pull in latest upstream

.gitbook.yaml

@@ -0,0 +1,5 @@
+root: ./docs/
+
+structure:
+  readme: README.md
+  summary: SUMMARY.md

.github/labeler.yml

@@ -0,0 +1,78 @@
+# Language labels
+typescript:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'typescript/**/*.ts'
+          - 'typescript/**/*.tsx'
+
+python:
+  - changed-files:
+      - any-glob-to-any-file: 'python/**/*.py'
+
+go:
+  - changed-files:
+      - any-glob-to-any-file: 'go/**/*.go'
+
+java:
+  - changed-files:
+      - any-glob-to-any-file: 'java/**/*.java'
+
+# SDK - v2 core packages only
+sdk:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'typescript/packages/core/**'
+          - 'typescript/packages/extensions/**'
+          - 'typescript/packages/http/**'
+          - 'typescript/packages/mechanisms/**'
+          - 'python/x402/**'
+          - 'go/*.go'
+          - 'go/http/**'
+          - 'go/mechanisms/**'
+          - 'go/signers/**'
+          - 'go/extensions/**'
+          - 'go/types/**'
+          - 'go/test/**'
+
+# Legacy packages and examples
+legacy:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'typescript/packages/legacy/**'
+          - 'python/legacy/**'
+          - 'go/legacy/**'
+          - 'java/**'
+          - 'examples/typescript/legacy/**'
+          - 'examples/python/legacy/**'
+
+# Examples
+examples:
+  - changed-files:
+      - any-glob-to-any-file: 'examples/**'
+
+# Protocol specifications
+specs:
+  - changed-files:
+      - any-glob-to-any-file: 'specs/**'
+
+# Documentation
+docs:
+  - changed-files:
+      - any-glob-to-any-file: 'docs/**'
+
+# Website
+website:
+  - changed-files:
+      - any-glob-to-any-file: 'typescript/site/**'
+
+# CI/CD workflows
+ci:
+  - changed-files:
+      - any-glob-to-any-file: '.github/**'
+
+# Ecosystem partner additions
+ecosystem:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'typescript/site/app/ecosystem/partners-data/**'
+          - 'typescript/site/public/logos/**'

.github/pull_request_template.md

@@ -20,6 +20,7 @@ Please describe the tests you've performed to verify your changes.
 Include relevant code samples, unit test cases, or screenshots if applicable.
 
 For TypeScript: Run `pnpm test` from the `/typescript` directory
+For Python: Run `uv run pytest` from the `python/x402/` directory
 For Go: Run `go test ./...` from the `/go` directory
 -->
 
@@ -28,8 +29,22 @@ For Go: Run `go test ./...` from the `/go` directory
 - [ ] I have formatted and linted my code
 - [ ] All new and existing tests pass
 - [ ] My commits are signed (required for merge) -- you may need to rebase if you initially pushed unsigned commits
+- [ ] I added a changelog fragment for user-facing changes (docs-only changes can skip)
+
+<!--
+Changelog fragments (required for user-facing changes):
+
+- TypeScript: add a Changesets file under `typescript/.changeset/*.md`
+  - Create: `pnpm -C typescript changeset`
+  - Select only publishable `@x402/*` packages
+- Go: add a Changie fragment under `go/.changes/unreleased/*`
+  - Create: `make -C go changelog-new`
+- Python (python/x402 v2): add a Towncrier fragment under `python/x402/changelog.d/<PR>.<type>.md`
+  - Create: `cd python/x402 && uv run towncrier create --content "Fixed ..." 123.bugfix.md`
+-->
 
 <!--
 For TypeScript: Run `pnpm format && pnpm lint` from `/typescript` and/or `/examples/typescript`
+For Python: Run `uvx ruff format && uvx ruff check` from the `python/x402/` directory
 For Go: Run `go fmt ./...` and `go vet ./...` from the `/go` directory
 --> 

.github/workflows/check_format.yml

@@ -1,41 +1,47 @@
 name: Format
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   check-format-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./typescript
       - name: Ensure formatting
         working-directory: ./typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm format:check
 
   check-format-examples-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./examples/typescript
       - name: Ensure formatting
         working-directory: ./examples/typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm format:check

.github/workflows/check_go.yml

@@ -0,0 +1,68 @@
+name: Check Go
+on: [pull_request]
+
+permissions:
+  contents: read
+  id-token: none
+
+jobs:
+  check-format-go:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./go
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: "1.24"
+          cache-dependency-path: ./go/go.sum
+
+      - name: Check formatting
+        run: |
+          make deps-dev
+          make fmt
+          if [ -n "$(git diff --name-only)" ]; then
+            echo "The following files are not properly formatted:"
+            git diff --name-only
+            exit 1
+          fi
+
+  lint-go:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./go
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: "1.24"
+          cache-dependency-path: ./go/go.sum
+
+      - name: Run golangci-lint
+        run: |
+          make deps-dev
+          make lint
+
+  test-go:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./go
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: "1.24"
+          cache-dependency-path: ./go/go.sum
+
+      - name: Run tests
+        run: make test
+

.github/workflows/check_lint.yml

@@ -1,41 +1,47 @@
 name: Lint
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   check-lint-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./typescript
       - name: Ensure Linting
         working-directory: ./typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm lint:check
 
   check-lint-examples-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./examples/typescript
       - name: Ensure Linting
         working-directory: ./examples/typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm lint:check

.github/workflows/check_package_lock.yml

@@ -1,27 +1,32 @@
 name: Package Lock
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   check-package-lock-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./typescript
 
       - name: Check if pnpm-lock.yaml changed
         working-directory: ./typescript
         run: |
-          pnpm install
+          pnpm install --ignore-scripts
           if [ -n "$(git diff pnpm-lock.yaml)" ]; then
             echo "Error: pnpm-lock.yaml was modified after running pnpm install. Please commit the updated pnpm-lock.yaml file."
             git diff pnpm-lock.yaml
@@ -31,23 +36,24 @@ jobs:
   check-package-lock-examples-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./examples/typescript
 
       - name: Check if pnpm-lock.yaml changed
         working-directory: ./examples/typescript
         run: |
-          pnpm install
+          pnpm install --ignore-scripts
           if [ -n "$(git diff pnpm-lock.yaml)" ]; then
             echo "Error: pnpm-lock.yaml was modified after running pnpm install. Please commit the updated pnpm-lock.yaml file."
             git diff pnpm-lock.yaml