Original release notes
Lots of security hardening, privacy improvements, new default for 5% zero fee maker allowance (including bondless), quantized feeround up for takers, concentrated mixdepth selection policy for improving maker liquidity, CJ ID logging, ...
Added
- Allow freezing and unfreezing several UTXOs in one atomic update (aeca8ee6)
- Add freeze-batch endpoint to freeze/unfreeze several UTXOs in one atomic request (3245fb82)
- Add grep-friendly CoinJoin IDs to logs and notifications and reduce routine INFO noise (9a3b6dd2)
- Reject CoinJoins whose miner fee rate is below the configured and locally resolved safety floor (1b6d38ae)
- Add opt-in conflict spending with Bitcoin Core policy diagnostics to jm-wallet send (a8740a8c)
- Improve tumbler maker diversity without deterministic counterparty exclusion (13c88f9b)
- Round each maker fee up to the closest public quantum by default, with an opt-out for exact-fee compatibility (9e18c515)
- Add an opt-in quantized-offers-only policy; using it without fee rounding is recommended and will become the future default (9e18c515)
- Change the default maker fee to 0.01% relative and 500 sats absolute while leaving taker fee limits unchanged (9e18c515)
- Restrict the default 5% maker allowance to zero-fee offers while retaining fidelity-bond weighting for all other slots (7180906d)
- Add optional concentrated maker mixdepth selection for improved liquidity. (fa4d5e00)
Fixed
- Fix batch freeze duplicate detection to ignore txid case and vout padding (b232fb50)
- Fix batch freeze to validate outpoints properly and recover in-memory state after a failed save (8343f3d6)
- Fix freeze-batch outpoint validation to reject whitespace-padded txids and vout overflow (6ddb8a89)
- Keep fidelity-bond warning indicators attached to their values on mobile screens (72b0f926)
- Return Neutrino UTXO timeout errors before taker response deadlines (075daf6e)
- Remove canceled offers promptly from directory orderbooks. (676776b0)
- Release stalled maker liquidity sooner and withdraw unfillable offers. (77ca46c8)
- Reduce privacy-damaging input consolidation in automatic direct sends (cc57bd79)
- Close authenticated WebSockets when locking or switching wallets (3bd4674b)
- Prevent directory advertisements from causing unintended clearnet peer connections (c9b4f214)
- Prevent wallet output address reuse across concurrent processes, restarts, and incomplete backend history checks. (d34fc7f4)
- Prevent concurrent or interrupted history writes from losing privacy-critical transaction and address records. (a6776ceb)
- Preserve tumbler exit and maker diversity across retries and resumes. (59ec098f)
- Remove the legacy jm-taker tumble command in favor of jm-tumbler. (463e3c50)
- Normalize CoinJoin locktime and input sequences to reduce transaction fingerprinting. (b03487b1)
- Warn and report when peer broadcast policies fall back to self-broadcast (c5643837)
- Honor configured mixdepth counts and hide privacy-sensitive logs by default (21ac47ce)
- Randomize maker identity renewal with isolated Tor, directory, and session generations (42eea55b)
- Preserve configured directory network policy in tumbler maker phases (00ce1399)
- Fix descriptor wallet UTXO lookups with multiple Core wallets loaded (9a5d9e94)
- Include the Orderbook Watcher web UI in virtual environment installs (928a0683)
- Fix maker startup through jmwalletd when clearnet development directories are explicitly enabled (9fbc55e9)
- Improve direct-send privacy with anti-fee-sniping locktimes, RBF defaults, and randomized ordering (3f982a6e)
- Prevent direct sends from selecting inputs reserved by in-flight CoinJoin rounds (ccfacb83)
- Clear wallet-session logs when locking a wallet (9b3fea63)
- Preserve established CoinJoin lease errors during explicit input validation (34d050be)
- Release the onion service, Tor control connection and listener port when maker startup fails (d4bb403e)
- Stop unauthenticated !fill messages from driving one node query per message (cb089fe9)
- Apply configured fee and identity renewal settings to makers started from the daemon (6eefad05)
- Stop wallet history reads from blocking each other (3d4f89ae)
- Fail address allocation with a clear error instead of searching a branch forever (cc7af3b2)
- Repair stale orderbook entries from completed directory peer snapshots (9b3383c2)
- Reduce maker identity linkage during periodic rotation (0e41df0b)
- Prevent concurrent maker fills from duplicating fee policy backend requests (87a3e336)
- Apply configured identity rotation quiet intervals to daemon-started makers (5428a97d)
- Prevent concurrent history migration from hiding newly appended wallet entries (251b8bc5)
- Stop blacklisting makers that decline a CoinJoin on fee policy (f9034253)
- Prevent signer response ordering from bypassing ignored-maker handling (030a93f2)
- Make nick change notifications opt-in to reduce noisy alerts (f384b556)
- Improve neutrino maker selection and directory outage diagnostics (9a207fed)
- Stop repeated closed-directory errors during CoinJoin response waits (dd5f2a62)
- Cancel stale CoinJoin previews before contacting makers (9ed0be8f)
- Refuse Neutrino HTTPS requests until TOFU pinning succeeds. (7010db36)
- Reject malformed or resource-intensive numeric offer fields. (cd4b171e)
- Reject unsafe relative fee policy values before order selection. (0d5b36f1)
- Harden wallet unlock and WebSocket admission against resource exhaustion. (3a2b6a36)
- Make mnemonic bond signing fail closed on unreviewed or malformed transactions. (16dc2cb6)
- Prevent remote HP2 gossip from growing the persistent commitment blacklist. (7a07fc30)
- Bound maker work and memory across rotating remote identities. (b93871c1)
- Bound maker health discovery and reject unsafe advertised destinations. (811e6306)
- Prevent remote metadata from altering transaction confirmation displays. (5d5d7162)
- Keep makers serving when scheduled identity rotation cannot complete. (75190e02)
- Prevent a minority of makers from exhausting taker PoDLE commitments. (e4f5c616)
- Harden protocol parsing against malformed and oversized peer data (dfb8e1f8)
- Validate backend responses and PSBT amounts before wallet use (86e2d0e7)
- Bound maker transaction payload decoding and validation (14f3111b)
- Keep randomized maker fees within protocol precision limits (10431ccc)
- Keep Gotify tokens out of process arguments and failure logs (1e110dfb)
- Prevent tumbler confirmation waits from stalling indefinitely (b1aafd21)
- Reject CoinJoin fee policies whose required minimum exceeds the configured safety cap (75736fc9)
- Apply configured maker runtime policies to daemon and tumbler maker sessions (3aa69109)
- Prevent retiring maker identities from reconnecting during privacy rotation (b8cd1dde)
- Reselect automatic taker inputs when the initial PoDLE UTXO is exhausted. (8e26d3c3)
- Fix zero-fee bondless Pick Chance values and make explanations available on mobile (ba255e68)
Configuration Changes
Existing config.toml files are not updated automatically. Review the bundled template changes below and apply the relevant options manually.
--- config.toml.template (0.37.1)
+++ config.toml.template (0.38.0)
@@ -165,6 +165,11 @@
# Override with a custom list if needed:
# directory_servers = ["custom1.onion:5222", "custom2.onion:5222"]
+# Development only: permit direct TCP to non-onion JoinMarket directories and
+# peers. Production networks require .onion endpoints by default. Regtest
+# permits local directories without this override.
+# allow_clearnet_connections = false
+
# Directory nick authentication policy (JMP-0005):
# "prefer_verified" authenticates when supported and falls back to legacy servers.
# "require_verified" rejects legacy servers. "disabled" uses the legacy handshake.
@@ -266,7 +271,8 @@
# Log level: "TRACE", "DEBUG", "INFO", "WARNING", "ERROR"
# level = "INFO"
-# Log sensitive information (private keys, mnemonics, etc.)
+# Log sensitive wallet addresses, amounts, balances, txids, transaction data,
+# descriptors, and secrets. Disabled by default.
# sensitive = false
# ============================================================================
@@ -315,7 +321,7 @@
# notify_signing = true
# notify_mempool = true
# notify_confirmed = true
-# notify_nick_change = true
+# notify_nick_change = false # Nick changes are frequent and disabled by default
# notify_disconnect = false # Individual directory disconnect/reconnect (noisy)
# notify_all_disconnect = true # All directories disconnected (critical)
# notify_coinjoin_start = true
@@ -355,6 +361,12 @@
# Default: 100000 (matches the upstream JoinMarket reference; using a different
# value may make jm-ng makers fingerprintable).
# min_size = 100000
+
+# Do not sign CoinJoins below this miner fee floor. Full-node makers combine
+# this with the local mempool minimum and a conservative estimate; Neutrino
+# makers cannot verify foreign prevout values and therefore cannot enforce it.
+# min_fee_rate_sat_vb = 1.0
+# min_fee_block_target = 10
# IMPORTANT: offer_type determines which fee setting is used.
# Simply changing cj_fee_absolute will NOT switch to absolute fees - you must set offer_type.
@@ -381,12 +393,8 @@
# offer_type = "sw0reloffer"
# Fee settings (only one is used based on offer_type above)
-# The relative default (0.00002) is exactly the lowest fee-quantization quantum,
-# so default makers sit on the grid and share one homogenized fee with every
-# other default maker, maximizing the anonymity set. It also matches the upstream
-# JoinMarket reference. If you set a non-quantized value, enable cjfee_factor
-# randomization below so your exact fee is not a fingerprint.