# Release Notes — 0.15.10 This document collects the changes that go into the 0.15.10 release. Each PR merged for this release should add its entry under the appropriate section below. ## Bug Fixes - **Auth: harden login request validation** ([#1654](https://github.com/Ride-The-Lightning/RTL/pull/1654)). Tightens server-side validation of authentication requests and adds regression coverage (`test/backend/authenticate.test.mjs`). Users who have two-factor authentication enabled are encouraged to update promptly. - **Config & logging: reduce exposure of authentication secrets** ([#1659](https://github.com/Ride-The-Lightning/RTL/pull/1659)). Tightens redaction of authentication material in node logs and configuration API responses, pins deployment-level authentication settings server-side, contains backup file downloads to the node's backup directory, and hardens the settings persistence path. Adds regression coverage (`test/backend/common.test.mjs`). Users are encouraged to update promptly. - **Eclair: stop logging the node's auth header at DEBUG level** ([#1664](https://github.com/Ride-The-Lightning/RTL/pull/1664)). `getChannels` in the Eclair channels controller logged its entire request options object, which for Eclair carries HTTP basic auth — so raising an Eclair node's `logLevel` to `DEBUG` wrote `authorization: Basic ` into the node log, a recoverable form of the configured `lnApiPassword`. The log now carries only the request url and form, matching every other DEBUG log in the controllers. Present since 0.12.0 and only reachable by opting in to `DEBUG` (the default level is `ERROR`), but it contradicted the logging guarantee stated for #1659. Regression coverage added (`test/backend/eclair-channels.test.mjs`). Found by auditing node logs at `DEBUG` while verifying this release against the regtest fixture. ## Code Health - **Bound remaining unbounded LND alias-resolution fan-outs** ([#1651](https://github.com/Ride-The-Lightning/RTL/pull/1651), fixes [#1630](https://github.com/Ride-The-Lightning/RTL/issues/1630)). Mirrors the `runWithConcurrencyLimit(tasks, 20, done)` pattern introduced in #1629 across the remaining unbounded `Promise.all(map(...))` alias-resolution fan-outs in the LND graph and channels controllers, preventing a large node from firing one alias-lookup request per peer, channel, or hop all at once. During review, a related race condition was found and fixed: the module-level `options` variable in these controllers was reassigned per-request, but `getAliasForChannel` and `getAliasFromPubkey` read it by closure rather than receiving it as a parameter. Once alias-resolution tasks were deferred across event-loop turns by the concurrency limiter, a concurrent request to a different node could overwrite `options` mid-fan-out, causing a task to send with the wrong node's credentials or URL. Both functions now accept an explicit `requestOptions` parameter, and each handler captures a per-request copy before building the task thunks. The catch blocks inside the concurrency-limit callbacks were also updated to log raw exceptions directly instead of routing them through `handleError` (which expects an HTTP-error-shaped value), matching the existing pattern used by `closeChannel`. - **Batch dependency update resolving the open Dependabot security PRs** ([#1653](https://github.com/Ride-The-Lightning/RTL/pull/1653)). Dependabot had three open security PRs against `master` (#1648, #1649, #1650). Rather than merging them piecemeal (they conflict with each other on `package-lock.json` and target the wrong branch for the release flow), the fixes were applied in one pass on the release branch. The only production exposure was `axios`, carrying ten advisories at 1.16.0 — prototype pollution in request-option merging, `formDataToJSON` recursion DoS, `maxBodyLength` bypasses on fetch/HTTP2 uploads, and a `NO_PROXY` bypass — now on 1.18.1 (a patch above Dependabot's validated 1.18.0, which was superseded during the batch). The lockfile was regenerated from scratch rather than incrementally patched, and the flagged transitive deps were moved to their fixed in-range versions (`fast-uri` 3.1.4, plus `form-data`, `qs`, `tough-cookie`, `tar`, `del` and `globby`). The dev toolchain took safe patch/minor bumps: `nodemon` 3.1.14, `eslint` 9.39.5, and `@typescript-eslint/*` 8.65.0. The unused `protractor` devDependency was also dropped. It had been dead since the Angular scaffold that introduced it — no `e2e/` directory, no `protractor.conf.js`, and no `e2e` target in `angular.json`, leaving a single line in `package.json` as its only reference — while dragging in 100 packages and the deprecated `request` stack. Removing it clears both remaining critical advisories (`request`, `form-data`) along with fourteen others (`adm-zip`, `selenium-webdriver`, `webdriver-manager`, `xml2js`, `tmp`, `rimraf` and the rest of the webdriver chain). `npm audit`: **50 vulnerabilities (2 critical, 37 high, 10 moderate, 1 low) → 29 (0 critical, 23 high, 6 moderate)**, and **production dependencies are now clean at 0** (from 1 high). Everything still flagged is dev-only build tooling that cannot be fixed by a version bump: the Angular CLI chain (`@hono/node-server` and `@modelcontextprotocol/sdk` need Angular 21, i.e. `@angular/core` ^21 and TypeScript ≥5.9 — a framework migration, not a bump; #1650 is left for that work), the `@angular-eslint` line, and the karma/jasmine stack. None of it ships in the released bundle. - **Angular framework patch update to 20.3.27** ([#1661](https://github.com/Ride-The-Lightning/RTL/pull/1661)). Dependabot opened one PR per package against `master` for `@angular/core` (#1658), `@angular/compiler` (#1657) and `@angular/common` (#1655). The framework packages are pinned to exact versions and their peer ranges require them to move as a set, so the three were applied as a single batch on the release branch, taking all nine 20.3.26 packages (`animations`, `common`, `compiler`, `compiler-cli`, `core`, `forms`, `platform-browser`, `platform-browser-dynamic`, `router`) to 20.3.27. Upstream fixes only, no advisories: the compiler now disallows `i18n` event attributes and limits its possible-event-handler check to property names longer than two characters, `HttpClient` distinguishes repeated transfer-cache params, and `platform-server` picks up a newer `domino`. This stays inside Angular 20 — the build toolchain (`@angular/build`, `@angular/cli` 20.3.32) and `@angular/cdk`/`@angular/material` (20.2.14) are already at the top of their v20 lines, so nothing in this batch pulls in the Angular 21 migration still tracked by #1650. `frontend/` was rebuilt for the new framework code.