getAlby/lightning-browser-extension v3.15.0

v3.15.0 🦒🌌 The Giraffe Nebula

on GitHub

TL;DR

This is a security-focused release. We received a number of reports through our security process (see SECURITY.md) and addressed them together with a round of dependency updates. We recommend all users update.

• LNURL hardening — LNURLs supplied by websites (webln.lnurl() and LNURL meta tags) must now use https (http only for .onion) and can no longer point at local or private network addresses. LNURL responses are validated before they are used, and websites only receive status/reason instead of the raw service response. LNURLs you paste or scan yourself are unchanged.
• LNURL-auth — auto-login is only applied when the login service runs on the same host as the website requesting it. Logins to a service on another host always show a confirmation prompt.
• Nostr schnorr signing — signSchnorr and hashAndSignSchnorr now always ask for confirmation and can no longer be remembered per site. Existing "remember" entries for this method are removed on update.
• Allowance budgets — the per-site budget check now handles invoices with millisatoshi precision correctly, and the budget is debited before a payment is sent, so concurrent payments cannot exceed the budget.
• Data migrations — every migration now updates the browser.storage.local mirror, so migrated data is not reverted when IndexedDB is re-seeded from storage.
• API change — webln.request() has been removed. If your website relied on it, please use the dedicated WebLN methods instead.
• Dependency security updates — axios, postcss, webpack-dev-server, nostr-tools 2.x, @scure/bip39 2.x, @bitcoinerlab/secp256k1 2.x, react-router-dom 6.30, and a refresh of vulnerable transitive packages (sha.js, cipher-base, elliptic, secp256k1, base-x, lodash, bn.js, valibot). Tailwind moved to devDependencies.
• Translations — Weblate sync and German onboarding wording.

Thank you to everyone who reported issues responsibly. If you find a security vulnerability, please email security@getalby.com instead of opening a public issue.

What's Changed

• fix: validate LNURL request targets and responses by @reneaaron in #3597
• fix: confirm LNURL-auth auto-login for the requesting website by @reneaaron in #3592
• fix: always prompt for nostr schnorr signing by @im-adithya in #3611
• Correct allowance budget checks for WebLN payments by @reneaaron in #3586
• fix: debit the allowance budget before sending a WebLN payment by @reneaaron in #3613
• fix: mirror migrated tables to browser.storage.local for every migration by @reneaaron in #3615
• feat: remove webln.request to reduce complexity by @im-adithya in #3610
• 🚨 [security] Update axios 1.16.1 → 1.20.0 (minor) by @depfu[bot] in #3605
• 🚨 [security] Update postcss 8.5.10 → 8.5.25 (patch) by @depfu[bot] in #3589
• 🚨 [security] Update webpack-dev-server 5.2.4 → 5.2.6 (patch) by @depfu[bot] in #3581
• Update nostr-tools 1.17.0 → 2.25.0 (major) by @depfu[bot] in #3603
• Update @scure/bip39 1.6.0 → 2.4.0 (major) by @depfu[bot] in #3609
• Update @bitcoinerlab/secp256k1 1.1.1 → 2.0.0 (major) by @depfu[bot] in #3602
• Update zustand 5.0.13 → 5.0.15 (patch) by @depfu[bot] in #3595
• chore: refresh vulnerable transitive dependencies and bump react-router-dom by @reneaaron in #3624
• chore: move tailwindcss to devDependencies by @reneaaron in #3623
• chore: drop the webpack bundle analyzer report by @reneaaron in #3594
• fix: tolerate locales without a permissions namespace in i18n resources by @reneaaron in #3620
• fix(i18n): use informal address in German onboarding strings by @reneaaron in #3621
• Translations update from Hosted Weblate by @weblate in #3579
• chore: bump package.json version to 3.15.0 by @reneaaron in #3622

LDN 1295: The Giraffe Nebula: https://apod.nasa.gov/apod/ap260910.html

Full Changelog: v3.14.5...v3.15.0