cashubtc/cdk v0.18.1

on GitHub

0.18.1

Summary

Version 0.18.1 improves wallet signature validation and recovery, payment-backend reliability, and PostgreSQL TLS enforcement.
It also restores compatibility with existing mints using shorter legacy seeds, adds more detailed payment lifecycle logging, and restores the armeabi-v7a and x86 Android targets in binding releases.
Operators upgrading from v0.17 must still follow the v0.18 migration guide.

Added

• cdk/cdk-mintd: Structured payment lifecycle logs include quote and saga transitions, incoming payments, issuance totals, melt fee and change outcomes, and the age and idle time of incomplete melt sagas (#2509) ([thesimplekid]).

Changed

• workspace: Refreshed the stable and MSRV dependency lockfiles ([thesimplekid]).

Fixed

• cdk: Receive and restore responses validate signature counts, requested amounts and keysets, and supplied DLEQ proofs before storing spendable proofs, while preserving optional DLEQ support and zero-amount placeholders during seed restore (#2547) ([thesimplekid]/[asmo]).
• cdk: Swap, issuance, and receive recovery retain pending state until every expected output is restored. Empty, partial, duplicate, unknown, or mismatched responses no longer discard recovery state; optional melt change still supports partial recovery (#2548) ([thesimplekid]).
• cdk: Mint recovery limits backend payment-status checks to ten seconds and defers stalled operations without releasing reserved proofs ([thesimplekid]).
• cdk/cdk-cln/cdk-ldk-node: Sat-denominated BOLT11 and BOLT12 quote principals round up, payment totals round principal plus actual fees up once, and recovery preserves native-unit status checks. Paid responses with unexpected units retain recovery state instead of releasing input proofs (#2537) ([thesimplekid]).
• cdk-cln: Payment event streams reconnect with backoff after RPC failures and resume from the persisted payment index (#2514) ([thesimplekid]).
• cdk-ldk-node: Existing BOLT12 dispatch claims resolve through outgoing payment status, with amounts converted to the requested unit. Other claim errors propagate instead of reporting a terminal failure while a payment may still settle (#2529) ([thesimplekid]).
• cdk-ldk-node: Replayed paid BOLT12 payments round combined principal and fees up once when converting millisatoshis to satoshis, matching the initial payment path and avoiding excess change ([thesimplekid]).
• cdk-lnd: Already-expired invoices fail before payment dispatch, preventing melts from remaining pending when LND never creates a payment; existing paid or pending results are preserved (#2497) ([thesimplekid]).
• cdk-lnd: Replayed paid and pending BOLT11 payments return totals in the requested unit, rounding fractional satoshis up. Already-paid sat quotes no longer fail with UnitMismatch, including when the invoice has since expired ([thesimplekid]).
• cdk-bdk: Replayed outgoing payments return their durable paid or pending state before validation and fee estimation, including when no spendable UTXOs remain, and convert stored amounts to the requested unit (#2523) ([thesimplekid]).
• cdk-bdk: Bitcoin Core synchronization handles replacement blocks below the previous tip, retries staged wallet writes before reconciliation, and moves bounded block fetching and transaction broadcasting off async workers. Cancellation stops further block fetching (#2526) ([thesimplekid]).
• cdk-bdk: Esplora requests use a ten-second timeout, zero request concurrency is rejected, and chain backends skip missed polling ticks to avoid catch-up bursts after slow synchronization (#2527) ([thesimplekid]).
• cdk-axum: NUT-29 batch issuance and status routes reject oversized batches and duplicate quote IDs before per-quote database lookups; status requests also respect the configured issuance limit (#2536) ([thesimplekid]).
• cdk-sql-common: Keyset fees update in a consistent keyset-ID order to avoid deadlocks between concurrent completed operations (#2542) ([thesimplekid]).
• cdk-postgres/cdk-mintd: PostgreSQL TLS modes enforce the requested negotiation and certificate verification policy, preserve connection-string settings when no explicit mode is supplied, and reject invalid modes or connector errors. Primary and authentication database settings are validated without connecting (#2553) ([thesimplekid]).
• cdk-mintd: Startup compares effective PostgreSQL TLS policies, accepting equivalent stored and bootstrap settings while rejecting invalid modes and conflicting policies ([thesimplekid]).
• cdk-mintd: Malformed management RPC enablement and management RPC/signatory insecure-transport environment overrides resolve to false, including non-Unicode values, while preserving override precedence (#2553) ([thesimplekid]).
• cdk-mintd: Existing-mint imports, configuration validation and updates, and restarts accept nonempty legacy seeds shorter than 32 bytes. The minimum applies only to new mints using local signing material; remote signatories skip local seed-length checks (#2501) ([thesimplekid]/[asmo]).
• cdk-mintd: The logging subscriber honors the most verbose configured output, making configured TRACE logging available (#2509) ([thesimplekid]).
• bindings: Android releases again include armeabi-v7a and x86 native libraries alongside the 64-bit targets (Evan Kaloudis).
• bindings: FFI release recipes run workflows from the requested release tag, and release-tag checks use the upstream repository (#2494) ([thesimplekid]).