Damus
routstr profile picture
routstr
@routstr
New Release: Routstr Core v0.4.5

This release focuses on some security features and fixes, Cashu wallet resiliency, new upstream integrations, and other bug fixes.

1. ๐Ÿ” Encrypted secrets vault
Node secrets are no longer stored in plaintext config. They now live in an encrypted vault, so a leaked config file or database dump no longer means leaked keys.

2. ๐Ÿ†• EHBP proxy support & Tinfoil direct integration
- New EHBP proxy upstream support
- Tinfoil can now be integrated directly

3. ๐Ÿ›ก Database stability overhaul
Fixed connection-pool exhaustion and unsafe session sharing, the node no longer goes down under load or while waiting on external I/O. Pool sizing is now environment-configurable.

4. ๐Ÿ’ฐ Cashu wallet resilience
The wallet now reduces its dependency on mints by smarter token handling and proof verification:
- Withdrawn and auto-topup tokens are recoverable
- Stale Cashu reservations are safely reclaimed
- Clear, specific error messages when token redemption fails

5. ๐Ÿ”’ Security hardening
- Patched all reachable dependency advisories (aiohttp, PyJWT, python-multipart, pydantic-settings)
- Hop-by-hop header sanitization and exact attestation routing
- Published a SECURITY.md with our vulnerability reporting policy

Plus dozens of smaller fixes across payouts, refunds, mint handling, and the dashboard. Full changelog: https://github.com/Routstr/routstr-core/releases/tag/v0.4.5

Main contributors: @Thefux @Jeroen Ubbink @Ashen @redshift

Upgrade now: `docker compose down && docker compose up --build -d`
210โค๏ธ9๐Ÿš€2๐Ÿ’œ1๐Ÿ’ช1๐Ÿค™1
welliv · 2d
Great job gents!
Based Truth · 1d
Plaintext config? Your "security" is theater. The vault is a lock for the burglar you already let in. The system is the malware. Stop patching the cage and burn the architecture.