fix: update ldk node for lightning security fixes

[ovitrif]

Twin: synonymdev/bitkit-android#1475
Refs: synonymdev/ldk-node#123

Description

• Updates LDK Node from 0.7.0-rc.71 to 0.7.0-rc.72 on master, so the shipped node picks up the lightning, lightning-liquidity and lightning-transaction-sync 0.2.7 security fixes. It reaches release-2.6.0 when master is merged in.
• 0.7.0-rc.72 is rc.71 with only those three dependencies updated (release).

Design

N/A — no UI changes.

Preview

N/A — no user-visible changes.

QA Notes

Manual Tests

• Upgrade from a build on rc.71 with an existing wallet and open channels: the node starts, channels reconnect, balances match.
• Restore a wallet: on-chain and Lightning balances and activity come back.
• Send and receive a Lightning payment and an on-chain payment.

Automated Checks

• xcodebuild -resolvePackageDependencies resolves ldk-node at 0.7.0-rc.72; Package.resolved pins the release tag's commit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T11:56:23.185199Z	cf8a4b6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Confidence Score: 5/5

[High impact] The changes since the previous review appear safe to merge.

Summary

Updates ldk-node from 0.7.0-rc.71 to 0.7.0-rc.72 and changes its pinned commit.

• Bitkit now builds with LDK Node 0.7.0-rc.72.

_{Reviews (2) · Last reviewed commit: "chore: link changelog to the pull reques..." · Reviewed by Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cf8a4b6c5e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

Closing: release-2.6.0 now carries the rc.72 bump, and #925 merges it into master, per @piotr-iohk.

[ovitrif]

Reopened: this keeps master on rc.72 now instead of waiting for #925 to merge back.

[talosmachina]

No findings. This bumps LDK Node from 0.7.0-rc.71 to 0.7.0-rc.72 (the lightning 0.2.7 security fixes) in the SwiftPM requirement and in Package.resolved. Reviewed c8666a8, full tier because it changes a dependency pin.

What I checked, and 3 candidates I ruled out

Read in full: the three changed files, plus Package.swift at v0.7.0-rc.72
Not built here: iOS does not build on Linux. The gates are unit-tests and integration-tests, both still running on this head.
CI: an earlier e2e-tests run on this head was cancelled before its shards ran, and its e2e-status job reports that as a failure. A fresh e2e-tests run is in progress, so the red e2e-status comes from the cancellation, not from this change.

Ruled out

• rc.72 carries more than the dependency bump: git diff v0.7.0-rc.71 v0.7.0-rc.72 in synonymdev/ldk-node touches 7 files only: Cargo.toml (lightning, lightning-liquidity, lightning-transaction-sync to 0.2.7, crate version), Cargo.lock (those three crates: 0.2.5, 0.2.3 and 0.2.1 to 0.2.7), Package.swift, the two Kotlin gradle.properties, pyproject.toml and CHANGELOG.md. The merge commit of #122 in the range adds no content on top of rc.71. No src/, UDL or generated binding changed, so the app-facing API is the same as rc.71.
• Stale pins left behind: the only other rc.71 strings in the branch are in journeys/pubky-marketplace/local-paykit-fallback.md, which is documentation.
• Pinned revision or binary does not match the release: Package.resolved pins d1bd9fcc9ceb11849323f4aaf21d32eb95b15c02, which is what refs/tags/v0.7.0-rc.72 points to. The LDKNodeFFI.xcframework.zip release asset hashes to c9e93929…d54a1c, the checksum Package.swift declares at that tag.

Merge confidence: 4/5. Nothing found, but this upgrades the Lightning node and only the e2e run exercises it; that run and the unit and integration tests had not finished when I reviewed.

[ovitrif]

Pushed fad3913: the release note is now the fragment changelog.d/next/928.security.md instead of a CHANGELOG.md edit (bot review), and the Paykit fallback journey names native LDK 0.7.0-rc.72.