currencyrate: vendor root certificates with webpki-roots

.version

@@ -1 +1 @@
-v26.06
+v26.06.2

CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [26.06.2] - 2026-06-24: "Qantum-Resistant Lightning Channel III"
+
+This point release if recommended for all minimal OS setups, including docker images, that have no root certificates for TLS installed.
+
+### Fixed
+
+ - cln-currencyrate: include root certificates to fix the `builder error` on OS's without root certificates. ([#9252])
+
+[#9252]: https://github.com/ElementsProject/lightning/pull/9252
+[26.06.2]: https://github.com/ElementsProject/lightning/releases/tag/v26.06.2
+
 ## [26.06.1] - 2026-06-05: "Qantum-Resistant Lightning Channel II"
 
 This point release is recommended: it fixes the bwatch plugin failure at registration
@@ -115,6 +126,17 @@ Note: You should always set `allow-deprecated-apis=false` to test for changes.
 [#9136]: https://github.com/ElementsProject/lightning/pull/9136
 [26.06]: https://github.com/ElementsProject/lightning/releases/tag/v26.06
 
+## [26.04.2] - 2026-06-24: "Negative Routing Fees III"
+
+This point release if recommended for all minimal OS setups, including docker images, that have no root certificates for TLS installed.
+
+### Fixed
+
+ - cln-currencyrate: include root certificates to fix the `builder error` on OS's without root certificates. ([9251])
+
+[#9251]: https://github.com/ElementsProject/lightning/pull/9251
+[26.04.2]: https://github.com/ElementsProject/lightning/releases/tag/v26.04.2
+
 ## [26.04.1] - 2026-04-25: "Negative Routing Fees II"
 
 This point release is recommended: it fixes a build failure in some environments and a gossip protocol issue.

contrib/pyln-client/pyln/client/__init__.py

@@ -4,7 +4,7 @@
 from .gossmapstats import GossmapStats
 from .version import NodeVersion
 
-__version__ = "v26.06"
+__version__ = "v26.06.2"
 
 __all__ = [
     "LightningRpc",

contrib/pyln-client/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-client"
-version = "v26.06"
+version = "v26.06.2"
 description = "Client library and plugin library for Core Lightning"
 authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
 license = { text = "BSD-MIT" }

contrib/pyln-proto/pyln/proto/__init__.py

@@ -4,7 +4,7 @@
 from .onion import OnionPayload, TlvPayload, LegacyOnionPayload
 from .wire import LightningConnection, LightningServerSocket
 
-__version__ = "v26.06"
+__version__ = "v26.06.2"
 
 __all__ = [
     "Invoice",

contrib/pyln-proto/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-proto"
-version = "v26.06"
+version = "v26.06.2"
 description = "This package implements some of the Lightning Network protocol in pure python. It is intended for protocol testing and some minor tooling only. It is not deemed secure enough to handle any amount of real funds (you have been warned!)."
 authors = [
     {name = "Christian Decker", email = "decker.christian@gmail.com"}

contrib/pyln-testing/pyln/testing/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "v26.06"
+__version__ = "v26.06.2"
 
 __all__ = [
     "__version__",

contrib/pyln-testing/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-testing"
-version = "v26.06"
+version = "v26.06.2"
 description = "Test your Core Lightning integration, plugins or whatever you want"
 authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
 license = { text = "BSD-MIT" }

plugins/currencyrate-plugin/Cargo.toml

@@ -22,13 +22,15 @@ reqwest = { version = "0.13", default-features = false, features = [
     "rustls-no-provider",
     "socks",
     "json",
+    "http2",
 ] }
 rustls = { version = "0.23", default-features = false, features = [
     "logging",
     "tls12",
     "std",
     "ring",
 ] }
+webpki-roots = "1"
 
 futures = "0.3"
 

plugins/currencyrate-plugin/src/main.rs

@@ -94,17 +94,27 @@ median from currencyrates results",
 
     let proxy = match check_proxy_config(&plugin).await {
         Ok(o) => o,
-        Err(e) => return plugin.disable(&e.to_string()).await,
+        Err(e) => {
+            return plugin.disable(&format!("Error in proxy config: {e}")).await;
+        }
     };
 
     let sources = match gather_sources(&plugin, proxy.is_some()) {
         Ok(o) => o,
-        Err(e) => return plugin.disable(&e.to_string()).await,
+        Err(e) => {
+            return plugin
+                .disable(&format!("Error in sources config: {e}"))
+                .await;
+        }
     };
 
     let price_oracle = match BtcPriceOracle::new(proxy, sources) {
         Ok(o) => o,
-        Err(e) => return plugin.disable(&e.to_string()).await,
+        Err(e) => {
+            return plugin
+                .disable(&format!("Error creating price oracle: {e}"))
+                .await;
+        }
     };
 
     let plugin_state = PluginState {

plugins/currencyrate-plugin/src/oracle.rs

@@ -2,6 +2,7 @@ use anyhow::anyhow;
 use futures::future::join_all;
 use reqwest::header::{HeaderMap, HeaderValue, USER_AGENT};
 use reqwest::{Client, Proxy};
+use rustls::ClientConfig;
 use serde_json::Value;
 use std::cmp::Reverse;
 use std::collections::HashMap;
@@ -254,9 +255,17 @@ impl BtcPriceOracle {
         let mut headers = HeaderMap::new();
         headers.insert(USER_AGENT, HeaderValue::from_static("cln-currencyrate"));
 
+        let root_store = rustls::RootCertStore {
+            roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
+        };
+
+        let tls = ClientConfig::builder()
+            .with_root_certificates(root_store)
+            .with_no_client_auth();
+
         let mut client = Client::builder()
             .default_headers(headers)
-            .tls_backend_rustls()
+            .tls_backend_preconfigured(tls)
             .timeout(SOURCE_TIMEOUT_SECS)
             .pool_max_idle_per_host(5);
 
@@ -267,7 +276,9 @@ impl BtcPriceOracle {
             client = client.proxy(proxy);
         }
 
-        let client = client.build()?;
+        let client = client
+            .build()
+            .map_err(|e| anyhow!("HTTP client failed to build: {:?}", e.source()))?;
 
         let mut map = HashMap::new();
         for s in sources {

tools/reckless

@@ -21,7 +21,7 @@ from urllib.error import HTTPError
 import venv
 
 
-__VERSION__ = 'v26.06'
+__VERSION__ = 'v26.06.2'
 
 logging.basicConfig(
     level=logging.INFO,