What's Changed
- fix(utils): guard the keysetIds argument of getDecodedToken [backport v4-dev] by @robwoodgate in #1085
- fix(transport): never retry a request carrying a Blind-auth header (v4) by @robwoodgate in #1091
- fix(wallet): normalise quote amounts in WebSocket updates [backport v4-dev] by @robwoodgate in #1089
- fix(wallet): unblind melt change and restore with the keyset the mint signed under [backport v4-dev] by @robwoodgate in #1083
- fix(wallet): unblind swap and mint outputs with the keyset the mint signed under [backport v4-dev] by @robwoodgate in #1096
- fix(utils): tighten UTF-8, CBOR and TLV decoding [backport v4-dev] by @robwoodgate in #1098
- fix(nut26): reject repeated singular TLV tags and untyped policy flags [backport v4-dev] by @robwoodgate in #1100
- fix(nut11): reject malformed P2PK tag values and bound key lists [backport v4-dev] by @robwoodgate in #1102
- fix(nut11): bind SIG_INPUTS signatures to the secret and honour overlapping HTLC refunds [backport v4-dev] by @robwoodgate in #1105
- fix(nut11): validate a SIG_ALL signing package before signing it [backport v4-dev] by @robwoodgate in #1107
- fix(crypto): validate helper inputs at the boundary [backport v4-dev] by @robwoodgate in #1112
- fix(model): tighten Amount construction and strict wire JSON parsing [backport v4-dev] by @robwoodgate in #1115
- fix(mint): validate and bound mint response shapes [backport v4-dev] by @robwoodgate in #1117
- fix(mint): strip wallet fields from inputs and bind melt responses [backport v4-dev] by @robwoodgate in #1119
- fix(transport): bound the WebSocket queue and tear down cleanly [backport v4-dev] by @robwoodgate in #1122
- fix(model): validate persisted outputs and pin the hash-to-curve counter [backport v4-dev] by @robwoodgate in #1124
- fix(transport): scope request logs, merge headers case-insensitively, sanitize log context [backport v4-dev] by @robwoodgate in #1126
- fix(wallet): guard counters, mint previews and cache age [backport v4-dev] by @robwoodgate in #1128
- fix(core): reject incomplete DLEQ proofs on encode and decode [backport v4-dev] by @robwoodgate in #1136
- fix(auth): install OIDC tokens through the session they belong to [backport v4-dev] by @robwoodgate in #1138
- chore(ci): run the auth demo against a live mint [backport v4-dev] by @robwoodgate in #1140
- fix(wallet): bind created quotes to what was asked for [backport v4-dev] by @robwoodgate in #1142
- fix(wallet): keep the keychain consistent across refreshes and cache loads [backport v4-dev] by @robwoodgate in #1144
- fix(auth): bound OIDC delays, refuse redirects and cap auth keyset lists [backport v4-dev] by @robwoodgate in #1146
- fix: throw CTSError from the last two bare Error sites, and lint for it [backport v4-dev] by @robwoodgate in #1149
- chore(v4-dev): release 4.10.2 by @robwoodgate in #1087
Full Changelog: v4.10.1...v4.10.2