Bump payjoin version to 1.1.0

flake.nix

@@ -63,7 +63,16 @@
               # From unstable so it keeps pace with the rustdoc JSON format
               # emitted by rust-overlay's latest stable toolchain; the
               # release-branch nixpkgs version lags too far behind.
-              cargo-semver-checks = nixpkgs-unstable.legacyPackages.${system}.cargo-semver-checks;
+              # Its check phase needs a writable HOME for a cache dir and
+              # fails in the sandbox without one. Drop the override once
+              # the lock includes NixOS/nixpkgs#563137.
+              cargo-semver-checks =
+                nixpkgs-unstable.legacyPackages.${system}.cargo-semver-checks.overrideAttrs
+                  (old: {
+                    nativeCheckInputs = (old.nativeCheckInputs or [ ]) ++ [
+                      nixpkgs-unstable.legacyPackages.${system}.writableTmpDirAsHomeHook
+                    ];
+                  });
               rustToolchains = {
                 msrv = prev.rust-bin.stable.${msrv-version}.default;
                 stable = prev.rust-bin.stable.latest.default;

payjoin-cli/Cargo.toml

@@ -35,7 +35,7 @@ dirs = "6.0.0"
 http-body-util = { version = "0.1.3", optional = true }
 hyper = { version = "1.8.0", features = ["http1", "server"], optional = true }
 hyper-util = { version = "0.1.18", optional = true }
-payjoin = { version = "1.0.0", default-features = false }
+payjoin = { version = "1.1.0", default-features = false }
 pest_derive = "2.7.0"
 r2d2 = "0.8.10"
 r2d2_sqlite = "0.22.0"

payjoin-ffi/Cargo.toml

@@ -25,7 +25,7 @@ path = "uniffi-bindgen.rs"
 async-trait = "0.1.89"
 getrandom = "0.2.10"
 lazy_static = "1.5.0"
-payjoin = { version = "1.0.0", features = ["v1", "v2"] }
+payjoin = { version = "1.1.0", features = ["v1", "v2"] }
 payjoin-test-utils = { version = "0.0.1", optional = true }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.149"

payjoin-mailroom/Cargo.toml

@@ -60,14 +60,14 @@ hyper-util = { version = "0.1.18", features = [
 hyperloglogplus = "0.4.1"
 ipnet = { version = "2.9", optional = true }
 maxminddb = { version = "0.27", optional = true }
-ohttp = { package = "bitcoin-ohttp", version = "0.6.0" }
+ohttp = { package = "bitcoin-ohttp", version = "0.7.0" }
 opentelemetry = "0.32"
 opentelemetry-http = { version = "0.32", features = ["hyper"], optional = true }
 opentelemetry-otlp = { version = "0.32", optional = true, default-features = false, features = [
   "http-proto",
 ] }
 opentelemetry_sdk = "0.32"
-payjoin = { version = "1.0.0", features = [
+payjoin = { version = "1.1.0", features = [
   "directory",
 ], default-features = false }
 rand = "0.8"

payjoin-test-utils/Cargo.toml

@@ -30,9 +30,9 @@ bitcoin = { version = "0.32.102", features = ["base64"] }
 corepc-node = { version = "0.12.0", features = ["download", "29_0"] }
 futures = { version = "0.3.21", default-features = false, features = ["std"] }
 http = { version = "1.3.1", optional = true }
-ohttp = { package = "bitcoin-ohttp", version = "0.6.0", optional = true }
+ohttp = { package = "bitcoin-ohttp", version = "0.7.0", optional = true }
 once_cell = "1.21.3"
-payjoin = { version = "1.0.0", default-features = false }
+payjoin = { version = "1.1.0", default-features = false }
 payjoin-mailroom = { version = "0.1.2", features = ["_manual-tls"] }
 rcgen = { version = "0.14.7", optional = true }
 reqwest = { version = "0.12.23", default-features = false, features = [

payjoin/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Payjoin Changelog
 
+## 1.1.0
+
+This release hardens how both sides of a payjoin validate what the
+counterparty sends. Fee rates, fee arithmetic, PSBT amounts, endpoint URLs,
+and directory responses are now checked before they can overflow, panic, or
+redirect a request. It deprecates the v2 `SenderBuilder::new` constructor,
+which panics on a BIP 78 only endpoint, and raises the minimum rust-bitcoin
+version.
+
+Selected Improvements:
+
+### Deprecations
+
+- `send::v2::SenderBuilder::new` is deprecated because it panics when the
+  URI's `pj` endpoint is BIP 78 only. Use `SenderBuilder::from_parts` with
+  the v2 `PjParam` from the parsed URI, and handle v1 endpoints explicitly
+  (#1884)
+
+### Dependencies
+
+- Raise the minimum `bitcoin` version from 0.32.9 to 0.32.102 and
+  `bitcoin-units` from 0.1.3 to 0.1.101. Cargo already resolved 1.0.0 to
+  these versions, so most dependents see no change (#1879)
+- Raise `bitcoin-hpke` from 0.13.0 to 0.20.0 and `bitcoin-ohttp` from 0.6.0 to
+  0.7.0. Neither crate appears in payjoin's public API, so dependents need no
+  change (#1817)
+- The crate now uses Rust edition 2024. The MSRV stays at 1.85 (#1874)
+
+### Features
+
+- Add an optional `arbitrary` feature with an `Arbitrary` implementation for
+  `Url`, for use in fuzzing (#1662)
+- `PersistedError` and the v1 receiver `RequestError` implement `PartialEq`
+  (#1873)
+
+### Bug Fixes
+
+- Reject userinfo in endpoint URLs with the new
+  `ParseError::UserinfoNotSupported`, and reject malformed ports instead of
+  storing them in the path. `http://x.onion:1@evil.com/pj` previously passed
+  the v1 onion check and sent the Original PSBT to `evil.com` in cleartext
+  (#1896)
+- Reject Original PSBT output and input UTXO values above `MAX_MONEY`, and use
+  checked addition when the receiver contributes inputs, so a crafted PSBT
+  can no longer panic the receiver. The sender runs the same check on its own
+  Original PSBT. `substitute_receiver_script` now reads the receiver output
+  value from the payjoin PSBT (#1897)
+- Harden fee handling on both sides. The receiver rejects NaN, negative, and
+  above-ceiling `minfeerate` values, ignores a sender fee contribution larger
+  than the output meant to pay it, and returns `FeeTooHigh` instead of
+  panicking when its fee exceeds its change output. Both sender and receiver
+  now check fee rate arithmetic for overflow and underflow (#1845, #1889)
+- Cap the size of OHTTP key responses from the directory and return the new
+  `io::Error::OhttpKeysBodyTooLarge` when a response exceeds it (#1846)
+- The receiver rejects mailbox responses too short to decrypt instead of
+  panicking (#1843)
+
 ## 1.0.0
 
 The first stable release of the payjoin library supports both synchronous

payjoin/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "payjoin"
-version = "1.0.0"
+version = "1.1.0"
 authors = ["Dan Gould <d@ngould.dev>"]
 description = "Payjoin Library implementing BIP 78 and BIP 77 batching protocols."
 repository = "https://github.com/payjoin/rust-payjoin"
@@ -46,9 +46,9 @@ bitcoin = { version = "0.32.102", features = ["base64"] }
 bitcoin-units = "0.1.101"
 bitcoin_uri = { version = "0.1.0", optional = true }
 hkdf = { version = "0.12.3", optional = true }
-hpke = { package = "bitcoin-hpke", version = "0.13.0", optional = true }
+hpke = { package = "bitcoin-hpke", version = "0.20.0", optional = true }
 http = { version = "1.3.1", optional = true }
-ohttp = { package = "bitcoin-ohttp", version = "0.6.0", optional = true }
+ohttp = { package = "bitcoin-ohttp", version = "0.7.0", optional = true }
 percent-encoding-rfc3986 = { version = "0.1.3", optional = true }
 reqwest = { version = "0.12.23", default-features = false, optional = true }
 rustls = { version = "0.23.38", optional = true, default-features = false, features = [

payjoin/src/core/ohttp.rs

@@ -19,9 +19,9 @@ pub(crate) fn ohttp_encapsulate(
     body: Option<&[u8]>,
 ) -> Result<([u8; ENCAPSULATED_MESSAGE_BYTES], ohttp::ClientResponse), OhttpEncapsulationError> {
     use std::fmt::Write;
-    let mut ohttp_keys = ohttp_keys.0.clone();
+    let ohttp_keys = ohttp_keys.0.clone();
 
-    let ctx = ohttp::ClientRequest::from_config(&mut ohttp_keys)?;
+    let ctx = ohttp::ClientRequest::from_config(&ohttp_keys)?;
     let url = crate::core::Url::parse(target_resource)?;
     let authority_bytes = {
         let mut authority = url.host_str();