chore(v4-dev): release 4.8.0

[robwoodgate]

🤖 I have created a release beep boop

4.8.0 (2026-08-12)

Features

• token: add getTokenMetadata proofAmounts and deprecate incompleteProofs (#942) (eee8a02)
• utils: rename normalizeUrl to normalizeMintUrl and make it public (#845) (874de04)
• wallet: add getFeesToInclude fee helper (#847) (c95fdd0)
• wallet: claim manual counter ranges with optional CounterSource.reserveAt (v4) (#924) (82fc193)
• wallet: prefer newest keyset version in getCheapestKeyset (#836) (e1327bf)
• wallet: prefer stale keysets in default proof selection (#818) (0117a42)
• wallet: support u64 amounts in proof selection (#823) (bc05395)

Bug Fixes

• auth: coerce the device-flow polling interval to a finite value (#936) (964e65b)
• auth: detach the OIDC token listener when the provider is replaced (#943) (0062f0f)
• auth: drop a CAT refresh that completes after the session changes (#934) (a85a5f8)
• auth: stop following redirects on token-bearing requests (#933) (57c8070)
• auth: tidy the OIDC debug logging (#884) (3fa34d3)
• auth: validate OIDC provider URLs use an http(s) scheme (#902) (2a89978)
• crypto: bound pow2height in createNewMintKeys at runtime (#940) (7e62f32)
• crypto: bound the deterministic counter to the safe integer range (#921) (67cbcd3)
• crypto: bound untrusted P2PK witness and CBOR decode input (#876) (8aa8abb)
• crypto: count unique signers by x-only pubkey identity (#910) (e60c2ca)
• crypto: harden HTLC witness parsing edge cases (#898) (ab9a1c1)
• crypto: harden P2PK witness edge cases (#878) (4ac3a36)
• crypto: tighten NUT-10 secret and tag-integer parsing (#899) (0e77c20)
• guard CBOR and keyset map lookups against prototype-chain keys (#901) (bb4e3c6)
• hooks: run both pre-push checks and fail on either (#957) (ebb5308)
• logger: escape control characters in log messages (#912) (355fa54)
• mint: derive a missing bolt11 quote state from the accounting fields (#961) (3a6d9aa)
• mintinfo: bound mint-advertised method and endpoint lists (#935) (6d16695)
• model: bound Amount.from to the u64 range [backport v4-dev] (#831) (01461de)
• model: cap Amount at the u64 range (#833) (3aa45f4)
• model: preserve Amount instances through MintInfo snapshot (#827) (7b56bb4)
• p2bk: share one ephemeral key across a blinded SIG_ALL batch (#948) (4e5dd3d)
• tidy response reads and number-token parsing [v4 backport] (#887) (6e5268a)
• types: make nut08Change expressible and NUT-10 tags optional (#958) (34e2861)
• utils: align base64 fallback chunk size to a 3-byte boundary (#911) (4ef72ac)
• utils: bound splitAmount output count (#868) (384c022)
• utils: cap JSON nesting depth in JSONInt.parse (#913) (595a453)
• utils: return false from isValidHex for non-string input (#844) (444fd99)
• wallet: bound fee convergence loop (#855) (a20d3ee)
• wallet: bound keyset denomination count at ingest (#865) (565c235)
• wallet: check bolt11 quote amounts against the invoice (#932) (42853f7)
• wallet: classify odd-length hex keyset ids as legacy (#840) (090b93d)
• wallet: compute keyset fees with integer arithmetic (#870) (e0c9521)
• wallet: more debug log tidy-up (#882) (95e7c44)
• wallet: reject a missing pubkey in locked mint quotes (#857) (fa788b5)
• wallet: reject duplicate proofs before selection (#918) (68665a7)
• wallet: reject extraPayload keys reserved by the melt request (#914) (b668700)
• wallet: return -1 from Keyset.version for unparseable ids (#838) (ee64a02)
• wallet: slim the seed error context (#922) (cb73750)
• wallet: tidy diagnostic log output (#880) (65ba6c0)
• wallet: validate pubkey in locked mint quote responses (#852) (2196368)
• wallet: widen exact-match trim bound for selection-level fee rounding (#819) (bba8c0c)
• ws: ignore socket events from a replaced connection (#937) (1c294e4)

Performance Improvements

• wallet: look up keyset unit by map instead of scanning ids (#915) (f558962)

---

This PR was generated with Release Please. See documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (v4-dev@3a6d9aa). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##             v4-dev     #820   +/-   ##
=========================================
  Coverage          ?   95.49%           
=========================================
  Files             ?       49           
  Lines             ?     5174           
  Branches          ?     1296           
=========================================
  Hits              ?     4941           
  Misses            ?      100           
  Partials          ?      133           

Flag	Coverage Δ
integration	39.06% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[robwoodgate]

🤖 Created releases:

• v4.8.0

🌻