Ride-The-Lightning/RTL v0.15.16

Release v0.15.16-beta

on GitHub

0.15.16 is a security hardening release for RTL as deployed behind a shared origin, with the dependency batch that clears every open Dependabot alert. There is no change to how RTL talks to Lightning nodes. Operators running the Docker image should pull v0.15.16; this image also carries the refreshed Alpine CA bundle that v0.15.15 missed (#1791). Bare-metal installs stay on Node 22.23.4 or 24.22.1 (or later), as set in 0.15.15.

Full detail in release-notes/Release-notes-0.15.16.md.

Security

• Cookies scoped to RTL's base path (#1785). The session, CSRF and XSRF-TOKEN cookies were issued with Path=/ although RTL serves itself under /rtl. Behind BTCPay Server and similar bundles that share an origin with other applications, the browser sent RTL's session and signed CSRF cookies on every request to those sibling paths, and the readable XSRF-TOKEN was visible in their document.cookie. All three now carry Path=/rtl. This is least privilege rather than isolation, and the login and BTCPay single-sign-on flows are unchanged. Reported by Gleb Lizunov (@hokvo).
• Docker image upgrades Alpine's packages at build time (#1792, fixes #1791). The v0.15.15 image ran Node 22.23.4, which rejects the leaked eMudhra chains, but was built a few hours before the node:22-alpine tag picked up Alpine's corrected ca-certificates package, so BusyBox wget and openssl inside the container still trusted them. RTL's own HTTPS calls use Node's bundled roots and were never affected. The runner stage now runs apk upgrade, so every build takes Alpine's current fixes regardless of when the base tag was last rebuilt. Reported by Nicolas Dorier (@NicolasDorier).

Dependencies

• Dependency update batch (#1784): npm audit goes from 17 findings (1 high in production scope) to 0 in both scopes. The production fix is body-parser 2.4.0 (GHSA-27r3-jxmh-p828, mishandled trailing bytes after a compressed request body; reachable before authentication). The rest is build tooling: Angular CLI 20.3.41 (brings @modelcontextprotocol/sdk 1.32.1; supersedes #1783), uuid 11.1.1 under sockjs via a scoped override, and transitive patches to launch-editor, fast-uri, serialize-javascript, undici, vite and webpack. The Dependabot PRs filed on 2026-10-25 (#1786 to #1790) are all covered by this batch and close once the release reaches master.
• The Angular framework stays on 20.3.34. Angular 22 (#1732) is a migration and stays open.

Verification

Verified at the branch tip (72b52098):

• npm run lint clean; 381/381 backend tests; 358/358 frontend Karma specs (0 skipped); frontend/ and backend/ rebuild byte-identical to the committed copies; PR CI green on Node 22 and 24 for every PR in the cycle including the "Build output matches source" check
• A Docker image built from the tip runs Node 22.23.4 on Alpine 3.24.3 with ca-certificates-bundle-20261020-r0; inside it, wget to an affected eMudhra test host fails certificate verification while a control host succeeds
• That image against the docker regtest fixture: 119/119 API checks across LND, Core Lightning and Eclair, including real routed payments; all three cookies observed with Path=/rtl; the BTCPay single-sign-on harness passes 16/16 assertions
• npm audit and npm audit --omit=dev: 0 vulnerabilities

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature:

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.16

$ git verify-tag v0.15.16
gpg: Signature made Mon Oct 26 12:47:07 2026 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "RTL Security <security@ridethelightning.info>" [ultimate]

Install RTL via npm ci

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags