fix: backport Lightning security update to rc66 for Bitkit 2.5.1

.github/workflows/publish-android.yml

@@ -48,6 +48,8 @@ jobs:
 
     - name: Set up Android SDK
       uses: android-actions/setup-android@v3
+      with:
+        packages: platform-tools
 
     - name: Set up Android NDK
       id: setup-ndk

.gitignore

@@ -2,11 +2,10 @@
 # will have compiled files and executables
 /target/
 /bindings/uniffi-bindgen/target/
+/bindings/uniffi-bindgen/Cargo.lock
 /bindings/kotlin/ldk-node-android/native-debug-symbols.zip
 
-# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
-# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
+# Commit Cargo.lock to freeze dependencies for published native artifacts.
 
 # These are backup files generated by rustfmt
 **/*.rs.bk

CHANGELOG.md

@@ -1,7 +1,8 @@
-# 0.7.0-rc.66 (Synonym Fork)
+# 0.7.0-rc.66.1 (Synonym Fork)
 
 ## Bug Fixes
 
+- Bump `lightning`, `lightning-liquidity` and `lightning-transaction-sync` to 0.2.7, which fixes a counterparty-exploitable funds-theft vulnerability (lightningdevkit/rust-lightning#5057) and an Electrum sync denial of service (lightningdevkit/rust-lightning#4867).
 - Prevent native SIGABRT crashes when stopping and rebuilding the node by making runtime teardown deterministic.
 - Keep exported payment and liquidity handles from calling into a shutting-down runtime, refuse restart while detached work is still live, and stop Electrum confirm gating from blocking or panicking shutdown.
 - Add keep consumer rules for JNA types UniFFI needs under R8.