Ride-The-Lightning/RTL v0.15.17

Release v0.15.17-beta

on GitHub

0.15.17 fixes login problems: two that 0.15.16's cookie change exposed, and 2FA codes failing on a server whose clock drifts. The Docker image moves to Node 24 LTS. There are also two smaller improvements: labelling any LND on-chain transaction, and routing CSV exports with stable columns.

Full detail in release-notes/Release-notes-0.15.17.md.

Login

• Opening RTL at the site root no longer breaks login (#1799, issue #1794). Since 0.15.16 scoped RTL's cookies to /rtl, a page first loaded outside /rtl, such as host:3000/, could not read its CSRF token, so every login failed with "Invalid Csrf Token" until the page was reloaded under /rtl. Such requests now redirect to /rtl/.
• Logout clears the session and CSRF cookies (#1795, issue #1794). The logout deleted the session cookie on the wrong path, so the browser kept it.
• 2FA tolerates a server clock that is slightly off (#1806, issue #1337). Login accepted only the current 30-second code, so on a server without time sync valid codes eventually failed every time. It now accepts the codes either side of the current one, and the log suggests checking the server clock.

Docker image

• Node 24 LTS (#1798, issue #1797). The image moves from node:22-alpine to node:24-alpine, ahead of Node 22's end of life in April 2027. CI now also tests Node 26. The frontend bundle is unchanged, and bare-metal installs on Node 22 stay supported. The 32-bit ARM (linux/arm/v7) image stays on node:22-alpine, because node:24-alpine publishes no 32-bit ARM image.

Improvements

• LND: label any on-chain transaction (#1801, issue #1261) from the Transactions table, including received transactions whose outputs are already spent.
• Routing CSV exports keep the same columns in the same order (#1803, issue #1545) for LND, Core Lightning and Eclair, so exports from different months line up.

Dependencies

• follow-redirects 1.16.2 (#1800) clears npm audit for GHSA-mrwp-f3q8-3g9p. RTL was not exposed.

Verification

Verified at the branch tip (50e89484):

• npm run lint clean; 390/390 backend tests; 373/373 frontend Karma specs; frontend/ and backend/ rebuild byte-identical to the committed copies; npm audit --omit=dev: 0 vulnerabilities
• A Docker image built from the tip (Node 24.22.2) against the regtest fixture: 119/119 API checks across LND, Core Lightning and Eclair, and the BTCPay single-sign-on harness 16/16

Contributors:
@ShahanaFarooqui @saubyk

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature:

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.17

$ git verify-tag v0.15.17
gpg: Signature made Thu Nov  5 22:26:38 2026 MST
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "RTL Security <security@ridethelightning.info>" [ultimate]

Install RTL via npm ci

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags