Skip to content

0.2.0-beta

Choose a tag to compare

View all tags
@git-nostr git-nostr released this 23 Jul 14:11
· 31 commits to main since this release
v0.2.0-beta
1f0b8ec

flnd v0.2.0-beta Release Notes

flnd v0.2.0-beta is a large sync against upstream lnd, bringing BOLT 12 offers, onion messaging, production Taproot channels, RBF-based cooperative close, and a major internal channel-state storage refactor, alongside the walletd/neutrino Start(ctx) API migration and several debug-logging fixes from this cycle's review.

BOLT 12 (new)

  • Offer and InvoiceRequest message structs with TLV codecs, chains subtype, and full BOLT 12 reader/writer validation.
  • NewInvoiceRequestFromOffer for building a request from an existing offer.

Onion Messages (new)

  • Actor-based onion message forwarding (OnionPeerActor), with a token-bucket rate limiter and an LRU-cached SCID resolver.
  • BFS pathfinding for onion messages, blinded-path support (lnwire.BlindedPath, bounded intro-node codec), and a --protocol.no-onion-messages flag.
  • Onion messages that would cycle back to the sending peer are now dropped.

Taproot Channels (production)

  • Production Taproot channel negotiation, gated behind explicit negotiation and rejected for public channel opens.
  • Commitment generation, HTLC resolvers (success/timeout), and the nursery all integrate production Taproot support.
  • The "taproot" channel type now means the production variant.

RBF Cooperative Close

  • New rbfCloseActor decouples RPC-driven fee bumps from the peer actor, with a unique ServiceKey per closer.
  • Cooperative close now insta-dispatches CLOSED_CHANNEL on first confirmation instead of waiting.

Channel State Refactor

  • New chanstate package: channel state, commitment, forwarding-package, and revocation-log storage moved behind a Store interface, consumed by funding, peer, server, contractcourt, channelnotifier, and RPC layers.
  • Closed channels on KV-SQL backends are now tombstoned instead of bulk-deleted, and hidden from open-channel views.

RPC

  • DeleteForwardingHistory RPC and flncli deletefwdhistory command.
  • SubmitPackage (v3 CPFP package relay) RPC and flncli wallet submitpackage command.
  • EstimateRouteFee gained outgoing_chan_ids.
  • Removed the deprecated SendPayment, SendToRoute, and TrackPayment RPCs (routerrpc V2 equivalents remain).
  • pgx bumped from v4 to v5 across kvdb and sqldb.

chain.Interface.Start(ctx) migration (this cycle)

chain.Interface.Start now takes a context.Context, matching the same change in walletd/flokicoin-neutrino. All in-tree callers (bitcoind notifier, chain-view, lnwallet/btcwallet, test harnesses) were updated, including a dev-build-tagged test helper (UnsafeStart) missed by the first pass since it isn't covered by a plain go build.

Fixes (this cycle's review)

  • itest: corrected two leftover BTC/Flokicoin-rebrand identifiers — undefined funding.MaxFLCFundingAmount(Wumbo) constants and an unqualified DefaultTimeout.
  • htlcswitch: dust fee-exposure debug logs were missing the current commit fee argument.
  • sweep: dropped a stray, unrelated argument from an immediate-param debug log.
  • Fixed a panic in the DNS fallback SRV lookup, RPC handler panics are now recovered, and peer uptime is seeded from actual online state.
  • BOLT-02 push_msat bound is now enforced on the fundee.
  • Fixed a flaky neutrino reorg sync timeout in test harnesses.

Dev Tooling

  • dev.Dockerfile bumped to Go 1.26.1 and now builds against local ../walletd and ../flokicoin-neutrino checkouts via a new Justfile, instead of the versions pinned in go.mod.

Dependency Security

  • Bumped golang.org/x/crypto from v0.45.0 to v0.52.0 (7 ssh/ssh/agent advisories; flnd uses chacha20poly1305/hkdf/salsa20/scrypt/ripemd160/acme/autocert, never ssh).
  • Bumped google.golang.org/grpc from v1.76.0 to v1.79.3, closing GHSA-p77j-4mvh-x3m3 (CVSS 9.1, gRPC :path authorization-bypass). This one is more relevant to flnd than most: rpcperms/interceptor.go implements exactly the kind of per-method (macaroon-based, info.FullMethod-keyed) authorization interceptor this CVE targets. Traced the fail path — unmatched/malformed method identifiers are denied, not allowed, so this wasn't actively exploitable even before the bump — but flnd's RPC surface is the highest-value target of the four repos for this fix.

Commit range: <previous>..0.2.0-beta (204 commits).

Assets 28
Loading