[vvillait88]

Summary

Moves @x402/core, @x402/evm and @x402/fetch from 2.28.0 to 2.29.0, still exact-pinned as one set (@x402/fetch nests its own core, so the three move together), and adds the @x402 set to minimumReleaseAgeExcludes. Because the set is exact-pinned, the pin is the gate for the version, the same as for viem and mppx.

2.29.0 changes on the client paths pay uses:

• core: facilitator and control-plane response bodies are capped at 1 MiB, and accepts is capped at 1024 entries.
• evm exact client: logs a one-time warning when gas sponsoring is advertised but the signer cannot read the chain. Signing behavior is otherwise unchanged.
• core now depends on zod 4.

The spend-control behavior pay disables (setSpendControls(false)) is unchanged. The test asserting that the upstream default still enforces passes.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

On this branch: bun install resolves 2.29.0 for every @x402 package. bun run lint, typecheck, test (52 files, 547 tests passed, 2 skipped) and knip all exit 0.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (no public surface change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review: x402 2.29.0 bump

Verdict: nothing blocks this PR. This comment is the approval.

Upstream diff, 2.28.0 vs 2.29.0 (npm pack of both, dist read directly; tarball integrity matches the lock for all five packages):

• @x402/hono: dist byte-identical; only package.json moves (deps to ~2.29.0, peer hono >=4.13.7 <5, satisfied by our ^4.13.14).
• @x402/evm: exact/server and upto/server dist unchanged (0 diff lines). Client side adds a one-time console.warn when gas sponsoring is advertised and the signer has no readContract; changes elsewhere are facilitator-only (EIP-6492 code-lookup handling, auth-capture/batch-settlement shapes).
• @x402/core: (a) NetworkSchemaV2 is now /^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}$/; every network id we emit passes (eip155:8453, eip155:84532, eip155:4217, eip155:42431, both Solana CAIP-2 refs at 32 chars), probed with node. Only a wildcard like eip155:* fails, and none of our repos put one on the wire. (b) accepts capped at 1024. (c) Facilitator responses read through a 1 MiB cap. (d) A settlement override above requirements.amount now throws. (e) HTTP route matching: HEAD falls back to GET routes and * no longer matches OPTIONS. (f) An unpaid 402 from x402HTTPResourceServer now carries {error} when no custom body is set. (g) afterSettle gains an opt-in AfterSettleAbortError. (h) The resource-server verify hook code is unchanged; only its doc comments changed. The isValid:false re-route from onVerifyFailure to onAfterVerify is in x402Facilitator only.
• @x402/extensions bazaar: enrichDeclaration now forces the declared method to the body set (POST/PUT/PATCH) when info.input.bodyType is set, and to GET/HEAD/DELETE otherwise.
• @x402/fetch: 402 bodies are read through the same 1 MiB cap, and a 402 returned after payment is re-wrapped as a fresh Response.

Effect on pay's client path (payViaX402): setSpendControls still exists in 2.29.0, and the client dist's spend-control code is unchanged. The onBeforePaymentCreation abort contract ({abort, reason}, thrown as "Payment creation aborted") is also unchanged, so the structured max_spend_exceeded/limit_exceeded path holds. The new gas-sponsoring warning can't fire, because chains/base.ts builds the signer with readContract; even if it did, it would go to stderr. The fetch wrapper's re-wrapped post-payment 402 is harmless here: pay reads the body with res.text() and never reads res.url. The new 1 MiB cap means a 402 body larger than 1 MiB now throws ResponseBodyTooLargeError instead of parsing. Real 402 challenges are far below that, so this is a behavior change, not a risk. The registered network is eip155:8453/eip155:84532, and both pass the new network regex.

Lockfile: @x402/core, @x402/evm and @x402/fetch all resolve to 2.29.0 (fetch depends on ~2.29.0, so there's a single core copy), with 0 occurrences of 2.28.0. The nested zod 3.25.76 under core and evm is gone, and the only zod left is 4.6.7. Package count goes from 611 to 609.

bunfig: the shared exclude list plus incur, as the maintenance-sweep doc describes. @x402/extensions and @x402/hono are listed but not installed here, so they have no effect.

CI: 9 of 9 rows pass, including ci (which runs the spend-controls test with its upstream positive control) and node-compat 22/24/26.