Cashu TS 5.0.0-rc.6

Mostly a hardening release: input validation and parsing fixes across auth, crypto, transport and wallet. It also adds CounterSource.reserveAt for claiming manual counter ranges atomically, and carries six breaking changes since rc.5, all documented in the migration guide.

Cashu-TS is also now dual-licensed under the MIT OR Apache-2.0

What's Changed

• fix: tidy response reads and number-token parsing by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/886
• test(crypto): refresh amended mint-quote vector to a uuid-v7 quote id by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/873
• fix(crypto): harden HTLC witness parsing edge cases by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/892
• fix(crypto): tighten NUT-10 secret and tag-integer parsing by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/893
• fix(wallet): harden P2PK spending-condition locktime and tag validation by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/894
• fix: guard CBOR and keyset map lookups against prototype-chain keys by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/895
• fix(auth): validate OIDC provider URLs use an http(s) scheme by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/896
• docs: add SECURITY.md policy by @ye0man in https://github.com/cashubtc/cashu-ts/pull/903
• fix(crypto): count unique signers by x-only pubkey identity by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/904
• fix(utils): align base64 fallback chunk size to a 3-byte boundary by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/905
• fix(logger): escape control characters in log messages by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/906
• fix(utils): cap JSON nesting depth in JSONInt.parse by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/907
• fix(wallet): reject extraPayload keys reserved by the melt request by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/908
• perf(wallet): look up keyset unit by map instead of scanning ids by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/909
• fix(wallet): reject duplicate proofs before totalling or selecting by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/916
• fix(crypto): bound the deterministic counter to the safe integer range by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/919
• fix(wallet): name the offending index when rejecting duplicate proofs by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/917
• fix(crypto): require a 64-byte seed and slim the seed error context by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/920
• feat(wallet): claim manual counter ranges up front with CounterSource.reserveAt by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/923
• fix(wallet): check bolt11 quote amounts against the invoice by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/925
• fix(auth): stop following redirects on token-bearing requests by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/926
• fix(auth): drop a CAT refresh that completes after the session changes by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/927
• fix(mintinfo): bound mint-advertised method and endpoint lists by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/928
• fix(auth): coerce the device-flow polling interval to a finite value by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/929
• fix(ws): ignore socket events from a replaced connection by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/930
• fix(crypto): validate the blind point in the BLS signer by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/931
• fix(crypto): bound pow2height in createNewMintKeys at runtime by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/938
• fix(token): return per-proof amounts, not proofs, from getTokenMetadata by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/941
• fix(auth): detach the OIDC token listener when the provider is replaced by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/939
• chore: add apache license by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/629
• fix(p2bk): share one ephemeral key across a blinded SIG_ALL batch by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/946
• refactor(sigall): recompute signing digests from package contents by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/947
• test: type check the test tree and fix fixture drift by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/954
• fix(types): align public API types with what the code returns by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/955
• chore(github): replace the PR template with TL;DR / Why / Changes / Impact by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/960
• docs(migration): cover isPaymentRequestSatisfied and the SIG_ALL digest change by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/962
• chore(main): release 5.0.0-rc.6 by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/888

New Contributors

• @ye0man made their first contribution in https://github.com/cashubtc/cashu-ts/pull/903

Full Changelog: https://github.com/cashubtc/cashu-ts/compare/v5.0.0-rc.5...v5.0.0-rc.6

Many thanks to Project Loupe for suggesting some of the hardening fixes in this release