What the developer wrote
Authored by Erick Cestari
docs: add release-notes
What changed, and why it matters
This commit only edits the release notes document for version 0.21.0. It describes a previously merged fix that makes certain data-parsing routines stricter about record sizes, and it adds a contributor name. The commit itself changes no program code, so it cannot directly introduce or fix a security issue.
No action is required for this documentation commit. If reviewing the underlying change, examine pull request #10249 and the actual TLV decoder code changes to assess whether the length-validation fix is complete and correctly backported.
Security signals we found
Release notes mention a prior fix for malformed TLV record length validation
No code changes in this commit
Evidence from the diff
The diff is a documentation-only update to docs/release-notes/release-notes-0.21.0.md. It adds two bullet points referencing pull request #10249: one under a bug-fix section noting that several fixed-size TLV decoders now reject malformed records with incorrect lengths, and one under Testing noting that unit tests were added for TLV length validation. It also adds ‘Erick Cestari’ to the contributor list. No source code, build scripts, tests, or configuration files are modified.
Changed components
docs/release-notes/release-notes-0.21.0.mdInspect captured patch +12 / −0
diff --git a/docs/release-notes/release-notes-0.21.0.md b/docs/release-notes/release-notes-0.21.0.md
index 30b7263..4e032a3 100644
--- a/docs/release-notes/release-notes-0.21.0.md
+++ b/docs/release-notes/release-notes-0.21.0.md
@@ -39,6 +39,12 @@
has been removed from the public key parsing methods, and proper mutex
protection has been added to the cache access in `DisconnectBlockAtHeight`.
+- [Fixed TLV decoders to reject malformed records with incorrect lengths](https://github.com/lightningnetwork/lnd/pull/10249).
+ TLV decoders now strictly enforce fixed-length requirements for Fee (8 bytes),
+ Musig2Nonce (66 bytes), ShortChannelID (8 bytes), Vertex (33 bytes), and
+ DBytes33 (33 bytes) records, preventing malformed TLV data from being
+ accepted.
+
# New Features
- Basic Support for [onion messaging forwarding](https://github.com/lightningnetwork/lnd/pull/9868)
@@ -108,6 +114,11 @@
## Testing
+* [Added unit tests for TLV length validation across multiple packages](https://github.com/lightningnetwork/lnd/pull/10249).
+ New tests ensure that fixed-size TLV decoders reject malformed records with
+ invalid lengths, including roundtrip tests for Fee, Musig2Nonce,
+ ShortChannelID and Vertex records.
+
## Database
* Freeze the [graph SQL migration
@@ -122,6 +133,7 @@
* Boris Nagaev
* Elle Mouton
+* Erick Cestari
* Mohamed Awnallah
* Nishant Bansal
* Pins
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.