fix: update Lightning dependencies for security fixes

[piotr-iohk]

Update lightning, lightning-liquidity and lightning-transaction-sync to 0.2.7 for the upstream security fixes, including malicious-counterparty commitment signing and inbound-channel Electrum sync denial of service. The lockfile changes only these three package versions. This PR uses Talos’s existing branch at a0ea0a3.

Intended release path: a new node release, proposed 0.7.0-rc.72, for Android/iOS master and Bitkit 2.6.0. The version bump, regenerated native artifacts and release are not part of this draft yet. The apps currently pin rc.71.

Validation

Talos reports cargo test --lib --locked: 117 passed, and cargo check --locked --features uniffi: passed with existing warnings. These results are attributed to his report; the PR creator has not independently rerun them. Integration tests, binding generation and downstream app tests remain outstanding. No independent vulnerability reproduction is claimed.

Before release

• Build and publish a new version with matching Android binaries and iOS framework/checksum, using the committed dependency graph.
• Run available library/integration tests and verify the patched dependencies in the artifacts.
• Update and validate both app consumers after artifacts are published.

The proposed separate rc.66-based security hotfix for Bitkit 2.5.1 is discussed in the release-plan thread. This draft does not approve either release path.

Companion hotfix draft: #124, based on the shipped rc.66 source.

[ovitrif]

@piotr-iohk I'm taking the release prep on this branch: version files for 0.7.0-rc.72, regenerated bindings, integration tests, then the tag and GitHub release, so the apps can bump. I'll post results here.

[piotr-iohk]

Partial validation

Ran locally on a0ea0a3, with locked dependencies. The PR still points to this revision.

• Rust unit tests: 117 node tests + 46 wallet-component tests passed; zero failures.
• UniFFI: cargo check --locked --features uniffi passed.
• Six integration tests passed: start_stop_reinit, connection_restart_behavior, onchain_wallet_recovery, onchain_transaction_events_electrum, vss_node_restart, and vss_v0_schema_backwards_compatibility.

Integration validation is not fully green:

• channel_full_cycle and channel_full_cycle_with_vss_store reached their 180-second runtime limits after Failed to sign transaction: On-chain transaction signing failed / Failed signing funding transaction during splicing. They were terminated; seven related channel-cycle variants were not run.
• reorg_test failed at tests/reorg_test.rs:196, asserting spendable_onchain_balance_sats > amount_sat - fee_sat (7,000-sat allowance). The minimized input is reorg_depth = 6, force_close = false. The saved regression seed is included in the logs.

The same reorg seed/input and assertion also fail on #124 at 67929be and on rc.66 source using the pre-security dependency graph (Lightning 0.2.5, liquidity 0.2.3, transaction-sync 0.2.1). The splice error was also previously reproduced with that pre-security graph. These comparisons point to existing failures under the controlled baseline; no new regression from the three security dependency bumps is established. The control does not reconstruct the original published rc.66 binary's dependencies.

For clarity, #124's earlier randomized reorg run passed, but replaying this newly discovered seed fails. The earlier pass remains valid for the cases it sampled; it does not cover this input.

Environment: macOS arm64, Rust/Cargo 1.90.0, isolated Bitcoin 27.2 and electrs a33e97e1. VSS storage/restart checks used the same unchanged upstream open-auth localhost fixture as #124 with temporary PostgreSQL 15; production LNURL/JWT authentication was not assessed. Temporary services were cleaned up; tracked source was unchanged.

No independent vulnerability reproduction or Android/iOS build/device testing was performed. This is partial validation, not full integration sign-off or shipping approval. The shared splice and reorg failures still need investigation.

Prepared log archive: ldk-pr123-partial-validation-a0ea0a3.zip, to be attached separately. It contains test output, splice evidence, the saved reorg seed and both comparison runs; user-specific paths are redacted.

[ovitrif]

Release prep for 0.7.0-rc.72 is pushed; the tag and release wait for a re-review.

• d1bd9fc bumps the version files and sets the Package.swift checksum to the built LDKNodeFFI.xcframework.zip.
• Regenerating the bindings changed nothing in the Swift, Kotlin or Python sources.
• The built xcframework slices and Android .so files embed lightning, lightning-liquidity and lightning-transaction-sync at 0.2.7 and no older version.
• rust.yml can't validate this branch: stable's -D warnings fails on warnings already on main, and fail-fast cancels the other jobs (run). I'm running the integration suite locally on Linux and will post the results here.

[ovi-reviewer]

Verdict: ✅ Approve

Review: diff 7 files.

Findings:
N/A

Proven at d1bd9fc:

• The xcframework slices and Android .so files built from this tree embed lightning, lightning-liquidity and lightning-transaction-sync 0.2.7 and no older version.
• The Package.swift checksum matches the built LDKNodeFFI.xcframework.zip.
• On Linux at d1bd9fc, these pass: the lib tests, the 45 integration_tests_rust tests outside the channel cycles and the splice, and 108 of the 110 multi_address_types_tests. The other two (channel_funding tests) hung under parallel load and pass when run alone.

Not proven:

• reorg_test fails at tests/reorg_test.rs:196 (spendable_onchain_balance_sats). @piotr-iohk reproduced the same failure on rc.66 with 0.2.5, so this predates the PR.
• channel_full_cycle* and splice_channel stall at splice funding signing on rc.71 and rc.66 alike, so this predates the PR and is tracked separately.
• The uploaded release zip and the Android package publish-android.yml builds from the tag: check the zip's checksum and the AAR's crate versions after publishing.

---

Reviewed by claude-opus-5-5 via gh-pr-review-loop skill
Commands: @ovi-reviewer review · test · retest

[ovitrif]

Release

• v0.7.0-rc.72

[ovitrif]

utAck

[ovitrif]

Correction to the multi_address_types_tests line in the review. On Linux at d1bd9fc:

• 106 of 110 pass in the full parallel run.
• channel_funding::test_open_channel_native_primary_with_nested_inputs and channel_funding::test_legacy_primary_channel_funding_excludes_legacy_inputs fail under parallel load and pass when run alone.
• derived_accounts::test_electrum_derived_account_incremental_sync_rolls_lookahead didn't finish in the parallel run. Run alone at d1bd9fc, it passes in 27 s.
• derived_accounts::test_derived_account_discovers_revealed_external_xpub_address_after_prior_sync doesn't finish, and it also hangs alone on main at 2204405 with lightning 0.2.5, so this PR didn't cause it.

The verdict stands.