CommitWatch RSS
EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1854 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue538AI analyses
147commits · 30 days
226commits · 60 days
804commits · 180 days
1850commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
431Strong · 80–100
1163Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dovgopoly1502164
Rusty Russell95873237072
Sangbida Chaudhuri1473171066
Dusty Daemon771314066
ShahanaFarooqui931020063
daywalker9089532062
Níckolas Goline40513076
Lagrang376428069
Christian Decker3647072
Vincenzo Palazzo834080
Chandra Pratap56250082
ekzyis222063
Analysis record

Published AI watches

Last scanned 56 minutes ago

Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: require Homebrew GNU make and gpatch on macOS

This commit only updates macOS installation instructions in the documentation. It tells macOS users to install newer GNU versions of 'make' and 'patch' from Homebrew because Apple's built-in tools are too old for building and running sourc…

d3ff1474by Sangbida Chaudhuri+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: drop obsolete x-prefix in compacter-slow.sh

This commit is a trivial shell script cleanup. It removes an old-fashioned 'x' prefix from a string comparison in a test helper script so that a newer version of the Shellcheck linter stops warning about it. The change does not alter progr…

474c272aby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist amount+currency parsing into common code.

This commit moves existing code that parses payment amounts (Bitcoin millisatoshis, 'any' amount, or fiat currency amounts) from one plugin file into a shared library so it can be reused by a future feature. It is a code refactoring with n…

Refactoring of amount-parsing code into a shared helperAddition of explicit u64 overflow guards (mul_overflows_u64, add_overflows_u64) in the new common codeNo change to wire protocol or RPC interface semantics
e0f86c17by Rusty Russell+112−723 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist hash_str helper into its own header.

This commit is a routine code cleanup: it moves a small string-hashing helper function into a shared header file so it can be reused without being copied and pasted. There is no change to behavior, no bug fix, and no security relevance.

581bbb1fby Rusty Russell+16−176 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: actually tell askrene when a payment succeeded.

This commit fixes a bookkeeping bug in Core Lightning's xpay plugin. Previously, when a payment succeeded, xpay did not tell the askrene routing-helper that the route worked. As a result, askrene kept stale or overly pessimistic ideas abou…

Missing success feedback to routing layer can degrade payment reliabilityStale negative impressions may bias future path selection toward worse or failing routesNo direct funds-loss primitive is introduced or fixed
a66fabd4by Rusty Russell+40−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: correctly order constraints.

This commit fixes a bug in Core Lightning's routing helper (askrene) where two kinds of channel information—hard limits called 'constraints' and usage estimates called 'impressions'—were being applied in the wrong order. Because impression…

Routing decision bug caused by incorrect ordering of time-relative channel statePotential payment failure or acceptance of an over-capacity routeRegression test added demonstrating incorrect route acceptance before fix
4b6fe4a1by Rusty Russell+211−1182 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: don't leak channel intel entries

This commit fixes a memory leak in the askrene plugin of Core Lightning. When individual channel intelligence entries were deleted, the code removed the entry from its array but forgot to free two internal pointers (impression and constrai…

Memory leak in plugin data structure cleanupMissing deallocation of nested pointers before array removalFix located in routing/intelligence plugin (askrene)
8891f414by Lagrang3+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: tests should expect the new error messages

This commit only updates test files so that automated checks expect slightly different error wording from the xpay payment command. It does not change any production code, so it cannot introduce a security vulnerability or fix one on its o…

0b67601fby Lagrang3+24−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit expiry to offer limit, or 10 minutes with currency conversion.

This commit tightens the expiration time on invoices created from BOLT12 offers. Previously, all such invoices defaulted to a 2-hour payment window. Now, if the offer has an absolute expiry, the invoice expires when the offer expires; and …

BOLT12 invoice expiry now bounded by offer absolute expiryCurrency-converted invoices use short expiry to limit exchange-rate exposureNew regression test added for expiry behavior
a6cf4915by Rusty Russell+55−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't do previous invoice checking in createinvoicerequest.

This commit removes a local sanity check in Core Lightning's experimental 'createinvoicerequest' command. Previously, when creating a recurring invoice request, the code looked up past payments by label to verify the previous recurrence wa…

Removal of local payment-state validation for recurring invoice requestsParameter rename from recurrence_label to label in internal RPC callsTest expectations changed from local 'previous invoice has not been paid' errors to remote failure messages
4348d8acby Rusty Russell+5−1224 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: handle weird labels in recurrence_label parameter.

This commit fixes how the fetchinvoice plugin handles user-supplied labels that contain special characters such as backslashes, quotes, tabs, and newlines. Previously these labels were passed as raw strings, which could cause JSON encoding…

JSON injection / improper escaping of user-controlled input passed between RPC componentsPotential mismatch between label parsing and label serialization leading to functional failures or unexpected behaviorFix is narrowly scoped to a single plugin and parameter
d7f87f2dby Rusty Russell+37−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Add unit tests for str_to_u64

This commit only adds a new automated test file that checks how a helper function (str_to_u64) converts text strings to unsigned 64-bit integers. It does not change any production code, so it cannot by itself introduce a security vulnerabi…

dddb455dby Lagrang3+203−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: add tests for what we want askrene to do.

This commit only adds a new pytest test file. It does not change any production code. The test describes desired future behavior for the askrene routing module's error messages when a payment source or destination lacks enough channel capa…

518620aeby Rusty Russell+67−01 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queueddecode / bolt12-cli: add missing invreq_recurrence_cancel field.by Rusty Russell · bf55e580 · May 11, 2026 · 11 filesMessage 73 · AdequateInformational 21Details
Commit message · Rusty Russell

decode / bolt12-cli: add missing invreq_recurrence_cancel field.

We missed this. It's experimental, so no changelog needed.

Spotted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 21/100

This commit adds a missing data field, invreq_recurrence_cancel, to Core Lightning's decode command and related generated code. The field is part of the experimental BOLT12 recurring invoice request format and lets a payer signal that they want to cancel a recurring invoice. The change is mostly schema, RPC, gRPC, and test updates to expose and validate the new field. It is not a traditional security patch, but missing the field could have caused invoice-request decoding or validation to be incomplete for an experimental feature.

AI review queuedcommon: add bolt12 payer proof support (decode)by Vincenzo Palazzo · d477db45 · May 11, 2026 · 10 filesMessage 68 · AdequateInformational 22Details
Commit message · Vincenzo Palazzo

common: add bolt12 payer proof support (decode)

[Adapted for my decode routines --RR]
Changelog-EXPERIMENTAL: JSON-RPC: `decode` now supports the `lnp` payer proof format.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 22/100

This commit adds support for decoding a new experimental BOLT12 format called a 'payer proof' in the Core Lightning node's decode command and related API bindings. It is a feature addition that extends existing decoding logic to recognize and return fields for payer proofs, such as the payment preimage, signature, and merkle proof hashes. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a protocol-support enhancement.

Lower-priorityaskrene: added reservations leak test under loadby ScuttoZ · ba855be9 · May 11, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · ScuttoZ

askrene: added reservations leak test under load

Changelog-None

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-priorityaskrene: relax timeout for reservation leakby Lagrang3 · e71f63f5 · May 11, 2026 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · Lagrang3

askrene: relax timeout for reservation leak

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Security candidatetxprepare: fix withdraw returning unsigned transactionby Vincenzo Palazzo · 16cf06b4 · May 9, 2026 · 2 filesMessage 100 · StrongLow 33Details
Commit message · Vincenzo Palazzo

txprepare: fix withdraw returning unsigned transaction

The withdraw command was returning an unsigned raw transaction in
its 'tx' response field. This happened because signpsbt_done() used
psbt_txid() to extract utx->tx, which internally calls
wally_psbt_extract() with WALLY_PSBT_EXTRACT_NON_FINAL — stripping
all signature and witness data.

The broadcast itself succeeded because sendpsbt internally finalizes
the PSBT via psbt_final_tx(), but the 'tx' field returned to the
user had empty scriptSigs and no witness data.

This is a regression from 908f834d6 ("Update libwally to 0.8.8,
support PSBTv2") which rewrote psbt_txid() from manually copying
final_scriptsig/redeem_script into the cloned tx, to using
wally_psbt_extract(WALLY_PSBT_EXTRACT_NON_FINAL) which strips all
signing data by design.

Fix by finalizing the signed PSBT in signpsbt_done() and extracting
the fully signed transaction via psbt_final_tx(). The txid
verification still uses psbt_txid() (which is correct for txid
computation since txids exclude witness data).

Fixes: https://github.com/ElementsProject/lightning/issues/8701
Changelog-Fixed: withdraw now returns a fully signed transaction in the `tx` response field.
Signed-off-by: Vincenzo Palazzo <vincenzopalazzo@member.fsf.org>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarydefensive validationsigning or wallet path
AI analysis · Low 33/100

This commit fixes a bug in Core Lightning's 'withdraw' command where the transaction shown to the user was returned without valid signatures or witness data, even though the actual network broadcast worked correctly. The returned 'tx' field looked like a real transaction but would be rejected if a user tried to broadcast it themselves. The fix ensures the returned transaction is fully signed and final.

Security candidatetests: add regression tests for withdraw returning unsigned txby Vincenzo Palazzo · c000fc90 · May 9, 2026 · 1 fileMessage 100 · StrongLow 46Details
Commit message · Vincenzo Palazzo

tests: add regression tests for withdraw returning unsigned tx

Adds two tests to reproduce issue #8701 where the withdraw command
returns an unsigned raw transaction in the 'tx' response field:

1. test_withdraw_returns_signed_tx: verifies that withdraw's 'tx' field
contains witness data for all inputs (basic wallet UTXOs).

2. test_withdraw_close_output_signed: verifies signing works when
withdrawing funds that include channel close outputs (anchor/P2WSH
with CSV locks), which was the exact scenario in the reported issue.

The root cause is that psbt_txid() uses WALLY_PSBT_EXTRACT_NON_FINAL
which strips signatures/witnesses, and the withdraw response returns
this unsigned tx instead of the finalized one.

Changelog-None
Signed-off-by: Vincenzo Palazzo <vincenzopalazzo@member.fsf.org>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundaryfuzzing or regression evidencesigning or wallet path
AI analysis · Low 46/100

This commit only adds two new automated tests that demonstrate an existing bug: the 'withdraw' command returns an unsigned raw transaction in its 'tx' field because an internal helper strips away signatures. The tests are marked as expected-to-fail, so the actual code flaw is not fixed here. A user relying on the returned transaction could receive a version that looks valid but would be rejected by the Bitcoin network because it lacks required witness data. The commit documents the regression but does not change the wallet logic itself.

Security candidatebitcoin/tx.c: use 330 sat dust limit for P2TR/P2WPKH change outputs Fixes #8395 Fix by checking is_elements: Elements keeps 546 sat, Bitcoin uses 330 sat. Changelog-Fixed: Transactions now correctly create change outputs >= 330 sat for P2TR/P2WPKH instead of absorbing them as feesby Andezion · fcd6671a · May 8, 2026 · 2 filesMessage 81 · StrongLow 36Details
Commit message · Andezion

bitcoin/tx.c: use 330 sat dust limit for P2TR/P2WPKH change outputs Fixes #8395
Fix by checking is_elements: Elements keeps 546 sat, Bitcoin uses 330 sat.
Changelog-Fixed: Transactions now correctly create change outputs >= 330 sat for P2TR/P2WPKH instead of absorbing them as fees

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundary
AI analysis · Low 36/100

This commit fixes a bug in Core Lightning where small change outputs on Bitcoin were being treated as too tiny to keep, causing them to be silently added to transaction fees instead of returned to the user. The fix lowers the threshold for P2TR/P2WPKH change outputs on Bitcoin from 546 satoshis to 330 satoshis, matching current Bitcoin network rules. Elements/Liquid still uses 546. Users could previously lose small change amounts as extra fees.

AI review queuedfuzz-tests: Add a seed corpus for the new testby Chandra Pratap · 8a4ffea7 · May 7, 2026 · 538 filesMessage 78 · AdequateInformational 15Details
Commit message · Chandra Pratap

fuzz-tests: Add a seed corpus for the new test

Add a minimal input set as a seed corpus for the newly introduced
test. This leads to discovery of interesting code paths faster.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesecond-pass: unusually broad change
AI analysis · Informational 15/100

This commit only adds test data files (a seed corpus) for a fuzzing test named fuzz-open_channel. Fuzzing corpora are collections of example inputs used to exercise code during automated testing. No production code, protocol logic, or configuration is changed, and the commit message does not describe any security fix or vulnerability.

Lower-priorityfuzz-tests: Add a test for `fundee_channel()`by Chandra Pratap · 4284fdef · May 7, 2026 · 2 filesMessage 78 · AdequateInformational 12Details
Commit message · Chandra Pratap

fuzz-tests: Add a test for `fundee_channel()`

Changelog-None: `fundee_channel()` in `openingd/openingd.c` is
responsible for handling incoming `open_channel` messages from a
peer. Since it deals with external input, add a test for it.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 12/100

This commit only adds a new automated fuzz test for an existing function called fundee_channel(). It does not change the actual production code that handles incoming channel offers, so it cannot by itself introduce a security vulnerability or fix one. It is a testing improvement.

Lower-priorityfuzz-tests: add test for amount-{sat, msat} arithmeticby Chandra Pratap · 9fae53fe · May 7, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Chandra Pratap

fuzz-tests: add test for amount-{sat, msat} arithmetic

Changelog-None: The `fuzz-amount` test doesn't fuzz the arithmetic
operations for `struct amount_sat` and `struct amount_msat`. Add a
test for them.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit only adds a new fuzz test file. Fuzz tests feed random data into program functions to check they behave correctly. There is no change to the actual wallet, network, or payment code that runs in production, so this commit does not introduce or fix a security vulnerability by itself.

AI review queuedfuzz-tests: Add a seed corpus for the new testby Chandra Pratap · 45ee23f0 · May 7, 2026 · 67 filesMessage 78 · AdequateInformational 15Details
Commit message · Chandra Pratap

fuzz-tests: Add a seed corpus for the new test

Add a minimal input set as a seed corpus for the newly introduced
test. This leads to discovery of interesting code paths faster.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesecond-pass: unusually broad change
AI analysis · Informational 15/100

This commit only adds test data files (a fuzzing seed corpus) for a new fuzz test called fuzz-amount-arith. It does not change any production code, so it cannot introduce a security vulnerability or fix one. It is purely a testing/development aid.

Lower-priorityMakefile: allow raw amount access in fuzz testsby Chandra Pratap · 5302cbf5 · May 7, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Chandra Pratap

Makefile: allow raw amount access in fuzz tests

Updates the `check-amount-access` target to exclude `tests/fuzz/*`
so fuzzing tests can directly verify .satoshis and .millisatoshis
without failing CI.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit changes a project Makefile so that a code-style check no longer scans files in the fuzz-testing directory. The check normally flags direct access to internal Bitcoin-amount fields (satoshis/millisatoshis) because that can lead to arithmetic overflow bugs. The change lets fuzz tests read those raw fields directly without causing a CI failure. It is a tooling/CI exemption, not a change to wallet, cryptographic, or network code, and it does not introduce a vulnerability on its own.

Lower-prioritychanbackup: Store the latest recvd peer storage onlyby Aditya Sharma · a1f907ce · May 7, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Aditya Sharma

chanbackup: Store the latest recvd peer storage only

Node should not store SCB that is older than what we already have.

Changelog-Fixed: Protocol: we now only store the most recent peer backup when recovering from peers.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritychanbackup: make getemergencyrecoverdata rpc more verboseby Aditya Sharma · 98ba9eb2 · May 7, 2026 · 10 filesMessage 73 · AdequateTriage 0Details
Commit message · Aditya Sharma

chanbackup: make getemergencyrecoverdata rpc more verbose

Adding more information to geremergencyrecoverdata, to let users know if they are using
legacy file format and the list of all the backed up channel ids.

Key Changes:
- Added:
1. can_create_penalty: To let user know if they need to update the file.
2. backed_up_channel_ids: List of all the backed up channels

Changelog-Changed: Made getemergencyrecoverdata more verbose.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityinjectpayment_onion: fix fees for blinded pathsby Lagrang3 · 7ee162b3 · May 7, 2026 · 5 filesMessage 68 · AdequateTriage 0Details
Commit message · Lagrang3

injectpayment_onion: fix fees for blinded paths

Changelog-Fixed: injectpayment_onion: fix fees for blinded paths, treat amount_msat as the incoming amount and not the forward amount.

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityxpay: fix reported value of amount_sent_msatby Lagrang3 · 8c2821e8 · May 7, 2026 · 2 filesMessage 60 · AdequateTriage 0Details
Commit message · Lagrang3

xpay: fix reported value of amount_sent_msat

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityxpay: add regtest for blinded path feesby Lagrang3 · c1274f65 · May 7, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Lagrang3

xpay: add regtest for blinded path fees

When the paying node is the entry point to the blinded path it will send
the wrong amount to the next peer. Instead of sending AMT_MSAT it will
send AMT_MSAT+FEES_MSAT.

# we pay fees to ourselves
htlcs = l1.rpc.listhtlcs()["htlcs"]
assert len(htlcs) == 1
assert htlcs[0]["payment_hash"] == b12_decode["invoice_payment_hash"]
> assert htlcs[0]["amount_msat"] == AMT_MSAT
E assert 15000 == 10000

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Security candidateopening: reject fundchannel_complete with unsigned non-segwit inputsby wqxoxo · 508ce922 · May 7, 2026 · 2 filesMessage 73 · AdequateLow 49Details
Commit message · wqxoxo

opening: reject fundchannel_complete with unsigned non-segwit inputs

We can't know the txid of an unsigned PSBT with non-segwit (legacy
P2PKH/P2SH) inputs. wally_psbt_extract() fills in an empty scriptSig
for unsigned inputs, giving a txid that changes once the user signs
and broadcasts. openingd then waits forever for a tx it will never see.

Changelog-Fixed: fundchannel_complete: reject PSBTs with unsigned non-segwit inputs (txid is indeterminate until signed).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 49/100

This commit fixes a bug in Core Lightning's channel-funding command. If a user supplied an unsigned old-style (non-SegWit) bitcoin input when completing a channel open, the software would compute a transaction ID that could change later when the user actually signed and broadcast the transaction. The node would then wait forever for a funding transaction it would never recognize, leaving the channel opening process stuck. The fix rejects such inputs up front with a clear error message.

Lower-priorityBuild: Only use -Werror on debug builds.by Rusty Russell · 245c1322 · May 5, 2026 · 1 fileMessage 92 · StrongTriage 0Details
Commit message · Rusty Russell

Build: Only use -Werror on debug builds.

Otherwise, we can break people's builds if they upgrade compiler, for example.

Yet we still want -Werror for developers, and CI.

Changelog-Changed: Build: We no longer use `-Werror` by default, unless --enable-debugbuild is set.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

92/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Lower-priorityCI: add a 32-bit cross build.by Rusty Russell · 6150fbcb · May 5, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · Rusty Russell

CI: add a 32-bit cross build.

This broke the recent docker upload in the release.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
Lower-priorityconfigure: delete non-working "do we have Python mako" test.by Rusty Russell · 9127050b · May 5, 2026 · 2 filesMessage 83 · StrongTriage 0Details
Commit message · Rusty Russell

configure: delete non-working "do we have Python mako" test.

It would need to run under uv. I noticed it failing while debugging the 32-bit CI build,
but it fails everywhere.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityconfigure: run python tests under uv run.by Rusty Russell · 2599c093 · May 5, 2026 · 1 fileMessage 82 · StrongTriage 0Details
Commit message · Rusty Russell

configure: run python tests under uv run.

They're misleading otherwise.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode✓ Mentions testing or verification
AI review queuedtests: test funds don't get stuck as reserved after `withdraw` fails due to broadcast rejection (e.g. feerate below mempoolminfee).by enaples · 36f02d32 · May 4, 2026 · 1 fileMessage 72 · AdequateLow 44Details
Commit message · enaples

tests: test funds don't get stuck as reserved after `withdraw` fails due to broadcast rejection (e.g. feerate below mempoolminfee).

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Explains rationale or failure mode✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 44/100

This commit only adds a new test case that demonstrates a known bug in Core Lightning's wallet handling. When a `withdraw` command fails because the Bitcoin node rejects the transaction broadcast (for example, the fee is too low), some funds can remain marked as 'reserved' even though they were never actually spent. The test documents the bug and includes a manual workaround using `unreserveinputs`. It does not fix the underlying issue, so user funds can appear stuck until manually unreserved.

AI review queuedflake8: fixed trailing whitespaceby MSimeZ · db9ea1a4 · May 4, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · MSimeZ

flake8: fixed trailing whitespace

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit removes a single blank line containing trailing whitespace from a test file. It is a cosmetic lint cleanup with no functional or security relevance.

Lower-priorityfix nagle time delay for macOS-Issue #9064by Mattia · 91c8c37c · May 4, 2026 · 1 fileMessage 53 · ThinTriage 0Details
Commit message · Mattia

fix nagle time delay for macOS-Issue #9064

53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body