Skip to content

fix(tempo): bump ox to 0.14.18 so bundled UI preserves limits[].period#393

Open
starc007 wants to merge 1 commit intowevm:mainfrom
starc007:fix/tempo-html-bundle-accounts-period
Open

fix(tempo): bump ox to 0.14.18 so bundled UI preserves limits[].period#393
starc007 wants to merge 1 commit intowevm:mainfrom
starc007:fix/tempo-html-bundle-accounts-period

Conversation

@starc007
Copy link
Copy Markdown

Closes #392.

The Tempo payment bundle's KeyAuthorization serializer was running ox 0.14.7 (forced by the workspace override), which predates the period field. Per-period access keys signed off-chain with a digest that included period were re-encoded without it before chain submission, so signer recovery failed:

Revm error: failed to recover signer from KeyAuthorization signature

Silent signing then fell back to the wallet approval dialog.

What changed

Aligned both ox declarations on 0.14.18:

  • pnpm-workspace.yaml: override 0.14.70.14.18
  • package.json: 0.14.150.14.18

Verified locally

  • pnpm check:types passes for the main package
  • pnpm check:types:html passes for the bundle subpackages
  • Manual test against mpp-playground: silent signing on payment-link pages now works for keys with a per-period limit

Notes

  • accounts in src/tempo/server/internal/html/package.json is unchanged. Bumping it is unrelated to this bug and would carry the dialog-host migration as separate scope.

The Tempo payment bundle's KeyAuthorization serializer was running ox
0.14.7 (forced by the workspace override), which predates the period
field. Per-period access keys signed off-chain with a period digest
were re-encoded without it before submission, so the chain couldn't
recover the signer and silent signing fell back to the wallet
approval dialog.

Aligning both ox declarations on 0.14.18:
- pnpm-workspace.yaml: override 0.14.7 → 0.14.18
- package.json: 0.14.15 → 0.14.18

The override and the main package have been silently disagreeing
since ox started moving forward without the override being bumped
along; this also fixes that drift.

Tested locally with mpp-playground: silent signing on payment-link
pages now succeeds for keys with a per-period limit. Type checks
pass on both the main package and the html bundle subpackages.
@socket-security
Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedox@​0.14.7 ⏵ 0.14.18100 +310099 +198 +1100

View full report

@brendanjryan
Copy link
Copy Markdown
Collaborator

LGTM -- thank you!

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Apr 25, 2026

Open in StackBlitz

npm i https://pkg.pr.new/mppx@393

commit: b6f7c08

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bundled Tempo payment UI strips limits[].period from on-chain KeyAuthorization

2 participants