RTL/release-notes/Release-notes-0.15.10.md

# Release Notes — 0.15.10

This document collects the changes that go into the 0.15.10 release. Each PR merged for
this release should add its entry under the appropriate section below.

## Bug Fixes

- **Auth: harden login request validation**
  ([#1654](https://github.com/Ride-The-Lightning/RTL/pull/1654)).
  Tightens server-side validation of authentication requests and adds regression coverage
  (`test/backend/authenticate.test.mjs`). Users who have two-factor authentication enabled
  are encouraged to update promptly.

- **Config & logging: reduce exposure of authentication secrets**
  ([#1659](https://github.com/Ride-The-Lightning/RTL/pull/1659)).
  Tightens redaction of authentication material in node logs and configuration API
  responses, pins deployment-level authentication settings server-side, contains backup
  file downloads to the node's backup directory, and hardens the settings persistence
  path. Adds regression coverage (`test/backend/common.test.mjs`). Users are encouraged
  to update promptly.

- **Eclair: stop logging the node's auth header at DEBUG level**
  ([#1664](https://github.com/Ride-The-Lightning/RTL/pull/1664)).
  `getChannels` in the Eclair channels controller logged its entire request options object,
  which for Eclair carries HTTP basic auth — so raising an Eclair node's `logLevel` to
  `DEBUG` wrote `authorization: Basic <base64>` into the node log, a recoverable form of the
  configured `lnApiPassword`. The log now carries only the request url and form, matching
  every other DEBUG log in the controllers. Present since 0.12.0 and only reachable by
  opting in to `DEBUG` (the default level is `ERROR`), but it contradicted the logging
  guarantee stated for #1659. Regression coverage added
  (`test/backend/eclair-channels.test.mjs`). Found by auditing node logs at `DEBUG` while
  verifying this release against the regtest fixture.

## Code Health

- **Bound remaining unbounded LND alias-resolution fan-outs**
  ([#1651](https://github.com/Ride-The-Lightning/RTL/pull/1651), fixes
  [#1630](https://github.com/Ride-The-Lightning/RTL/issues/1630)).
  Mirrors the `runWithConcurrencyLimit(tasks, 20, done)` pattern introduced in #1629
  across the remaining unbounded `Promise.all(map(...))` alias-resolution fan-outs in
  the LND graph and channels controllers, preventing a large node from firing one
  alias-lookup request per peer, channel, or hop all at once.

  During review, a related race condition was found and fixed: the module-level
  `options` variable in these controllers was reassigned per-request, but
  `getAliasForChannel` and `getAliasFromPubkey` read it by closure rather than
  receiving it as a parameter. Once alias-resolution tasks were deferred across
  event-loop turns by the concurrency limiter, a concurrent request to a different
  node could overwrite `options` mid-fan-out, causing a task to send with the wrong
  node's credentials or URL. Both functions now accept an explicit `requestOptions`
  parameter, and each handler captures a per-request copy before building the task
  thunks. The catch blocks inside the concurrency-limit callbacks were also updated
  to log raw exceptions directly instead of routing them through `handleError`
  (which expects an HTTP-error-shaped value), matching the existing pattern used
  by `closeChannel`.

- **Batch dependency update resolving the open Dependabot security PRs**
  ([#1653](https://github.com/Ride-The-Lightning/RTL/pull/1653)).
  Dependabot had three open security PRs against `master` (#1648, #1649, #1650). Rather than
  merging them piecemeal (they conflict with each other on `package-lock.json` and target the
  wrong branch for the release flow), the fixes were applied in one pass on the release branch.
  The only production exposure was `axios`, carrying ten advisories at 1.16.0 — prototype
  pollution in request-option merging, `formDataToJSON` recursion DoS, `maxBodyLength` bypasses
  on fetch/HTTP2 uploads, and a `NO_PROXY` bypass — now on 1.18.1 (a patch above Dependabot's
  validated 1.18.0, which was superseded during the batch). The lockfile was regenerated from
  scratch rather than incrementally patched, and the flagged transitive deps were moved to their
  fixed in-range versions (`fast-uri` 3.1.4, plus `form-data`, `qs`, `tough-cookie`, `tar`,
  `del` and `globby`). The dev toolchain took safe patch/minor bumps: `nodemon` 3.1.14,
  `eslint` 9.39.5, and `@typescript-eslint/*` 8.65.0.

  The unused `protractor` devDependency was also dropped. It had been dead since the Angular
  scaffold that introduced it — no `e2e/` directory, no `protractor.conf.js`, and no `e2e`
  target in `angular.json`, leaving a single line in `package.json` as its only reference —
  while dragging in 100 packages and the deprecated `request` stack. Removing it clears both
  remaining critical advisories (`request`, `form-data`) along with fourteen others
  (`adm-zip`, `selenium-webdriver`, `webdriver-manager`, `xml2js`, `tmp`, `rimraf` and the
  rest of the webdriver chain).

  `npm audit`: **50 vulnerabilities (2 critical, 37 high, 10 moderate, 1 low) → 29
  (0 critical, 23 high, 6 moderate)**, and **production dependencies are now clean at 0**
  (from 1 high). Everything still flagged is dev-only build tooling that cannot be fixed by a
  version bump: the Angular CLI chain (`@hono/node-server` and `@modelcontextprotocol/sdk`
  need Angular 21, i.e. `@angular/core` ^21 and TypeScript ≥5.9 — a framework migration, not a
  bump; #1650 is left for that work), the `@angular-eslint` line, and the karma/jasmine stack.
  None of it ships in the released bundle.

- **Angular framework patch update to 20.3.27**
  ([#1661](https://github.com/Ride-The-Lightning/RTL/pull/1661)).
  Dependabot opened one PR per package against `master` for `@angular/core` (#1658),
  `@angular/compiler` (#1657) and `@angular/common` (#1655). The framework packages are
  pinned to exact versions and their peer ranges require them to move as a set, so the three
  were applied as a single batch on the release branch, taking all nine 20.3.26 packages
  (`animations`, `common`, `compiler`, `compiler-cli`, `core`, `forms`, `platform-browser`,
  `platform-browser-dynamic`, `router`) to 20.3.27. Upstream fixes only, no advisories:
  the compiler now disallows `i18n` event attributes and limits its possible-event-handler
  check to property names longer than two characters, `HttpClient` distinguishes repeated
  transfer-cache params, and `platform-server` picks up a newer `domino`.

  This stays inside Angular 20 — the build toolchain (`@angular/build`, `@angular/cli`
  20.3.32) and `@angular/cdk`/`@angular/material` (20.2.14) are already at the top of their
  v20 lines, so nothing in this batch pulls in the Angular 21 migration still tracked by
  #1650. `frontend/` was rebuilt for the new framework code.