CommitWatch RSS
EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1854 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue427AI analyses
147commits · 30 days
226commits · 60 days
804commits · 180 days
1850commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
431Strong · 80–100
1163Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dovgopoly1502164
Rusty Russell95873208072
Sangbida Chaudhuri1473161066
Dusty Daemon771314066
ShahanaFarooqui931017063
daywalker9089528062
Níckolas Goline40510076
Lagrang376410069
Christian Decker3647072
Vincenzo Palazzo834080
Chandra Pratap56224082
ekzyis222063
Analysis record

Published AI watches

Last scanned 35 minutes ago

Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

add a test for downgrading askrene datastore

This commit adds a regression test for Core Lightning's database downgrade path. It ensures that when a user downgrades from an upcoming v26.09 release to an older version (v26.06), the new 'impressions' data added by the askrene routing s…

Database downgrade path for new askrene schema (impressions table)Regression test only; no production code changeNo input validation, cryptography, network, or authorization changes
1818553eby Lagrang3+156−13 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 81 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't crash when truncating large log messages

This commit fixes a crash bug in Core Lightning's logging code. When a log message was very long and got truncated, the program accidentally used the standard free() on memory that had been allocated by the project's own tal allocation sys…

Use-after-free / allocator mismatch: free() called on tal-allocated memoryDenial of service via large log message triggering truncation path crashMemory ownership semantics corrected with TAKES annotations
81425f17by Matt Whitlock+22−183 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightning-hsmtool: Fix getsecret does not show mnemonic after typing passphrase

This is a bug fix in a command-line helper tool used by Core Lightning node operators. The `getsecret` command was accidentally refusing to show the wallet recovery words (mnemonic) when the wallet was protected by a passphrase. After the …

Functional bug in secret-recovery pathError path blocked legitimate mnemonic recoveryNo input validation, memory-safety, or cryptographic change
8480f6c2by ekzyis+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 60 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: add regression test for hsmtool commands with passphrase

This commit only adds and updates a regression test in the project's test suite. It checks that the hsmtool utility correctly handles both empty and non-empty passphrases when working with BIP39 mnemonic-based wallet secrets. There is no c…

Regression test added for passphrase handling in hsmtoolNo production code changes observedTest-only change to tests/test_wallet.py
8c42be35by ekzyis+47−201 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 76 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wally: update libwally to v1.5.6

This commit updates the bundled libwally library to version 1.5.6. The practical effect is that calling the JSON-RPC `signpsbt` command on a PSBT that is already signed now succeeds as a harmless no-op, instead of returning an error on Bit…

Dependency update to incorporate upstream bug fixBehavior change from error to no-op on re-signing signed PSBTsTaproot keypath handling change in upstream cryptographic library
37526ca4by daywalker90+7−82 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: make datastore helpers self-wrap a wallet transaction

This change fixes a crash bug in Core Lightning's wallet datastore helpers. Previously, four datastore functions required the caller to already be inside a database transaction, and would fatally crash if called outside one. The patch make…

Fixes fatal assertion/crash in database statement preparationResolves transaction-context mismatch in wallet datastore helperswatchman plugin persistence path was affected
ae1a3347by Sangbida Chaudhuri+23−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: handle bwatch wallet/utxo spend notifications

This commit adds the missing bookkeeping that runs when Core Lightning's own on-chain wallet spends a UTXO. It makes the node mark the UTXO as spent, record the spending transaction, and log a withdrawal coin movement. It also handles bloc…

Missing spend tracking for wallet-owned UTXOs could lead to stale UTXO state or incorrect coin-movement accountingReorg handling clears spendheight, preventing a spent output from becoming permanently unspendable in the wallet's viewDefensive log_broken calls on unexpected missing UTXO or malformed watch suffix
4ba051caby Sangbida Chaudhuri+149−03 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 54 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: handle reorgs for our_outputs/our_txs by hand

This commit fixes how Core Lightning's wallet records handle blockchain reorganizations (reorgs) for two newer database tables, our_outputs and our_txs. Previously, these tables were not properly updated when blocks were removed or rolled …

Incorrect state persistence across blockchain reorgsMissing reorg handling for wallet tables without foreign-key cascadePotential stale spend/confirmation metadata in our_outputs/our_txs
bcdea215by Sangbida Chaudhuri+40−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: read UTXO state from our_outputs

This commit switches Core Lightning's wallet code to read UTXO (unspent transaction output) data from a new database table called our_outputs instead of the older outputs table. It also deletes several old helper functions and updates test…

Large internal data-model migration with reader/writer split between old and new tablesDual-write mirroring to legacy outputs table for downgrade compatibilityDeletion of legacy UTXO reading helpers
0a10e74eby Sangbida Chaudhuri+433−5772 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: rename b32script to scriptpubkey in PSBT change paths

This commit is a simple variable rename inside a Bitcoin/Lightning wallet file. The old name 'b32script' suggested all change addresses were bech32 format, but the project now uses a newer address type (p2tr) by default. The developer rena…

b8a60579by Sangbida Chaudhuri+12−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: update test_wallet.py raw-SQL queries for our_outputs

This commit only updates internal test code to query a new database table (our_outputs) instead of an old one (outputs). It does not change the actual wallet or node software that users run, so it cannot directly affect security.

d14ee378by Sangbida Chaudhuri+31−281 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: register scriptpubkey watches at startup

This change makes Core Lightning register long-lasting 'watches' for all wallet deposit addresses when the node starts up, so the new bwatch plugin can spot incoming payments from the first block it scans. It also removes a now-redundant p…

Change is part of an experimental chain-watcher (bwatch) featureAdds startup registration of scriptPubKey watches for all derived wallet keysRemoves a redundant unconfirmed-change watch, relying on the new blanket coverage
4a951d65by Sangbida Chaudhuri+89−114 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: dual-write chaintopology UTXO changes into our_outputs

This is a database refactoring commit in Core Lightning. It makes the wallet write UTXO (unspent transaction output) state to a new table called our_outputs in addition to the legacy outputs table, while reads still use the old table. The …

Database schema migration with dual-write mirror patternNo security claim in commit title or messageNo CVE, advisory, or researcher attribution in commit metadata
824e8195by Sangbida Chaudhuri+118−162 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: record bwatch-discovered wallet outputs

This commit adds new wallet bookkeeping code for Core Lightning. It records Bitcoin deposits found by a new chain-watcher ('bwatch') into database tables and handles blockchain reorganizations by demoting transactions back to unconfirmed r…

New database write paths for wallet UTXOs and transactionsReorg revert logic demotes rather than deletes rows to preserve metadataOwner-string constructors added to avoid silent unwatch failures from format mismatches
bc021011by Sangbida Chaudhuri+543−07 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritytests: update cli tests to reflect bwatch rpcsby Sangbida Chaudhuri · f4955c82 · May 11, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · Sangbida Chaudhuri

tests: update cli tests to reflect bwatch rpcs

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritytests: wait for bwatch block write before stopping in test_db_hookby Sangbida Chaudhuri · d5e69b24 · May 11, 2026 · 1 fileMessage 83 · StrongTriage 0Details
Commit message · Sangbida Chaudhuri

tests: wait for bwatch block write before stopping in test_db_hook

I'm not entirely sure about changing this test but this test was written prior to bwatch. Bwatch unconditionally triggers datastore writes on startup when it polls bcli.

If the async poll chain completes during shutdown rather than normal operation, the db_write hook fires after dblog has wound down, so the main DB gets the write but dblog doesn't capture it.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI review queuedbwatch: detect reorgs and roll back tipby Sangbida Chaudhuri · 65c92ec3 · May 11, 2026 · 3 filesMessage 68 · AdequateLow 46Details
Commit message · Sangbida Chaudhuri

bwatch: detect reorgs and roll back tip

When handle_block fetches the next block, validate its parent hash
against our current tip. If they disagree we're seeing a reorg: pop our
in-memory + persisted tip via bwatch_remove_tip, walk the history one
back, and re-fetch from the new height. Each fetch may itself reorg
further, so the loop naturally peels off as many stale tips as needed
until the chain rejoins.

After every rollback, tell watchman the new tip via
revert_block_processed so its persisted height tracks bwatch's. If we
crash before the ack lands, watchman's stale height will be higher than
ours on restart, which retriggers the rollback.

If the rollback exhausts our history (we rolled back past the oldest
record we still hold) we zero current_height/current_blockhash and let
the next poll re-init from bitcoind's tip.

Notifying owners that their watches were reverted lands in a subsequent
commit.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validationsecond-pass: broader security terminology
AI analysis · Low 46/100

This commit adds blockchain reorganization (reorg) handling to Core Lightning's 'bwatch' plugin. A reorg happens when the Bitcoin network temporarily replaces a known block with a different one. Previously, bwatch appears to have blindly trusted each new block's parent hash, which could have left the plugin tracking an invalid or forked chain. The patch detects mismatched parent hashes, rolls back its internal tip one block at a time, and tells another component ('watchman') to do the same. It is a defensive correctness fix rather than an active exploit patch; the commit message notes that notifying users whose transactions were affected is deferred to a later commit.

Lower-prioritycommon: add helpers for bitcoin blockids.by Rusty Russell · bf5ee2a6 · May 11, 2026 · 7 filesMessage 68 · AdequateTriage 0Details
Commit message · Rusty Russell

common: add helpers for bitcoin blockids.

Like bitcoin_txid, they are special backwards-printed snowflakes.

Thanks Obama!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritycommon: expose json_hex_to_be32/be64by Sangbida Chaudhuri · 2dd780c9 · May 11, 2026 · 4 filesMessage 58 · ThinTriage 0Details
Commit message · Sangbida Chaudhuri

common: expose json_hex_to_be32/be64

These helper functions decode hex strings from JSON into big-endian 32-bit and 64-bit values, useful for parsing datastore entries exposing these into a more common space so they can be used by bwatch in the future.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Lower-prioritybwatch: add skeleton and makefileby Sangbida Chaudhuri · 764e81d5 · May 11, 2026 · 9 filesMessage 68 · AdequateTriage 0Details
Commit message · Sangbida Chaudhuri

bwatch: add skeleton and makefile

bwatch is an async block scanner that consumes blocks from bcli or any
other bitcoind interface and communicates with lightningd by sending
it updates. In this commit we're only introducing the plugin and some
files that we will populate in future commits.

Changelog-Added: bwatch plugin, this is to handle block processing outside of lightningd. Not yet hooked up to lightningd.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritybwatch: add rescan engine for historical blocksby Sangbida Chaudhuri · acc0b667 · May 11, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · Sangbida Chaudhuri

bwatch: add rescan engine for historical blocks

bwatch_start_rescan(cmd, w, start_block, target_block) replays
blocks from start_block..target_block for a single watch w (or
for all watches if w is NULL).

The rescan runs asynchronously: fetch_block_rescan ->
rescan_block_done -> next fetch, terminating with rescan_complete
(which returns success for an RPC-driven rescan and aux_command_done
for a timer-driven one).

Nothing calls bwatch_start_rescan yet; the add-watch RPCs wire it
up next.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritybwatch: poll chain and append blocksby Sangbida Chaudhuri · 591a57b2 · May 11, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · Sangbida Chaudhuri

bwatch: poll chain and append blocks

Add the chain-polling loop. A timer fires bwatch_poll_chain, which calls
getchaininfo to learn bitcoind's tip; if we're behind, we fetch the next
block via getrawblockbyheight, append it to the in-memory history and
persist it to the datastore. After each successful persist we reschedule
the timer at zero delay so we keep fetching back-to-back until we catch
up to the chain tip. Once getchaininfo reports no new block, we settle
into the steady-state cadence (30s by default, tunable via the
--bwatch-poll-interval option).

This commit only handles the happy path. Reorg detection, watchman
notifications and watch matching land in subsequent commits.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritybwatch: scan blocks for scid matchesby Sangbida Chaudhuri · 8eccae35 · May 11, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Sangbida Chaudhuri

bwatch: scan blocks for scid matches

After the per-tx scriptpubkey/outpoint pass, walk every scid watch and
fire watch_found for any whose encoded blockheight matches the block
just processed.

The watch's scid encodes the expected (txindex, outnum), so we jump
straight there without scanning. If the position is out of range
(txindex past the block, or outnum past the tx) we send watch_found
with tx=NULL, which lightningd treats as the "not found" case.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritybwatch: fire blockdepth notifications per blockby Sangbida Chaudhuri · b5c5fe4b · May 11, 2026 · 5 filesMessage 80 · StrongTriage 0Details
Commit message · Sangbida Chaudhuri

bwatch: fire blockdepth notifications per block

Subdaemons like channel_open and onchaind care about confirmation
depth, not the underlying tx. Walk blockdepth_watches on every new
block and send watch_found with the current depth to each owner.

This is what keeps bwatch awake in environments like Greenlight,
where we'd otherwise prefer to hibernate: as long as something is
waiting on a confirmation milestone, the blockdepth watch holds the
poll open; once it's deleted, we're free to sleep again.

Depth fires before the per-tx scan so restart-marker watches get a
chance to spin up subdaemons before any outpoint hits land for the
same block. Watches whose start_block is ahead of the tip are stale
(reorged-away, awaiting delete) and skipped.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Lower-prioritybwatch: notify watch owners on reorgby Sangbida Chaudhuri · 3b73db58 · May 11, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Sangbida Chaudhuri

bwatch: notify watch owners on reorg

When bwatch removes its tip block on a reorg, fire watch_revert for
the affected owners so lightningd-side handlers actually run.

Two cases, depending on whether the watch has an anchor block:

- scriptpubkey watches have no anchor (a wallet address can receive
funds in any block), so notify every owner on every removed block.
Handlers are cheap and defensive — they check their own state and
no-op if there is nothing to undo.

- outpoint, scid, and blockdepth watches each carry a start_block.
Notify only those with start_block >= removed_height (the watch's
anchor is gone). Older watches stay armed and refire naturally on
the new chain.

Owners are snapshotted before dispatch so revert handlers can safely
call watchman_unwatch_* and mutate the watch tables.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritybwatch: gate chain polling behind --experimental-bwatchby Sangbida Chaudhuri · c3d4ae3c · May 11, 2026 · 4 filesMessage 73 · AdequateTriage 0Details
Commit message · Sangbida Chaudhuri

bwatch: gate chain polling behind --experimental-bwatch

The plugin still loads (so its options and RPCs stay registered) but
stays inert — no chain polling, no watch replay — unless the user
explicitly opts in with --experimental-bwatch.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI review queuedsetconfig: fix crash on dynamic multi-value plugin optionsby wqxoxo · e9fee876 · May 11, 2026 · 14 filesMessage 81 · StrongLow 45Details
Commit message · wqxoxo

setconfig: fix crash on dynamic multi-value plugin options

We had an assert(!(ot->type & OPT_MULTI)) which crashed when using
setconfig on a plugin option marked as both dynamic and multi.

The fix changes plugin_set_dynamic_opt to accept an array of values
(scalar options pass a 1-element array, multi options pass the complete
set). For multi options, setconfig replaces ALL values atomically - an
empty array clears them.

Fixes: #8295

Changelog-Fixed: setconfig no longer crashes on dynamic multi-value plugin options

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Low 45/100

This commit fixes a crash in Core Lightning's `setconfig` command. Previously, if a user tried to change a plugin option that accepts multiple values and can be changed while running, the node would hit an internal assertion and crash. The fix allows `setconfig` to handle these multi-value options properly by accepting an array of values and replacing all existing values at once.

Lower-prioritylibplugin: add helpers for multi-string optionsby Lagrang3 · 03e5d22a · May 11, 2026 · 3 filesMessage 60 · AdequateTriage 0Details
Commit message · Lagrang3

libplugin: add helpers for multi-string options

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityxpay: config option xpay-user-layerby Lagrang3 · 2346d379 · May 11, 2026 · 4 filesMessage 68 · AdequateTriage 0Details
Commit message · Lagrang3

xpay: config option xpay-user-layer

This option allow user to configure xpay to always use the layers
specified.

Changelog-Added: xpay: config option xpay-user-layer

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritypytest: fix use of deprecated `getroute` in tests/test_misc.py::test_graceful_htlcby Rusty Russell · b1d77a62 · May 11, 2026 · 1 fileMessage 83 · StrongTriage 0Details
Commit message · Rusty Russell

pytest: fix use of deprecated `getroute` in tests/test_misc.py::test_graceful_htlc

Merge conflict:

```
FAILED tests/test_misc.py::test_graceful_htlc - pyln.client.lightning.RpcError: RPC call failed: method: getroute, payload: {'id': '03cecbfdc68544cc596223b68ce0710c9e5d2c9cb317ee07822d95079acc703d31', 'amount_msat': 10000, 'riskfactor': 1, 'cltv': 9}, error: {'code': -32601, 'message': 'Command "getroute" is deprecated'}
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityconfig: change message-padding to false by default.by Rusty Russell · 04fc51f5 · May 11, 2026 · 4 filesMessage 85 · StrongTriage 0Details
Commit message · Rusty Russell

config: change message-padding to false by default.

Too many reports of problems with weird nodes.

Changelog-Changed: Protocol: `message-padding` defaults to false, due to poor detection of broken implementations.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI review queuedgraceful: new command to instruct CLN to start shutting down.by Rusty Russell · a87062b2 · May 11, 2026 · 16 filesMessage 81 · StrongInformational 22Details
Commit message · Rusty Russell

graceful: new command to instruct CLN to start shutting down.

Based on "lightningd: add "snub-idle-channels" dynamic config variable" by
Matt Whitlock <c-lightning@mattwhitlock.name>.

Fixes: https://github.com/ElementsProject/lightning/issues/4842
Changelog-Added: JSON-RPC: `graceful` command to prepare CLN for shutdown.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 22/100

This commit adds a new JSON-RPC command called 'graceful' that lets a Core Lightning node operator tell their node to prepare for shutdown. When invoked, the node stops accepting new HTLCs (payment forwarding commitments), declines to reestablish idle channels, disconnects peers that have no active HTLCs, and waits for any remaining in-flight HTLCs to resolve before returning. It is an operational/administrative feature, not a vulnerability fix. The commit does not change authentication or authorization rules; it only adds a new state (LD_STATE_GRACE) and the logic to enter and exit it safely.

Lower-prioritylightningd.service: shut down lightningd properly.by Rusty Russell · bd8e8e64 · May 11, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Rusty Russell

lightningd.service: shut down lightningd properly.

And use the new graceful shutdown to make it even smoother!

Fixes: #7697
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: contrib: the systemd lightningd.service script now shuts down lightningd properly.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-prioritygraceful: add a timeout for user simplicity.by Rusty Russell · 8ee0a613 · May 11, 2026 · 4 filesMessage 60 · AdequateTriage 0Details
Commit message · Rusty Russell

graceful: add a timeout for user simplicity.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityCCAN: update to get json_escape_dup helper.by Rusty Russell · f8c42de4 · May 11, 2026 · 4 filesMessage 60 · AdequateTriage 0Details
Commit message · Rusty Russell

CCAN: update to get json_escape_dup helper.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritypytest: cleanup test_pay_avoid_low_fee_chan flake.by Rusty Russell · 52bb4922 · May 11, 2026 · 1 fileMessage 63 · AdequateTriage 0Details
Commit message · Rusty Russell

pytest: cleanup test_pay_avoid_low_fee_chan flake.

Use standard names, and don't wait for each channel: wait for the final result.

In particular, make sure l1 sees *all* the gossip!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

63/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Provides detailed explanatory context
Lower-priorityaskrene: all remove_small_channel_layer when maxparts=1.by Rusty Russell · a577e530 · May 11, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

askrene: all remove_small_channel_layer when maxparts=1.

We were doing it for "auto.no_mpp_support", but not maxparts=1.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityaskrene: improve errors we return.by Rusty Russell · b74305b5 · May 11, 2026 · 6 filesMessage 60 · AdequateTriage 0Details
Commit message · Rusty Russell

askrene: improve errors we return.

In particular, we can return PAY_ROUTE_TOO_EXPENSIVE.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritypytest: use maxparts=1 not the soon-to-be-deprecated "auto.no_mpp_support" layer.by Rusty Russell · d62c3833 · May 11, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

pytest: use maxparts=1 not the soon-to-be-deprecated "auto.no_mpp_support" layer.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body