chore(deps): bump lightning from 0.0.119 to 0.0.120

[dependabot]

Bumps lightning from 0.0.119 to 0.0.120.

Release notes

Sourced from lightning's releases.

v0.0.120 - Jan 17, 2024 - "Unblinded Fuzzers"

API Updates

• The PeerManager bound on UtxoLookup was removed entirely. This enables use of UtxoLookup in cases broken in 0.0.119 by #2773 (#2822).
• LDK now exposes and fully implements the route blinding feature (#2812).
• The lightning-transaction-sync crate no longer relies on system time without the time feature (#2799, #2817).
• lightning::onion_message's module layout has changed (#2821).
• Event::ChannelClosed now includes the channel_funding_txo (#2800).
• CandidateRouteHop variants were destructured into individual structs, hiding some fields which were not generally consumable (#2802).

Bug Fixes

• Fixed a rare issue where lightning-net-tokio may not fully flush its send buffer, leading to connection hangs (#2832).
• Fixed a panic which may occur when connecting to a peer if we opened a second channel with that peer while they were disconnected (#2808).
• Retries for a payment which previously failed in a blinded path will now always use an alternative blinded path (#2818).
• Feature's Eq and Hash implementation now ignore dummy bytes (#2808).
• Some missing DiscardFunding or ChannelClosed events are now generated in rare funding-related failures (#2809).
• Fixed a privacy issue in blinded path generation where the real cltv_expiry_delta would be exposed to senders (#2831).

Security

0.0.120 fixes a denial-of-service vulnerability which is reachable from untrusted input from peers if the UserConfig::manually_accept_inbound_channels option is enabled.

• A peer that sent an open_channel message with the channel_type field unfilled would trigger a reachable unwrap since LDK 0.0.117 (#2808).
• In protocols where a funding output is shared with our counterparty before it is given to LDK, a malicious peer could have caused a reachable panic by reusing the same funding info in (#2809).

In total, this release features 67 files changed, 3016 insertions, 2473 deletions in 79 commits from 9 authors, in alphabetical order:

• Elias Rohrer
• Jeffrey Czyz
• José A.P
• Matt Corallo
• Tibo-lg
• Valentine Wallace
• benthecarman
• optout
• shuoer86

Changelog

Sourced from lightning's changelog.

0.0.120 - Jan 17, 2024 - "Blinded Fuzzers"

API Updates

• The PeerManager bound on UtxoLookup was removed entirely. This enables use of UtxoLookup in cases broken in 0.0.119 by #2773 (#2822).
• LDK now exposes and fully implements the route blinding feature (#2812).
• The lightning-transaction-sync crate no longer relies on system time without the time feature (#2799, #2817).
• lightning::onion_message's module layout has changed (#2821).
• Event::ChannelClosed now includes the channel_funding_txo (#2800).
• CandidateRouteHop variants were destructured into individual structs, hiding some fields which were not generally consumable (#2802).

Bug Fixes

• Fixed a rare issue where lightning-net-tokio may not fully flush its send buffer, leading to connection hangs (#2832).
• Fixed a panic which may occur when connecting to a peer if we opened a second channel with that peer while they were disconnected (#2808).
• Retries for a payment which previously failed in a blinded path will now always use an alternative blinded path (#2818).
• Feature's Eq and Hash implementation now ignore dummy bytes (#2808).
• Some missing DiscardFunding or ChannelClosed events are now generated in rare funding-related failures (#2809).
• Fixed a privacy issue in blinded path generation where the real cltv_expiry_delta would be exposed to senders (#2831).

Security

0.0.120 fixes a denial-of-service vulnerability which is reachable from untrusted input from peers if the UserConfig::manually_accept_inbound_channels option is enabled.

• A peer that sent an open_channel message with the channel_type field unfilled would trigger a reachable unwrap since LDK 0.0.117 (#2808).
• In protocols where a funding output is shared with our counterparty before it is given to LDK, a malicious peer could have caused a reachable panic by reusing the same funding info in (#2809).

In total, this release features 67 files changed, 3016 insertions, 2473 deletions in 79 commits from 9 authors, in alphabetical order:

• Elias Rohrer
• Jeffrey Czyz
• José A.P
• Matt Corallo
• Tibo-lg
• Valentine Wallace
• benthecarman
• optout
• shuoer86

Commits

• 5592378 Merge pull request #2834 from TheBlueMatt/2024-01-cut-120
• 37017ec Bump crate versions to 0.0.120/invoice 0.28
• 947850b Add CHANGELOG entry for 0.0.120
• 871db63 Merge pull request #2818 from valentinewallace/2024-01-blinded-path-retries
• a175958 Merge pull request #2828 from TheBlueMatt/2024-01-crypto-module
• 5c87f40 Test that we won't retry over previously failed blinded paths.
• 8fcfaeb Test util: separate out code to construct a blinded path.
• 32ab7a9 Avoid building routes over previously failed blinded payment paths.
• 23ef253 Store previously failed blinded paths on outbound payment failure.
• 5c5d691 Persist previously failed blinded paths in RouteParameters.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Dependabot can't resolve your Rust dependency files. Because of this, Dependabot cannot update this pull request.

[dependabot]

Superseded by #212.