • Updated README documentation with an expanded protocol description, added an MPP SDKs table listing official implementations in multiple languages, and cleaned up URLs and prose throughout. (by @​DerekCofausper, #315)
  • Add client-side Tempo chain pinning. TempoProvider::with_expected_chain_id rejects charge challenges whose methodDetails.chainId conflicts with the configured chain ID, and signs on the pinned chain when the challenge omits it — matching the mpp-go conformance ABI. (by @​DerekCofausper, #315)
  • Align Tempo zero-amount proof shape with the wallet proof flow. (by @​DerekCofausper, #315)

... (truncated)

Changelog

Sourced from mpp's changelog.

0.11.0 (2026-07-16)

Minor Changes

  • Validate the credential source on the Tempo hash-credential verification path. The server now parses the did:pkh:eip155 source before reserving the transaction hash, requires TIP-20 transfers to originate from the declared source address (falling back to the receipt sender when no source is provided), and rejects malformed or chain-mismatched sources with a uniform error. Adds ChargeMethod::with_validate_sender to authorize smart-account / relayer flows where the on-chain transfer sender differs from the declared source. (by @​DerekCofausper, #315)
  • Added a structured reason: Option<PaymentFailureReason> field to PaymentFailedContext, marked the struct #[non_exhaustive], and added PaymentFailedContext::new() and with_reason() constructors. Downstream callers should construct it via new() and destructure it with .. so future field additions remain non-breaking. (by @​DerekCofausper, #315)
  • Sponsored (fee-payer) charges now dry-run the co-signed transaction via tempo_simulateV1 before broadcasting. If the transaction would revert on-chain, the sponsor rejects it instead of paying gas for a failing transaction. The check fails closed: if the simulation RPC is unavailable, the charge is rejected. (by @​DerekCofausper, #315)
  • Added TIP-1034 Tempo session client primitives for descriptor-backed channels, precompile ABI helpers, voucher signing, and fee-sponsored session opens. (by @​DerekCofausper, #315)

Patch Changes

  • Added configurable incremental 402 challenge retries for HTTP clients. (by @​DerekCofausper, #315)
  • Rejected oversized WWW-Authenticate request parameters before decoding payment challenges. (by @​DerekCofausper, #315)
  • Updated README documentation with an expanded protocol description, added an MPP SDKs table listing official implementations in multiple languages, and cleaned up URLs and prose throughout. (by @​DerekCofausper, #315)
  • Add client-side Tempo chain pinning. TempoProvider::with_expected_chain_id rejects charge challenges whose methodDetails.chainId conflicts with the configured chain ID, and signs on the pinned chain when the challenge omits it — matching the mpp-go conformance ABI. (by @​DerekCofausper, #315)
  • Align Tempo zero-amount proof shape with the wallet proof flow. (by @​DerekCofausper, #315)

0.2.0 (2026-07-16)

0.3.0 (2026-07-16)

0.1.4 (2026-06-02)

Commits

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the rust-dependencies group
e339f08 
Bumps the rust-dependencies group in /conformance/adapters/rust with 2 updates: [mpp](https://github.com/tempoxyz/mpp-rs) and [serde](https://github.com/serde-rs/serde).


Updates `mpp` from 0.10.4 to 0.11.0
- [Release notes](https://github.com/tempoxyz/mpp-rs/releases)
- [Changelog](https://github.com/tempoxyz/mpp-rs/blob/main/CHANGELOG.md)
- [Commits](tempoxyz/mpp-rs@v0.10.4...v0.11.0)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

---
updated-dependencies:
- dependency-name: mpp
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 20, 2026
@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcargo/​serde@​1.0.228 ⏵ 1.0.2298110093100100
Updatedcargo/​mpp@​0.10.4 ⏵ 0.11.09510093100100

View full report

@brendanjryan
brendanjryan merged commit 66260aa into main Jul 20, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/cargo/conformance/adapters/rust/rust-dependencies-6251e089a8 branch July 20, 2026 16:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brendanjryan