Mostly a hardening release: input validation and parsing fixes across auth, crypto, transport and wallet. It also adds CounterSource.reserveAt for claiming manual counter ranges atomically, and carries six breaking changes since rc.5, all documented in the migration guide.
Cashu-TS is also now dual-licensed under the MIT OR Apache-2.0
What's Changed
- fix: tidy response reads and number-token parsing by @robwoodgate in #886
- test(crypto): refresh amended mint-quote vector to a uuid-v7 quote id by @robwoodgate in #873
- fix(crypto): harden HTLC witness parsing edge cases by @robwoodgate in #892
- fix(crypto): tighten NUT-10 secret and tag-integer parsing by @robwoodgate in #893
- fix(wallet): harden P2PK spending-condition locktime and tag validation by @robwoodgate in #894
- fix: guard CBOR and keyset map lookups against prototype-chain keys by @robwoodgate in #895
- fix(auth): validate OIDC provider URLs use an http(s) scheme by @robwoodgate in #896
- docs: add SECURITY.md policy by @ye0man in #903
- fix(crypto): count unique signers by x-only pubkey identity by @robwoodgate in #904
- fix(utils): align base64 fallback chunk size to a 3-byte boundary by @robwoodgate in #905
- fix(logger): escape control characters in log messages by @robwoodgate in #906
- fix(utils): cap JSON nesting depth in JSONInt.parse by @robwoodgate in #907
- fix(wallet): reject extraPayload keys reserved by the melt request by @robwoodgate in #908
- perf(wallet): look up keyset unit by map instead of scanning ids by @robwoodgate in #909
- fix(wallet): reject duplicate proofs before totalling or selecting by @robwoodgate in #916
- fix(crypto): bound the deterministic counter to the safe integer range by @robwoodgate in #919
- fix(wallet): name the offending index when rejecting duplicate proofs by @robwoodgate in #917
- fix(crypto): require a 64-byte seed and slim the seed error context by @robwoodgate in #920
- feat(wallet): claim manual counter ranges up front with CounterSource.reserveAt by @robwoodgate in #923
- fix(wallet): check bolt11 quote amounts against the invoice by @robwoodgate in #925
- fix(auth): stop following redirects on token-bearing requests by @robwoodgate in #926
- fix(auth): drop a CAT refresh that completes after the session changes by @robwoodgate in #927
- fix(mintinfo): bound mint-advertised method and endpoint lists by @robwoodgate in #928
- fix(auth): coerce the device-flow polling interval to a finite value by @robwoodgate in #929
- fix(ws): ignore socket events from a replaced connection by @robwoodgate in #930
- fix(crypto): validate the blind point in the BLS signer by @robwoodgate in #931
- fix(crypto): bound pow2height in createNewMintKeys at runtime by @robwoodgate in #938
- fix(token): return per-proof amounts, not proofs, from getTokenMetadata by @robwoodgate in #941
- fix(auth): detach the OIDC token listener when the provider is replaced by @robwoodgate in #939
- chore: add apache license by @robwoodgate in #629
- fix(p2bk): share one ephemeral key across a blinded SIG_ALL batch by @robwoodgate in #946
- refactor(sigall): recompute signing digests from package contents by @robwoodgate in #947
- test: type check the test tree and fix fixture drift by @robwoodgate in #954
- fix(types): align public API types with what the code returns by @robwoodgate in #955
- chore(github): replace the PR template with TL;DR / Why / Changes / Impact by @robwoodgate in #960
- docs(migration): cover isPaymentRequestSatisfied and the SIG_ALL digest change by @robwoodgate in #962
- chore(main): release 5.0.0-rc.6 by @robwoodgate in #888
New Contributors
Full Changelog: v5.0.0-rc.5...v5.0.0-rc.6
Many thanks to Project Loupe for suggesting some of the hardening fixes in this release