Repository navigation
Bring master up to published LND v0.21.6-beta-1 - #22
Merged
Merged
Conversation
(cherry picked from commit 98abfba)
…ort-10804-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#10804: lnwallet: expose negotiated configs in aux chan state
Scaffold release-notes-0.21.4.md with the standard section structure so contributors have a place to add entries for the next v0.21 patch release. The pending 0.22 deprecation warnings are carried over from release-notes-0.21.3.md, matching the rest of the v0.21 series. (cherry picked from commit 69eaa2e)
…ort-11162-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11162: docs: add empty release notes for v0.20.5 and v0.21.4
Apply the existing graph reader compatibility helper to the frozen migration reader, which missed the fix introduced in lightningnetwork#10529. Empty legacy feature payloads otherwise fail with EOF when the decoder tries to read a two-byte length prefix. Add a migration regression test using mixed legacy and length-prefixed channel records. Capture expected state before replacing the feature payloads and verify that channel features and both policies survive. (cherry picked from commit 7e0b32d)
(cherry picked from commit d29a322)
…ort-11179-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11179: graph/db: fix legacy feature decoding in SQL migration
Pin btcwallet and wtxmgr to canonical pseudo-versions of f2c79d772865, the merged 0.16-line backport in btcsuite/btcwallet#1378. This includes the configurable-lease API and its wall-clock expiry fix without depending on unpublished release tags or module replacements. Regenerate the module checksums and remove the temporary btcwallet and wtxmgr replacement lint exemptions. Without the expiry fix, a slowly confirming spend can outlive its timed lease before wtxmgr records the spend height. A later shallow reorg can then expose the input to coin selection.
Define an optional interface for confirmation-controlled output leases without widening WalletController or changing existing callers. Resolve that capability through adapter chains before applying a non-zero depth. LightningWallet and RPCKeyRing expose their wrapped controller, so local and remote-signer nodes reach the concrete btcwallet backend. Unsupported controllers fail closed. Map the accepted depth to btcwallet's persisted option and retain the legacy LeaseOutput path for zero-depth callers.
Add optional confirmation-depth fields to LeaseOutput and FundPsbt. A non-zero value selects a lease that ignores wall-clock expiry and releases at the requested spend depth or by explicit owner release. Zero preserves time-controlled leases. Resolve wallet capability before acquiring inputs so unsupported backends fail closed even when FundPsbt selects no new input. Echo the accepted depth after installation, and expose persisted spend height through ListLeases so clients can observe confirmation and reorg progress. Cover option forwarding, zero-depth compatibility, unsupported wallets, partial acquisition rollback, and response marshalling.
Make multi-input lease acquisition all-or-nothing. A metadata lookup or lease failure after an earlier success now triggers one guarded deferred rollback. Release each acquired output with its recorded lock ID. This preserves a caller's custom owner ID instead of incorrectly using LND's internal ID. Cover both metadata and lease failures with internal and custom owners.
Document the new LeaseOutput and FundPsbt confirmation-depth option in the 0.22.0 release notes.
Exercise the WalletKit and btcwallet lease lifecycle with a real node and miner. Let the wall-clock deadline pass before broadcasting. Confirm the spend, disconnect it, restart the node, and reconfirm it. Assert persisted spend progress at each transition and verify that the lease remains active until the requested confirmation depth is reached.
…125-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11125: walletrpc: retain input leases through spend confirmation
In this commit, we let the switch reconcile replayed adds whose incoming circuit has already been committed. Once the interceptor resumes a forward, the switch commits its incoming circuit and removes the packet from the held set. If the incoming link then replays that add before the return packet is committed, the packet can be offered to the interceptor a second time. The circuit map still distinguishes in-memory duplicates from circuits restored during recovery. Fresh packets continue through the normal interception path.
In this commit, we recognize held duplicates before applying the current-height expiry check. The original held forward keeps its resolution handle and auto-fail deadline. This prevents a near-expiry replay from failing upstream while the interceptor can still resume the outgoing HTLC. The regression test verifies that the original handle opens and settles exactly one circuit.
In this commit, we add the public PR to the 0.20.5 and 0.21.4 release notes. The note calls out that incoming-link replays are reconciled after the interceptor resumes a forward, so operators know the duplicate interception behavior is fixed.
…ort-11163-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11163: htlcswitch: reconcile resumed forward replays
The `outgoing_amount_msat` field of `ForwardHtlcInterceptRequest` is the sender's `amt_to_forward` value copied straight out of the onion payload. The incoming link does not validate it, and the switch only compares it against the real incoming amount and the outgoing forwarding policy in `CheckHtlcForward` when the HTLC is resumed. When the interceptor answers with SETTLE that check never runs, so an interceptor that credits the outgoing amount can be made to release a preimage for far more than the incoming HTLC is actually worth. The field comments did not say any of this, and the naming makes the outgoing amount look like "the" amount. Spell out that only `incoming_amount_msat` reflects what the peer committed to, and that the `in_amount_msat` override on RESUME_MODIFIED replaces the value used by the policy check without changing what is actually received. Generated files are updated by hand to match the proto comments since only comments changed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit cee8ed6)
…ort-11194-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11194: docs+routerrpc: document that interceptor outgoing amount is untrusted
When an AMP set completes but fails preimage reconstruction, updateMpp issued a CancelInvoiceUpdate that canceled the greater invoice. For reusable static AMP invoices this is too broad: the failure is a set-local condition, since only the HTLCs of the failing set can never settle. Other sets accepted on the same invoice are unaffected by the failure and should remain payable. Issue a CancelHTLCsUpdate scoped to the failing set instead, keeping the invoice open. Adds a regression test verifying that a concurrently accepted set on the same invoice survives a failing set and can still settle. (cherry picked from commit d74ab6f)
(cherry picked from commit 7b65e32)
…ort-11198-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11198: invoices: cancel only the failing AMP set on reconstruction failure
Run the SQLite and Postgres property checks as isolated subtests, close each database after its check, and migrate a bounded batch of randomized invoices per Rapid iteration. This preserves multi-invoice transaction coverage while preventing the accidental 100-by-100 workload from exhausting the Postgres fixture under the race detector. (cherry picked from commit 381faa6)
…ort-11206-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11206: invoices: bound rapid migration test workload
Resolve the fn/v2 dependency to the repository's local ./fn module, matching master. Without this replacement, the v0.20 and v0.21 branches download fn/v2@v2.0.9. Its published Go 1.23 module metadata is incompatible with Go 1.27 when its tests use testing.B.Context. Keep the replacement local so the existing unit-module job tests the same source as the root module. This is a backport-specific compatibility change and does not alter the required fn/v2 version.
Keep lnd compatible with the previous stable Go release by updating the language version in every tracked go.mod file to Go 1.26.8. Move build and release tooling to Go 1.27.1, including CI, Docker images, the Makefile, protobuf generation, the linter configuration, and mobile build documentation. Update the installation documentation and official Linux archive checksums for Go 1.26.8 as well. (cherry picked from commit b1f9ca6)
Upgrade the custom golangci-lint from v2.4.0 to v2.13.2 because the older version reports false type-checking errors for generic mutex code when it runs with Go 1.27. Refresh the tools module dependencies, account for the renamed exhaustruct_v5 linter, and disable the deprecated gomodguard while leaving gomodguard_v2 active. Apply Go 1.27's gofmt output to the PSBT test's composite-literal return. Lower the consecutive-SCID zlib test boundary from 30,794 to 30,792. Go 1.27 changed compress/flate output, making 30,793 SCIDs exceed the 65,535-byte Lightning message limit while 30,792 still fit. (cherry picked from commit 6b54a38)
The protobuf generator uses Go's formatting packages and is now compiled inside the Go 1.27.1 Docker image. This changes generated doc-comment formatting and causes rpc-check to report stale checked-in bindings. Regenerate the RPC bindings with the newly pinned image. The resulting changes affect comments only; protobuf schemas and generated API code stay unchanged. (cherry picked from commit dd52310)
The linter configuration uses default: all, so upgrading golangci-lint also enables checks introduced after v2.4. Adopt canonicalheader, clickhouselint, godoclint, iotamixing, and unqueryvet because they add focused HTTP, documentation, const-block, and SQL safeguards. Fix the canonical WebSocket protocol header spelling required by the expanded canonicalheader implementation. Update twelve existing doc comments to begin with their declared symbol names as required by godoclint. Keep modernize disabled for now because its findings require broader code changes that should be reviewed separately against the Go 1.26 support baseline. (cherry picked from commit bada7ea)
…ort-11328-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11328: build: use release tags in dev Docker image
…odule-tags build: consume backported kvdb, queue and sqldb fixes
BTCPay's overlay as of basedon-v0.21.3-beta-2 (899d516), carried onto upstream v0.21.5-beta.rc1: the three per-arch Dockerfiles with Loop, the startup and wallet-unlock scripts (PR #17), the startup regression suite, the GitHub Actions publish and test workflows, and the -fresh-btcpay commit suffix in the Makefile. The upstream README stays as it is on version branches.
Upstream builds v0.21.5-beta.rc1 with Go 1.27.3 (Makefile GO_VERSION, Dockerfile) and its go.mod requires 1.26.10, which the old 1.26.6 base images cannot build. Loop stays at v0.33.3-beta.
The network result store is pruned at startup, keeping only results for payments that are still in flight. Previously, cleanStore iterated over the bucket and deleted each stale key individually. On SQL backends, each iteration step and deletion requires separate database queries. A store with N entries therefore incurred O(N) sequential client/server round trips and could make startup take hours when using remote PostgreSQL. Read retained results with one streaming query, drop and recreate the bucket, then restore the retained entries. PostgreSQL still processes O(N) rows internally, but the operation no longer performs a round trip for every stored result. Exercise cleanup across the supported kvdb backends, including partial, empty, and unchanged result sets. Add PostgreSQL benchmarks covering 1,000 and 10,000 entries with fully stale and partially retained stores. Fixes lightningnetwork#11353. Co-authored-by: ziggie <ziggie1984@protonmail.com> (cherry picked from commit e092b72)
…ort-11413-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11413: htlcswitch: avoid per-row queries when pruning network result store
…5-final build: bump version to v0.21.5
BTCPay's overlay as of basedon-v0.21.5-beta.rc1 (242c454), carried onto upstream v0.21.5-beta: the three per-arch Dockerfiles with Loop, the startup and wallet-unlock scripts (PR #17), the startup regression suite, the GitHub Actions publish and test workflows, and the -fresh-btcpay commit suffix in the Makefile. Go stays at 1.27.3, as upstream's Makefile for this release; its go.mod still requires 1.26.10. Loop stays at v0.33.3-beta. The upstream README stays as it is on version branches.
(cherry picked from commit a14fcb3)
(cherry picked from commit 619ea5f)
…ort-11456-to-v0.21.x-branch [v0.21.x-branch] Backport lightningnetwork#11456: build: disable MPTCP listeners by default
Address review: lead with ordered steps that make the patched kernel the fix, cover Docker namespaces and kernels without MPTCP, add a verification step and link the CVE, exploit and pinned mitigation. Qualify the MPTCP opt-in in the bug fix entry so it no longer contradicts the notice.
…6-final build: bump version to v0.21.6
|
Important Review skippedToo many files! This PR contains 203 files, which is 103 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v0.21.6-beta-1release, including the tini startup-helper fix in Let tini reap the Docker startup helper #21 and Go 1.27.3 Dockerfiles.UPDATING-LND-NOTES.mdremoved.The final tree matches published source
6065fe8012ef464d0f27512b793a0de773c4f92dexactly except for the BTCPay README and the intentionally absent archival maintenance file. Existing startup scripts, tests, publishing workflow, and CodeRabbit configuration were compared before assembling the merge tree; no master-only product changes were dropped.Release and rollout evidence
No tag or image is republished by this branch. Merge is authorized once current PR CI passes. Preserve the merge history when merging this PR; do not squash it.