RoboSats v0.8.7-alpha is now out! :rocket:

Changes

What's new

TL;DR Security hardening across the full stack, live coordinator ranking by DevFund donations, federation consensus mechanism, image upload in encrypted chat, 3 new payment methods, and new coordinators (Eleuteria, Freeport, Ammanaya).

For Users

• New coordinators joined the federation: Eleuteria, Freeport, Ammanaya — FreedomSats removed
• Image uploads in encrypted chat — Users can now upload E2E encrypted images in the order chat via Blossom. Only available on coordinators that opt in.
• Federation consensus mechanism, learn more here https://github.com/RoboSats/robosats/pull/2683
• Live coordinator ranking — coordinators are now sorted by their actual real-time DevFund donation value (devfund% × fee rate), falling back to the static federation.json value when unreachable

New payment methods

• eBay Gift Card
• MobilePay
• PYUSD

Bugs

• Fixed PGP armor blank line being stripped when escaping robot key headers, which broke PGP verification
• Fixed null premium default blocking order creation in the maker form
• Fixed sensitive data exposure on password-protected orders — location and description are now redacted from non-participants; password-protected orders are also excluded from the public order book
• Fixed Server-Side Request Forgery vector in the Android WebView interface
• Fixed Redis 8.x channel layer timeout causing WebSocket disconnections

For Coordinators

• Federation consensus mechanism, learn more here https://github.com/RoboSats/robosats/pull/2683
• BLOSSOM_ENABLED — new opt-in env var to re-enable image uploads in chat (off by default); requires a Blossom blob server running behind the coordinator
• STRFRY_HOST / STRFRY_PORT — new env vars for the embedded Nostr relay
• DEVFUND is now exposed publicly via GET /api/info/ and used live by clients to weight coordinator lottery ranking — keep it accurate
• Redis cache for public endpoints (/api/book/, /api/info/, etc.) — reduces DB load significantly under traffic
• CLN pinned to v25.09.3 — holdinvoice v4.0.0 is incompatible with CLN v25.11+; do not upgrade CLN beyond v25.09.x until a compatible holdinvoice release exists
• LND updated to v0.21 with HTLC_SET_ONLY lookup and /v2/router/send REST path fixes
• GPG keys are now also purged when cleaning expired robot accounts
• Fixed CSRF protection — DisableCSRFMiddleware replaced with the standard Django CsrfViewMiddleware (admin fully protected; DRF API views remain exempt via APIView)

Android

Click to download universal RoboSats APK for Android Smaller bundles for each CPU architecture available in the attachments.

Verify the app using GPG:

1. Download the ascii armored signature

2. Run this command on a directory that contains the apk file and and the ascii armored signature. gpg --verify robosats-v0.8.7.alpha-universal.apk.asc

3. Verify the signer is actually KoalaSat 8FCDBF574CCFD73DB68B00CC2F7F61C6146AB157

Additionally, you can download it from Izzysoft repository or ZapStore

Desktop

Download the Desktop App zip file Find the zip file that suits with your operative system:

• Windows
• Mac
• Linux

Verify the app using GPG:

1. Download the ascii armored signature:

2. Windows

3. Mac

4. Linux

5. Run this command on a directory that contains the apk file and and the ascii armored signature. gpg --verify robosats-v0.8.7.alpha-....asc

6. Verify the signer is actually KoalaSat 8FCDBF574CCFD73DB68B00CC2F7F61C6146AB157

Docker Images

Coordinator Backend Image v0.8.7-alpha (Docker Hub)

:::bash
docker pull recksato/robosats:v0.8.7-alpha

Client App Image v0.8.7-alpha (Docker Hub)

:::bash
docker pull recksato/robosats-client:v0.8.7-alpha

See nodeapp/docker-compose.yml (github.com) for an example docker-compose usage of the robosats-client image.

What's Changed

• Bump CI workflows by @KoalaSat in https://github.com/RoboSats/robosats/pull/2611
• Bump Desktop dependencies by @KoalaSat in https://github.com/RoboSats/robosats/pull/2612
• Add testnet relay routes to nodeapp by @gabbygator184 in https://github.com/RoboSats/robosats/pull/2617
• Upgrae mui 9 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2562
• Fix CLN race condition by @KoalaSat in https://github.com/RoboSats/robosats/pull/2610
• Remove unused environment variable by @alicecoordinator in https://github.com/RoboSats/robosats/pull/2452
• Fix Redis 8.x timeout in Channels by @gabbygator184 in https://github.com/RoboSats/robosats/pull/2622
• Bump babel 8 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2621
• Bump Typescript 6 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2624
• Cache public endpoints in Redis by @gabbygator184 in https://github.com/RoboSats/robosats/pull/2626
• Bump i18n 26 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2627
• Cache public endoints in Redis by @KoalaSat in https://github.com/RoboSats/robosats/pull/2628
• Downgrade babel by @KoalaSat in https://github.com/RoboSats/robosats/pull/2629
• Bump openpgp 6 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2630
• Bump uuid 14 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2631
• Bump react grid layout 2.2.4 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2634
• Remove unused npm library by @KoalaSat in https://github.com/RoboSats/robosats/pull/2635
• Bump webpack-cli 7 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2636
• Migrate MUI Grid v2 API by @KoalaSat in https://github.com/RoboSats/robosats/pull/2637
• Remove unused libraries by @KoalaSat in https://github.com/RoboSats/robosats/pull/2638
• Fix types https nodeapp by @gabbygator184 in https://github.com/RoboSats/robosats/pull/2641
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2603
• Fix Code Scan Alerts by @KoalaSat in https://github.com/RoboSats/robosats/pull/2644
• Fix Typescript Errors and Types by @KoalaSat in https://github.com/RoboSats/robosats/pull/2639
• Bump eslint and libraries by @KoalaSat in https://github.com/RoboSats/robosats/pull/2642
• ci: add dependabot groups to reduce PR noise by @KoalaSat in https://github.com/RoboSats/robosats/pull/2643
• Fix GHSA-p353-f8m7-8v95 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2660
• Fix Desktop Artifact poisoning by @KoalaSat in https://github.com/RoboSats/robosats/pull/2662
• Server-side request forgery by @KoalaSat in https://github.com/RoboSats/robosats/pull/2663
• Bump the ci-misc group across 1 directory with 6 updates by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2659
• Bump copy-webpack-plugin from 13.0.1 to 14.0.0 in /frontend by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2658
• Bump @typescript-eslint/parser from 8.66.0 to 8.67.0 in /frontend by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2657
• Bump globals from 16.5.0 to 17.11.0 in /frontend by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2656
• Bump js-sha256 from 0.11.1 to 1.0.0 in /frontend by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2655
• Bump the ci-docker group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2651
• Bump dawidd6/action-download-artifact from 21 to 23 in the ci-artifact-pipeline group across 1 directory by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2647
• Bump the python-patch group with 2 updates by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2648
• Bump nostr-tools from 2.24.1 to 2.24.2 in /frontend in the frontend-security group by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2649
• traditional scripts roboauto config update by @jerryfletcher21 in https://github.com/RoboSats/robosats/pull/2431
• fix: allow null premium default to unblock order creation by @kanishka0411 in https://github.com/RoboSats/robosats/pull/2434
• remove also gpg keys when cleaning users by @jerryfletcher21 in https://github.com/RoboSats/robosats/pull/2623
• Add new payment methods and fix wero logo by @KoalaSat in https://github.com/RoboSats/robosats/pull/2671
• Align NPM versions across repositories by @KoalaSat in https://github.com/RoboSats/robosats/pull/2672
• Bump electron from 43.4.0 to 43.4.1 in /desktopApp in the desktop-all group by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2677
• Bump uuid from 14.0.1 to 14.0.2 in /frontend in the frontend-security group by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2678
• Bump the python-patch group with 2 updates by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2679
• Fix CR in auth header by @gabbygator184 in https://github.com/RoboSats/robosats/pull/2676
• docs: fix broken "How to use" links in payment methods by @21Mill in https://github.com/RoboSats/robosats/pull/2633
• Hide from order book and sensitive data exposure of password protected orders by @KoalaSat in https://github.com/RoboSats/robosats/pull/2680
• Live DevFund donation weights for coordinator ranking by @gabbygator184 in https://github.com/RoboSats/robosats/pull/2560
• Upgrade LND to v0.21.2-beta and CLN to v25.09.3 by @KoalaSat in https://github.com/RoboSats/robosats/pull/2675
• fix(frontend): keep PGP armor blank line when escaping robot key headers by @TempleOfSats in https://github.com/RoboSats/robosats/pull/2681
• Blossom security analysis fixes by @KoalaSat in https://github.com/RoboSats/robosats/pull/2674
• Weight lottery by actual sats donated (devfund% × fee rate) by @TempleOfSats in https://github.com/RoboSats/robosats/pull/2561
• Federation concensus by @KoalaSat in https://github.com/RoboSats/robosats/pull/2683
• docs: fix typo mantained -> maintained by @vaibhav8a in https://github.com/RoboSats/robosats/pull/2695
• Fix Kotlin CI by @KoalaSat in https://github.com/RoboSats/robosats/pull/2696
• Remove FreedomSats, add Eleuteria, FreePort and Ammanaya by @KoalaSat in https://github.com/RoboSats/robosats/pull/2684
• V0.8.7-alpha by @KoalaSat in https://github.com/RoboSats/robosats/pull/2697
• Better dynamic tests by @KoalaSat in https://github.com/RoboSats/robosats/pull/2698
• Clients bug fixes by @KoalaSat in https://github.com/RoboSats/robosats/pull/2705
• Make CSRF_TRUSTED_ORIGINS configurable by @alicecoordinator in https://github.com/RoboSats/robosats/pull/2708
• Print Federation calculated consensus by @KoalaSat in https://github.com/RoboSats/robosats/pull/2709
• Revert "Print Federation calculated consensus" by @KoalaSat in https://github.com/RoboSats/robosats/pull/2711
• Fix Blossom image static URLs by @KoalaSat in https://github.com/RoboSats/robosats/pull/2710
• Bump fast-uri from 3.1.5 to 3.1.7 in /frontend by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2714
• Bump @xmldom/xmldom from 0.8.14 to 0.8.15 in /desktopApp by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2713
• Bump @xmldom/xmldom from 0.9.10 to 0.9.12 in /frontend by @dependabot[bot] in https://github.com/RoboSats/robosats/pull/2712
• Coordinator load and race condition by @KoalaSat in https://github.com/RoboSats/robosats/pull/2718

New Contributors

• @vaibhav8a made their first contribution in https://github.com/RoboSats/robosats/pull/2695

Full Changelog: https://github.com/RoboSats/robosats/compare/v0.8.6-alpha...v0.8.7-alpha