Repository navigation
Release 26.09 - #168
Merged
Merged
Release 26.09#168
Conversation
And update cln-application version
Tokens use per-session identifier and an explicit 24h lifetime
Use LIGHTNING_WS_CA_CERT_FILE to validate the certificate chain of the WebSocket connection
csurf is archived. Use csrf-csrf's signed double-submit cookie instead
Replace the hand-written Content-Security-Policy middleware with helmet.
Also documented in the README.
APP_TLS_KEY_FILE and APP_TLS_CERT_FILE let the backend serve TLS itself. without them it keeps listening on plain HTTP and expects a reverse proxy. APP_PROTOCOL still only describes the scheme the browser sees.
lnmessage picks up globalThis.WebSocket when one exists, and Node 22 provides one that cannot complete Core Lightning's upgrade handshake and ignores the CA-pinned client. The ws implementation is now installed as the global unconditionally, pinned for wss and plain for ws. Commando calls also wait for an in-progress connection attempt to settle and start a fresh one after lnmessage has given up, returning an error instead of waiting forever when the node stays unreachable.
- Reference actions by commit SHA - Declare read-only permissions - A new security workflow audits runtime dependencies and secrets
…a wrong password Fixes #165
Add comment to set the initial password straight away
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.