v0.13.0

Minor Changes

• Remove custom primary Tempo charge memos from TempoMethodDetails and TempoChargeExt. Clients always generate attribution memos bound to the challenge and realm, and servers always verify that binding. Split-specific memos remain supported. (by @brendanryan, #428)

Patch Changes

• Added a machine-payment metadata field to every Stripe PaymentIntent created by mpp-rs. (by @brendanryan, #428)
• Export session channel deduction helpers and update the multi-fetch example to
• atomically charge each request before releasing paid content. (by @brendanryan, #428)
• Enforce configured HTTP methods when matching paid proxy routes, preventing
• method-mismatched requests from reaching authenticated upstream services. (by @brendanryan, #428)
• Accept canonical payment method identifiers containing digits, colons, underscores, or hyphens after the initial lowercase letter. (by @brendanryan, #428)
• Reject a voucher when a concurrent request has already accepted the same or a
• higher cumulative authorization amount. (by @brendanryan, #428)
• Reject malformed human-readable amounts before converting them to base units,
• preventing inputs such as . from being normalized to zero. (by @brendanryan, #428)
• Added a requires_auth server option that advertises header="Payment-Authorization" so Payment credentials do not collide with ordinary Authorization. (by @brendanryan, #428)
• Preserve Unicode in challenge auth-params by encoding non-Latin-1 text as UTF-16 escapes and decoding those escapes while parsing. (by @brendanryan, #428)
• Reject payment transactions whose attribution memo is not bound to the active challenge before fee-payer signing or broadcast, preventing funds from settling before memo verification fails. (by @brendanryan, #428)

What's Changed

• feat(stripe): mark machine payment intents by @bensandler-stripe in #401
• chore: update GitHub STS action by @sds in #403
• feat: advertise Payment-Authorization when requires_auth is set by @raubrey-stripe in #400
• ci: use the vendored third-party actions from tempoxyz/gh-actions by @sds in #405
• ci: use the vendored third-party actions from tempoxyz/gh-actions by @sds in #406
• ci: use the vendored third-party actions from tempoxyz/gh-actions by @sds in #407
• Pin GitHub STS POST action by @sds in #408
• chore(ci): migrate deny to gh-actions by @decofe in #409
• fix(ci): update release and scanner pins for action policy by @decofe in #412
• fix(intents): reject malformed decimal amounts by @miinimes1 in #413
• fix: enforce proxy route methods by @brendanjryan in #417
• fix: charge multi-fetch session requests by @brendanjryan in #416
• fix: reject concurrent voucher reuse by @brendanjryan in #415
• chore(ci): add dependency scanning and secure runners by @sds in #420
• fix(ci): run required actions scan on every pull request by @brendanjryan in #422
• chore(ci): refresh shared action and secure-runner pins by @decofe in #423
• ci: pin shared actions revision by @sds in #424
• fix(tempo): remove custom primary charge memos by @decofe in #421
• fix(tempo): validate challenge memo before broadcast by @brendanjryan in #427
• fix(headers): align method and Unicode parsing with mppx by @brendanjryan in #428
• chore: release v0.13.0 by @tempo-github-sts[bot] in #402

New Contributors

• @raubrey-stripe made their first contribution in #400
• @miinimes1 made their first contribution in #413
• @tempo-github-sts[bot] made their first contribution in #402

Full Changelog: v0.12.0...v0.13.0