Release payjoin-1.1.0 #1900

Create a new minor release

Summary

payjoin 1.1.0 hardens how both sides of a payjoin validate what the counterparty sends. Fee rates, fee arithmetic, PSBT amounts, endpoint URLs, and directory responses are now checked before they can overflow, panic, or redirect a request. It deprecates the v2 SenderBuilder::new, which panics on a BIP 78 only endpoint, and raises the minimum rust-bitcoin version. Upgrading from 1.0.0 needs no code changes, though callers of SenderBuilder::new will see a deprecation warning.

Commit

TBD, the merge commit of the bump PR.

Changelog

Selected Improvements:

Deprecations

• send::v2::SenderBuilder::new is deprecated because it panics when the URI's pj endpoint is BIP 78 only. Use SenderBuilder::from_parts with the v2 PjParam from the parsed URI, and handle v1 endpoints explicitly (Deprecate v2 SenderBuilder::new, fix FFI v1 panic #1884)

Dependencies

• Raise the minimum bitcoin version from 0.32.9 to 0.32.102 and bitcoin-units from 0.1.3 to 0.1.101. Cargo already resolved 1.0.0 to these versions, so most dependents see no change (Bump rust-bitcoin minimums to the 0.32.10x line #1879)
• The crate now uses Rust edition 2024. The MSRV stays at 1.85 (Update toml edition 2024 #1874)

Features

• Add an optional arbitrary feature with an Arbitrary implementation for Url, for use in fuzzing (Introduce arbitrary crate #1662)
• PersistedError and the v1 receiver RequestError implement PartialEq (Add PartialEq to errors compared in tests #1873)

Bug Fixes

• Reject userinfo in endpoint URLs with the new ParseError::UserinfoNotSupported, and reject malformed ports instead of storing them in the path. http://x.onion:1@evil.com/pj previously passed the v1 onion check and sent the Original PSBT to evil.com in cleartext (Reject userinfo and malformed ports in Url::parse #1896)
• Reject Original PSBT output and input UTXO values above MAX_MONEY, and use checked addition when the receiver contributes inputs, so a crafted PSBT can no longer panic the receiver. The sender runs the same check on its own Original PSBT. substitute_receiver_script now reads the receiver output value from the payjoin PSBT (Reject Amount overflow in receiver contribution #1897)
• Harden fee handling on both sides. The receiver rejects NaN, negative, and above-ceiling minfeerate values, ignores a sender fee contribution larger than the output meant to pay it, and returns FeeTooHigh instead of panicking when its fee exceeds its change output. Both sender and receiver now check fee rate arithmetic for overflow and underflow (Fee rate check hardening #1845, More fee rate guard protection #1889)
• Cap the size of OHTTP key responses from the directory and return the new io::Error::OhttpKeysBodyTooLarge when a response exceeds it (Cap the ohttp key body size from directory #1846)
• The receiver rejects mailbox responses too short to decrypt instead of panicking (Ensure receiver properly handles malformed responses to mailbox #1843)

Checklist

Release numbering must follow Semantic Versioning. These steps assume the current master branch development version is MAJOR.MINOR.0. Release-managed crates are payjoin, payjoin-cli, and payjoin-mailroom; tags use the <crate>-<version> scheme.

On the day of the feature freeze

Change the master branch to the next MINOR+1 version:

• Switch to the master branch.
• Create a new PR branch called bump-CRATE-MAJOR-MINOR+1, eg. bump-CRATE-0-22.
• Bump the bump-CRATE-MAJOR-MINOR+1 branch to the next development MINOR+1 version.
  • Change the Cargo.toml version value to MAJOR.MINOR+1.0 for the crate being released, and update every workspace member's version requirement on it to match.
  • Run contrib/update-lock-files.sh to apply upgrades to the Cargo lock files.
  • Update the crate's CHANGELOG.md file, adding a ## MAJOR.MINOR+1.0 section that summarizes the PRs merged since the last release tag.
  • The commit message should be "Bump CRATE version to MAJOR.MINOR+1.0".
• Create PR for the bump-CRATE-MAJOR-MINOR+1 branch to master.
  • Title PR "Bump CRATE version to MAJOR.MINOR+1.0".
• Merge the bump-CRATE-MAJOR-MINOR+1 branch to master.

If any issues need to be fixed before the MAJOR.MINOR+1.0 version is released:

• Merge fix PRs to the master branch.
  • Publish bitcoin-hpke 0.20.0 and bitcoin-ohttp 0.7.0, then move payjoin's requirements to them.
• Git cherry-pick fix commits to the bump-CRATE-MAJOR.MINOR+1 branch.
• Verify fixes in bump-CRATE-MAJOR.MINOR+1 branch.

On the day of the release

• Create a signed annotated tag on the HEAD commit in the master branch.
  • The tag name should be CRATE-MAJOR.MINOR+1.0, eg. payjoin-1.0.0.
  • The first line of the tag message should be "Release CRATE-MAJOR.MINOR+1.0".
  • In the body of the tag message put a copy of the Summary and Changelog for the release.
  • Sign with a key committed under contrib/release/keys/, using the explicit --sign flag.
• Push the new tag to the payjoin/rust-payjoin repo.
• Approve the release environment when it requests a reviewer.
• Announce the release, using the Summary, on Discord, Twitter, Nostr, and stacker.news.
• Celebrate 🎉