v1.0.1

Summary

A security fix for /send commands. Upgrade if you pin v1.0.0; if you pin v1, you already have it.

Fixed

• A /send that names an asset other than the one the workflow pays is now refused. Previously /send 0xabc 25 DAI on a USDC workflow paid 25 USDC under a receipt that said DAI, and USDC, usdc and DAI on one PR produced three different idempotency keys — so one person could be paid up to three times without a round bump. The asset word must now match the asset input (case-insensitive), and every spelling shares one key. (#43)
• The v1 major tag is now looked up exactly before it is moved. (#31)

What adopters need to do

• Nothing. Receipts written by v1.0.0 are still found under the spelling they were written with, so past payouts are not paid again.
• If your /send commands name an asset, make sure the workflow sets the asset input; a named asset with no asset input to compare against is refused.

Also in this release

• The marketing site, https://gitpay.stability.nexus/ (#33).

---

What's Changed

• Close the release gate: v1.0.0 tagged, SBOM and provenance published by @kpj2006 in #32
• Look up the major tag exactly before moving it by @kpj2006 in #31
• Add the marketing site in frontend/ and deploy it to GitHub Pages by @kpj2006 in #33
• Refuse a /send that names a different asset than the workflow pays by @kpj2006 in #43
• Release v1.0.1: ship the /send asset fix by @kpj2006 in #44

Full Changelog: v1.0.0...v1.0.1