v0.15.1

Patch Changes

• Stopped WebSocket reconnects from renewing payment authorization after a charge or voucher attempt. Rejected custom-header payment challenges before credential creation when the caller's reqwest redirect policy cannot be verified, while selecting a safe alternative challenge when offered. (by @TanishkGoyal, #564)
• Preserved the signed transaction gas limit in fallback pre-broadcast simulation. (by @TanishkGoyal, #564)
• Reused the signed top-up transaction when retrying a refreshed challenge and enforced the local deposit cap before signing.
• Serialized top-ups with channel-store leases, reconciled deposits before enforcing caps, and rejected refreshed challenges that change sponsorship mode. (by @TanishkGoyal, #564)
• Verified session close and voucher signatures before comparing the voucher against the channel, so unauthenticated requests no longer learn a channel's spent or accepted amount from the error. (by @TanishkGoyal, #564)

What's Changed

• fix: preserve signed gas limits in fallback simulation by @brendanjryan in #557
• fix: reuse signed session top-ups across challenge retries by @brendanjryan in #558
• fix: stop paid WebSocket reconnects and unsafe credential redirects by @brendanjryan in #560
• fix: mark payment recovery release as patch by @brendanjryan in #562
• fix(ci): match syn and rustix pins by major version by @mattsse in #568
• fix(session): verify close voucher signature before amount checks by @mattsse in #565
• ci: audit every PR push with Cyclops by @legion2002 in #564
• chore: release v0.15.1 by @tempo-github-sts[bot] in #559

Full Changelog: v0.15.0...v0.15.1