chore(deps): bump stripe from 22.6.2 to 23.0.0

[dependabot]

Bumps stripe from 22.6.2 to 23.0.0.

Release notes

Sourced from stripe's releases.

v23.0.0

See the changelog for the full release notes.

v22.7.0-beta.1

This release changes the pinned API version to 2026-08-26.preview.

• #2807 Update generated code for beta
  • Add support for new resources V2.Core.ApprovalRequest, V2.Signals.AccountActivity, V2.Signals.AccountEvaluation, and V2.Signals.AccountSignal
  • Add support for list and retrieve methods on resource V2.Signals.AccountSignal
  • Add support for create and retrieve methods on resource V2.Signals.AccountEvaluation
  • Add support for create, del, and retrieve methods on resource V2.Signals.AccountActivity
  • Add support for cancel, list, retrieve, and update methods on resource V2.Core.ApprovalRequest
  • Add support for disable method on resource V2.MoneyManagement.PayoutMethod
  • Add support for disable_stripe_user_authentication on AccountSessionCreateParams.components.payment_method_settings.features
  • ⚠️ Remove support for payment_method_types on PaymentIntentConfirmParams, PaymentIntentCreateParams, PaymentIntentUpdateParams, SetupIntentCreateParams, and SetupIntentUpdateParams
  • ⚠️ Change type of ProductCatalog.TrialOffer.end_behavior.transition.price and ProductCatalog.TrialOffer.price from Price to deletable($Price)
  • Add support for billie on QuotePreviewInvoice.payment_settings.payment_method_options
  • Add support for new value billie on enum QuotePreviewInvoice.payment_settings.payment_method_types
  • Add support for payout_methods on V2.Core.Account.defaults and V2.Core.AccountUpdateParams.defaults
  • Add support for restricted on V2.Core.Vault.GbBankAccount and V2.Core.Vault.UsBankAccount
  • Add support for enabled_delivery_schemes on V2.MoneyManagement.PayoutMethod.bank_account
  • ⚠️ Remove support for enabled_delivery_options on V2.MoneyManagement.PayoutMethod.bank_account
  • ⚠️ Add support for new value disabled on enum V2.MoneyManagement.PayoutMethod.usage_status.payments
  • ⚠️ Add support for new value disabled on enum V2.MoneyManagement.PayoutMethod.usage_status.transfers
  • Add support for new value disabled on enum V2.MoneyManagement.PayoutMethodListParams.usage_status.payments
  • Add support for new value disabled on enum V2.MoneyManagement.PayoutMethodListParams.usage_status.transfers
  • Add support for event notifications V2CoreApprovalRequestApprovedEvent, V2CoreApprovalRequestCanceledEvent, V2CoreApprovalRequestCreatedEvent, V2CoreApprovalRequestExpiredEvent, V2CoreApprovalRequestFailedEvent, V2CoreApprovalRequestRejectedEvent, and V2CoreApprovalRequestSucceededEvent with related object V2.Core.ApprovalRequest
  • Add support for event notification V2SignalsAccountEvaluationCompleteEvent with related object V2.Signals.AccountEvaluation
  • Add support for error codes authentication_failure, capability_not_active, expired_payment_method, incorrect_postal_code, invalid_canceled_subscription_fields, and payment_method_restricted on QuotePreviewInvoice.last_finalization_error
  • Add support for error code default_payout_method_cannot_be_disabled on CannotProceedError
• #2813 Add non-verified methods to managed handlers

See the changelog for more details.

v22.7.0-alpha.5

See the changelog for the full release notes.

v22.7.0-alpha.4

See the changelog for the full release notes.

v22.7.0-alpha.3

• #2839 Update generated code for private-preview
  • Add support for customer_tax_exemption on Tax.Calculation.shipping_cost.tax_breakdown[], Tax.CalculationLineItem.tax_breakdown[], and Tax.Transaction.shipping_cost.tax_breakdown[]
  • Add support for new value data_share_only on enums Charge.payment_method_details.card.three_d_secure.result, PaymentAttemptRecord.payment_method_details.card.three_d_secure.result, PaymentRecord.payment_method_details.card.three_d_secure.result, and SetupAttempt.payment_method_details.card.three_d_secure.result
  • Add support for backdate_start_date on Checkout.Session.items[].subscription and Checkout.SessionCreateParams.items[].subscription
  • Add support for signals on Identity.VerificationReport
  • Add support for network_response_code on Issuing.Authorization.request_history[]
  • Add support for unit_cost_precision on PaymentIntentAmountDetailsLineItem, PaymentIntentCaptureParams.amount_details.line_items[], PaymentIntentConfirmParams.amount_details.line_items[], PaymentIntentCreateParams.amount_details.line_items[], PaymentIntentDecrementAuthorizationParams.amount_details.line_items[], PaymentIntentIncrementAuthorizationParams.amount_details.line_items[], and PaymentIntentUpdateParams.amount_details.line_items[]
  • Change PaymentIntent.payment_record to be required
  • Add support for active on ProductCatalog.TrialOfferListParams

... (truncated)

Changelog

Sourced from stripe's changelog.

23.0.0 - 2026-09-30

This release changes the pinned API version to 2026-09-30.endive.

• #2844 Support EventNotifications with singleton related objects

• #2853 Allow suppressing Stripe notices

  Set the STRIPE_SUPPRESS_NOTICES environment variable to true to suppress Stripe notices in test and sandbox environments when not running under a detected AI agent. Notices remain enabled by default and continue to be shown to AI agents.

• #2850 Fix account scoping for EventNotificationHandler callback clients

  • Fix callback clients to use the event's Stripe context and preserve client telemetry.
  • Fix 400 errors when using an EventNotificationHandler with a StripeClient configured with stripeAccount.

• ⚠️ #2856 Remove V1-only fields from V2 list response types

  Remove the V1-only object, has_more, and url fields from Stripe.V2List<T>. These fields were never populated and were added only to maintain type compatibility when correcting the V2 list response type in a minor release.

• ⚠️ #2862 Remove Stripe.constructEventWithoutVerification

  Removed the function Stripe.constructEventWithoutVerification() that was mistakenly added in version 22.5.0 of this package. The same functionality can be achieved via stripe.webhooks.constructEventWithoutVerification(payload);

• ⚠️ Generate operation-specific address parameters for V2 requests

  • Change V2 request address properties from shared V1 address parameter types to operation-specific V2 interfaces.

• ⚠️ #2865 Remove ErrorType export

  Remove the ErrorType interface from the top level client. Users can use .errors instead since it works as both a type and a value

• ⚠️ #2868 Classify incomplete response bodies as connection errors

  • Responses that stall or are severed before the body is complete now throw StripeConnectionError instead of StripeAPIError.

• Fix NodeHttpClient compatibility with HTTP request interceptors

  • Fix NodeHttpClient requests hanging when using Nock 14 or MSW interceptors (#2211).

• ⚠️ Drop support for Node 18

  Drop support for Node.js 18. Node.js 20 is now the minimum supported version.

• ⚠️ #2876 Update verifyHeader and verifyHeaderAsync methods to use DEFAULT_TOLERANCE

  stripe.webhooks.signature.verifyHeader() and verifyHeaderAsync() previously skipped timestamp tolerance verification when the tolerance argument was omitted. They now default to Webhook.DEFAULT_TOLERANCE

  Passing 0 to stripe.webhooks.constructEvent now properly skips timestamp tolerance verification. Previously, passing 0 would perform verification with the default tolerance Webhook.DEFAULT_TOLERANCE.

• #2879 Update generated code

  • Release specs are identical.

• ⚠️ #2832 Update generated code

  • Add support for new resources Apps.Install, ProductCatalog.TrialOffer, Tax.Location, and ThreeDSecure.Authentication
  • Add support for create, list, retrieve, uninstall, and update methods on resource Apps.Install
  • Add support for create, list, retrieve, and update methods on resource ProductCatalog.TrialOffer
  • Add support for create, list, and retrieve methods on resource Tax.Location
  • Add support for cancel, create, list, retrieve, and submit methods on resource ThreeDSecure.Authentication
  • Add support for pause method on resource Subscription
  • Add support for specified_commercial_transactions_act_url on Account.business_profile, AccountCreateParams.business_profile, and AccountUpdateParams.business_profile
  • Add support for blik_recurring_payments and sequra_payments on Account.capabilities, AccountCreateParams.capabilities, AccountUpdateParams.capabilities, V2.Core.Account.configuration.merchant.capabilities, V2.Core.AccountCreateParams.configuration.merchant.capabilities, and V2.Core.AccountUpdateParams.configuration.merchant.capabilities
  • Add support for paypay_payments on Account.capabilities, Account.settings, AccountCreateParams.capabilities, AccountCreateParams.settings, AccountUpdateParams.capabilities, and AccountUpdateParams.settings
  • Add support for sepa_debit_payments on AccountCreateParams.settings, V2.Core.AccountCreateParams.configuration.merchant, and V2.Core.AccountUpdateParams.configuration.merchant
  • ⚠️ Change type of AccountRejectParams.reason from string to enum
  • ⚠️ Add support for new values invalid_address_cmra_address and invalid_address_registered_agent_address on enums Account.future_requirements.errors[].code, Account.requirements.errors[].code, BankAccount.future_requirements.errors[].code, BankAccount.requirements.errors[].code, Capability.future_requirements.errors[].code, Capability.requirements.errors[].code, Person.future_requirements.errors[].code, and Person.requirements.errors[].code
  • Add support for performance_location on Tax.CalculationCreateParams.line_items[] and Tax.CalculationLineItem
  • Add support for new value performance on enums Tax.Calculation.shipping_cost.tax_breakdown[].sourcing, Tax.CalculationLineItem.tax_breakdown[].sourcing, and Tax.Transaction.shipping_cost.tax_breakdown[].sourcing

... (truncated)

Commits

• fe645f6 Bump version to 23.0.0
• 14d17e2 Correct v23 migration guidance links (#2880)
• bc1bbb4 Merge pull request #2879 from stripe/latest-codegen-master
• 1aaf232 Update generated code for v2526 and 588801ef34f7b5f7d6a784d3354f5f93d2a26ffb
• 63be8e6 Update generated code (#2832)
• d1a1df1 Pin stripe-mock to the SDK OpenAPI version (#2870)
• e280a13 Merge pull request #2857 from stripe/sdk-release/next-major
• eb8f079 Drop Node's uuid4 override in node platform functions (#2861)
• 4956bcf Update verifyHeader and verifyHeaderAsync methods to use DEFAULT_TOLERANCE (#...
• 42f051a Classify incomplete response bodies as connection errors (#2868)
• Additional commits viewable in compare view

---

Note

Medium Risk
Major Stripe SDK bump affects payment webhooks and checkout flows; runtime must meet Node 20+ and upstream API/type breaks may surface at build or in production without code changes in this diff.

Overview
Upgrades the stripe Node SDK from 22.6.2 to 23.0.0 in @query/api and sites/mainweb, with matching pnpm-lock.yaml resolution (including Node ≥20 for the package).

This PR does not change application code—only dependency versions. Stripe v23 is a major release (pinned API 2026-09-30.endive) with upstream breaking changes (e.g. webhook verifyHeader default tolerance, removed ErrorType / constructEventWithoutVerification, stricter error typing). Existing usage here appears limited to stripe.webhooks.constructEvent and typed Stripe.* models in the webhook route and API router.

^{Reviewed by Cursor Bugbot for commit 8bb8e3b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/stripe	^23.0.0	Unknown	Unknown
npm/stripe	23.0.0	🟢 7.2	Details Check Score Reason Code-Review 🟢 8 Found 13/15 approved changesets -- score normalized to 8 Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits Fuzzing ⚠️ 0 project is not fuzzed Packaging 🟢 10 packaging workflow detected
npm/stripe	^23.0.0	Unknown	Unknown

Scanned Files

• packages/api/package.json
• pnpm-lock.yaml
• sites/mainweb/package.json

[aamoghS]

@dependabot rebase