Merge remote-tracking branch 'upstream/Release-0.15.10' into fix/bound-lnd-alias-fanout-1630

CLAUDE.md

@@ -0,0 +1,106 @@
+# RTL — notes for AI coding agents
+
+RTL (Ride The Lightning) is a device-agnostic web UI for Lightning node operations:
+an Angular single-page frontend plus a Node/Express backend, both TypeScript.
+
+`CONTRIBUTING.md` is the process document — how to install, run the dev servers, package a
+build, open a PR, add a library, and handle Dependabot. **Read it first.** This file covers
+only the things that are easy to get wrong and aren't obvious from the tree.
+
+## Source vs. generated — read this before editing anything
+
+| Directory   | What it is                        | Edit it? |
+|-------------|-----------------------------------|----------|
+| `src/`      | Angular frontend source           | yes      |
+| `server/`   | Express backend source            | yes      |
+| `frontend/` | Built AOT bundle, **committed**   | never by hand |
+| `backend/`  | Compiled `server/` output, **committed** | never by hand |
+
+`frontend/` and `backend/` look like ignorable build artifacts, but they are tracked in git
+and are expected to stay in sync with the sources. So a code change is a two-step edit:
+change `src/`/`server/`, then rebuild and commit the regenerated output in the same PR.
+
+```bash
+npm run buildbackend     # tsc: server/ -> backend/
+npm run buildfrontend    # ng build --configuration production: src/ -> frontend/
+```
+
+`backend/` is a plain `tsc` transpile of `server/`, so it changes only when `server/` does —
+a dependency bump alone won't move it. `frontend/` is a bundle, so it also carries the app
+version and any bundled dependency.
+
+## The three-implementation pattern
+
+RTL supports three Lightning implementations, and the layout mirrors that everywhere:
+
+```
+src/app/{lnd,cln,eclair,shared}/
+server/controllers/{lnd,cln,eclair,shared}/
+server/routes/{lnd,cln,eclair,shared}/
+```
+
+A feature or fix usually touches the matching folder in **each layer** for the
+implementations it affects; genuinely cross-cutting logic belongs in `shared/`. When fixing a
+bug in one implementation, check whether the same shape exists in the other two — they
+frequently do, since the controllers were written in parallel.
+
+## Commands, and where they bite
+
+- **Install with `npm ci --legacy-peer-deps`**, not `npm install`. Plain `npm ci` fails on an
+  `ERESOLVE` conflict from `@fortawesome/angular-fontawesome`.
+- **`npm run server` only works on Windows** — it sets `NODE_ENV` with `set X=Y&&` syntax. On
+  macOS/Linux use `npm run serverUbuntu`.
+- **`npm run lint` and `npm run test` must both be green before a PR.**
+- If lint reports hundreds of template "Parsing error" failures, look for a stale
+  **`coverage/`** directory (git-ignored Karma output). The template linter walks its HTML
+  report. Delete it and re-run.
+- The repo README is at **`.github/README.md`** — there is none at the root.
+
+## Branches and releases
+
+- **PRs target the current `Release-x.y.z` branch, not `master`.** Because release branches
+  merge into `master` by *rebase*, a `Fixes #N` reference never auto-closes its issue (GitHub
+  only does that for the default branch) — close it manually after the merge.
+- **Every PR adds its own release-note entry**, in the same PR as the change:
+  `release-notes/Release-notes-<x.y.z>.md`, under `## Bug Fixes`, `## Enhancements`,
+  `## Code Health` or `## Developer Tooling`. Create the file if it doesn't exist yet.
+  Link the PR and any issue, and state the root cause briefly. Because the PR number isn't
+  known until the PR exists, commit the entry with `#TBD` and follow up with a
+  `Fill in PR number in release note (#N)` commit.
+
+### If a release ships while your PR is open
+
+The rebase-merge rewrites every commit of the release branch to a new hash, and the next
+release branch is cut from `master` — so a branch based on the old release branch shares no
+recent ancestor with the new one. Retargeting it makes the merge base collapse to before the
+release cycle, and GitHub replays the entire cycle into your PR: hundreds of files, and a
+`CONFLICTING` state. Replay just your own commits instead:
+
+```bash
+git rebase --onto Release-<new> Release-<old> <your-branch>
+```
+
+Then confirm `git diff Release-<old>..<old-head>` is identical to
+`git diff Release-<new>..<new-head>` before force-pushing. Retargeting *before* the release
+branch is merged avoids the problem entirely.
+
+## Testing against real nodes
+
+`docker/` is a self-contained regtest fixture — bitcoind, three LND nodes, Core Lightning and
+Eclair, wired to RTL — for end-to-end testing across all three implementations. See
+`docker/README.md`, or the `rtl-docker-fixture` skill in `.claude/skills/`. It is dev-only;
+every credential in it is throwaway.
+
+Backend code has no unit-test harness; `npm run test` runs the frontend Karma/Jasmine specs.
+For backend changes, verify against the fixture and say so in the PR.
+
+## Conventions
+
+- **Be conservative about dependencies.** This is security-sensitive software. Prefer what's
+  already there, and raise an issue before adding anything. Never run `npm audit fix` — it
+  reaches for breaking major bumps. Dependabot PRs are batched, not merged individually; see
+  `CONTRIBUTING.md`.
+- Match the surrounding code's style, naming and structure. Only fix style in code you're
+  already changing.
+- `RTL-Config.json` is local runtime config and git-ignored; `Sample-RTL-Config.json` is the
+  template, and `RTL.conf` is an alternate config format.

package.json

@@ -26,7 +26,7 @@
     "@swimlane/ngx-charts": "23.1.0",
     "angular-user-idle": "4.0.0",
     "atob": "2.1.2",
-    "axios": "1.16.0",
+    "axios": "1.18.1",
     "buffer": "6.0.3",
     "cookie-parser": "1.4.7",
     "csrf-csrf": "4.0.3",
@@ -76,10 +76,10 @@
     "@ngrx/store-devtools": "21.0.1",
     "@types/jasmine": "5.1.15",
     "@types/node": "20.19.30",
-    "@typescript-eslint/eslint-plugin": "8.53.0",
-    "@typescript-eslint/parser": "8.53.0",
+    "@typescript-eslint/eslint-plugin": "8.65.0",
+    "@typescript-eslint/parser": "8.65.0",
     "dotenv": "17.2.3",
-    "eslint": "9.39.2",
+    "eslint": "9.39.5",
     "eslint-plugin-deprecation": "3.0.0",
     "jasmine-core": "5.13.0",
     "jasmine-spec-reporter": "7.0.0",
@@ -89,8 +89,7 @@
     "karma-jasmine": "5.1.0",
     "karma-jasmine-html-reporter": "2.1.0",
     "material-icons": "1.13.14",
-    "nodemon": "3.1.11",
-    "protractor": "7.0.0",
+    "nodemon": "3.1.14",
     "roboto-fontface": "0.10.0",
     "ts-node": "10.9.2",
     "typescript": "5.8.3"

release-notes/Release-notes-0.15.10.md

@@ -25,3 +25,33 @@ this release should add its entry under the appropriate section below.
   to log raw exceptions directly instead of routing them through `handleError`
   (which expects an HTTP-error-shaped value), matching the existing pattern used
   by `closeChannel`.
+
+- **Batch dependency update resolving the open Dependabot security PRs**
+  ([#1653](https://github.com/Ride-The-Lightning/RTL/pull/1653)).
+  Dependabot had three open security PRs against `master` (#1648, #1649, #1650). Rather than
+  merging them piecemeal (they conflict with each other on `package-lock.json` and target the
+  wrong branch for the release flow), the fixes were applied in one pass on the release branch.
+  The only production exposure was `axios`, carrying ten advisories at 1.16.0 — prototype
+  pollution in request-option merging, `formDataToJSON` recursion DoS, `maxBodyLength` bypasses
+  on fetch/HTTP2 uploads, and a `NO_PROXY` bypass — now on 1.18.1 (a patch above Dependabot's
+  validated 1.18.0, which was superseded during the batch). The lockfile was regenerated from
+  scratch rather than incrementally patched, and the flagged transitive deps were moved to their
+  fixed in-range versions (`fast-uri` 3.1.4, plus `form-data`, `qs`, `tough-cookie`, `tar`,
+  `del` and `globby`). The dev toolchain took safe patch/minor bumps: `nodemon` 3.1.14,
+  `eslint` 9.39.5, and `@typescript-eslint/*` 8.65.0.
+
+  The unused `protractor` devDependency was also dropped. It had been dead since the Angular
+  scaffold that introduced it — no `e2e/` directory, no `protractor.conf.js`, and no `e2e`
+  target in `angular.json`, leaving a single line in `package.json` as its only reference —
+  while dragging in 100 packages and the deprecated `request` stack. Removing it clears both
+  remaining critical advisories (`request`, `form-data`) along with fourteen others
+  (`adm-zip`, `selenium-webdriver`, `webdriver-manager`, `xml2js`, `tmp`, `rimraf` and the
+  rest of the webdriver chain).
+
+  `npm audit`: **50 vulnerabilities (2 critical, 37 high, 10 moderate, 1 low) → 29
+  (0 critical, 23 high, 6 moderate)**, and **production dependencies are now clean at 0**
+  (from 1 high). Everything still flagged is dev-only build tooling that cannot be fixed by a
+  version bump: the Angular CLI chain (`@hono/node-server` and `@modelcontextprotocol/sdk`
+  need Angular 21, i.e. `@angular/core` ^21 and TypeScript ≥5.9 — a framework migration, not a
+  bump; #1650 is left for that work), the `@angular-eslint` line, and the karma/jasmine stack.
+  None of it ships in the released bundle.