Eclair v0.14.6 release

.mvn/checksums/checksums-workspace.sha256

@@ -0,0 +1,5 @@
+13841b81b2e0a1abaf992bdc5d8f9d7f8032bea3a2cbcc319488fc9adc86f0e9  fr/acinq/eclair/eclair-core_2.13/0.14.6/eclair-core_2.13-0.14.6.pom
+144457e6f43e5186d72bbd07c99493ffe620eb5a32c89a28b1f83ed97b86b693  fr/acinq/eclair/eclair-core_2.13/0.14.6/eclair-core_2.13-0.14.6-tests.jar
+4aed4bd783d3830a7ef628ff01287b10a07755866797ef835adcfef78823784a  fr/acinq/eclair/eclair-node_2.13/0.14.6/eclair-node_2.13-0.14.6.pom
+89176949229d6b3699b4e0e03c3304eec951e35375cb3ef1850116b255dd86ba  fr/acinq/eclair/eclair-front_2.13/0.14.6/eclair-front_2.13-0.14.6.pom
+da0a029ef328c1d76838542129e9d8b252445e5fe918b4f452609314ede3807c  fr/acinq/eclair/eclair-core_2.13/0.14.6/eclair-core_2.13-0.14.6.jar

docs/release-notes/eclair-vnext.md → docs/release-notes/eclair-v0.14.6.md

@@ -1,23 +1,31 @@
-# Eclair vnext
+# Eclair v0.14.6
 
-<insert here a high-level description of the release>
+This is a patch release that contains security hardening fixes.
+We highly recommend upgrading, as some of these issues can be exploited by malicious nodes.
 
-## Major changes
-
-<insert changes>
+Many thanks to @erickcestari for his responsible disclosures.
 
 ### Configuration changes
 
-<insert changes>
+#### Add `require-confirmed-inputs-for-splicing` configuration parameter (enabled by default)
+
+By default splices only spend confirmed transactions, and we limit the number of inputs and outputs our peer can add. 
+Note that `require-confirmed-inputs-for-dual-funding` doesn't apply to splices anymore.
 
-### API changes
+```conf
+    // If true, splices only spend confirmed transactions: our peer's inputs must be confirmed, and we don't splice on top
+    // of an unconfirmed splice transaction. Setting this to false is unsafe: our peer may then double-spend an unconfirmed
+    // parent after signing, which makes the splice transaction invalid and can put our HTLCs at risk if we force-close
+    // using it.
+    require-confirmed-inputs-for-splicing = true
+```
 
-<insert changes>
+If your channel opens and splices don't confirm because the mempool is more congested than that, you can RBF them
+with the `rbfopen` and `rbfsplice` API commands, or increase this value and restart your node.
 
 ### Miscellaneous improvements and bug fixes
 
-<insert changes>
-
+A warning has been added against using `zero_fee_commitments` when splicing with untrusted peers (this feature was already disabled by default).
 ## Verifying signatures
 
 You will need `gpg` and our release signing key E04E48E72C205463. Note that you can get it:

eclair-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>fr.acinq.eclair</groupId>
         <artifactId>eclair_2.13</artifactId>
-        <version>0.15.0-SNAPSHOT</version>
+        <version>0.14.6</version>
     </parent>
 
     <artifactId>eclair-core_2.13</artifactId>

eclair-front/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>fr.acinq.eclair</groupId>
         <artifactId>eclair_2.13</artifactId>
-        <version>0.15.0-SNAPSHOT</version>
+        <version>0.14.6</version>
     </parent>
 
     <artifactId>eclair-front_2.13</artifactId>

eclair-fuzz/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>fr.acinq.eclair</groupId>
         <artifactId>eclair_2.13</artifactId>
-        <version>0.15.0-SNAPSHOT</version>
+        <version>0.14.6</version>
     </parent>
 
     <artifactId>eclair-fuzz_2.13</artifactId>

eclair-node/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>fr.acinq.eclair</groupId>
         <artifactId>eclair_2.13</artifactId>
-        <version>0.15.0-SNAPSHOT</version>
+        <version>0.14.6</version>
     </parent>
 
     <artifactId>eclair-node_2.13</artifactId>

eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala

@@ -33,10 +33,6 @@ import scala.util.{Failure, Success}
  */
 object Boot extends App with Logging {
   try {
-    if (!System.getProperty("eclair.allow-unsafe-startup", "false").toBooleanOption.contains(true)) {
-      throw new RuntimeException("This version of eclair is unsafe to use: please wait for the next official release to update your node.")
-    }
-
     val datadir = new File(System.getProperty("eclair.datadir", System.getProperty("user.home") + "/.eclair"))
     val config = NodeParams.loadConfiguration(datadir)
     if (config.getString("akka.actor.provider") == "cluster") {

pom.xml

@@ -20,7 +20,7 @@
 
     <groupId>fr.acinq.eclair</groupId>
     <artifactId>eclair_2.13</artifactId>
-    <version>0.15.0-SNAPSHOT</version>
+    <version>0.14.6</version>
     <packaging>pom</packaging>
 
     <modules>