Skip to content

multi: update btcd to v0.26.2 - #11029

Open
Roasbeef wants to merge 2 commits into
lightningnetwork:masterfrom
Roasbeef:btcd-v0.26.2
Open

multi: update btcd to v0.26.2#11029
Roasbeef wants to merge 2 commits into
lightningnetwork:masterfrom
Roasbeef:btcd-v0.26.2

Conversation

@Roasbeef

@Roasbeef Roasbeef commented Aug 5, 2026

Copy link
Copy Markdown
Member

In this PR, we update the btcd dependency from v0.26.0 to v0.26.2. The v2 submodule migration landed already in #10913, so this is a patch-level bump on top of that work: btcutil/v2 v2.0.1, wire/v2 v2.0.1, and v2transport v1.1.0 come along with the root module.

No API changes in the release, so the bump is a straight go.mod/go.sum update across the root module and the submodules that pin btcd (kvdb, healthcheck, tor, tlv, tools). The psbt + address strictness fixes on btcd master don't have tagged submodule releases yet, so they aren't part of this bump.

In this commit, we update the btcd dependency from v0.26.0 to v0.26.2,
along with the tagged v2 submodule releases that ship with it:
btcutil/v2 v2.0.1, wire/v2 v2.0.1, and v2transport v1.1.0.

The release is mostly hardening of the parsing + decoding paths:
btcutil.NewTxFromBytes and btcutil.NewBlockFromBytes now reject trailing
bytes, DecodeWIF rejects out-of-range private keys, and
wire.ReadV2MessageN rejects trailing payload data. The v2transport bump
restores responder handshake progress for the v2 noise transport, and
the rpcclient gains a DisableAuth option for cookie-less setups. No API
changes, so the bump is a straight go.mod/go.sum update with no code
changes needed on our side.
@github-actions github-actions Bot added the severity-medium Focused review required label Aug 5, 2026
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

🟡 PR Severity: MEDIUM

gh pr view | 13 files | 116 lines changed

🟡 Medium (10 files)
  • go.mod - root dependency version bumps
  • go.sum - root dependency lockfile update
  • healthcheck/go.mod - module dependency bump (uncategorized submodule)
  • healthcheck/go.sum - module dependency lockfile update
  • kvdb/go.mod - kvdb submodule dependency bump
  • kvdb/go.sum - kvdb submodule lockfile update
  • tlv/go.mod - tlv submodule dependency bump
  • tlv/go.sum - tlv submodule lockfile update
  • tor/go.mod - tor submodule dependency bump
  • tor/go.sum - tor submodule lockfile update
🟢 Low (3 files)
  • docs/release-notes/release-notes-0.22.0.md - release notes update
  • tools/go.mod - tools submodule dependency bump
  • tools/go.sum - tools submodule lockfile update

Analysis

This PR is a routine dependency-bump across the repo's Go submodules (root, healthcheck, kvdb, tlv, tor, tools), plus a release notes entry. No source files in any critical or high-severity package (lnwallet, htlcswitch, contractcourt, sweep, peer, keychain, channeldb, funding, lnwire, routing, invoices, etc.) are touched, and only go.mod/go.sum/go.sum lockfiles plus a docs file changed. File count (13) and line count (116) are both well under the bump thresholds. No distinct critical packages are involved. Severity is set to MEDIUM based on the highest-tier files touched (kvdb, tlv, tor, and uncategorized root/healthcheck go.mod changes). Worth a quick check that the dependency version bumps don't pull in breaking changes, but no expert-level review is required.


To override, add a severity-override-{critical,high,medium,low} label.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

severity-medium Focused review required

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant