v13.2.3 Highlights:

• Bug fixes
• Security hardening

What's Changed

• build: make Xcode Cloud post-clone survive Intel runners by @kaloudis in #4677
• Verify LSP wrapped invoices against the invoice they wrap by @kaloudis in #4673
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4679
• locales: fix 17 broken localeString references, add en.json coverage test by @kaloudis in #4674
• fix(ui): swap the GIF loading indicator for the Lottie loader by @kaloudis in #4678
• fix(channels): require a host when connecting a peer by @kaloudis in #4644
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4681
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4682
• tests: scan all literal keys in localeString calls by @kaloudis in #4680
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4683
• tests: surface coverage summary in CI logs and PR comments by @kaloudis in #4676
• fix(security): bind LNURL-auth callback host to signing domain by @kaloudis in #4576
• build(ios): refresh Podfile.lock for react-native-get-random-values 2.0.0 by @kaloudis in #4691
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4690
• tests: cover StealthModeUtils, which had none by @kunalKumar-13 in #4685
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4692
• chore(deps): bump assert from 1.5.0 to 2.1.0 by @dependabot[bot] in #4607
• chore(deps): bump react-native-reanimated to 4.7.0 by @kaloudis in #4689
• fix: LSP and LSPS1 reset button visibility and Olympus detection by @shubhamkmr04 in #4664
• fix(lsps1): show empty state when no orders match the current node by @ajaysehwal in #4704
• fix(recovery): guard clearLegacyLocations behind DEV by @kunalKumar-13 in #4694
• stores: no node calls until a wallet is picked by @TheSeydiCharyyev in #4450
• fix: gate simple taproot reset on backend support by @shubhamkmr04 in #4705
• fix: keep preset amounts when fiat has no rate by @TheSeydiCharyyev in #4651
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4722
• fix(lsps): arm custom-message timeout per-request, not per-subscription by @ajaysehwal in #4702
• fix(nwc): point empty NWC budget at Cashu settings when Lightning balance is zero by @ajaysehwal in #4662
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4732
• chore(deps): bump metro to 0.84.6 to drop image-size by @kaloudis in #4734
• views: drop the latch before taking the fetch lock by @TheSeydiCharyyev in #4726
• build: stop tracking LDK Node jniLibs by @kaloudis in #4737
• Balance view: stop double counting unconfirmed on-chain funds by @kaloudis in #4515
• utils: stop accepting mainnet bech32 addresses on testnet by @kaloudis in #4721
• utils: accept uppercase Lightning Address domains by @kaloudis in #4731
• remove SATSCARD bounty by @kaloudis in #4767
• docs: ask first-time contributors to disclose AI assistance by @kaloudis in #4772
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4773
• utils: share one LUD-16 lnurlp URL builder by @kaloudis in #4762
• fix(nwc): don't crash NWC settings when settings have no ecash key by @kaloudis in #4763
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4777
• nostr: lowercase NIP-05 identifiers before lookup by @kaloudis in #4761
• SweepStore: use regtest and testnet params on regtest and signet by @kaloudis in #4758
• fix(balance): count a force close with an unconfirmed sweep once by @kunalKumar-13 in #4775
• chore(deps): bump @nostr-dev-kit/ndk to 3.0.3 by @kaloudis in #4701
• AddressUtils: validate destinations against the node's network in one place by @kaloudis in #4759
• handleAnything: drop wrong-network addresses from unified URIs by @kaloudis in #4760
• fix: harden the BIP 353 lookup (skip .onion, encode the query name) by @kaloudis in #4729
• fix(settings): don't crash when a stored blob is missing a settings group by @ajaysehwal in #4788
• fix: avoid spurious node refetch after unlocking by @myxmaster in #4423
• LnurlChannel: use the themed Switch component by @kaloudis in #4790
• [feat] chore(deps): bump react-native to 0.87.1 by @kaloudis in #4566
• build(deps): bump brace-expansion from 1.1.16 to 1.1.21 in /zeus_modules/@lightninglabs/lnc-core by @dependabot[bot] in #4795
• chore(deps): bump moment from 2.30.1 to 2.31.0 by @dependabot[bot] in #4794
• fix: pay BIP 353 offers from records with multiple params by @kaloudis in #4658
• chore(deps): bump brace-expansion and markdown-it to patched versions by @kaloudis in #4798
• chore(proto): regenerate bindings with protobufjs 8.8.0 by @kaloudis in #4799
• [Transifex] Updates for project ZEUS by @transifex-integration[bot] in #4801
• chore(deps): bump minor and patch dependencies from #4796 by @kaloudis in #4800
• Avoid keyboard-inserted spaces in URL and host inputs by @myxmaster in #4793
• chore(deps): bump react-native-nitro-tor from 0.6.0 to 0.6.1 in the minor-and-patch group across 1 directory by @dependabot[bot] in #4805
• chore(ios): update Podfile.lock for react-native-nitro-tor 0.6.1 by @kaloudis in #4808
• Handle LightningAddressStore promise rejections by @kaloudis in #4485
• fix(bolt12): show the actual payment outcome after LDK direct pay by @kaloudis in #4307

Full Changelog: v13.2.2...v13.2.3-alpha1

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keys.openpgp.org --recv-keys 96C225207F2137E278C31CF7AAC48DE8AB8DEE84

Once you have his PGP key you can verify the release (assuming manifest-v13.2.3-alpha1.txt and manifest-v13.2.3-alpha1.txt.sig are in the current directory) with:

gpg --verify manifest-v13.2.3-alpha1.txt.sig manifest-v13.2.3-alpha1.txt

You should see the following if the verification was successful:

gpg: Signature made Fri Oct  2 10:18:39 2026 EDT
gpg:                using RSA key 96C225207F2137E278C31CF7AAC48DE8AB8DEE84
gpg:                issuer "zeusln@tutanota.com"
gpg: Good signature from "Zeus LN <zeusln@tutanota.com>"
gpg:                 aka "ZEUS Support <support@zeusln.com>"

That will verify the signature on the main manifest page which ensures integrity and authenticity of the binaries you've downloaded locally. Next, depending on your operating system you should then re-calculate the sha256 sum of the binary, and compare that with the following hashes:

cat manifest-v13.2.3-alpha1.txt

One can use the shasum -a 256 <file name here> tool in order to re-compute the sha256 hash of the target binary for your operating system. The produced hash should be compared with the hashes listed above and they should match exactly.

Android fingerprint

Users verifying the release on an Android device can check against the key fingerprint below using AppVerifier. This fingerprint can also be found on our website here.

SHA1: 32:06:3C:97:96:38:0D:99:EE:4A:CB:B8:1E:2A:6F:27:FD:66:8E:C1
  SHA256: 2A:F8:E2:0A:C9:44:57:67:CB:D4:4E:D8:4D:BB:FC:33:C6:C9:82:48:89:7C:4F:84:3C:42:C2:76:5C:4A:D3:BA
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

External links

ZEUS documentation
PGP Key

Apple TestFlight