Merge pull request #4721 from TheBlueMatt/2026-06-0.1-backports-3

Cut 0.1.10/invoice 0.33.3/types+possiblyrand+dns-resolver 0.2.1

Author: TheBlueMatt

CHANGELOG.md

@@ -49,9 +49,27 @@
  * Several spurious debug assertions were fixed (#4537, #4618).
 
 ## Security
-0.1.10 fixes a sanitization issue.
+0.1.10 fixes a sanitization issue and several denial-of-service vulnerabilities.
+ * `Bolt11Invoice::recover_payee_pub_key` no longer panics if called on an
+   invoice which set an explicit public key, rather than relying on public key
+   recovery. This method is called from `payment_parameters_from_invoice` and
+   `payment_parameters_from_variable_amount_invoice` (#4717).
+ * Maliciously-crafted unpayable invoices which have overflowing feerates will
+   no longer cause an `unwrap` failure panic (#4716).
+ * `possiblyrandom` did not properly generate random data except when it was
+   explicitly configured to. By default this means LDK is vulnerable to various
+   HashDoS attacks (#4719).
+ * `OMNameResolver` will no longer panic when looking up payment instructions
+   which include unicode characters at the start of a TXT record (#4718).
  * `PrintableString` did not properly sanitize unicode format characters,
    allowing an attacker to corrupt the rendering of logs or UI (#4593, #4605).
+ * RGS data is now limited in how large of a graph it is able to cause a client
+   to store in memory. Note that RGS data is still considered a DoS vector in
+   general and you should only use semi-trusted RGS data (#4713).
+ * Counterparty-provided strings in failure messages are no longer logged in
+   full, reducing the ability of such a counterparty to spam our logs (#4714).
+ * Reading a corrupted `ChannelManager` or `ProbabilisticScorer` can no longer
+   cause us to allocate large amounts of memory (#4712).
 
 Thanks to Project Loupe for reporting most of the issues fixed in this release.
 

lightning-custom-message/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lightning-custom-message"
-version = "0.1.0"
+version = "0.1.10"
 authors = ["Jeffrey Czyz"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lightningdevkit/rust-lightning"

lightning-dns-resolver/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lightning-dns-resolver"
-version = "0.2.0"
+version = "0.2.1"
 authors = ["Matt Corallo"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lightningdevkit/rust-lightning/"

lightning-invoice/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "lightning-invoice"
 description = "Data structures to parse and serialize BOLT11 lightning invoices"
-version = "0.33.2"
+version = "0.33.3"
 authors = ["Sebastian Geisler <sgeisler@wh2.tu-dresden.de>"]
 documentation = "https://docs.rs/lightning-invoice/"
 license = "MIT OR Apache-2.0"

lightning-persister/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lightning-persister"
-version = "0.1.0"
+version = "0.1.10"
 authors = ["Valentine Wallace", "Matt Corallo"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lightningdevkit/rust-lightning"

lightning-rapid-gossip-sync/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lightning-rapid-gossip-sync"
-version = "0.1.0"
+version = "0.1.10"
 authors = ["Arik Sosman <git@arik.io>"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lightningdevkit/rust-lightning"

lightning-transaction-sync/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lightning-transaction-sync"
-version = "0.1.9"
+version = "0.1.10"
 authors = ["Elias Rohrer"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lightningdevkit/rust-lightning"

lightning-types/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lightning-types"
-version = "0.2.0"
+version = "0.2.1"
 authors = ["Matt Corallo"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lightningdevkit/rust-lightning/"

lightning/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lightning"
-version = "0.1.8"
+version = "0.1.10"
 authors = ["Matt Corallo"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lightningdevkit/rust-lightning/"

possiblyrandom/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "possiblyrandom"
-version = "0.2.0"
+version = "0.2.1"
 authors = ["Matt Corallo"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lightningdevkit/rust-lightning/"