Taproot Assets 0.8.7

Taproot Assets v0.8.7

In this release, we rebuild tapd and tapcli with Go 1.27.3 to address CVE-2026-111943. Go's crypto/x509 verifier now rejects certificate chains containing a specific set of intermediate certificates due to security concerns around their operation. We recommend that all users upgrade.

Updating the Go installation on a host does not patch an existing binary. Install the new release binaries, or rebuild from the v0.8.7 tag with Go 1.27.3.

Changes

• Raise the minimum Go version and release toolchain to Go 1.27.3, including

the Docker build images and generated RPC bindings.

• Backport the applicable lint, formatting, and test maintenance updates to

the v0.8 release branch.

See the release-specific notes and full changes since v0.8.6.

The release tag points to commit 5be24d78f5bb7fe6628f1564817db3257cb4272a.

Database migrations and upgrade notes

There are no new database migrations relative to v0.8.6. Back up your databases before upgrading.

If you use Taproot Assets channels, follow the operational safety guidelines and arrange a controlled update of affected nodes. Users upgrading from a version older than v0.8.6 must also review the v0.8.6 upgrade instructions, including the guidance for nodes with a configured RFQ oracle. Restarting a node does not clear pending HTLCs.

Verifying the release

Download the archive for your platform, manifest-v0.8.7.txt, and manifest-roasbeef-v0.8.7.sig. The detached PGP signature authenticates the manifest, which contains the SHA-256 hashes of the release archives and binaries.

Download the release signing key and check that its primary fingerprint is A5B61896952D9FDA83BC054CDC42612E89237182 before importing it:

gpg --show-keys --with-fingerprint roasbeef.asc
gpg --import roasbeef.asc
gpg --verify manifest-roasbeef-v0.8.7.sig manifest-v0.8.7.txt
shasum -a 256 <downloaded-archive>

Compare the archive hash with its entry in manifest-v0.8.7.txt.

The manifest and signature also have OpenTimestamps proofs:

ots verify manifest-v0.8.7.txt.ots
ots verify manifest-roasbeef-v0.8.7.sig.ots

Bitcoin confirmation is required to verify the timestamp attestation. If a proof reports pending confirmation, retry after the confirmations arrive.

Reproducing the release

The release binaries are built with Go 1.27.3. From the v0.8.7 source tag, run:

make docker-release tag=v0.8.7

To build a single platform, add sys=<OS-ARCH>. The release also includes taproot-assets-source-v0.8.7.tar.gz and vendor.tar.gz for a contained rebuild. See the reproducible build guide for the build and verification steps. Compare the resulting hashes with the entries in manifest-v0.8.7.txt.

Contributors (alphabetical order)

• George Tsagkarelis
• Jared Tobin
• Olaoluwa Osuntokun

Tracked CVEs

• CVE-2026-111943