Bump mpp from 0.10.0 to 0.10.3

[dependabot]

Bumps mpp from 0.10.0 to 0.10.3.

Changelog

Sourced from mpp's changelog.

0.10.3 (2026-05-18)

Patch Changes

• Added payment event lifecycle hooks (by @​BrendanRyan, #257)

0.2.3 (2026-05-18)

0.1.2 (2026-05-13)

0.10.2 (2026-05-13)

Patch Changes

• Scoped Tempo session voucher and close operations to the active challenge's channel so client-managed channels cannot be mixed across sessions. (by @​github-actions[bot], #255)

0.2.2 (2026-05-13)

0.1.1 (2026-05-13)

0.10.1 (2026-05-13)

Patch Changes

• Validated challenge-bound memos for server-broadcast Tempo charge transactions. (by @​BrendanRyan, #247)
• Validated fee-sponsored approval targets against the swap input token. (by @​BrendanRyan, #247)
• Bound zero-amount Tempo proof signatures to the wallet being authenticated. (by @​BrendanRyan, #247)
• Locked Tempo session channels locally while close settlement is in progress. (by @​BrendanRyan, #247)
• Refreshed on-chain Tempo session channel state before accepting vouchers. (by @​BrendanRyan, #247)
• Rejected replayed Tempo session vouchers that do not increase the accepted cumulative amount. (by @​BrendanRyan, #247)
• Preserved fresh channel deposit state when accepting higher Tempo session vouchers. (by @​BrendanRyan, #247)
• Stopped WebSocket reconnect retries after a payment credential is sent without a receipt. (by @​BrendanRyan, #247)

0.2.1 (2026-05-13)

Patch Changes

• Made the axum extractor use route-aware expected-request verification by default. High-level MppCharge extraction now forwards the route amount into verification so built-in Tempo and Stripe challengers compare incoming credentials against the route's expected charge request instead of trusting the echoed request alone. (by @​BrendanRyan, #213)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)