lightninglabs/pool v0.7.3-beta

pool v0.7.3-beta

on GitHub

This release ships a security mitigation for the MPTCP listener path, a connection-ownership fix for Lightning Terminal embedders, a Taproot fee-estimation fix, and clears all open Dependabot security advisories.

Bug Fixes

• Connection ownership for embedded/LiT operation (#528). Stopping the pool trader no longer closes the shared lnd connection owned by the parent process. The server now tracks whether it created the connection itself and only closes owned connections.

• Disable MPTCP listeners by default (#530). Restores plain TCP for poold and removes the demonstrated CVE-2026-98432 exploit prerequisite on vulnerable Linux kernels. Existing binaries can apply the same mitigation immediately by starting poold with GODEBUG=multipathtcp=0 and restarting. A patched kernel is still required to fix the underlying kernel vulnerability.

• ListLeases chain fee estimation (#532, closes #431). The estimate now uses the account version at the time of the executed batch rather than always assuming P2WSH, so estimates are correct for Taproot accounts, including accounts auto-upgraded from P2WSH to P2TR within a batch.

Security

• gRPC → v1.85.0, x/net → v0.62.0, klauspost/compress → v1.18.7, moby/sys/user → v0.4.1, opencontainers/runc → v1.3.6, OpenTelemetry → v1.45.0 (#531). Clears all open Dependabot advisories across the root, auctioneerrpc, and poolrpc modules, including the critical gRPC :path authorization-bypass advisories.

Breaking Changes

• btcd v2 modules migration (from v0.7.0-beta): source builds require Go 1.26.8+, and L402 token payments require lnd v0.19.0-beta+.

Platform Notes

• linux-s390x is not included in this release. The legacy github.com/aead/chacha20 assembly fails to compile for that target with current Go toolchains. Affected users can build from source with a patched dependency or request a follow-up release.
• windows-arm is no longer a supported Go target; windows-arm64 is provided instead.

Verifying the Release

Each archive's SHA-256 hash is listed in manifest-v0.7.3-beta.txt. After downloading an archive and the manifest, verify with:

shasum -a 256 <archive-file>

and compare the output against the corresponding line in the manifest.

Building from Source

To build only your platform from the tagged source:

make release sys=<OS-ARCH> tag=v0.7.3-beta

Or install directly:

GO111MODULE=on go install github.com/lightninglabs/pool/cmd/poold@v0.7.3-beta
GO111MODULE=on go install github.com/lightninglabs/pool/cmd/pool@v0.7.3-beta

Full Changelog: v0.7.2-beta...v0.7.3-beta