npm / mppx

mppx

What changed in mppx 0.4 to 0.15, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.

5 breaking5 security9 new APIs and options2 behavior and defaults3 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

mppx 0.159 changes

Custom WebSocket routes must return the canonical challenge or set an explicit amount.
0.15.0release notes
The CLI no longer pays when --insecure is enabled.
0.15.0release notes
HTTPS hostnames are preserved for certificate validation, and local HTTPS names use the system resolver.
0.15.0release notes
Standalone credential APIs now require a configured matching realm or trusted route context.
0.15.0release notes

Setup carries an authenticated encrypted key token in the challenge, using one persistent sealing key instead of per-request pending state.
0.15.0release notes
A new subscription challenge's bound key is selected before a previously retained billing key, allowing an expired subscription to be activated again for the same payer.
0.15.0release notes

Expiry remains enforced before activation.
0.15.0release notes
Successful charge receipts are preserved when a challenge expires during settlement, preventing a fresh payment challenge after funds moved.
0.15.0release notes
JSON replacers, spacing, and escaping are preserved before payment response wrapping.
0.15.0release notes

Settles the largest accepted voucher at or below spent; throws "nothing to settle" when no accepted voucher is within spent.
0.14.0release notes

Exported for developers to use.
0.14.1release notes
Exported for developers to use.
0.14.1release notes
Accepts a settlementSchedule in raw token units and settles open channels whose spend crosses it, within spend, reporting them as settled.
0.14.1release notes
Accepts a block number.
0.14.0release notes
Accepts a Store as well as a channel store.
0.14.0release notes
Accepts an idempotencyKey so retries with the same key and amount return the recorded charge without charging again; reusing the key with another amount throws IdempotencyKeyConflictError.
0.14.0release notes
Returns an amount to a channel's spent at most once per key, with outcomes for credited, declined, or unknown.
0.14.0release notes
Resolves the largest accepted voucher at or below spent for settlement.
0.14.0release notes
Limits fee-payer-sponsored opens and top-ups to five per verified transaction signer per UTC day, counted in a Store.AtomicStore.
0.14.0release notes

mppx has Stripe charge credential replay via missing idempotency check
0.4.11security advisory
mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
0.4.11security advisory
mppx has multiple payment bypass and griefing vulnerabilities
0.4.8security advisory