From 21ccedfe2f81e99b0e36ad03ac6f233b6e58a078 Mon Sep 17 00:00:00 2001 From: Ovi Trif Date: Tue, 13 Oct 2026 14:14:54 +0200 Subject: [PATCH 1/3] fix: update ldk node for lightning security fixes --- CHANGELOG.md | 3 +++ gradle/libs.versions.toml | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 038b3570f0..a9c7730f26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Fixed +- Updated LDK Node to 0.7.0-rc.72 for the upstream Lightning security fixes. + ## [2.5.0] - 2026-09-10 ### Added diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 9562316c50..60e041c8ed 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -65,7 +65,7 @@ ktor-client-logging = { module = "io.ktor:ktor-client-logging", version.ref = "k ktor-client-mock = { module = "io.ktor:ktor-client-mock", version.ref = "ktor" } ktor-client-okhttp = { module = "io.ktor:ktor-client-okhttp", version.ref = "ktor" } ktor-serialization-kotlinx-json = { module = "io.ktor:ktor-serialization-kotlinx-json", version.ref = "ktor" } -ldk-node-android = { module = "com.synonym:ldk-node-android", version = "0.7.0-rc.71" } +ldk-node-android = { module = "com.synonym:ldk-node-android", version = "0.7.0-rc.72" } lifecycle-process = { group = "androidx.lifecycle", name = "lifecycle-process", version.ref = "lifecycle" } lifecycle-runtime-compose = { module = "androidx.lifecycle:lifecycle-runtime-compose", version.ref = "lifecycle" } lifecycle-runtime-ktx = { module = "androidx.lifecycle:lifecycle-runtime-ktx", version.ref = "lifecycle" } From a7d7c7c1c9b4d0f2479f3c7c88fad7922b9ad40f Mon Sep 17 00:00:00 2001 From: Ovi Trif Date: Tue, 13 Oct 2026 14:15:55 +0200 Subject: [PATCH 2/3] chore: link changelog to the pull request --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a9c7730f26..aabfd04094 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Fixed -- Updated LDK Node to 0.7.0-rc.72 for the upstream Lightning security fixes. +- Updated LDK Node to 0.7.0-rc.72 for the upstream Lightning security fixes. #1475 ## [2.5.0] - 2026-09-10 From 24fd170977c91d9bf151eb67354cb0ea3b91e55a Mon Sep 17 00:00:00 2001 From: Ovi Trif Date: Tue, 13 Oct 2026 17:33:47 +0200 Subject: [PATCH 3/3] chore: use a changelog fragment and update the journey ldk pin --- CHANGELOG.md | 3 --- changelog.d/next/1475.security.md | 1 + journeys/pubky-marketplace/local-paykit-fallback.md | 2 +- 3 files changed, 2 insertions(+), 4 deletions(-) create mode 100644 changelog.d/next/1475.security.md diff --git a/CHANGELOG.md b/CHANGELOG.md index aabfd04094..038b3570f0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,9 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] -### Fixed -- Updated LDK Node to 0.7.0-rc.72 for the upstream Lightning security fixes. #1475 - ## [2.5.0] - 2026-09-10 ### Added diff --git a/changelog.d/next/1475.security.md b/changelog.d/next/1475.security.md new file mode 100644 index 0000000000..53f44a5b92 --- /dev/null +++ b/changelog.d/next/1475.security.md @@ -0,0 +1 @@ +Updated the Lightning node with upstream security fixes. diff --git a/journeys/pubky-marketplace/local-paykit-fallback.md b/journeys/pubky-marketplace/local-paykit-fallback.md index b931bb2382..a3310490fe 100644 --- a/journeys/pubky-marketplace/local-paykit-fallback.md +++ b/journeys/pubky-marketplace/local-paykit-fallback.md @@ -18,7 +18,7 @@ that Locks released its content. Follow `local-paykit-fallback.xml` after this s on that homeserver. Preserve existing identities. Use the grant signup journey for a fresh `pubkyauth://signup_grant` URL naming that homeserver; invites and authorization URLs are secrets. - Record the app commit, APK hash and installed package. Android uses `devDebug`, `to.bitkit.dev`, - Paykit `0.1.0-rc72` and native LDK `0.7.0-rc.71`. Use a normal build (`E2E=false`) or explicitly + Paykit `0.1.0-rc72` and native LDK `0.7.0-rc.72`. Use a normal build (`E2E=false`) or explicitly network-backed E2E build; the local E2E default selects a different chain endpoint. - Both wallets and the server must use `ssl://electrs.bitkit.stag0.blocktank.to:9999`, the regtest endpoint in `app/src/main/java/to/bitkit/env/Env.kt`. Verify this before funding or creating a request.