0.15.12 is primarily a login-hardening release: it closes the remaining gaps in RTL's login lockout and the application-settings API, and fixes a set of long-standing Eclair and LND behaviours around invoices, payments and channel opens. Operators running RTL's own login behind a reverse proxy have one setting to add; see below.
Full detail, entry by entry, in release-notes/Release-notes-0.15.12.md.
Login lockout and settings hardening
The failed-login lockout is rebuilt around what it was meant to guarantee (#1691, #1701, closes #1656). It now actually expires after its 30-minute window instead of persisting until restart, its counter table is bounded and keyed safely, a locked address cannot have its window extended or learn whether a guess was right, and with 2FA enforced the two failure replies no longer reveal which credential was wrong.
The counter is now keyed on the connecting address rather than on X-Forwarded-For, which any client could rotate for a fresh attempt budget or use to lock out someone else. If RTL's own login runs behind a reverse proxy, set the new trustedProxies config key (or TRUSTED_PROXIES) to the proxy's exact address; without it every client behind the proxy shares one lockout counter, and the first affected login logs a warning saying so. Exact addresses matter: express trusts every hop inside the list, so a range that also contains clients reopens the bypass, and a list entry wider than one host is flagged at startup. SSO deployments such as BTCPay Server are unaffected. The SSO login itself now validates its inputs, so a malformed access key or session token gets a proper 406 instead of an error-handler reply or no reply at all.
The application-settings save is allowlisted and pinned (#1683, fixes #1660): an authenticated caller can no longer re-point macaroon, rune or config paths, server URLs, or the 2FA seed through it, or provision a node the server does not know. Loop and Boltz connection settings move out of the UI entirely and are configured in the config file or environment like the other credentialed paths (#1696). Every state-changing route now carries the authentication guard, enforced by a test that walks the route tree (#1688); this closes GHSA-wj92-jhwh-85j5, an unauthenticated circular-rebalance call on Eclair nodes reported by @archnexus707.
Eclair
Invoices are paged server-side instead of fetched whole (#1690, fixes #1067), which stops the Transactions page from pinning a node with a large invoice history at 100% CPU. A failed channel open is reported as a failure carrying Eclair's own reason, where it used to show success followed by "Unknown Error" (#1695). The Public Key dialog now offers the node URI, as it does for LND and Core Lightning (#1694).
LND
A channel can be opened with the entire wallet balance via a "Use Entire Wallet Balance" toggle backed by fund_max, on LND 0.16 and above (#1682, fixes #155). Omitted invoice and payment paging parameters are no longer forwarded to the node as the string undefined, and malformed values are refused with a 400 instead of passed through (#1687, fixes #1678).
Code health and tooling
The websocket ping timer no longer keeps a process alive on its own, which had hung the backend test run (#1699, fixes #1697). package.json declares engines.node >= 20.19.0, so an unsupported runtime is warned about at install rather than failing at start (#1681, closes #1220).
A batched dependency pass (#1702) resolved the open Dependabot alerts: the Angular CLI line moves to 20.3.36 within v20, picking up the webpack-dev-server, less and image-size fixes without the Angular 22 migration Dependabot proposed, and fast-uri, browserslist and qs move to their fixed versions. Production dependencies are clean at 0; the eight remaining findings are moderate, dev-only build tooling with no bumpable fix. The Angular 21 migration remains tracked by #1650.
The backend regression suite grew from 38 to 159 tests this cycle, including boot-time configuration checks that start rtl.js in a child process, and the BTCPay SSO harness in docker/ grew to 16 assertions.
Verification
The branch was verified as a whole at its tip, not just per PR:
npm run lintclean; 159/159 backend tests; 230/230 frontend Karma specs- Committed
backend/andfrontend/artifacts reproduce byte-for-byte from a clean build - End-to-end against a clean, seeded docker regtest fixture with the tip's build: 57/57 API checks across three LND nodes, Core Lightning and Eclair, including node switching, both Eclair fixes against a live Eclair 0.13.1, and the SSO harness at 16/16; dashboards and transaction pages for all three implementations rendered in a browser with no console errors
npm audit --omit=dev: 0 vulnerabilities (full audit 8, all moderate, all dev-only)
Contributors:
@7-falseparfait @stupleb @SIDHARTH20K4 @saubyk
PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature
$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL
$ git checkout v0.15.12
$ git verify-tag v0.15.12
gpg: Signature made Mon Sep 7 19:47:57 2026 PDT
gpg: using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg: aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg: aka "RTL Security <security@ridethelightning.info>" [ultimate]
Install RTL via npm
npm ci --omit=dev --legacy-peer-deps
Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags