fix: consume vss-client 0.5.23

[ovitrif]

This PR bumps vss-rust-client-ffi from 0.5.21 to 0.5.23.

Description

0.5.23 includes synonymdev/vss-rust-client-ffi#20. Unauthenticated client setup now returns AuthError instead of encrypting with a public all-zero key.

Companion Android PR: synonymdev/bitkit-android#1164

Linked Issues/Tasks

• https://github.com/synonymdev/audit/issues/55
• fix: reject unauthenticated vss encryption vss-rust-client-ffi#20

Screenshot / Video

N/A

QA Notes

Manual Tests

• 1. regression: Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.

Automated Checks

• Local Debug simulator build passed against 0.5.23.

[greptile-apps]

Greptile Summary

This PR upgrades vss-rust-client-ffi to 0.5.23 and makes VSS initialization fail closed when LNURL-auth configuration is blank.

• Removes unauthenticated backup and Lightning-node VSS fallback paths.
• Normalizes whitespace in the LNURL-auth URL and adds a dedicated authentication-required error.
• Updates the Swift package lockfile and adds a security changelog entry.

Confidence Score: 5/5

The PR appears safe to merge, with authenticated VSS initialization consistently replacing the removed unauthenticated fallback.

The changed setup paths reject blank authentication configuration, retain correct failure cleanup, and use the authenticated VSS APIs pinned by the coordinated dependency update; no reachable blocking failure remains.

Important Files Changed

Filename	Overview
Bitkit/Services/LightningService.swift	Removes fixed-header VSS fallback and requires a nonblank LNURL-auth URL before building the Lightning node.
Bitkit/Services/VssBackupClient.swift	Routes app and debug VSS setup exclusively through authenticated client initialization.
Bitkit/Utilities/Errors.swift	Adds the dedicated vssAuthRequired service error and its AppError mapping.
Bitkit.xcodeproj/project.pbxproj	Updates the exact vss-rust-client-ffi package requirement to 0.5.23.
Bitkit.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved	Pins vss-rust-client-ffi 0.5.23 at the corresponding resolved revision.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Backup or Lightning setup] --> B[Read and trim LNURL-auth URL]
    B --> C{URL present?}
    C -- No --> D[Throw vssAuthRequired]
    C -- Yes --> E[Initialize authenticated VSS client]
    E --> F[Proceed with backup or Lightning node]

Loading

_{Reviews (1): Last reviewed commit: "fix: consume vss-client 0.5.23" | Re-trigger Greptile}