chore(registry): CoinPay Wallet 0.0.1 -> 0.9.2 - #64
Merged
Conversation
The mirrored listing still described the Phase 1 release: version 0.0.1, a bundle URL pointing at extension-v0.0.1, and a description promising that Send and x402 approval would "land in subsequent updates". They landed, along with bulk payouts, nine releases ago. Points at the extension-v0.9.2 bundle, with the sha256 verified against what that URL actually serves, and records the host permissions the shipped manifest declares — including ugig.net, which the listing never mentioned despite the extension having requested it since 0.1.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The mirrored listing for
coinpay-walletis nine releases stale. It still says:"version": "0.0.1"bundle_urlpointing atextension-v0.0.1They landed, along with bulk payouts. The live store DB is on 0.9.0; the released extension is on 0.9.2.
What changed
version0.0.10.9.2bundle_url…/extension-v0.0.1/coinpay-wallet.zip…/extension-v0.9.2/coinpay-wallet.zipbundle_sha256c874f773…21a3ebpermissionsstorage, alarms, coinpayportal.comugig.net,www.ugig.netpublished_at2026-07-052026-08-01T07:06:41ZSummary and description updated to describe what actually ships now, including bulk payouts and the funding display added in 0.9.2.
The
ugig.nethost permissions are not new to the extension — it has requested them since 0.1.0, when bulk payouts were added. The listing simply never said so, which understated what users were granting.Verified
The declared
bundle_sha256was checked by downloadingbundle_urland hashing what it actually serves:The bundle's own
manifest.jsonreads0.9.2, matching the listing, andmanifest_versionis3as the store requires.What this does not do
This updates the git mirror. Per
registry/README.mdthe Turso DB is the source of truth for instant publish — if merging this doesn't sync the DB, the listing at/store/extension.html?slug=coinpay-walletwill still serve 0.9.0 and needs a publisher-token push (scripts/publish-extension.sh) instead.🤖 Generated with Claude Code