ElementsProject/lightning v26.06.10 on GitHub

This 26.06.10 point release includes fixes for vulnerabilities responsibly reported by a number of sources, alongside a set of bug fixes. We strongly recommend upgrading to this release.

As with 26.06.8 and 26.06.9, there is no embargo period: the release and it's fixes are available immediately. We have again temporarily withheld the tests for the security fixes, to make it harder to quickly turn the fixes into working exploits and to give users and network participants more time to upgrade before more technical detail is published.

The full list of changes is in the CHANGELOG.

We strongly encourage everyone to upgrade to 26.06.10 as soon as practical.

Highlights

Security fixes in dual funding and splicing (including signature checks on the peer's tx_signatures), onchaind HTLC resolution, gossip resource limits, connectd, runes and commando, plugin hooks and hsmd, plus a number of remote-crash and hardening fixes.
xpay now budgets the number of hops so a payment's onion fits, and fails early when it can't. askrene slightly prefers shorter routes and fewer parts.
Reproducible amd64, arm64 and armv7 binaries for Ubuntu 22.04, 24.04 and 26.04 (amd64 also for Fedora 40), each architecture with its own signed manifest.

Notes for operators

Channel opens: a peer's dust_limit_satoshis above 5000sat is refused, and for dual-funded opens a peer dust_limit_satoshis above the channel reserve is refused too. A v2 open requesting option_zeroconf is refused unless you're configured to accept zero-conf channels from that peer, as v1 opens already were.
bkpr-dumpincomecsv: csv_file must now be a plain filename ending in .csv. The file is written in the node's network directory, and never through a symlink.
connect with a host name now resolves it without blocking, and fails when --disable-dns is set.
Plugins: a hook handler that fails or panics (pyln-client, cln-plugin) now gets a safe default reply instead of crashing or hanging lightningd. commitment_revocation and db_write failures still stop the node.
Splicing: an RBF of a pending splice now uses at least 25/24 of its feerate, which peers such as Eclair require.
currencyrate: IPv6 proxy addresses are now rejected.
Offers: CLN now limits recurrence parameters to reasonable values; see the offer and fetchinvoice documentation.
Dual funding (--experimental-dual-fund) remains experimental. Zero-conf channels with peers you do not trust are discouraged.
Nodes that have run development (master) builds cannot downgrade to a 26.06.x release: the database schema is newer.

Recommended rune practices

Several fixes in this release concern runes and commando, so this is a good moment to review the runes issued on your node:

Bind runes used over commando to the node that uses them, with an id restriction, so they can't be used from anywhere else: lightning-cli createrune restrictions='[["id=<nodeid of the app>"]]'.
Rotate runes you can't account for: blacklist them with blacklistrune and issue new ones with tighter restrictions.

Docker images

Multi-platform images (linux/amd64, linux/arm64, linux/arm/v7) are on Docker Hub:

elementsproject/lightningd:v26.06.10 (also tagged latest)
elementsproject/lightningd:v26.06.10-vls, with the VLS remote signer (also tagged latest-vls)

docker pull elementsproject/lightningd:v26.06.10

Verifying the release

Check the signatures against the manifest explicitly (pass both files), then the checksums:

gpg --verify SHA256SUMS-v26.06.10.asc SHA256SUMS-v26.06.10
sha256sum -c SHA256SUMS-v26.06.10 --ignore-missing

Use SHA256SUMS-v26.06.10-arm64 / -armv7 and their .asc for the ARM tarballs. The maintainers' keys are listed in SECURITY.md; instructions for reproducing the builds are in the reproducible builds guide.

Thanks

This point release includes fixes for issues responsibly reported by:

And to the core-maintaining team and open source contributors who have triaged, analyzed, reproduced, fixed, verified, reviewed, tested over and over and over every.single.day: fix after fix after fix:

ElementsProject/lightning v26.06.10 v26.06.10 Quantum-Resistant Lightning Channel VII on GitHub