Repository navigation
chore(deps): bump the verifier-npm-deps group across 1 directory with 3 updates - #197
Conversation
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
f271c91 to
fb23daa
Compare
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this dependency bump and didn't find any bugs. A human should still look before merging, because the mppx 0.12 to 0.13 jump changes the graders for the MPP tasks, not just the Tempo verifier.
What was reviewed:
- The verifier's own code (
src/,bin/stable-bench-verify.js) uses only viem, a patch bump here. It never imports mppx or the MCP SDK. - Those two packages are installed in the verifier image at
/opt/stable-bench/verifier. MPP grading clients load them from there withcreateRequire:tasks/mpp/server-mcp-pathusd/tests/support/mcp_client.ts,server-custom-payment-method,server-x402-mpp-charges,server-charge-pathusd-usdc, andshared/global/rewardkit-lib/stable_bench_rewardkit/mpp/session_client.ts. They call APIs likeMcpClient.wrap,tempo(),Challenge.fromResponseandCredential.serialize. I couldn't check these against 0.13 offline. - The reference solutions and
shared/mpp/solutionstill pinmppx ^0.12.0, so the graders (0.13) would talk to servers built on 0.12. Running the oracle for the MPP tasks would confirm the protocol still matches. - The node >=22.12 requirement of the nested eventsource-parser is met by the floating
node:22base images. The extra ox copy (0.14.54 under viem, 0.14.45 under mppx) is worth watching where a viem client is passed into mppx'stempo().
Extended reasoning...
The change bumps @ modelcontextprotocol/sdk, mppx and viem in shared/tempo/verifier/package.json and regenerates the lockfile. It touches no auth or injection code, but this package's node_modules is the shared grader runtime that the MPP task test clients load. The deciding fact is the minor bump of mppx, a 0.x payment-protocol library, on the grader side while the task solutions stay on ^0.12.0. I couldn't verify compatibility without installing and running the MPP oracles, so a human check is worthwhile. No CODEOWNERS file covers these paths, and the timeline shows no open reviewer objections.
… 3 updates Bumps the verifier-npm-deps group with 3 updates in the /shared/tempo/verifier directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [mppx](https://github.com/wevm/mppx) and [viem](https://github.com/wevm/viem). Updates `@modelcontextprotocol/sdk` from 1.32.0 to 1.32.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.32.0...1.32.1) Updates `mppx` from 0.12.0 to 0.13.4 - [Release notes](https://github.com/wevm/mppx/releases) - [Changelog](https://github.com/wevm/mppx/blob/main/CHANGELOG.md) - [Commits](https://github.com/wevm/mppx/compare/mppx@0.12.0...mppx@0.13.4) Updates `viem` from 2.57.1 to 2.57.5 - [Release notes](https://github.com/wevm/viem/releases) - [Commits](https://github.com/wevm/viem/compare/viem@2.57.1...viem@2.57.5) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: verifier-npm-deps - dependency-name: mppx dependency-version: 0.13.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: verifier-npm-deps - dependency-name: viem dependency-version: 2.57.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: verifier-npm-deps ... Signed-off-by: dependabot[bot] <support@github.com>
fb23daa to
925472a
Compare
There was a problem hiding this comment.
Apart from the inline finding, I checked whether the nested eventsource-parser 4.1.1, which requires node >=22.12, could break the verifier image. It can't: the verifier image is built on the agent image (shared/global/docker/agent/Dockerfile), which uses the floating node:22-trixie tag, so it already runs a 22.x release that meets the requirement.
Extended reasoning...
This is a Dependabot bump touching only shared/tempo/verifier/package.json and package-lock.json (MCP SDK, mppx, viem). It changes no source files and touches no auth or crypto code. The one confirmed finding about stale image pins is posted inline, and this note covers only the Node engine check that was ruled out.
| "@modelcontextprotocol/sdk": "1.32.1", | ||
| "mppx": "0.13.4", | ||
| "viem": "^2.57.5" | ||
| } |
There was a problem hiding this comment.
🔴 CI's npm run check will fail after this bump, and no task run picks up the new mppx/viem until the image pins are refreshed. Both verifier files feed source_hash() in scripts/images.py, so the verifier image tag changes. config/tasks.yaml and the generated task Dockerfiles still pin verifier-source-4b54e240…, so scripts/images_test.py:31 now fails. Fix: in this PR, regenerate the image refs in config/tasks.yaml, run npm run sync for every task Dockerfile, and refresh the dataset manifests. #229 did the same for its verifier bump.
Why this was flagged
shared/tempo/verifier is in INPUTS (scripts/images.py:25), and source_hash() (scripts/images.py:44-69) hashes the content of every file under it. Changing package.json and package-lock.json therefore changes the hash. config/tasks.yaml:6-7 still pins the agent-source-/verifier-source-4b54e240ada3ce72f003e3327c0e5db68af183589d208a8e42981b7222ac5c48 tags. test_source_tags_share_a_stable_pair_hash asserts configured_image_ref(image) == source_image_tag(image) (scripts/images_test.py:31). That test runs under test:results, inside npm run check, on every PR in .github/workflows/ci.yml:57. On the base branch the pin matches the hash and the test passes. Even if this merged, every task's tests/Dockerfile would still be FROM ...:verifier-source-4b54..., i.e. the image built with npm ci of mppx 0.12.0. The mppx/viem bump would never reach the verifier clients under /opt/stable-bench/verifier, such as session_client.ts and x402_client.ts.
Verification: Path("shared/tempo/verifier") is listed in INPUTS (scripts/images.py:25). config/tasks.yaml:6-7 still pins agent-source-4b54e240... and verifier-source-4b54e240.... test_source_tags_share_a_stable_pair_hash asserts self.assertEqual(configured_image_ref(image), source_image_tag(image)) (scripts/images_test.py:31). check runs in CI (.github/workflows/ci.yml:57).
Bumps the verifier-npm-deps group with 3 updates in the /shared/tempo/verifier directory: @modelcontextprotocol/sdk, mppx and viem.
Updates
@modelcontextprotocol/sdkfrom 1.32.0 to 1.32.1Release notes
Sourced from @modelcontextprotocol/sdk's releases.
Commits
ff07b00chore: bump version to 1.32.1 (#2954)8a74d50[v1.x] docs: point the README at v2 and say what v1.x supports (#2942)a8cf503[v1.x] docs: state the principles in CLAUDE.md (#2939)Updates
mppxfrom 0.12.0 to 0.13.4Release notes
Sourced from mppx's releases.
Changelog
Sourced from mppx's changelog.
... (truncated)
Commits
d8d800fchore: version packages (#1019)a732d24fix(tempo): serve transient settlement failures and read back at the receipt ...53c394afix(cli): reject redirects during endpoint validation (#1021)99b6e08fix(session): honor cancellation before WebSocket authorization (#1022)bbbec69fix(server): randomize payment challenge issuance (#996)d27f02dfix(tempo): report settlement deltas from the receipt and export SettlementCh...59de230chore: version packages (#1015)c22cf1afix(tempo): keep confirmed settlements successful when their checkpoint fails...06dc781fix(tempo): keep ambiguous session closes pending and reconcile expired ones ...55c3c26feat(tempo): report failed session settlements and serve retryable failures (...Updates
viemfrom 2.57.1 to 2.57.5Release notes
Sourced from viem's releases.
... (truncated)
Commits
964095achore: version package (#5209)3edc967chore: up21205c9fix(tempo): update Earn factories to the latest releases (#5221)9285d18feat(tempo): back KeyAuthorizationManager with a Store (#5220)0dc5f58feat(tempo): addRelay.keyAuthorizationplugin (#5214)c811bb5chore: format socket subscriptions (#5219)cae835cfix(wallet): waitForCallsStatus concurrent waits sharing options and hanging ...dd73698fix(transports): unsubscribe with the current id after a WebSocket/IPC reconn...0c504acFixnormalizeSignaturedropping the parameter after((#5201)a8f8a07fix: enforce http transport timeout on response body and with request signal ...