request has been deprecated since 2020 with an unfixed SSRF advisory and
pins vulnerable copies of form-data (critical), qs, tough-cookie and
uuid - 8 of the 13 remaining production audit findings, none fixable by
version bumps (issue #1634, item 1).
All 36 backend files that imported request-promise now use a small
compatibility wrapper (server/utils/request.ts) backed by axios, which
is already a production dependency. The wrapper accepts the existing
options shape (qs, form - object or pre-encoded string, body,
baseUrl/uri, rejectUnauthorized, json), resolves with the response body
directly, and rejects with a plain object mirroring request-promise's
StatusCodeError/RequestError shape, so CommonService.handleError works
unchanged (ECONNREFUSED -> 503, Eclair StatusCodeError -> 500, nested
error body extraction). Auth headers are excluded from rejected errors
so they cannot leak into logs. Callers without json: true (block
explorer, currency rates) still get raw text bodies, and LND's
line-delimited /v2/router/send stream still surfaces as a string for
the existing parser.
Only behavioral code change: CLN verifyMessage used request-promise's
callback style and was ported to the same promise style as signMessage;
four Eclair handlers gained explicit returns to satisfy
noImplicitReturns once the import became typed.
Production npm audit drops from 13 findings (2 critical) to 6 low, all
in the crypto-browserify/elliptic chain tracked in #1634.
Verified against the docker regtest fixture with 43 API checks across
LND, Core Lightning and Eclair: reads, invoice creation, a routed LND
payment over the streaming endpoint, cross-implementation payments from
CLN and Eclair, message sign/verify, channel backup to disk, and
bad-invoice/node-unreachable error mapping. Lint and both production
builds are clean.
Follow-up to the second #1629 review:
- F4: the limiter invokes its done callback outside the surrounding .then/.catch,
so a throw in the response-send body became an unhandled rejection with no
response (a 500 -> hang regression, notably on LND postPeer where the inner
.catch was removed). Wrap each converted done body in try/catch that sends the
error response, guarded by res.headersSent.
- F5: CLN postPeer re-listed peers but never resolved their aliases, so a freshly
connected CLN peer came back with a raw node id (the frontend uses this response
directly). Resolve aliases through the same bounded limiter, matching LND postPeer.
- F6: make runWithConcurrencyLimit fire 'done' exactly once via a one-shot guard,
so multiple synchronous completions (e.g. non-function task elements) can't
double-send the response.
Follow-up to the #1501 review (PR #1629):
- F1: CLN getAlias now builds its request from selNode.authentication.options
instead of the shared module-level 'options'. That coupling meant a cold
Peers/route lookup dereferenced a null 'options'; with the new limiter
swallowing per-task throws, that returned 200 with every alias unset. Aliases
now resolve regardless of call order, with a truncated-id fallback if auth
options are somehow absent.
- F2: mirror the 20-way concurrency bound to LND peers (getPeers and postPeer),
which had the same unbounded Promise.all alias fan-out. Eclair resolves
aliases inline from a bulk nodes list, so it needs no change.
- F3: normalize runWithConcurrencyLimit's start count to at least 1 so a
non-positive limit can't leave 'done' unfired and hang the response.
RTL resolves peer aliases by calling listnodes once per peer. A prior fix
(1cec7b1) bounded this to 20 concurrent calls plus a cache for the channel
list, but the peers list and route lookup still used an unbounded Promise.all,
firing one request per peer at once. On nodes with many peers this overwhelms
clnrest and fails with 'Resource temporarily unavailable (os error 11)'
(EAGAIN), so aliases fall back to raw node IDs.
- peers.ts and network.ts getRoute now resolve aliases via
runWithConcurrencyLimit(tasks, 20, ...), matching the channel list.
- Harden runWithConcurrencyLimit to call done() immediately for an empty task
list; otherwise an empty peers/route set would never send a response.
- Give the alias cache a 6h TTL and a max size (evicting oldest) so aliases
refresh without an RTL restart and the cache can't grow unbounded.
Address review F7/F8 on #1625:
F7 (verification): the onchain.ts `connected === false` branch reads /v1/listfunds
(CLN's own connected field) and only buckets balance as inactive — it is not the
listPeerChannels mirror and does no close logic, so the coercion activates nothing
there. Reword the mirror comment, which inaccurately implied onchain.ts consumes it;
the mirror simply keeps the documented backward-compat `connected` field defined.
F8: hardcode the rune path in create-rune.sh to /root/.lightning/rtl.rune so it
matches the volume mount, healthcheck and RTL runePath instead of deriving it from
${LIGHTNINGD_DATA}, removing the silent-divergence risk.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Address review feedback on #1625: copy peer_connected onto the legacy
`connected` field as a real boolean (!!), so strict-equality readers such as
onchain.ts's `connected === false` behave correctly when peer_connected is
absent, instead of leaving `connected` undefined.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
CLN's listpeerchannels reports connection state as peer_connected, but the
open/pending channel list columns read the legacy `connected` field, which the
backend never populated. It was therefore always empty, so the list always
rendered "Disconnected" while the detail panel (which reads peer_connected)
showed the true state — the contradiction reported in #1606.
Normalize `connected = peer_connected` in the backend listPeerChannels response
so legacy consumers stay in sync, and point the list columns at peer_connected
directly. Add regression specs asserting the connected column follows
peer_connected even when the legacy field disagrees.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* rm .DS_Store
* Add watchfrontenddev command for npm
* Fix toggle issues in sidenav (pinning and on page refresh)
* Add copy-to-clipboard fallback if navigator.clipboard is not available (#1336)
* add copy-to-clipboard fallback if navigator.clipboard is not available
* amend copy fallback
* clipboard copy lint fixes and frontend build
* fix: add missing boltz state `transaction.lockupFailed` (#1349)
* fix: boltzd docs link (#1354)
* exit gracefully (#1356)
* allow for eclair updated relayed audit format (#1363)
* feat: add boltz service to cln (#1352)
* lint fix
* Request Params Cleanup
* cln: Boltz auto-send (#1366)
* Bug-fix (CLN Boltz): Hide claim tx id and routing fee for non-zero conf reverse swap
* cln: Boltz auto-send
- Added auto send option for Swap In
- Checking compatiblity with v2.0.0 and above
* Test import fixes
* Update help.component.ts (#1379)
Fixed broken link under "Help" -> "Node Settings"
* Backend config fix (#1382)
* Updating Common Application Configuration
* Fixed get RTL Conf
* Update Application Settings
* application and settings case change
* Unified config models
* Default node update
* 2FA and Password reset
* Final application settings update
* Config Settings and Authentication case fixed
* Node Setting Fix
* Fiat currency Symbol fix
* CLN: Fiat symbol fix
* All: Fiat symbol fix
* Update node settings
* Services UI fix
* CLN: Removed child node settings
* All: Removed child node settings
* Test fixes
* mempool links for onchain information (#1383)
* Tests fix
Tests fix
* UI for Block Explorer Configuration (#1385)
* Bump fee with mempool information (#1386)
* Mempool openchannel minfee (#1388)
Open channel model block if min fee is higher
* Show error on login screen if rune is incorrect and getinfo throws error (#1391)
* cln: Removed channel lookup call for update policy (#1392)
* ECL: On-chain Transactions, Invoice and Payments pagination (#1393)
Done most of the UI changes to accommodate pagination on transactions, payments and invoices tables but true pagination cannot be implemented till total number of records are missing from the API response.
Once the issue https://github.com/ACINQ/eclair/issues/2855 is fixed, I will uncomment pagination changes in the frontend.
* lnd: Onchain CPFP (#1394)
- UTXO label bug fix
- Warning on utxo label for "sweep" in text.
* Bug fixes after testing
* Testing bug fixes (#1401)
* Bug fix 2: lnd: Link channel point to explorer and show fee on close channel too
* lnd: explorer link on pending channels
* Node lookup link on view channel peer pubkey
* Testing bug fixes (#1402)
* Bug fix 2: lnd: Link channel point to explorer and show fee on close channel too
* lnd: explorer link on pending channels
* Node lookup link on view channel peer pubkey
* test fixes
* ng update to v18.0.x
* Updating install with --legacy-peer-deps
---------
Co-authored-by: Grzegorz Kućmierz <gkucmierz@gmail.com>
Co-authored-by: lacksfish <lacksfish@gmail.com>
Co-authored-by: jackstar12 <62219658+jackstar12@users.noreply.github.com>
Co-authored-by: Kilian <19181985+kilrau@users.noreply.github.com>
Co-authored-by: Taylor King <taylorbradleyking@gmail.com>
Co-authored-by: Fishcake <128653975+fishcakeday@users.noreply.github.com>
Co-authored-by: Ant <72945059+2140data@users.noreply.github.com>
