Add release notes for LDK 0.1.4

Author: TheBlueMatt

CHANGELOG.md

@@ -1,3 +1,28 @@
+# 0.1.4 - May 23, 2025 - "Careful Validation of Bogus States"
+
+## Bug Fixes
+ * In cases where using synchronous persistence with higher latency than the
+   latency to communicate with peers caused issues fixed in 0.1.2,
+   `ChannelManager`s may have been left in a state which LDK 0.1.2 and later
+   would refuse to deserialize. This has been fixed and nodes which experienced
+   this issue prior to 0.1.2 should now deserialize fine (#3790).
+ * In some cases, when using synchronous persistence with higher latency than
+   the latency to communicate with peers, when receiving an MPP payment with
+   multiple parts received over the same channel, a channel could hang and not
+   make progress, eventually leading to a force-closure due to timed-out HTLCs.
+   This has now been fixed (#3680).
+
+## Security
+0.1.4 fixes a funds-theft vulnerability in exceedingly rare cases.
+ * A malicious peer, if they allow a public channel with an LDK-based node to
+   have no reserve on the LDK end, if the LDK-based node increases the channel
+   feerate on an anchor-based channels somewhat while there are several
+   HTLCs in the channel and the LDK-based node has nearly zero balance in the
+   channel, may be able to cause the LDK-based node to create an invalid
+   commitment transaction which it cannot use to claim its part of forwarded
+   HTLC. The counterparty would have to forfeit their reserve value (#3796).
+
+
 # 0.1.3 - Apr 30, 2025 - "Routing Unicode in 2025"
 
 ## Bug Fixes