Issues

• [BUG] LNbits >= 1.0 webhook is rejected with 400: body is a JSON-encoded string and the schema is strict

  cameri/nostream#1066 · Filter by author Perlover opened on Nov 6, 2026
  1

  

• chore(deps): bump Node to 24.22.2 across every image and .nvmrc

  dependencies
  cameri/nostream#1061 · Filter by author chappie-daemon opened on Nov 5, 2026

• fix(cli): a SECRET containing '#' does not round-trip through .env

  bugsecurity
  cameri/nostream#1060 · Filter by author chappie-daemon opened on Nov 5, 2026

• test(relay): non-sequential socket cases — commands that race the connection, not just sequential ones

  v3-release
  cameri/nostream#1052 · Filter by author chappie-daemon opened on Nov 4, 2026
  3

  

• rewrite: ADR 0005 cites the subscription handlers for an unbounded send

  bugdocumentationfactoryrewriterust
  cameri/nostream#1051 · Filter by author chappie-daemon opened on Nov 4, 2026 · Phase 2: Protocol core
  1

• config: a .nan value is reported twice by the settings validator

  bugfactoryrewriterust
  cameri/nostream#1050 · Filter by author chappie-daemon opened on Nov 4, 2026 · Phase 2: Protocol core

• config: the cap ceiling depends on a copied frame-queue constant a third crate could falsify

  bugfactoryrewriterust
  cameri/nostream#1049 · Filter by author chappie-daemon opened on Nov 4, 2026 · Phase 2: Protocol core

• config: config get prints values from a document the loader discarded

  bugfactoryrewriterust
  cameri/nostream#1048 · Filter by author chappie-daemon opened on Nov 4, 2026 · Phase 2: Protocol core

• A settings save can undo an admin moderation ban

  cameri/nostream#1039 · Filter by author chappie-daemon opened on Nov 2, 2026

• A probe alert that fails to save is lost for that transition

  cameri/nostream#1040 · Filter by author chappie-daemon opened on Nov 2, 2026

• Port the behaviour behind nip77, peering, subscription plans and the probe/SSL notifications

  cameri/nostream#1036 · Filter by author chappie-daemon opened on Nov 2, 2026

• relay: a refusal re-pin needs three edits and the third is held by nothing

  bugfactoryrewriterust
  cameri/nostream#1032 · Filter by author chappie-daemon opened on Nov 1, 2026 · Phase 2: Protocol core

• relay: the module doc credits the encoder/decoder pair for a consistency only the pin test holds

  documentationfactoryrewriterust
  cameri/nostream#1027 · Filter by author chappie-daemon opened on Nov 1, 2026 · Phase 2: Protocol core

• Security: 9 low-severity findings across admin, adapters, payments and compose

  security
  cameri/nostream#1022 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 7 low-severity findings in the CLI

  security
  cameri/nostream#1021 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 6 low-severity findings in the message handlers and event strategies

  security
  cameri/nostream#1020 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 16 low-severity findings in services, repositories and utils

  security
  cameri/nostream#1019 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: idor in src/services/payments-service.ts

  securityvulnerability
  cameri/nostream#1017 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: broken auth in src/admin/password-admin-auth-provider.ts

  securityvulnerability
  cameri/nostream#1016 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: sensitive data exposure in src/handlers/request-handlers/rate-limiter-middleware.ts

  securityvulnerability
  cameri/nostream#1015 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: authorization bypass in src/utils/settings.ts

  securityvulnerability
  cameri/nostream#1014 · Filter by author chappie-daemon opened on Nov 1, 2026

• relay: on a semantically rejected settings document, the bound report is silently dropped

  factoryrewriterust
  cameri/nostream#994 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  2

• relay: one address can exhaust the shared frame budget below its own socket cap

  factoryrewriterust
  cameri/nostream#992 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 1: Rust foundation

• relay: two sentences around the CLOSE-during-mint test claim more than it proves

  bugfactoryrewriterust
  cameri/nostream#984 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  1

• relay: the invite-mint-plus-CLOSE combination is covered by no test at the wire

  bugfactoryrewriterust
  cameri/nostream#983 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  1