Bug Fixes

• Event::InvoiceReceived is now only generated once for each Bolt12Invoice received matching a pending outbound payment. Previously it would be provided each time we received an invoice, which may happen many times if the sender sends redundant messages to improve success rates (#3658).
• LDK's router now more fully saturates paths which are subject to HTLC maximum restrictions after the first hop. In some rare cases this can result in finding paths when it would previously spuriously decide it cannot find enough diverse paths (#3707, [#3755]).

Security

0.1.3 fixes a denial-of-service vulnerability which cause a crash of an LDK-based node if an attacker has access to a valid Bolt12Offer which the LDK-based node created. * A malicious payer which requests a BOLT 12 Invoice from an LDK-based node (via the Bolt12InvoiceRequest message) can cause the panic of the LDK-based node due to the way String::truncate handles UTF-8 codepoints. The codepath can only be reached once the received Botlt12InvoiceRequest has been authenticated to be based on a valid Bolt12Offer which the same LDK-based node issued (#3747, [#3750]).