Public commit record
53/100 · Thin
What the developer wrote
Authored by Bastien Teinturier
Eclair v0.14.1 release (#3338)
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
What changed, and why it matters
This commit is the packaging of Eclair v0.14.1. It mostly changes version numbers and release notes, plus two operational tweaks: it turns off Maven's trusted-checksum post-processor and removes a startup guard that previously refused to run. The release notes describe the release as a routine patch with bug fixes and performance improvements, but also mention a Bolt12 fee-discount feature that was disabled because it could put nodes 'at risk' if used with custom plugins. No CVE or independent security report is referenced in the materials.
Recommended action
Treat this as a routine release commit, but verify the actual security-relevant code changes in the referenced prior commits (especially #3332, #3323, #3324, #3328, #3331, #3337). Users running custom Bolt12 offer-handler plugins should review the feeOverride_opt warning and upgrade. Build engineers should confirm that disabling the Maven trusted-checksum post-processor is intentional and does not weaken supply-chain verification in their environment.
Security signals we found
01
Release notes explicitly warn that custom Bolt12 offer-handler plugins setting feeOverride_opt put the node 'at risk' (#3332).
02
Startup safety guard removed: Boot.scala no longer requires eclair.allow-unsafe-startup=true to run.
03
Maven trusted-checksum post-processor disabled (Daether.artifactResolver.postProcessor.trustedChecksums=false).
04
Version downgrade from 0.15.0-SNAPSHOT to 0.14.1, consistent with a patch release.
Evidence from the diff
The diff is a release-tagging commit. It renames the vnext release notes to v0.14.1, bumps all Maven module versions from 0.15.0-SNAPSHOT to 0.14.1, disables the Aether trusted-checksum post-processor in .mvn/maven.config, and removes a hard startup abort in Boot.scala that required ‘eclair.allow-unsafe-startup=true’. The release notes list several prior commits, including one (#3332) that disables a Bolt12 blinded-path fee discount and warns that custom offer-handler plugins setting feeOverride_opt could put a node ‘at risk’. The commit itself does not contain the actual code fixes; it only documents and tags the release.
Changed components
Eclair v0.14.1 release packaging and versioningMaven build configuration (.mvn/maven.config)Eclair node startup logic (Boot.scala)Bolt12 payment handling / blinded path fee discount (documented only, fixed in prior commit #3332)Inspect captured patch +85 / −86
diff --git a/.mvn/maven.config b/.mvn/maven.config
index acf5164..e92391e 100644
--- a/.mvn/maven.config
+++ b/.mvn/maven.config
@@ -2,7 +2,7 @@
-Daether.trustedChecksumsSource.summaryFile=true
-Daether.trustedChecksumsSource.summaryFile.basedir=${session.rootDirectory}/.mvn/checksums/
# post processor: trusted checksums
--Daether.artifactResolver.postProcessor.trustedChecksums=true
+-Daether.artifactResolver.postProcessor.trustedChecksums=false
-Daether.artifactResolver.postProcessor.trustedChecksums.checksumAlgorithms=SHA-256
-Daether.artifactResolver.postProcessor.trustedChecksums.failIfMissing=true
-Daether.artifactResolver.postProcessor.trustedChecksums.snapshots=false
diff --git a/docs/release-notes/eclair-v0.14.1.md b/docs/release-notes/eclair-v0.14.1.md
new file mode 100644
index 0000000..8f95d79
--- /dev/null
+++ b/docs/release-notes/eclair-v0.14.1.md
@@ -0,0 +1,79 @@
+# Eclair v0.14.1
+
+This is a patch release that contains several bug fixes and performance improvements.
+It also updates the minimal version of Bitcoin Core and our bitcoin library.
+
+## Major changes
+
+### Update minimal version of Bitcoin Core
+
+With this release, eclair requires using Bitcoin Core 31.x.
+Newer versions of Bitcoin Core may be used, but have not been extensively tested.
+
+### Disable blinded path fee discount for Bolt12
+
+We've disabled blinded path fee discount introduced in #2993 for Bolt12 payments.
+It doesn't work well with MPP and need to be re-designed.
+If you're using a custom offer-handler plugin, make sure you don't set `feeOverride_opt`
+in the `InvoiceRequestActor.Route` you create, otherwise your node will be at risk.
+
+See #3332 for more details.
+
+## Verifying signatures
+
+You will need `gpg` and our release signing key E04E48E72C205463. Note that you can get it:
+
+- from our website: https://acinq.co/pgp/drouinf2.asc
+- from github user @sstone, a committer on eclair: https://api.github.com/users/sstone/gpg_keys
+
+To import our signing key:
+
+```sh
+$ gpg --import drouinf2.asc
+```
+
+To verify the release file checksums and signatures:
+
+```sh
+$ gpg -d SHA256SUMS.asc > SHA256SUMS.stripped
+$ sha256sum -c SHA256SUMS.stripped
+```
+
+## Building
+
+Eclair builds are deterministic. To reproduce our builds, please use the following environment (*):
+
+- Ubuntu 24.04.1
+- Adoptium OpenJDK 21.0.6
+
+Then use the following command to generate the eclair-node packages:
+
+```sh
+./mvnw clean install -DskipTests
+```
+
+That should generate `eclair-node/target/eclair-node-<version>-XXXXXXX-bin.zip` with sha256 checksums that match the one we provide and sign in `SHA256SUMS.asc`
+
+(*) You may be able to build the exact same artefacts with other operating systems or versions of JDK 21, we have not tried everything.
+
+## Upgrading
+
+This release is fully compatible with previous eclair versions. You don't need to close your channels, just stop eclair, upgrade and restart.
+
+## Changelog
+
+- [2dda794](https://github.com/ACINQ/eclair/commit/2dda79468a8b69a2acf7962cdac63245f7cc3ee8) Back to dev (#3313)
+- [7fb62fc](https://github.com/ACINQ/eclair/commit/7fb62fc58799857bceb3997b4f461ec7c3911762) Send `splice_locked` if necessary while reconnecting (#3318)
+- [cfe47a8](https://github.com/ACINQ/eclair/commit/cfe47a8c3c48cb43a45903b6f6709747fffb48e0) Remove deprecated `bip125 replaceable` field in mempool transaction class (#3319)
+- [4b9ba01](https://github.com/ACINQ/eclair/commit/4b9ba01058b677428cb67ebb6c4894a03550d53d) Refactor attribution data (#3320)
+- [743dcdd](https://github.com/ACINQ/eclair/commit/743dcdd1a8fbbe3d11fa80946b3cd731920f6988) Use bitcoin-lib 0.48 (#3316)
+- [7fb9460](https://github.com/ACINQ/eclair/commit/7fb9460183490260537c2e80c0ce4f1af144ea90) Reject incoming HTLCs with a high `cltv_expiry` (#3323)
+- [9b0bcec](https://github.com/ACINQ/eclair/commit/9b0bcec4b1d946b6b1b8c8ba2ae8cf24803bc40e) Reject `temporary_channel_id` duplicates early (#3324)
+- [cbafa93](https://github.com/ACINQ/eclair/commit/cbafa93a38ef2e729d9f86fad2a1d6e79ae6a430) Update Bitcoin Core to v31.1 (#3327)
+- [823341e](https://github.com/ACINQ/eclair/commit/823341e6e3d603be90a57343f79a726f65ab342f) Ignore repeated invalid `tx_signatures` (#3328)
+- [7951924](https://github.com/ACINQ/eclair/commit/79519244952d321a0579768baf5d15297d29a400) Accept Bolt12 invoices with reply path (#3325)
+- [3eebbe9](https://github.com/ACINQ/eclair/commit/3eebbe96188f93170b6015fd3abaa9c8c4bf5d42) Don't store duplicate settlement messages (#3336)
+- [e4e1a19](https://github.com/ACINQ/eclair/commit/e4e1a19d913279b3cdea1feefee1ec8372735172) Reject `start_batch` with size <= 1 (#3333)
+- [687485f](https://github.com/ACINQ/eclair/commit/687485fc3ef8d98c2c08b67190fb1f17c95bb2cf) Apply RBF limits to remote closing transactions (#3331)
+- [45ea9fb](https://github.com/ACINQ/eclair/commit/45ea9fbfb707d11c69508ab4cb072c1cbe5502cc) Prevent `channel_id` collisions (#3337)
+- [3397b1a](https://github.com/ACINQ/eclair/commit/3397b1a642690f52f5ab6591ca9d6e19783b4c04) Disable Bolt12 recipient path fee discount (#3332)
diff --git a/docs/release-notes/eclair-vnext.md b/docs/release-notes/eclair-vnext.md
deleted file mode 100644
index 3153d56..0000000
--- a/docs/release-notes/eclair-vnext.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# Eclair vnext
-
-<insert here a high-level description of the release>
-
-## Major changes
-
-### Update minimal version of Bitcoin Core
-
-With this release, eclair requires using Bitcoin Core 31.x.
-Newer versions of Bitcoin Core may be used, but have not been extensively tested.
-
-### Disable blinded path fee discount for Bolt12
-
-We've disabled blinded path fee discount introduced in #2993 for Bolt12 payments.
-It doesn't work well with MPP and need to be re-designed.
-If you're using a custom offer-handler plugin, make sure you don't set `feeOverride_opt`
-in the `InvoiceRequestActor.Route` you create, otherwise your node will be at risk.
-
-See #3332 for more details.
-
-### Configuration changes
-
-<insert changes>
-
-### API changes
-
-<insert changes>
-
-### Miscellaneous improvements and bug fixes
-
-<insert changes>
-
-## Verifying signatures
-
-You will need `gpg` and our release signing key E04E48E72C205463. Note that you can get it:
-
-- from our website: https://acinq.co/pgp/drouinf2.asc
-- from github user @sstone, a committer on eclair: https://api.github.com/users/sstone/gpg_keys
-
-To import our signing key:
-
-```sh
-$ gpg --import drouinf2.asc
-```
-
-To verify the release file checksums and signatures:
-
-```sh
-$ gpg -d SHA256SUMS.asc > SHA256SUMS.stripped
-$ sha256sum -c SHA256SUMS.stripped
-```
-
-## Building
-
-Eclair builds are deterministic. To reproduce our builds, please use the following environment (*):
-
-- Ubuntu 24.04.1
-- Adoptium OpenJDK 21.0.6
-
-Then use the following command to generate the eclair-node packages:
-
-```sh
-./mvnw clean install -DskipTests
-```
-
-That should generate `eclair-node/target/eclair-node-<version>-XXXXXXX-bin.zip` with sha256 checksums that match the one we provide and sign in `SHA256SUMS.asc`
-
-(*) You may be able to build the exact same artefacts with other operating systems or versions of JDK 21, we have not tried everything.
-
-## Upgrading
-
-This release is fully compatible with previous eclair versions. You don't need to close your channels, just stop eclair, upgrade and restart.
-
-## Changelog
-
-<fill this section when publishing the release with `git log v0.14.0... --format=oneline --reverse`>
diff --git a/eclair-core/pom.xml b/eclair-core/pom.xml
index 8108813..aea82bd 100644
--- a/eclair-core/pom.xml
+++ b/eclair-core/pom.xml
@@ -21,7 +21,7 @@
<parent>
<groupId>fr.acinq.eclair</groupId>
<artifactId>eclair_2.13</artifactId>
- <version>0.15.0-SNAPSHOT</version>
+ <version>0.14.1</version>
</parent>
<artifactId>eclair-core_2.13</artifactId>
diff --git a/eclair-front/pom.xml b/eclair-front/pom.xml
index 57dc724..104870b 100644
--- a/eclair-front/pom.xml
+++ b/eclair-front/pom.xml
@@ -21,7 +21,7 @@
<parent>
<groupId>fr.acinq.eclair</groupId>
<artifactId>eclair_2.13</artifactId>
- <version>0.15.0-SNAPSHOT</version>
+ <version>0.14.1</version>
</parent>
<artifactId>eclair-front_2.13</artifactId>
diff --git a/eclair-fuzz/pom.xml b/eclair-fuzz/pom.xml
index 42042f9..402a772 100644
--- a/eclair-fuzz/pom.xml
+++ b/eclair-fuzz/pom.xml
@@ -5,7 +5,7 @@
<parent>
<groupId>fr.acinq.eclair</groupId>
<artifactId>eclair_2.13</artifactId>
- <version>0.15.0-SNAPSHOT</version>
+ <version>0.14.1</version>
</parent>
<artifactId>eclair-fuzz_2.13</artifactId>
diff --git a/eclair-node/pom.xml b/eclair-node/pom.xml
index 2d16440..d2f4b56 100644
--- a/eclair-node/pom.xml
+++ b/eclair-node/pom.xml
@@ -21,7 +21,7 @@
<parent>
<groupId>fr.acinq.eclair</groupId>
<artifactId>eclair_2.13</artifactId>
- <version>0.15.0-SNAPSHOT</version>
+ <version>0.14.1</version>
</parent>
<artifactId>eclair-node_2.13</artifactId>
diff --git a/eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala b/eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala
index 1d6c4ec..7e29046 100644
--- a/eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala
+++ b/eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala
@@ -33,10 +33,6 @@ import scala.util.{Failure, Success}
*/
object Boot extends App with Logging {
try {
- if (!System.getProperty("eclair.allow-unsafe-startup", "false").toBooleanOption.contains(true)) {
- throw new RuntimeException("This version of eclair is unsafe to use: please wait for the next official release to update your node.")
- }
-
val datadir = new File(System.getProperty("eclair.datadir", System.getProperty("user.home") + "/.eclair"))
val config = NodeParams.loadConfiguration(datadir)
diff --git a/pom.xml b/pom.xml
index 4ee8291..3c44bb8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,7 +20,7 @@
<groupId>fr.acinq.eclair</groupId>
<artifactId>eclair_2.13</artifactId>
- <version>0.15.0-SNAPSHOT</version>
+ <version>0.14.1</version>
<packaging>pom</packaging>
<modules>
Risk score
Our methodology →Why this scored 45/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.