# What changed in mppx

> 24 changes in mppx 0.4 to 0.15 from its official release notes, upgrade guides and advisories: 5 breaking, 5 security, 9 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/mppx/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## mppx 0.15

### Breaking changes

- Custom WebSocket routes must return the canonical challenge or set an explicit amount. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)
- The CLI no longer pays when `--insecure` is enabled. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)
- HTTPS hostnames are preserved for certificate validation, and local HTTPS names use the system resolver. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)
- Standalone credential APIs now require a configured matching realm or trusted route context. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)

### Behavior and default changes

- Setup carries an authenticated encrypted key token in the challenge, using one persistent sealing key instead of per-request pending state. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)
- A new subscription challenge's bound key is selected before a previously retained billing key, allowing an expired subscription to be activated again for the same payer. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)

### Fixes and other changes

- Expiry remains enforced before activation. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)
- Successful charge receipts are preserved when a challenge expires during settlement, preventing a fresh payment challenge after funds moved. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)
- JSON replacers, spacing, and escaping are preserved before payment response wrapping. (0.15.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.15.0)

## mppx 0.14

### Breaking changes

- Settles the largest accepted voucher at or below spent; throws "nothing to settle" when no accepted voucher is within spent. (0.14.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.0)

### New APIs and options

- Exported for developers to use. (0.14.1) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.1)
- Exported for developers to use. (0.14.1) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.1)
- Accepts a settlementSchedule in raw token units and settles open channels whose spend crosses it, within spend, reporting them as settled. (0.14.1) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.1)
- Accepts a block number. (0.14.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.0)
- Accepts a Store as well as a channel store. (0.14.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.0)
- Accepts an idempotencyKey so retries with the same key and amount return the recorded charge without charging again; reusing the key with another amount throws IdempotencyKeyConflictError. (0.14.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.0)
- Returns an amount to a channel's spent at most once per key, with outcomes for credited, declined, or unknown. (0.14.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.0)
- Resolves the largest accepted voucher at or below spent for settlement. (0.14.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.0)
- Limits fee-payer-sponsored opens and top-ups to five per verified transaction signer per UTC day, counted in a Store.AtomicStore. (0.14.0) — [release notes](https://github.com/wevm/mppx/releases/tag/mppx%400.14.0)

## mppx 0.8

### Security

- mppx: Gas Draining with access list (0.8.2) — [security advisory](https://github.com/advisories/GHSA-VC9J-9WPH-QGHJ)
- mppx: Gas Draining with padding (0.8.2) — [security advisory](https://github.com/advisories/GHSA-727H-3VM5-QWQ6)

## mppx 0.4

### Security

- mppx has Stripe charge credential replay via missing idempotency check (0.4.11) — [security advisory](https://github.com/advisories/GHSA-8MHJ-RFFC-RCVW)
- mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality (0.4.11) — [security advisory](https://github.com/advisories/GHSA-MV9J-8JVG-J8MR)
- mppx has multiple payment bypass and griefing vulnerabilities (0.4.8) — [security advisory](https://github.com/advisories/GHSA-8X4M-QW58-3PCX)