Client libraries,hardened.

Before an independent penetration test of the web app, the API and the client libraries, we reviewed them ourselves the way a tester would. Nothing critical or high came up. Everything that did is fixed, and these releases carry the fixes for the libraries.

The API key is no longer shown when a client object is logged: in the TypeScript SDK it lives in a private field that console.log and JSON.stringify do not show, and in the PHP SDK var_dump, print_r and exception traces show it masked. In every SDK and in the WooCommerce plugin, a payment or suggestion id is checked before it goes into an API address, so an id such as "." or ".." taken from user input cannot reach a different endpoint.

@payshen/checkout 0.4.0 sends the customer only to https pages (http on localhost aside) and refuses a baseUrl that points at another site, including one written as //host. The TypeScript SDK now treats an empty webhook secret as no secret, as the PHP and Python SDKs already did.

On the platform side, approving a store with Connect with Payshen now needs two-factor authentication, as creating keys in the console does, and sign-in links can no longer be used to lock someone else out of their account. The full list is in the API changelog.

To upgrade: npm install @payshen/sdk@latest @payshen/checkout@latest, composer update payshen/payshen-php, or pip install -U payshen. The WooCommerce plugin carries its fixes in 1.1.0.