chore: update Lightning Network dependencies to latest

[grunch]

Summary

Updates the Lightning Network related dependencies to their latest releases:

Package	Before	After
invoices	2.0.6	6.0.5
lightning	11.1.0	12.2.4

Both keep exact version pins, matching the existing convention for these two dependencies.

No source changes were required — every lightning and invoices API the codebase uses is still exported in the new major versions.

Dependency tree impact

The upgrade deduplicates the transitive bitcoin/bolt tree. bitcoinjs-lib, bs58, bs58check, base-x, tiny-secp256k1, bolt07, bolt09 and the create-hash / sha.js / ripemd160 / md5.js / cipher-base / hash-base chain are no longer vendored twice under lightning/node_modules and psbt/node_modules.

Net effect: 31 packages removed, lockfile shrinks by ~215 lines. @grpc/grpc-js now resolves to 1.14.4 (the existing ^1.13.5 override is still satisfied, so it was left untouched).

npm audit reports no advisories anywhere in the lightning / invoices dependency chain after the update.

Test plan

• npx tsc — compiles clean, exit 0
• npm run lint — passes, exit 0
• npm test — 233 passing, 0 failing
• LN-specific suites (dist/tests/ln/**) — 15 passing, covering hold invoice creation, getPaymentStatus happy paths and error codes, and recordPayoutIntent
• Verified all lightning exports used by the codebase still exist in v12: getInvoices, subscribeToInvoice, subscribeToProbeForRoute, authenticatedLndGrpc, createHodlInvoice, settleHodlInvoice, cancelHodlInvoice, payViaPaymentRequest, subscribeToPayViaRequest, getPayment, getWalletInfo, getIdentity, getChannelBalance, getNode
• Verified all invoices exports still exist in v6: parsePaymentRequest, createUnsignedRequest, createSignedRequest
• Smoke-loaded every compiled module that imports these packages (ln/connect, ln/hold_invoice, ln/pay_request, ln/info, ln/subscribe_invoice, ln/resubscribe_invoices, ln/subscribe_probe, ln/index, bot/validations, bot/scenes, lnurl/lnurl-pay) — all load without error
• package-lock.json version stays in sync with package.json (0.16.2)

Not covered by automated tests

These two majors sit on the hot path for real fund custody, so a manual pass against a signet/testnet LND node is worth doing before merge:

• Create a sell order end to end — hold invoice generated, paid, settled
• Create a buy order end to end — buyer invoice paid out
• Cancel flow — hold invoice canceled and funds returned

Summary by CodeRabbit

• Chores
  • Updated invoice and Lightning service integrations to newer versions.
  • No user-facing feature or behavior changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7f60c73c-dead-4cb5-b4c2-914ebc7f2dbf

📥 Commits

Reviewing files that changed from the base of the PR and between 1ff500b and 219623e.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

Walkthrough

The pull request updates invoices from 2.0.6 to 6.0.5 and lightning from 11.1.0 to 12.2.4 in package.json.

Changes

Dependency updates

Layer / File(s)	Summary
Upgrade package dependencies package.json	The declared invoices and lightning versions were upgraded.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: toryvand

Poem

I’m a rabbit with packages bright,
New versions hop into place just right.
invoices leaps, lightning flies,
Fresh numbers sparkle beneath the skies.
Hop, hop—dependencies rise!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency updates in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/update-lightning-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 219623ebd6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep dependencies compatible with the Node 20 runtime

When this is built or deployed through the checked Dockerfile (lines 4 and 48) or .github/workflows/integrate.yaml (lines 24-28), it runs on Node 20, but both upgraded packages declare node >=22 in the lockfile (package-lock.json lines 3630-3632 and 4123-4125), while the root package still advertises Node 20 support. Installation may only emit engine warnings, leaving production to execute these fund-handling libraries on an unsupported runtime; either upgrade the image, CI, and root engine to Node 22 or retain dependency versions supporting Node 20.

AGENTS.md reference: AGENTS.md:L39-L39

Useful? React with 👍 / 👎.