Release v0.15.13-beta

0.15.13 is primarily a request-validation and clean-up release: RTL now checks the values it forwards to LND, Core Lightning, Eclair and Loop before they leave, the Boltz integration is removed, and two first-login problems are fixed. Operators who still have Boltz settings in their config have nothing to do, but will see a one-line notice at start-up; see below.

Full detail, entry by entry, in release-notes/Release-notes-0.15.13.md.

Boltz integration removed

Boltz suspended its swap service in August 2026 and it has not returned, so the integration could neither create a swap nor be tested. The Services > Boltz pages, the /api/boltz endpoints and the boltzServerUrl / boltzMacaroonPath settings are gone (#1726, closes #1724).

A config file or environment that still sets boltzServerUrl, boltzMacaroonPath, BOLTZ_SERVER_URL or BOLTZ_MACAROON_PATH keeps working. RTL ignores those settings and prints one line at start-up saying so; they can be deleted, and a bundled boltz-client container is no longer used by RTL.

Values are checked before they are forwarded to the node

Several handlers passed request values on to the node as they arrived. They now check the value's form first and answer 400 otherwise:

• LND: query parameters are built through the request wrapper and omitted when absent, instead of being sent as the string undefined (#1713, fixes #1698); path values for node, channel and route lookups, payment decode and lookup, and peer disconnect must be a public key, channel id, amount, payment request or payment hash (#1722); channel backup, verify and restore accept only a channel point or ALL, and an invalid one can no longer stop the process (#1718).
• Loop: each request builds its options from the selected node, so on a multi-node RTL a Loop call no longer goes to another node's swap server, and a missing swap server URL is reported as such (#1715, fixes #1714).
• Core Lightning: the invoice fetched for a BOLT 12 offer is validated before it is paid (#1720).
• Core Lightning and Eclair: the payments list and the sent-payments info list ask the node for at most 20 entries at a time, each with the request's own options, instead of all at once (#1725). The LND payment-request list does the same (#1722).

Login and first-run fixes

• The first login no longer fails with "Invalid CSRF token" when RTL is entered at /rtl/ (#1711, fixes #1710).
• On a multi-node setup the node dropdown now appears after the first login; it stayed hidden after a default-password login, or when a node had index 0 or string indexes in the config (#1600, thanks @CosimoRicciardi).
• An LND wallet can be initialised through RTL with any seed passphrase. Passphrases whose encoded form holds + or / used to fail; the passphrase now travels in the request body, and the wallet requests check their password and passphrase input (#1728, #1729).

Code health and tooling

A batched dependency pass (#1727) resolved the open Dependabot alerts: the Angular framework moves to 20.3.33 and the CLI line to 20.3.37 within v20, axios to 1.20.0, and hono, js-yaml, ip-address and other transitive packages to their fixed versions. Production dependencies are clean at 0; the six remaining findings are dev-only build tooling under Angular's v20 builder, which only an Angular 22 migration moves.

The backend regression suite grew from 159 to 275 tests this cycle and the frontend specs from 230 to 248. The docker regtest fixture's Core Lightning node moves to v26.06.8 (#1717).

Verification

The branch was verified as a whole at its tip, not just per PR:

• npm run lint clean; 275/275 backend tests; 248/248 frontend Karma specs
• Committed backend/ and frontend/ artifacts reproduce byte-for-byte from a clean install and build
• End-to-end against the docker regtest fixture running an image built from the tip: 66/66 API checks across LND, Core Lightning and Eclair, including node switching and real payments through RTL, and the BTCPay SSO harness at 16/16; 22 pages across the three implementations rendered in a browser with no console errors or failed API calls
• npm audit --omit=dev: 0 vulnerabilities (full audit 6, all dev-only build tooling)

Contributors:
@CosimoRicciardi @saubyk

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.13

$ git verify-tag v0.15.13
gpg: Signature made Thu Oct  1 11:25:39 2026 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "RTL Security <security@ridethelightning.info>" [ultimate]

Install RTL via npm

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.12-beta

0.15.12 is primarily a login-hardening release: it closes the remaining gaps in RTL's login lockout and the application-settings API, and fixes a set of long-standing Eclair and LND behaviours around invoices, payments and channel opens. Operators running RTL's own login behind a reverse proxy have one setting to add; see below.

Full detail, entry by entry, in release-notes/Release-notes-0.15.12.md.

Login lockout and settings hardening

The failed-login lockout is rebuilt around what it was meant to guarantee (#1691, #1701, closes #1656). It now actually expires after its 30-minute window instead of persisting until restart, its counter table is bounded and keyed safely, a locked address cannot have its window extended or learn whether a guess was right, and with 2FA enforced the two failure replies no longer reveal which credential was wrong.

The counter is now keyed on the connecting address rather than on X-Forwarded-For, which any client could rotate for a fresh attempt budget or use to lock out someone else. If RTL's own login runs behind a reverse proxy, set the new trustedProxies config key (or TRUSTED_PROXIES) to the proxy's exact address; without it every client behind the proxy shares one lockout counter, and the first affected login logs a warning saying so. Exact addresses matter: express trusts every hop inside the list, so a range that also contains clients reopens the bypass, and a list entry wider than one host is flagged at startup. SSO deployments such as BTCPay Server are unaffected. The SSO login itself now validates its inputs, so a malformed access key or session token gets a proper 406 instead of an error-handler reply or no reply at all.

The application-settings save is allowlisted and pinned (#1683, fixes #1660): an authenticated caller can no longer re-point macaroon, rune or config paths, server URLs, or the 2FA seed through it, or provision a node the server does not know. Loop and Boltz connection settings move out of the UI entirely and are configured in the config file or environment like the other credentialed paths (#1696). Every state-changing route now carries the authentication guard, enforced by a test that walks the route tree (#1688); this closes GHSA-wj92-jhwh-85j5, an unauthenticated circular-rebalance call on Eclair nodes reported by @archnexus707.

Eclair

Invoices are paged server-side instead of fetched whole (#1690, fixes #1067), which stops the Transactions page from pinning a node with a large invoice history at 100% CPU. A failed channel open is reported as a failure carrying Eclair's own reason, where it used to show success followed by "Unknown Error" (#1695). The Public Key dialog now offers the node URI, as it does for LND and Core Lightning (#1694).

LND

A channel can be opened with the entire wallet balance via a "Use Entire Wallet Balance" toggle backed by fund_max, on LND 0.16 and above (#1682, fixes #155). Omitted invoice and payment paging parameters are no longer forwarded to the node as the string undefined, and malformed values are refused with a 400 instead of passed through (#1687, fixes #1678).

Code health and tooling

The websocket ping timer no longer keeps a process alive on its own, which had hung the backend test run (#1699, fixes #1697). package.json declares engines.node >= 20.19.0, so an unsupported runtime is warned about at install rather than failing at start (#1681, closes #1220).

A batched dependency pass (#1702) resolved the open Dependabot alerts: the Angular CLI line moves to 20.3.36 within v20, picking up the webpack-dev-server, less and image-size fixes without the Angular 22 migration Dependabot proposed, and fast-uri, browserslist and qs move to their fixed versions. Production dependencies are clean at 0; the eight remaining findings are moderate, dev-only build tooling with no bumpable fix. The Angular 21 migration remains tracked by #1650.

The backend regression suite grew from 38 to 159 tests this cycle, including boot-time configuration checks that start rtl.js in a child process, and the BTCPay SSO harness in docker/ grew to 16 assertions.

Verification

The branch was verified as a whole at its tip, not just per PR:

• npm run lint clean; 159/159 backend tests; 230/230 frontend Karma specs
• Committed backend/ and frontend/ artifacts reproduce byte-for-byte from a clean build
• End-to-end against a clean, seeded docker regtest fixture with the tip's build: 57/57 API checks across three LND nodes, Core Lightning and Eclair, including node switching, both Eclair fixes against a live Eclair 0.13.1, and the SSO harness at 16/16; dashboards and transaction pages for all three implementations rendered in a browser with no console errors
• npm audit --omit=dev: 0 vulnerabilities (full audit 8, all moderate, all dev-only)

Contributors:
@7-falseparfait @stupleb @SIDHARTH20K4 @saubyk

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.12

$ git verify-tag v0.15.12
gpg: Signature made Mon Sep  7 19:47:57 2026 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "RTL Security <security@ridethelightning.info>" [ultimate]

Install RTL via npm

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.11-beta

0.15.11-beta is a security-posture release: it gives RTL a proper vulnerability-disclosure channel for the first time, closes the last credential-crossing race in the LND controllers, and takes the dependency tree another step down. It is small and every change was verified end-to-end; operators running multiple LND nodes from one RTL are encouraged to update.

Full detail, entry by entry, in release-notes/Release-notes-0.15.11.md.

A private way to report vulnerabilities

RTL now ships a SECURITY.md (#1677). Until now the repository had no security policy, GitHub private vulnerability reporting was off, and the only contact anywhere in the repo was a Twitter DM — so a researcher holding an RTL bug had no private route short of a public issue. The policy names two channels — GitHub private vulnerability reporting (now enabled) and security@ridethelightning.info — publishes the release-signing PGP key for encrypted reports, sets an RTL-specific scope (disableAuth deployments, plain HTTP behind a proxy and the intentionally-committed docker/ fixture credentials are out of scope; auth/session bypass, CSRF, credential exposure and config-file handling are in), and commits to a 72-hour acknowledgement. The README's contact line now routes security reports there. The same contact is published machine-readably as security.txt on ridethelightning.info.

LND: peer alias lookups no longer cross nodes

getAliasForPeers read a module-level options object inside deferred alias tasks, and postPeer mutated it again after the connect round trip (#1668, fixes #1662). Because every handler reassigns that object on entry, a request for a different node arriving in that window — a second tab, or a multi-node switch — sent node A's alias lookups (and postPeer's follow-up peer list) out with node B's URL or macaroon, yielding truncated aliases or a failed connect. This was the one alias fan-out #1651 did not cover; CLN and Eclair are structurally unaffected. Both handlers now snapshot their request options before any async boundary and hand each task its own copy. Two new backend tests reproduce the race against fake LND nodes and fail on the pre-fix code.

Small UX fix

The 2FA token input now carries autocomplete="one-time-code" (#1673, fixes #1674), so password managers and browsers recognise it and offer the code instead of leaving users to type it.

Dependencies

A single batched pass (#1676) resolved the seven open Dependabot security PRs, all against build tooling: the Angular CLI line moved to 20.3.34 (bringing postcss, hono and @hono/node-server fixes) and the flagged transitives moved to their fixed in-range versions. npm audit went 15 → 6 with production dependencies at 0 before and after; the six that remain are dev-only and pinned exactly by @angular-devkit/build-angular 20.x, so they wait on the Angular 21 migration (#1650). No runtime dependency changed version.

Verification

The branch was verified as a whole at its tip (392e1c77), not just per-PR:

• npm run lint clean; 40/40 backend tests; 205/205 frontend Karma specs
• Committed backend/ and frontend/ artifacts reproduce byte-for-byte from a clean build
• npm audit --omit=dev: 0 vulnerabilities
• End-to-end against the docker regtest fixture with a tip-built image, from a fresh down -v + seed: 19/19 API checks across LND, CLN and Eclair; the #1668 race exercised on real nodes — 25/25 concurrent getPeers rounds across two node sessions with no cross-node or truncated aliases, and 10/10 postPeer connects racing another node's peer list; the BTCPay SSO harness (verify-sso.sh) 11/11 on the same image
• Every contributor-submitted frontend/ bundle was discarded and regenerated from source by the maintainer (now written into CLAUDE.md as standing practice)

Contributors:
@7-falseparfait @lorenzolfm @saubyk

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.11

$ git verify-tag v0.15.11
gpg: Signature made Tue Aug 18 17:16:21 2026 IST
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "RTL Security <security@ridethelightning.info>" [ultimate]

Install RTL via npm

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.10-beta

0.15.10-beta is primarily a secret-hygiene release: it tightens how RTL handles and exposes authentication material, both in its own API responses and in the node log files users routinely share when asking for help. Operators are encouraged to update promptly.

Full detail, entry by entry, in release-notes/Release-notes-0.15.10.md.

Authentication and secret handling

Server-side validation of authentication requests is tightened (#1654), with two-factor setups the most affected.

Redaction of credential material is now symmetric across the surfaces that carry it (#1659): node logs and configuration API responses no longer emit server-held secrets, deployment-level authentication settings (disableAuth, SSO, the password policy, the database location) are pinned server-side so the settings API cannot flip them, channel-backup downloads are contained to the selected node's backup directory, and the settings write path is atomic and mode-preserving.

Eclair's channels controller no longer logs its request options wholesale (#1664) — because Eclair authenticates with HTTP basic auth, that log wrote a recoverable form of the configured lnApiPassword into the node log whenever logLevel was raised to DEBUG.

Robustness under load

The remaining unbounded alias-resolution fan-outs in the LND graph and channels controllers are now bounded at 20 concurrent lookups (#1651, fixes #1630), matching the CLN and LND peers paths. A node with many channels no longer fires one graph/node request per channel at once. The same change fixed a race where per-request options could be swapped mid-fan-out by a concurrent request for a different node.

Dependencies and tooling

A single batched dependency pass (#1653) resolved the open Dependabot security PRs and dropped the long-dead protractor devDependency, taking npm audit from 50 findings to 29 and leaving production dependencies clean at 0; everything still flagged is dev-only build tooling. The Angular framework moved to 20.3.27 (#1661), staying within v20 — the Angular 21 migration remains tracked separately by #1650.

This release also establishes a backend regression suite (test/backend/, plain node:test against the compiled backend/), wired into npm run test ahead of the frontend specs. It now stands at 38 tests, each written against a defect this release fixed.

Verification

The branch was verified as a whole at its tip, not just per-PR:

• npm run lint clean; 38/38 backend tests; 204/204 frontend Karma specs
• Committed backend/ and frontend/ artifacts reproduce byte-for-byte from a clean build
• npm audit --omit=dev: 0 vulnerabilities
• End-to-end against the docker regtest fixture with a branch-built image: 32/32 checks across LND, CLN and Eclair — login validation, config redaction, backup containment (including cross-node isolation), settings round-trip preserving node auth on all three implementations, the bounded LND fan-outs, and the shipped Angular bundle
• A DEBUG-level scan of all five node logs shows no macaroon bytes, rune, basic-auth header, secret2FA, cookieValue or rtlPass

Contributors:
@7-falseparfait @saubyk

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.10

$ git verify-tag v0.15.10
gpg: Signature made Mon Aug  3 22:51:37 2026 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]

Install RTL via npm

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.9-beta

RTL v0.15.9

🔒 Security & dependencies — zero production vulnerabilities. Production npm audit goes from 13 findings (2 critical) to 0. The deprecated, unmaintained dependencies behind them were retired via code changes, not just version bumps: request/request-promise → axios, csurf → csrf-csrf (with session-bound CSRF tokens), and the crypto-browserify polyfill chain removed by moving 2FA TOTP to WebCrypto — plus a batch update clearing all outstanding Dependabot security PRs.

Multi-node reliability. Fixed per-node authentication being corrupted when saving application settings, and a node whose credentials load late (e.g. a CLN rune written after startup) being permanently blocked until a restart.

Core Lightning. Corrected contradictory channel connection status between the list and detail views, and fixed the channel View Info modal rendering blank for disconnected channels.

UI/UX & accessibility. Restored the "items per page" selector and first/last-page buttons on tables; fixed a dashboard page-load error on missing channel aliases; realigned the Reports date controls; added missing form-field labels and removed positive tab indexes.

Enhancements. Added an option to disable RTL's built-in login (for platforms that front their own auth), and surfaced "Blocks till Maturity" by default on the pending force-closing list.

Reliability. Bounded peer/route alias resolution to stop clnrest "Resource temporarily unavailable" errors on nodes with many peers.

Developer tooling. Rebuilt the regtest docker fixture to cover all three implementations (LND, Core Lightning, Eclair), and documented the Dependabot / dependency-update process.

Full details: release-notes/Release-notes-0.15.9.md

Contributors:
@ShahanaFarooqui @SIDHARTH20K4 @MattDHill @CosimoRicciardi @saubyk

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.9

$ git verify-tag v0.15.9
gpg: Signature made Sun Jul 19 22:02:47 2026 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]

Install RTL via npm

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.8-beta

Hotfix release

• Fix for the payments bug introduced with 0.15.7
• Fix for memo not being visible for regular invoices

Contributors:
@ShahanaFarooqui

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.7-beta

Minor release:

• Angular version upgraded to v20
• Keysend messages now visible in the memo column of the invoices
• Bug fix for indefinite hanging of the dashboard after login

Contributors:
@ShahanaFarooqui

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.6-beta

What’s new

We’ve added a fix to protect against a recent npm supply-chain attack where malicious code was found in popular packages.
(Details: link)

Why it matters

• Our app doesn’t directly use the bad packages.
• They could still sneak in through indirect dependencies.
• Even though our current package-lock.json was safe, a fresh npm install could have pulled in a hacked version.

What we did

• Forced npm to always use safe, audited versions of the risky packages.
• Ignored any vulnerable versions that might be requested by other dependencies.

What you need to do

Run a clean install on the new release with npm ci --omit=dev --legacy-peer-deps.

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.6

$ git verify-tag v0.15.6
gpg: Signature made Tue Sep  9 20:04:18 2025 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]

Install RTL via npm

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.5-beta

Minor release:

• Boltz
  • Added a "Refund Address" input field to the swap modal for swap-in operations, with conditional validation based on wallet selection
  • Swap-in transactions now support specifying a refund address when not sending from the internal wallet
• Fix to show correct experimental-dual-fund configuration from listconfig

Contributors:
@ShahanaFarooqui
@jackstar12

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.5

$ git verify-tag v0.15.5
gpg: Signature made Mon Jul  7 13:32:25 2025 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]

Install RTL via npm

npm install --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags

Release v0.15.4-beta

Minor release with technical updates:

• Improved authentication logic for clearer error handling and validation during login and password reset processes.
• Refined application settings handling to ensure stricter validation of access keys.

Contributors:
@ShahanaFarooqui

---

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.4

$ git verify-tag v0.15.4
gpg: Signature made Mon 18 Nov 2024 08:31:13 PM PST
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [unknown]
gpg:                 aka "Suheb (approves) <39208279+saubyk@users.noreply.github.com>" [unknown]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3E9B D443 6C28 8039 CA82  7A92 00C9 E2BC 2E45 666F

Install RTL via npm

npm install --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags