Ride-The-Lightning/RTL v0.15.11

Release v0.15.11-beta

on GitHub

0.15.11-beta is a security-posture release: it gives RTL a proper vulnerability-disclosure channel for the first time, closes the last credential-crossing race in the LND controllers, and takes the dependency tree another step down. It is small and every change was verified end-to-end; operators running multiple LND nodes from one RTL are encouraged to update.

Full detail, entry by entry, in release-notes/Release-notes-0.15.11.md.

A private way to report vulnerabilities

RTL now ships a SECURITY.md (#1677). Until now the repository had no security policy, GitHub private vulnerability reporting was off, and the only contact anywhere in the repo was a Twitter DM — so a researcher holding an RTL bug had no private route short of a public issue. The policy names two channels — GitHub private vulnerability reporting (now enabled) and security@ridethelightning.info — publishes the release-signing PGP key for encrypted reports, sets an RTL-specific scope (disableAuth deployments, plain HTTP behind a proxy and the intentionally-committed docker/ fixture credentials are out of scope; auth/session bypass, CSRF, credential exposure and config-file handling are in), and commits to a 72-hour acknowledgement. The README's contact line now routes security reports there. The same contact is published machine-readably as security.txt on ridethelightning.info.

LND: peer alias lookups no longer cross nodes

getAliasForPeers read a module-level options object inside deferred alias tasks, and postPeer mutated it again after the connect round trip (#1668, fixes #1662). Because every handler reassigns that object on entry, a request for a different node arriving in that window — a second tab, or a multi-node switch — sent node A's alias lookups (and postPeer's follow-up peer list) out with node B's URL or macaroon, yielding truncated aliases or a failed connect. This was the one alias fan-out #1651 did not cover; CLN and Eclair are structurally unaffected. Both handlers now snapshot their request options before any async boundary and hand each task its own copy. Two new backend tests reproduce the race against fake LND nodes and fail on the pre-fix code.

Small UX fix

The 2FA token input now carries autocomplete="one-time-code" (#1673, fixes #1674), so password managers and browsers recognise it and offer the code instead of leaving users to type it.

Dependencies

A single batched pass (#1676) resolved the seven open Dependabot security PRs, all against build tooling: the Angular CLI line moved to 20.3.34 (bringing postcss, hono and @hono/node-server fixes) and the flagged transitives moved to their fixed in-range versions. npm audit went 15 → 6 with production dependencies at 0 before and after; the six that remain are dev-only and pinned exactly by @angular-devkit/build-angular 20.x, so they wait on the Angular 21 migration (#1650). No runtime dependency changed version.

Verification

The branch was verified as a whole at its tip (392e1c77), not just per-PR:

• npm run lint clean; 40/40 backend tests; 205/205 frontend Karma specs
• Committed backend/ and frontend/ artifacts reproduce byte-for-byte from a clean build
• npm audit --omit=dev: 0 vulnerabilities
• End-to-end against the docker regtest fixture with a tip-built image, from a fresh down -v + seed: 19/19 API checks across LND, CLN and Eclair; the #1668 race exercised on real nodes — 25/25 concurrent getPeers rounds across two node sessions with no cross-node or truncated aliases, and 10/10 postPeer connects racing another node's peer list; the BTCPay SSO harness (verify-sso.sh) 11/11 on the same image
• Every contributor-submitted frontend/ bundle was discarded and regenerated from source by the maintainer (now written into CLAUDE.md as standing practice)

Contributors:
@7-falseparfait @lorenzolfm @saubyk

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.11

$ git verify-tag v0.15.11
gpg: Signature made Tue Aug 18 17:16:21 2026 IST
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "RTL Security <security@ridethelightning.info>" [ultimate]

Install RTL via npm

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags