[ovitrif]

Closes #1294

Twin: synonymdev/bitkit-android#1876

Updates bitkit-core to 0.8.0-rc15, which updates LDK's lightning crate to 0.2.8 and lightning-invoice to 0.34.2 (synonymdev/bitkit-core#207).

Description

• Bumps bitkit-core from 0.8.0-rc14 to 0.8.0-rc15, a dependency-update release with no API changes.
• The upgraded crates are used only by bitkit-core's Boltz swap module (boltz-client), so the new code runs in submarine and reverse swaps: create, claim and refund. Invoice decoding (decode) still uses bitkit-core's lightning-invoice 0.32, unchanged.
• No changelog fragment: the only parsing change rejects a BOLT11 invoice of 18,446,745 BTC or more without an SI prefix, which no real swap uses, so users see no change.
• v3.1.0 ships bitkit-core 0.8.0-rc11, so taking this into a 3.1.x patch also brings the rc12–rc14 changes: BIP21 and fee-rate fixes, trezor-connect-rs 10.0.1, the wake client, the Paykit router with its swaps route, and regtest auth.

Design

N/A — no UI changes.

Preview

N/A

QA Notes

Journeys

N/A — no user-visible behaviour change.

Manual Tests

N/A

Automated Checks

• xcodebuild -resolvePackageDependencies resolves bitkit-core 0.8.0-rc15 from a clean package directory, binary target included.
• CI build, unit and E2E checks run on this head.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T18:52:18.673679Z	bb74a97	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates bitkit-core from 0.8.0-rc14 to 0.8.0-rc15.

• The wallet app now uses bitkit-core 0.8.0-rc15.

_{Reviews (1) · Last reviewed commit: "chore: add changelog fragment" · Reviewed by Greptile}

[talosmachina]

No findings. Bumps bitkit-core from 0.8.0-rc14 to 0.8.0-rc15 (LDK lightning 0.2.8, lightning-invoice 0.34.2) and adds a changelog fragment. Reviewed 2505d98, full tier (dependency manifest), static: iOS does not build on this reviewer's Linux host, so the build and tests are CI's.

What I checked

Pin: project.pbxproj moves the exactVersion requirement to 0.8.0-rc15; Package.resolved pins revision 045c7ff68529d9ffb8135de3b27916447f64b0c4, which is what tag v0.8.0-rc15 in synonymdev/bitkit-core dereferences to.
Binary target: Package.swift at that tag declares checksum ea644021...ceb9ee05; the BitkitCore.xcframework.zip release asset downloaded from the tag hashes to the same value, so SPM resolution will not fail on a checksum mismatch.
Upstream delta rc14..rc15: two commits, version strings in Cargo.toml/Package.swift/gradle, Cargo.lock and the lightning/lightning-invoice bump. No public API or binding source changed, consistent with the body's "no API changes".
Other pins: no other reference to an rc14 version in the app sources or workflows.
CI at review time: SwiftFormat, validate, detect-changes green. build-local and Run Tests still pending. One Run Integration Tests run was cancelled at "Start local regtest" (The operation was canceled), with a second run on the same branch started seconds earlier; that reads as a concurrency cancel, not a failure of the change.

Merge confidence: 4/5, no findings, but the dependency change has no finished build or test run on this head yet.

[pwltr]

Reviewed 2505d98.

No consequential correctness finding was established by the static General and scoped cross-project reviews of the BitkitCore rc15 dependency update.

Review details

General review
Model: GPT-6.1 Sol
Reasoning effort: high

Cross-project review
Model: GPT-6.1 Sol
Reasoning effort: high

[ovitrif]

ef86224 rewords the changelog fragment to "Bitkit now rejects a Lightning invoice with an out-of-range amount instead of treating it as having no amount.", the one user-visible change in rc15, as @coreyphillips raised on the Android twin (synonymdev/bitkit-android#1876 (comment)). No code change.

[ovitrif]

7ccd2ad drops the changelog fragment: the app decodes invoices with bitkit-core's lightning-invoice 0.32, which rc15 leaves unchanged, so the release has no user-visible change (details on the Android twin: synonymdev/bitkit-android#1876). The PR is now only the pin.

[coreyphillips]

Two independent reviews, nothing blocking a merge.

nits

• Description's no-changelog reasoning skips the Boltz swap path. The description says no behaviour changes because invoice decoding still uses lightning-invoice 0.32. That is true for decode(invoice:), which goes through bitkit-core's scanner module. But the crates this release upgrades (lightning 0.2.8, lightning-invoice 0.34.2, lightning-types 0.3.5) are pulled in only by boltz-client. The app does reach that crate. Bitkit/Services/BoltzService.swift calls boltzCreateSubmarineSwap, boltzCreateReverseSwap, boltzClaimReverseSwap and boltzRefundSubmarineSwap. I confirmed the crate versions with strings on the rc15 libbitkitcore.a and with the rc15 Cargo.lock. The no-changelog call still holds. The only parsing change in rust-lightning 0.2.4 to 0.2.8 rejects BOLT11 invoices of 18,446,745 BTC or more that have no SI prefix (#5338), and no real swap is affected. Naming the swap path in the description would tell a tester where the new code actually runs.

[ovitrif]

Naming the swap path in the description would tell a tester where the new code actually runs.

@coreyphillips Done: the description now names the Boltz swap path (create, claim and refund) as where the new crates run, and keeps the no-changelog reason. The Android twin says the same.

[coreyphillips]

Rechecked after replies, with no new commit since 7ccd2ad. Nothing blocking remains.

addressed

• Description's no-changelog reasoning skips the Boltz swap path. Fixed: The live PR body (gh pr view 1295) now says the upgraded crates run only in boltz-client, during submarine and reverse swap create, claim and refund, and that decode stays on lightning-invoice 0.32. I checked this against the rc15 Cargo.lock. boltz-client 0.4.1 is the only dependent of lightning 0.2.8 and lightning-invoice 0.34.2. The 0.32.0 copy is still there. BoltzService.swift calls all four swap entry points.