[ralyodio]

Bumps @profullstack/x402-gateway to ^0.11.0 (and @profullstack/throttle to ^0.3.3 where used).

• x402 v2 transport headers: PAYMENT-REQUIRED on every 402, proofs read from PAYMENT-SIGNATURE or X-PAYMENT, PAYMENT-RESPONSE on a sale (old body offer and X-PAYMENT unchanged).
• Every sale sends CoinPay metadata {property, resource_path, payer, user_agent, ip_hash}; onSale gets the same.
• The 402 sales page offers a Buy a day pass button (CoinPay hosted checkout, any coin or PayPal) once CoinPay serves /api/checkout/sessions; hidden until then.

Release: https://github.com/profullstack/x402-gateway/releases/tag/v0.11.0

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​throttle@​0.3.2 ⏵ 0.3.3	+2			+2
	@​profullstack/​x402-gateway@​0.10.1 ⏵ 0.11.0	+9		+1	+1

View full report

[github-actions]

ThreatCrush Security Scan

97 finding(s)

HIGH/CRITICAL: 11 | MEDIUM: 30 | LOW: 56

Severity	Rule	Location
HIGH	secret-private-key	src/app/settings/seedbox-section.tsx:412
HIGH	secret-generic-api-key	docs/incidents/2026-05-okshanaby-supply-chain.md:18
HIGH	tls-verification-disabled	src/app/api/iptv-proxy/route.ts:39
HIGH	tls-verification-disabled	src/app/api/iptv/channels/route.ts:35
HIGH	tls-verification-disabled	src/app/api/iptv/playlists/[id]/route.ts:73
HIGH	tls-verification-disabled	src/app/api/iptv/playlists/route.ts:64
HIGH	js-cors-origin-reflected	src/app/api/public/shares/[slug]/checkout/route.ts:40
HIGH	js-cors-origin-reflected	src/app/api/public/vod/[slug]/checkout/route.ts:34
HIGH	tls-verification-disabled	src/lib/iptv/shares/upstream.ts:37
HIGH	tls-verification-disabled	workers/iptv-cache/epg-fetcher.ts:25
HIGH	tls-verification-disabled	workers/iptv-cache/playlist-fetcher.ts:62
MEDIUM	secret-jwt	.github/workflows/ci.yml:120
MEDIUM	secret-jwt	.github/workflows/ci.yml:121
MEDIUM	secret-jwt	.github/workflows/ci.yml:123
MEDIUM	secret-jwt	.github/workflows/ci.yml:162
MEDIUM	secret-jwt	.github/workflows/ci.yml:164
MEDIUM	secret-jwt	docs/tunein (2).py:9
MEDIUM	secret-jwt	docs/tunein.py:9
MEDIUM	sh-remote-script-execution	scripts/setup-server.sh:182
MEDIUM	sh-remote-script-execution	scripts/setup-server.sh:419
MEDIUM	sh-remote-script-execution	scripts/setup-server.sh:428
MEDIUM	sh-unquoted-expansion-destructive	scripts/setup-server.sh:1096
MEDIUM	sh-unquoted-expansion-destructive	scripts/setup-server.sh:1106
MEDIUM	js-unescaped-html-sink	src/app/api/player/route.ts:127
MEDIUM	js-unescaped-html-sink	src/app/api/player/route.ts:281
MEDIUM	js-unescaped-html-sink	src/app/blog/[slug]/page.tsx:40
MEDIUM	js-unescaped-html-sink	src/app/blog/[slug]/page.tsx:66
MEDIUM	js-unescaped-html-sink	src/app/email/email-content.tsx:566
MEDIUM	js-open-redirect	src/app/login/page.tsx:68
MEDIUM	js-open-redirect	src/app/pricing/page.tsx:159
MEDIUM	js-open-redirect	src/app/rent/[slug]/rent-client.tsx:170
MEDIUM	js-unescaped-html-sink	src/app/rss/rss-content.tsx:615
MEDIUM	js-open-redirect	src/app/vod/[slug]/vod-client.tsx:138
MEDIUM	js-open-redirect	src/app/watch/[slug]/watch-client.tsx:131
MEDIUM	js-unescaped-html-sink	src/app/youtube/youtube-content.tsx:546
MEDIUM	js-open-redirect	src/components/account/iptv-subscription-section.tsx:135
MEDIUM	js-open-redirect	src/components/account/iptv-subscription-section.tsx:167
MEDIUM	js-unescaped-html-sink	src/components/layout/pit-footer.tsx:25
MEDIUM	js-unescaped-html-sink	src/components/news/news-section.tsx:358
MEDIUM	js-unescaped-html-sink	src/components/news/news-section.tsx:731
MEDIUM	redos-nested-quantifier	src/lib/metadata-enrichment/metadata-enrichment.ts:317
LOW	tls-verification-disabled	docs/tunein (2).py:34
LOW	tls-verification-disabled	docs/tunein (2).py:37
LOW	tls-verification-disabled	docs/tunein (2).py:47
LOW	tls-verification-disabled	docs/tunein.py:34
LOW	tls-verification-disabled	docs/tunein.py:37
LOW	tls-verification-disabled	docs/tunein.py:47
LOW	tls-verification-disabled	src/app/api/iptv-proxy/route.test.ts:457
LOW	secret-generic-credential	src/app/api/iptv/subscription/route.test.ts:66
LOW	secret-generic-credential	src/lib/argontv/client.test.ts:54

…and 47 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.