[ovitrif]

Twin: synonymdev/bitkit-android#1824

Updates ldk-node to 0.7.0-rc.79 and vss-rust-client-ffi to 0.5.26-rc2.

Description

• Bumps ldk-node from 0.7.0-rc.78 to 0.7.0-rc.79, a dependency-update release with no API changes.
• Bumps vss-rust-client-ffi from 0.5.26-rc1 to 0.5.26-rc2, a dependency-update release with no API changes.

Design

N/A — no UI changes.

Preview

N/A

QA Notes

Setup

N/A — dependency bump with no behaviour change.

Journeys

N/A — no user-visible behaviour change.

Manual Tests

N/A

Automated Checks

N/A

Evidence

• xcodebuild -resolvePackageDependencies resolves ldk-node 0.7.0-rc.79 and vss-rust-client-ffi 0.5.26-rc2.
• CI build, unit and E2E checks run on this head.

Gaps

None.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T17:17:51.769471Z	2decbb9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable defects were found.

Summary

Updates ldk-node from 0.7.0-rc.78 to 0.7.0-rc.79 and vss-rust-client-ffi from 0.5.26-rc1 to 0.5.26-rc2.

• Bitkit's wallet and Lightning flows use a newer node package.
• Bitkit's VSS backups use a newer client package.

_{Reviews (1) · Last reviewed commit: "chore: bump ldk-node and vss client" · Reviewed by Greptile}

[talosmachina]

No findings. Bumps ldk-node to 0.7.0-rc.79 and vss-rust-client-ffi to 0.5.26-rc2. Reviewed 2decbb9, light tier, static: iOS does not build on Linux, so this was not built here.

What I checked

Pins: the Package.resolved revisions match the tags' commits (faddf6d for v0.7.0-rc.79, cf5b5cd for v0.5.26-rc2), and the project.pbxproj exact versions match.
Upstream deltas: ldk-node rc.78 to rc.79 is the rustls 0.23.46 bump, changelog, and version and checksum lines (4 commits). vss-rust-client-ffi rc1 to rc2 is the same rustls bump and the version and checksum lines (2 commits). No source or binding changes in either, which matches the PR body.
Binaries: downloaded both release xcframework zips; their SHA-256 matches the checksum in each tag's Package.swift (226a0518... and 4ef61f91...).
CI: build-local, integration tests, SwiftFormat and validate green; Run Tests and the local e2e were still running.

Merge confidence: 4/5, Run Tests and the e2e run had not finished at review time.

[jvsena42]

No findings. Both twins pin ldk-node 0.7.0-rc.79 and vss-rust-client-ffi 0.5.26-rc2, up from rc.78 and rc1, the versions in v3.1.0. iOS Package.resolved revisions match the upstream tag commits.

Upstream diffs: ldk-node rc.78→rc.79 only bumps rustls to 0.23.46. vss rc1→rc2 bumps rustls and rustls-webpki. Neither changes source, bindings, storage, backup format or fee/payment behaviour, so upgrades from v3.1.0 need no migration. The new webpki Entrust distrust list doesn't affect the VSS endpoints, which use Let's Encrypt certificates. The Android artifacts, including the native debug-symbols classifier, are published.

No device run: nothing in the app changes, and only the TLS library is patched.

Reviewer model: Claude Fable 5.1 (claude-fable-5-1), Claude Opus 5.5 (claude-opus-5-5)
Reasoning effort: not exposed

[coreyphillips]

Two independent reviews, nothing blocking a merge.

worth doing, does not block

• rustls security fixes ship without a changelog fragment (Bitkit.xcodeproj/project.pbxproj:1236)

nits

• PR body has no QA Notes or verification record. The description does not say what was built or run against the new binaries. .agents/commands/pr.md asks for the QA Notes structure on every PR, and AGENTS.md asks authors to record what they verified. For a dependency bump, a short Automated Checks and Evidence note is enough. For reference, here is what I ran on 2decbb9 (iPhone 17 simulator, Xcode 27.1). build-for-testing succeeded. The CI unit selection ran 3,176 BitkitTests: 0 failed, 1 skipped. Tests that call into both binaries passed (LDK Builder().build(), vssDeriveStoreId). CI's integration job also passed.

[ovitrif]

PR body has no QA Notes or verification record.

@coreyphillips The description now follows the template, with QA Notes and the Evidence recorded for this head.

[coreyphillips]

Rechecked after replies, with no new commit since 2decbb9. Nothing blocking remains.

addressed

• PR body has no QA Notes or verification record. Fixed: gh pr view 1252 --json body now shows QA Notes with all six template subsections. Evidence names the package resolution and the CI checks on 2decbb9. Run Tests, Run Integration Tests and build-local pass on that head. One caveat: e2e-tests-local - e2e was still in progress at 18:34 UTC, so "Gaps: None" is only accurate once that job finishes green.

still open

• rustls security fixes ship without a changelog fragment (Bitkit.xcodeproj/project.pbxproj:1236). This bump ships upstream TLS security fixes to users but adds no changelog fragment, and the description calls it dependency updates only. The upstream Cargo.lock diffs show ldk-node rc.79 moving rustls from 0.23.43 to 0.23.46. vss-rust-client-ffi rc2 moves rustls from 0.23.35 to 0.23.46 and rustls-webpki from 0.103.8 to 0.103.16. The rustls 0.23.45 and 0.23.46 releases fix GHSA-2mjx-qc3c-rqvc (affects 0.23.13 through 0.23.44), GHSA-w44r-93j7-qv28 and GHSA-c8m5-c952-6cm4, among others. These crates carry the TLS for VSS backups and Electrum, Esplora and RGS traffic. The repo already treats this kind of bump as user-facing. #928 was an ldk-node bump for upstream security fixes; it added changelog.d/next/928.security.md and appears under Security in CHANGELOG.md. A single changelog.d/next/1252.security.md, for example "Updated the Lightning node and backup client with upstream TLS security fixes.", would keep the release notes consistent. The description could also name the rustls advisories. Your reply records a decision to match bitkit-android#1824, but it doesn't show the point is wrong. #928 was the same version-only bump (cf8a4b6 touches only pbxproj and Package.resolved), and it got changelog.d/next/928.security.md. The --generate-notes PR list in the draft release (release.md:155-161) will show the chore title, but CHANGELOG.md is the primary source for release notes (release.md:170) and gets nothing here. This is still non-blocking.

[ovitrif]

Merging: approved by @coreyphillips and @jvsena42, and CI is green on 2decbb9.