fix: update ldk node for lightning security fixes

[ovitrif]

Twin: synonymdev/bitkit-ios#928
Refs: synonymdev/ldk-node#123

Description

• Updates LDK Node from 0.7.0-rc.71 to 0.7.0-rc.72 on master, so the node picks up the lightning, lightning-liquidity and lightning-transaction-sync 0.2.7 security fixes. It reaches release-2.6.0 when master is merged in.
• 0.7.0-rc.72 is rc.71 with only those three dependencies updated (release).

Design

N/A — no UI changes.

Preview

N/A — no user-visible changes.

QA Notes

Manual Tests

• Upgrade from a build on rc.71 with an existing wallet and open channels: the node starts, channels reconnect, balances match.
• Send and receive a Lightning payment and an on-chain payment.

Automated Checks

• The published com.synonym:ldk-node-android:0.7.0-rc.72 native libraries embed lightning, lightning-liquidity and lightning-transaction-sync 0.2.7.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T12:18:14.140539Z	21ccedf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 21ccedfe2f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable defect was found.

Summary

Updates ldk-node-android from 0.7.0-rc.71 to 0.7.0-rc.72 and records the upstream Lightning security fixes in CHANGELOG.md.

• Bitkit now builds with LDK Node Android 0.7.0-rc.72.

_{Reviews (1) · Last reviewed commit: "fix: update ldk node for lightning secur..." · Reviewed by Greptile}

[github-actions]

Regtest APK

Built from 24fd170 (run).

Download bitkit-dev-debug universal APK (expires in 30 days).

[talosmachina]

No findings. This bumps com.synonym:ldk-node-android from 0.7.0-rc.71 to 0.7.0-rc.72 (the lightning 0.2.7 security fixes) in gradle/libs.versions.toml. Reviewed a7d7c7c, full tier because it changes a dependency pin.

What I checked, and 2 candidates I ruled out

Read in full: both changed files. The only ldk-node coordinate in the build is libs.versions.toml:68, and settings.gradle.kts already points to the synonymdev/ldk-node Maven repository.
Not built here: CI is the gate. CI (build) and Lint passed on this head, so the 0.7.0-rc.72 artifact resolves and compiles. E2E is still running.
Not verified here: that the published AAR's native libraries embed the 0.2.7 crates. That needs the package itself, and I could not fetch it from this review.

Ruled out

• rc.72 carries more than the dependency bump: git diff v0.7.0-rc.71 v0.7.0-rc.72 in synonymdev/ldk-node touches 7 files only: Cargo.toml (lightning, lightning-liquidity, lightning-transaction-sync to 0.2.7, crate version), Cargo.lock (those three crates: 0.2.5, 0.2.3 and 0.2.1 to 0.2.7), Package.swift, the two Kotlin gradle.properties, pyproject.toml and CHANGELOG.md. The merge commit of #122 in the range adds no content on top of rc.71. No src/, UDL or generated binding changed, so the app-facing API is the same as rc.71.
• Stale pins left behind: the only other rc.71 strings in the branch are in journeys/pubky-marketplace/local-paykit-fallback.md, which is documentation.

Merge confidence: 4/5. Nothing found and the build is green, but this upgrades the Lightning node and only the E2E run exercises it, which had not finished when I reviewed.

[ovitrif]

Pushed 24fd170: the release note is now the fragment changelog.d/next/1475.security.md instead of a CHANGELOG.md edit, and the Paykit fallback journey names native LDK 0.7.0-rc.72 (both from the bot review).