Tested by SkillHammer Agent skill + scanner for Claude Code and Cursor

Stripe Endive Upgrade Check

Find what breaks before you move to Stripe API 2026-09-30.endive, stripe-node 23 or stripe-python 16.

Stripe's 2026-09-30.endive API version rejects payment_method_types on Checkout Session, PaymentIntent and SetupIntent requests with an HTTP 400. stripe-node 23 and stripe-python 16 pin Endive, so a routine SDK bump changes the API version you send.

In plain JavaScript and Python nothing warns you until checkout fails. stripe-node 23 also changes constructEvent(..., 0): it now skips the webhook replay check.

The skill gives your agent a safe upgrade order (pin, bump, fix, test, then move the API version) and a read-only scanner with 15 rules that lists every affected line before anything changes.

What's in the download

• SKILL.md: the upgrade order and a fix for each of the 14 rules that find a problem (SD001 only lists SDK versions)
• scripts/endive_scan.py: read-only scanner (Python 3.9+, no dependencies; text or JSON; exit code 1 on blockers). It skips its own installed folder, node_modules and .git; --exclude leaves out anything else
• reference/MIGRATION-NOTES.md: each change with its Stripe source link
• A before/after example app (TypeScript, JavaScript, React, Python) and the full test suite
• TEST-REPORT.md, CHANGELOG.md, LICENSE.txt, REFUND.txt

Who it's for

Developers and founders with a Stripe integration in Node/TypeScript or Python who are about to bump the Stripe SDK, or just got a Dependabot or Renovate PR for it.

What's tested

• 27 scanner unit tests and 8 skill structure checks, all passing, including the skill installed in a project (one and two copies): the scan finds exactly what it finds on the app alone
• The example app type-checked against the real stripe-node 22.6.2 and 23.0.1 types: the before-app fails on 23 with exactly the 4 expected errors, the after-app compiles
• 23 runtime checks of the real stripe-node 22.6.2 / 23.0.1 and 15 of stripe-python 16.0.0 against a local server

What isn't tested

• No request went to real Stripe; the 400 errors on Endive come from Stripe's changelog
• Stripe.js and Elements in a browser (checked by pattern only)
• Ruby, PHP, Go, Java and .NET; parameters built at run time
• A live Claude Code or Cursor session: no AI agent has followed the skill yet

Read the full TEST-REPORT

Requirements

Claude Code or Cursor (or any agent that reads Agent Skills). Python 3.9+ for the scanner. Scans JavaScript, TypeScript (incl. JSX/TSX, Vue, Svelte) and Python.

How to use it

Copy the stripe-endive-upgrade-check folder into ~/.claude/skills/ (Claude Code) or .cursor/skills/ (Cursor), then ask your agent "we're upgrading stripe to 23, check what breaks".