Release 26.09

.dockerignore

@@ -0,0 +1,21 @@
+# Build context for the Dockerfile: only sources are needed
+.git
+.github
+.claude
+.vscode
+node_modules
+apps/*/node_modules
+apps/frontend/build
+apps/backend/dist
+data
+release
+*.log
+.commando
+.commando-env
+.env
+env.sh
+env-local.sh
+docker-compose.yml
+Dockerfile
+README.md
+LICENSE

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/docs/Contributing.md

@@ -1,7 +1,7 @@
 Development Setup
 ------------------
 ### Prerequisites
-- Node.js (v14 or higher)
+- Node.js (v20.19 or higher, or v22.12 or higher)
 - npm
 - Running instances of bitcoind and core-lightning
 

.github/docs/Dashboard.md

@@ -21,7 +21,9 @@ node's full state at a glance:
 - **Total Balance** — combined on-chain + Lightning funds.
 - The summary strip beside it shows **Active Channels**, connected **Peers**,
   and **Maximum Send / Maximum Receive** — the node's total outbound and
-  inbound Lightning capacity.
+  inbound Lightning capacity. In sats mode these two values are shown in full
+  up to 999,999 sats and in millions above that (for example `1.5M`, `74.89M`);
+  hover over a value to see its fiat equivalent.
 
 ## Bitcoin Wallet card
 

.github/workflows/build.yml

@@ -3,18 +3,21 @@ name: Build
 on:
   pull_request:
   workflow_dispatch:
-
+
+permissions:
+  contents: read
+
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 18.x
+          node-version: 22.x
 
       - name: Get version from package.json
         id: package-version
@@ -23,32 +26,18 @@ jobs:
           echo "Project Version: $VERSION"
 
       - name: Cache node_modules
-        uses: actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache-npm-packages
         with:
           path: node_modules
-          key: ${{ runner.OS }}-build-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-node22-${{ hashFiles('**/package-lock.json') }}
 
       - name: Install NPM dependencies
         if: steps.cache-npm-packages.outputs.cache-hit != 'true'
         run: npm clean-install
 
-      - name: Cache build frontend
-        uses: actions/cache@v3
-        id: cache-build-frontend
-        with:
-          path: apps/frontend
-          key: ${{ runner.os }}-frontend-${{ github.sha }}
-
       - name: Run build production application
         run: npm run frontend:build
 
-      - name: Cache build backend
-        uses: actions/cache@v3
-        id: cache-build-backend
-        with:
-          path: apps/backend
-          key: ${{ runner.os }}-backend-${{ github.sha }}
-
       - name: Run build backend server
         run: npm run backend:build

.github/workflows/lint.yml

@@ -4,33 +4,37 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   eslint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v3
-
-    - name: Use Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: 18.x
-
-    - name: Get version from package.json
-      id: package-version
-      run: |
-        echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV
-        echo "Project Version: $VERSION"
-
-    - name: Cache node_modules
-      uses: actions/cache@v3
-      id: cache-npm-packages
-      with:
-        path: node_modules
-        key: ${{ runner.OS }}-build-${{ hashFiles('**/package-lock.json') }}
-
-    - name: Install NPM dependencies
-      if: steps.cache-npm-packages.outputs.cache-hit != 'true'
-      run: npm clean-install
-
-    - name: Check lint errors
-      run: npm run lint
+      - name: Checkout source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.x
+
+      - name: Get version from package.json
+        id: package-version
+        run: |
+          echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV
+          echo "Project Version: $VERSION"
+
+      - name: Cache node_modules
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        id: cache-npm-packages
+        with:
+          path: node_modules
+          key: ${{ runner.os }}-node22-${{ hashFiles('**/package-lock.json') }}
+
+      - name: Install NPM dependencies
+        if: steps.cache-npm-packages.outputs.cache-hit != 'true'
+        run: npm clean-install
+
+      - name: Check lint errors
+        run: npm run lint

.github/workflows/release.yml

@@ -4,7 +4,11 @@ on:
   release:
     types: [released]
   workflow_dispatch:
-
+
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     name: Build image
@@ -15,19 +19,19 @@ jobs:
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
           echo "IMAGE_NAME=$(echo $GITHUB_REPOSITORY | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
-          
+
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout project
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.x
 
@@ -40,16 +44,17 @@ jobs:
           echo "Project Version: $VERSION"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
         id: qemu
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         id: buildx
 
       - name: Run Docker buildx
         run: |
           docker buildx build \
           --platform linux/amd64,linux/arm64,linux/arm/v7 \
           --tag ghcr.io/$IMAGE_NAME:$VERSION \
+          --provenance=true --sbom=true \
           --output "type=registry" .

.github/workflows/security.yml

@@ -0,0 +1,46 @@
+name: Security checks
+
+on:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Runtime dependency audit
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.x
+
+      - name: Audit runtime dependencies
+        run: npm audit --omit=dev --audit-level=high
+
+  secrets:
+    name: Secret scan
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Scan commits for secrets
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            RANGE="${{ github.event.pull_request.base.sha }}..${{ github.sha }}"
+          else
+            RANGE="HEAD~20..HEAD"
+          fi
+          docker run --rm -v "$PWD:/repo" -w /repo \
+            ghcr.io/gitleaks/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
+            git --log-opts="$RANGE" --redact --no-banner --verbose

.github/workflows/test.yml

@@ -3,18 +3,21 @@ name: Unit tests
 on:
   pull_request:
   workflow_dispatch:
-
+
+permissions:
+  contents: read
+
 jobs:
   test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 18.x
+          node-version: 22.x
 
       - name: Get version from package.json
         id: package-version
@@ -23,11 +26,11 @@ jobs:
           echo "Project Version: $VERSION"
 
       - name: Cache node_modules
-        uses: actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache-npm-packages
         with:
           path: node_modules
-          key: ${{ runner.OS }}-build-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-node22-${{ hashFiles('**/package-lock.json') }}
 
       - name: Install NPM dependencies
         if: steps.cache-npm-packages.outputs.cache-hit != 'true'
@@ -36,3 +39,5 @@ jobs:
       - name: Run frontend unit tests
         run: npm run frontend:test
 
+      - name: Run backend unit tests
+        run: npm run backend:test

.gitignore

@@ -1,3 +1,4 @@
+.claude
 .vscode
 node_modules
 data
@@ -8,3 +9,4 @@ release
 env-local.sh
 apps/frontend/build
 apps/backend/dist
+.env