Ride-The-Lightning/RTL v0.15.10

Release v0.15.10-beta

on GitHub

0.15.10-beta is primarily a secret-hygiene release: it tightens how RTL handles and exposes authentication material, both in its own API responses and in the node log files users routinely share when asking for help. Operators are encouraged to update promptly.

Full detail, entry by entry, in release-notes/Release-notes-0.15.10.md.

Authentication and secret handling

Server-side validation of authentication requests is tightened (#1654), with two-factor setups the most affected.

Redaction of credential material is now symmetric across the surfaces that carry it (#1659): node logs and configuration API responses no longer emit server-held secrets, deployment-level authentication settings (disableAuth, SSO, the password policy, the database location) are pinned server-side so the settings API cannot flip them, channel-backup downloads are contained to the selected node's backup directory, and the settings write path is atomic and mode-preserving.

Eclair's channels controller no longer logs its request options wholesale (#1664) — because Eclair authenticates with HTTP basic auth, that log wrote a recoverable form of the configured lnApiPassword into the node log whenever logLevel was raised to DEBUG.

Robustness under load

The remaining unbounded alias-resolution fan-outs in the LND graph and channels controllers are now bounded at 20 concurrent lookups (#1651, fixes #1630), matching the CLN and LND peers paths. A node with many channels no longer fires one graph/node request per channel at once. The same change fixed a race where per-request options could be swapped mid-fan-out by a concurrent request for a different node.

Dependencies and tooling

A single batched dependency pass (#1653) resolved the open Dependabot security PRs and dropped the long-dead protractor devDependency, taking npm audit from 50 findings to 29 and leaving production dependencies clean at 0; everything still flagged is dev-only build tooling. The Angular framework moved to 20.3.27 (#1661), staying within v20 — the Angular 21 migration remains tracked separately by #1650.

This release also establishes a backend regression suite (test/backend/, plain node:test against the compiled backend/), wired into npm run test ahead of the frontend specs. It now stands at 38 tests, each written against a defect this release fixed.

Verification

The branch was verified as a whole at its tip, not just per-PR:

• npm run lint clean; 38/38 backend tests; 204/204 frontend Karma specs
• Committed backend/ and frontend/ artifacts reproduce byte-for-byte from a clean build
• npm audit --omit=dev: 0 vulnerabilities
• End-to-end against the docker regtest fixture with a branch-built image: 32/32 checks across LND, CLN and Eclair — login validation, config redaction, backup containment (including cross-node isolation), settings round-trip preserving node auth on all three implementations, the bounded LND fan-outs, and the shipped Angular bundle
• A DEBUG-level scan of all five node logs shows no macaroon bytes, rune, basic-auth header, secret2FA, cookieValue or rtlPass

Contributors:
@7-falseparfait @saubyk

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.10

$ git verify-tag v0.15.10
gpg: Signature made Mon Aug  3 22:51:37 2026 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]

Install RTL via npm

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags