Skip to content

Release v0.18.7

Latest

Choose a tag to compare

@github-actions github-actions released this 04 Sep 22:07
v0.18.7
afc39a2

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/catrya.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/andreadiazcorreia.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider, manifest.txt.sig.catrya, manifest.txt.sig.andreadiazcorreia and manifest.txt are in the current directory) with:

gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg --verify manifest.txt.sig.catrya manifest.txt
gpg --verify manifest.txt.sig.andreadiazcorreia manifest.txt

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using RSA key 9A718444050F091D3D24CF6CE15E232F243D73E6
gpg: Good signature from "Catrya (github) <140891948+Catrya@users.noreply.github.com>" [ultimate]

gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg:                using EDDSA key 57376B6467F41F565ADDC65B1ED8B40E3A46E21D
gpg: Good signature from "Andrea Diaz Correia <andrea.diaz.correia@gmail.com>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

What's Changed in v0.18.7

🚀 Features

  • feat: cap in-flight payouts per destination and node-wide by @grunch in #951
  • feat: bound the total timelock of a payout route, not just the last hop by @grunch in #950
  • feat: CancelOrderRequest.pretrade_only — refuse to fall through to the dispute cancel by @grunch in #944
  • feat: operator cancel of pre-trade orders via CancelOrder RPC by @grunch in #939

🐛 Bug Fixes

  • fix: info event advertised the hold window as invoice_expiration_window by @grunch in #952
  • fix: cap user payout invoices at 144 blocks instead of 432 by @grunch in #949
  • fix: dev-fee verify parks hashes the connected node has never seen by @grunch in #947
  • fix: admin cancel tolerates a hold invoice LND already canceled or does not know by @grunch in #941
  • fix: drain counter E counts only in-flight bond payouts by @grunch in #943
  • fix: count only in-flight dev fees in the drain counters by @grunch in #938
  • fix: drain counter A no longer counts settled-hold-invoice orders by @grunch in #940

💼 Other

  • Update CHANGELOG for version 0.18.7 by @grunch

📚 Documentation

  • operator cancel goes through the gRPC, not mostro-cli admcancel by @grunch

⚙️ Miscellaneous Tasks

  • Release mostro version 0.18.7 by @grunch

Contributors

Full Changelog: v0.18.6...v0.18.7