[ovitrif]

Refs: #207

Prepares 0.8.0-rc11.1 for the Bitkit 3.1.1 patch line. v3.1.0 ships 0.8.0-rc11; this branch adds only the LDK 0.2.8 crates on top of it, so 3.1.1 gets the LDK update without the rc12–rc14 changes. Master stays on 0.8.0-rc15 for 3.2.0.

Description

• lightning 0.2.3 → 0.2.8, lightning-types 0.3.2 → 0.3.5 and lightning-invoice 0.34.1 → 0.34.2 in Cargo.lock, the same lock change as chore: prepare 0.8.0-rc15 #207. boltz-client is the only crate that depends on them.
• Version 0.8.0-rc11.1 in Cargo.toml, Cargo.lock, Package.swift and bindings/android/gradle.properties, plus the iOS checksum in Package.swift.
• One changelog line.

No API change: the regenerated Swift bindings are byte-identical to v0.8.0-rc11.

This PR targets release/0.8.0-rc11, cut at the v0.8.0-rc11 tag (22e0acc).

The iOS archive was built with ./build_ios.sh on Rust 1.91.1 and Xcode 27.0. It is 86,783,449 bytes, SHA-256 8414875259de52a50d8f7e3b8f638cbd31d1938d650bb1e257596a29265706f2, matching Package.swift. Android coordinates are com.synonym:bitkit-core-android:0.8.0-rc11.1.

Release steps after approval

1. Push a signed annotated tag v0.8.0-rc11.1 on the approved head and publish it as a prerelease with the preserved BitkitCore.xcframework.zip, so v0.8.0-rc15 stays the latest release. Publishing runs gradle-publish.yml, which builds and publishes the Android package.
2. Check that the published zip's checksum matches Package.swift and that the Android package resolves.
3. Merge this PR with a merge commit.

QA Notes

• cargo metadata --locked resolves the lock as committed.
• ./build_ios.sh: passed. The regenerated Swift interface files are identical to v0.8.0-rc11's.
• swift package compute-checksum on the archive matches Package.swift.
• cargo test modules::boltz (32 passed) and modules::scanner (19 passed).

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T20:15:48.888397Z	89f3cee	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[talosmachina]

No findings. Moves lightning to 0.2.8, lightning-types to 0.3.5 and lightning-invoice to 0.34.2 in the lock on top of v0.8.0-rc11, and bumps the version to 0.8.0-rc11.1 across the three manifests. Reviewed 89f3cee, full tier (lock file change).

What I checked, and 3 candidates I ruled out

Base: release/0.8.0-rc11 is 22e0acc, the commit v0.8.0-rc11 points at, so the diff is the whole delta for the patch line.
Lock integrity: the three new checksums match the crates.io index entries for lightning 0.2.8, lightning-types 0.3.5 and lightning-invoice 0.34.2, none yanked. Every non-optional requirement of the new lightning (lightning-macros ^0.2.1, dnssec-prover ^0.6, hashbrown ^0.13, possiblyrandom ^0.2, lightning-types ^0.3.5, bech32 ^0.11) resolves to an entry already in the lock, so no new crate enters the graph.
Scope: boltz-client 0.4.1 is the only lock entry that depends on lightning; the crate's own lightning-invoice = "0.32.0" in Cargo.toml is a separate entry and untouched.
Version sync: Cargo.toml, Package.swift (tag) and bindings/android/gradle.properties all read 0.8.0-rc11.1; no other tracked file carries the old version outside the changelog and lock.
CI at review time: manifest and SwiftPM checks green; Android Bindgen, iOS Bindgen and usdt-tests still pending.
Build: build skipped: the PR-run gate could not read the author's permission on this repo and fails closed, so the review is static. The iOS checksum in Package.swift was not recomputed here; it can only be checked against the release asset once it is uploaded, which is step 2 of the release plan.

Ruled out

• Pre-release ordering: 0.8.0-rc11.1 sorts after 0.8.0-rc11 and before 0.8.0-rc12 under SemVer (identifiers rc11 then 1), so a consumer pinning the rc11 line does not jump to master's releases.
• Android publish from the tag: gradle-publish.yml checks out release.tag_name and passes the version from it, so it builds this branch's code, not the default branch.
• Binding drift: no Rust source or UniFFI export changed, so there is nothing for the generated bindings to pick up.

Merge confidence: 4/5, the lock change was not built or tested here and three CI jobs were still pending.

[coreyphillips]

Two independent reviews, nothing blocking a merge.

[ovitrif]

Closing unmerged: in bitkit-core the LDK 0.2.8 crates reach only boltz-client, and the app gets its LDK fixes through ldk-node 0.7.0-rc.80, so Bitkit 3.1.1 keeps bitkit-core 0.8.0-rc11. Master stays on 0.8.0-rc15 for 3.2.0.