We received multiple security reports last weeks and the most critical has been fixed with the latest version: https://github.com/RoboSats/robosats/releases/tag/v0.8.7-alpha Big thanks to all individuals and Rob Hamilton's Red Team for taking care and spend time and money to keep the project safe!

RoboSats v0.8.7-alpha is now out! 🚀 # Changes ## What's new **TL;DR** Security hardening across the full stack, live coordinator ranking by DevFund donations, federation consensus mechanism, image upload in encrypted chat, 3 new payment methods, and new coordinators (Eleuteria, Freeport, Ammanaya). ### For Users - **New coordinators** joined the federation: [Eleuteria](https://github.com/RoboSats/robosats/issues/2670), [Freeport](https://github.com/RoboSats/robosats/issues/2504), [Ammanaya](https://github.com/RoboSats/robosats/issues/2453) — FreedomSats removed - **Image uploads in encrypted chat** — Users can now upload E2E encrypted images in the order chat via Blossom. Only available on coordinators that opt in. - **Federation consensus** mechanism, learn more here https://github.com/RoboSats/robosats/pull/2683 - **Live coordinator ranking** — coordinators are now sorted by their actual real-time DevFund donation value (devfund% × fee rate), falling back to the static `federation.json` value when unreachable **New payment methods** - eBay Gift Card - MobilePay - PYUSD **Bugs** - Fixed PGP armor blank line being stripped when escaping robot key headers, which broke PGP verification - Fixed null premium default blocking order creation in the maker form - Fixed sensitive data exposure on password-protected orders — location and description are now redacted from non-participants; password-protected orders are also excluded from the public order book - Fixed Server-Side Request Forgery vector in the Android WebView interface - Fixed Redis 8.x channel layer timeout causing WebSocket disconnections ### For Coordinators - **Federation consensus** mechanism, learn more here https://github.com/RoboSats/robosats/pull/2683 - **`BLOSSOM_ENABLED`** — new opt-in env var to re-enable image uploads in chat (off by default); requires a Blossom blob server running behind the coordinator - **`STRFRY_HOST` / `STRFRY_PORT`** — new env vars for the embedded Nostr relay - **`DEVFUND`** is now exposed publicly via `GET /api/info/` and used live by clients to weight coordinator lottery ranking — keep it accurate - **Redis cache** for public endpoints (`/api/book/`, `/api/info/`, etc.) — reduces DB load significantly under traffic - **CLN pinned to v25.09.3** — `holdinvoice v4.0.0` is incompatible with CLN v25.11+; do not upgrade CLN beyond v25.09.x until a compatible holdinvoice release exists - **LND updated** to v0.21 with `HTLC_SET_ONLY` lookup and `/v2/router/send` REST path fixes - GPG keys are now also purged when cleaning expired robot accounts - Fixed CSRF protection — `DisableCSRFMiddleware` replaced with the standard Django `CsrfViewMiddleware` (admin fully protected; DRF API views remain exempt via `APIView`) https://github.com/RoboSats/robosats/releases/tag/v0.8.7-alpha