Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 0 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
3f91083b · Aug 31, 2026 · 2 filesTriage 8lightningd: sanitize "usage" for registered plugins
We first check that the "usage" can be unescaped before handing it down
to jsonrpc_command_add. The latter can only fail if there is a method
collision.
Changelog-None
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
0550e5a2 · Aug 24, 2026 · 1 fileTriage 5pytest: onion message reply path with no hops must not stop the node
Regression test: inject an onion message whose blinded reply path
declares num_hops=0 and check the node processes it and stays up.
Co-Authored-By: Claude <noreply@anthropic.com>
(cherry picked from commit 5580b1b9d8595e947504a1600181f9df1ef90615)
084baf59 · Aug 24, 2026 · 2 filesTriage 0offers: treat an unparseable reply path as absent, not fatal
A remote peer supplies the reply path of an onion message, and its
blinded hop count is a single unbounded byte. A zero-hop path parses to
an empty hop array, which json_to_blinded_path rejects with NULL;
offers then called plugin_err, and as an important builtin its death
takes lightningd down with it.
Drop a hopless reply path in lightningd when the message is decoded, and
in offers log and ignore any reply path that fails to parse rather than
aborting: a value that arrived from a remote peer must never terminate
the plugin.
Changelog-Fixed: plugins: `offers` no longer stops the node when an onion message carries a reply path with no hops.
Co-Authored-By: Claude <noreply@anthropic.com>
(cherry picked from commit 5fe925d2996bdcda04e3eebfb1fbabc9296de498)
9e93e9f2 · Aug 24, 2026 · 2 filesTriage 0common: fix tlv_span returning huge length for out-of-range stream
tlv_span tracked its range with two pointers and returned end - start.
end was assigned only after the type > maxfield test, so a stream whose
first in-range field also exceeds maxfield left end NULL while start was
set, and the guard that copies start over only fired when start was NULL.
The returned end - start was then a pointer difference against NULL,
close to the full width of size_t, which callers hand to sha256_update
as a length: an out-of-bounds read walking mapped memory until it faults.
Track the span as offsets rather than pointers, and return an empty span
(at the range's position) whenever no field falls inside the range or the
end precedes the start, which is the correct measure for such a stream.
Changelog-Fixed: A crafted BOLT12 message could cause an out-of-bounds read while computing its identifier.
Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit a0b451761edf2d0148b6787f0d2f07aea44a2fff)
122baa98 · Aug 24, 2026 · 4 filesTriage 0doc: fix typos across getting-started, plugins and contributor docs
prefered -> preferred, specifiy -> specify, preceeding -> preceding,
compatability -> compatibility, sucessfully -> successfully.
c1551c55 · Aug 24, 2026 · 1 fileLow 25Cargo.lock: update dependencies
```
cargo update
Updating crates.io index
Locking 87 packages to latest Rust 1.85.0 compatible versions
Updating aho-corasick v1.1.4 -> v1.1.5
Updating android_system_properties v0.1.5 -> v0.1.6
Updating anyhow v1.0.103 -> v1.0.104
Updating async-trait v0.1.89 -> v0.1.92
Updating bitcoin v0.32.101 -> v0.32.102
Updating bitcoin-consensus-encoding v1.0.0 -> v1.2.0
Updating bitcoin-internals v0.5.0 -> v0.6.0
Updating bitflags v2.13.0 -> v2.13.1
Updating cc v1.2.67 -> v1.4.4
Updating crc32fast v1.5.0 -> v1.5.1
Updating data-encoding v2.11.0 -> v2.11.1
Updating displaydoc v0.2.6 -> v0.2.7
Updating dnssec-prover v0.6.8 -> v0.6.9
Updating either v1.16.0 -> v1.18.0
Updating fastrand v2.4.1 -> v2.5.0
Updating find-msvc-tools v0.1.9 -> v0.1.11
Updating futures v0.3.32 -> v0.3.34
Updating futures-channel v0.3.32 -> v0.3.34
Updating futures-core v0.3.32 -> v0.3.34
Updating futures-executor v0.3.32 -> v0.3.34
Updating futures-io v0.3.32 -> v0.3.34
Updating futures-macro v0.3.32 -> v0.3.34
Updating futures-sink v0.3.32 -> v0.3.34
Updating futures-task v0.3.32 -> v0.3.34
Updating futures-util v0.3.32 -> v0.3.34
Updating h2 v0.4.15 -> v0.4.18
Updating hex-conservative v0.3.2 -> v1.2.0
Updating http v1.4.2 -> v1.5.0
Updating http-body v1.0.1 -> v1.1.0
Updating http-body-util v0.1.3 -> v0.1.5
Updating hybrid-array v0.4.13 -> v0.4.14
Updating hyper v1.10.1 -> v1.11.0
Updating ipnet v2.12.0 -> v2.12.1
Updating jiff v0.2.32 -> v0.2.35
Adding jiff-core v0.1.0
Updating jiff-static v0.2.32 -> v0.2.35
Updating js-sys v0.3.103 -> v0.3.104
Updating libc v0.2.186 -> v0.2.189
Updating lightning v0.1.11 -> v0.1.12
Updating lightning-types v0.2.1 -> v0.2.12
Updating litemap v0.8.2 -> v0.8.3
Updating log v0.4.33 -> v0.4.34
Updating mio v1.2.1 -> v1.2.2
Updating num-integer v0.1.46 -> v0.1.47
Updating portable-atomic v1.13.1 -> v1.15.0
Updating potential_utf v0.1.5 -> v0.1.6
Updating proc-macro2 v1.0.106 -> v1.0.107
Updating pulldown-cmark-to-cmark v22.0.0 -> v22.0.1
Updating quote v1.0.46 -> v1.0.47
Updating regex v1.13.0 -> v1.13.1
Updating regex-automata v0.4.15 -> v0.4.18
Updating rustls v0.23.41 -> v0.23.43
Updating rustls-pki-types v1.15.0 -> v1.15.1
Updating rustls-webpki v0.103.13 -> v0.103.15
Updating serde v1.0.228 -> v1.0.229
Updating serde_core v1.0.228 -> v1.0.229
Updating serde_derive v1.0.228 -> v1.0.229
Updating serde_json v1.0.150 -> v1.0.151
Updating serde_qs v1.1.2 -> v1.1.3
Updating simd-adler32 v0.3.9 -> v0.3.10
Updating simd_cesu8 v1.1.1 -> v1.2.0
Updating socket2 v0.6.4 -> v0.6.5
Removing syn v2.0.118
Adding syn v2.0.119
Adding syn v3.0.4
Updating thiserror v2.0.18 -> v2.0.20
Updating thiserror-impl v2.0.18 -> v2.0.20
Updating tinystr v0.8.3 -> v0.8.4
Updating tokio v1.52.3 -> v1.53.1
Updating tokio-macros v2.7.0 -> v2.7.2
Updating tokio-stream v0.1.18 -> v0.1.19
Updating tokio-util v0.7.18 -> v0.7.19
Updating wasm-bindgen v0.2.126 -> v0.2.127
Updating wasm-bindgen-futures v0.4.76 -> v0.4.77
Updating wasm-bindgen-macro v0.2.126 -> v0.2.127
Updating wasm-bindgen-macro-support v0.2.126 -> v0.2.127
Updating wasm-bindgen-shared v0.2.126 -> v0.2.127
Updating web-sys v0.3.103 -> v0.3.104
Updating webpki-root-certs v1.0.8 -> v1.0.9
Updating webpki-roots v1.0.8 -> v1.0.9
Updating writeable v0.6.3 -> v0.6.4
Updating zerocopy v0.8.54 -> v0.8.56
Updating zerocopy-derive v0.8.54 -> v0.8.56
Updating zerotrie v0.2.4 -> v0.2.5
Updating zerovec v0.11.6 -> v0.11.8
Updating zerovec-derive v0.11.3 -> v0.11.6
Updating zlib-rs v0.6.6 -> v0.6.7
Updating zmij v1.0.22 -> v1.0.23
```
Changelog-None
This commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link it to a known vulnerability. Dependency updates can fix hidden security bugs, but this change alone does not prove any specific flaw exists or is being patched.
8e316709 · Aug 21, 2026 · 2 filesTriage 5common: reject dns: addresses which are not hostnames
fromwire_wireaddr() now ignores a DNS descriptor which isn't a hostname, but
parse_wireaddr() still accepts one: it only checks the length. So an
announce-addr which fails is_dnsaddr() is accepted at startup, gossiped, and
then dropped by every peer which receives it, with nothing in our own logs to
say the address is useless.
Apply the same rule where the operator can see the answer. A name which
passes is_dnsaddr() is unaffected; a name which fails it was already being
ignored by everyone.
This also restores the towire/fromwire round trip which tests/fuzz/fuzz-wireaddr
asserts, and which the fromwire-side check alone broke:
Assertion failed: (fromwire_wireaddr((const u8 **)&output_buffer, &len,
&decoded_wa) == FROMWIREADDR_OK),
function run, file fuzz-wireaddr.c, line 37.
Changelog-Changed: config: `dns:` addresses which are not valid hostnames are now rejected at startup instead of being silently ignored by peers.
(cherry picked from commit 0613903e013c8d1f2e634b63af332cbd24804f55)
9bd6c849 · Aug 21, 2026 · 1 fileTriage 0pytest: a revoked commitment paying our shutdown script is still a cheat
A peer that opened without an upfront_shutdown_script can name any script in
its shutdown, including the to_local of a commitment we have already revoked.
Publish that commitment and every output matches a shutdown script we have on
record, so classifying a funding spend by its outputs alone treats it as a
mutual close and the penalty never fires.
Check we recognise it as the revoked commitment it is, sweep it with
OUR_PENALTY_TX, and that the peer's own to_local sweep is dead by the time its
CSV matures.
(cherry picked from commit f05bc959d11b9fd08d9e1f6c2d24a05e59a35ce2)
83f92e4b · Aug 20, 2026 · 2 filesHigh 80common: bound JSON nesting depth when parsing
json_next() and the JSMN result validator each recurse once per level of
nesting, so a sufficiently deeply nested (but otherwise valid) JSON document
could exhaust the C stack. Bound the nesting depth in json_parse_input(),
before either recursive walk runs, and reject anything deeper. The depth
check is itself iterative, so it cannot overflow.
Changelog-Fixed: JSON-RPC: reject excessively-nested JSON rather than risk a stack overflow.
(cherry picked from commit b940aa32b7b385b4139bbc9251b1cca044c496cc)
This commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion for each nesting level, so such input could crash the process by exhausting the C call stack. The patch adds an iterative depth check (maximum 256 levels) before any recursive walk, rejecting over-nested input safely.
af72406a · Aug 20, 2026 · 1 fileTriage 0askrene: make the timestamp-ordered trimming logic stop at the first retained entry.
And clean up the AMOUNT_MSAT(-1ULL) to a clearer UINT64_MAX, correct spacing in if.
4c361c03 · Aug 20, 2026 · 1 fileTriage 0libplugin: handle weird ids, not just weird methods when creating our own JSON ids.
Any JSON-RPC user (or commando, with a rune) could feed in a weird ID,
causing us not to recognize the response and not finish.
353b91c0 · Aug 20, 2026 · 1 fileTriage 0offers: avoid potential expiry underflow when issuing invoices.
Issue #9378 notes that the absolute-expiry subtraction can underflow when an offer is already expired. Clamp that case to a one-second relative expiry so zero retains its cancellation meaning.
[ Added comment --RR ]
9dc16610 · Aug 20, 2026 · 1 fileTriage 0lightningd: remove dead code.
Left over from 4348d8acf00154b44a49f5b97dd7bf3267c1bbee ("lightningd:
don't do previous invoice checking in createinvoicerequest.")
6269ea96 · Aug 20, 2026 · 4 filesTriage 0askrene: don't pass unused ctx arg to fromwire...impression
dcb0b426 · Aug 20, 2026 · 5 filesTriage 0askrene: fix up documentation for impressions.
273d7f02 · Aug 20, 2026 · 2 filesInformational 15common: minor typo fixes
Why it was queuedThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no security relevance.
3188d082 · Aug 19, 2026 · 1 fileTriage 0tests: don't use io logs for commando's oversized reply
test_commando needs a reply over 65535 bytes to exercise commando's
multi-message split, and used getlog level=io to get one. getlog no
longer serves that level, so read back a 100k datastore entry instead.
(cherry picked from commit 9373b5fb710a898849ecc51771cea7cfc64c3511)
f76225f0 · Aug 19, 2026 · 1 fileTriage 0sql: free strmap internal nodes on plugin shutdown
Changelog-None
c4fe4cba · Aug 19, 2026 · 2 filesInformational 20pyln-testing: truncate long testnames
Postgres truncates identifiers at 63 bytes. This can lead to
'DuplicateDatabase' errors for tests with long names, as the nonce and
the node_id may collapse. This commit truncates the testname in favor of
the node_id and the nonce, to avoid conflicting db names.
Changelog-None
Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>
This change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes to accidentally share the same database name and fail with a 'DuplicateDatabase' error. The patch makes sure the unique parts of the name (node ID and random nonce) are kept while the long human-readable test name is shortened instead. It is a reliability fix for the test suite, not a security vulnerability in the live lightning node software.
34883ff7 · Aug 18, 2026 · 2 filesModerate 60wallet: exclude immature coinbase outputs from fee rescue selection
wallet_utxo_boost() selects wallet-funded inputs for anchor and HTLC fee
rescue transactions, but unlike ordinary coin selection it never applied
the coinbase-maturity check. An immature coinbase could therefore be the
sole rescue input, producing a consensus-invalid transaction that Bitcoin
Core rejects as a premature coinbase spend.
Apply the same utxo_is_immature() filter used by deep_enough()/ordinary
selection. Since both call sites pass the live blockheight and rebuild on
reorg/RBF, maturity is revalidated at construction and after reorgs.
This makes test_anchorspend_ignores_immature_coinbase pass, so its xfail
marker is dropped.
Changelog-Fixed: Wallet: anchor and HTLC fee rescue no longer select immature coinbase outputs, which produced a transaction bitcoind rejects
(cherry picked from commit 5e79baacc1c900c29acfae852f6233095872e309)
This fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the network, potentially leaving a channel unable to quickly bump fees during congestion. The patch adds the same maturity check already used for normal spending.
5ae05f21 · Aug 18, 2026 · 1 fileTriage 0tests: cover fee rescue input selection with an immature coinbase
wallet_utxo_boost() picks the wallet inputs which fund anchor and HTLC fee
rescue transactions. Ordinary coin selection filters immature coinbase
outputs via deep_enough(); a rescue funded by one cannot confirm, so rescue
selection needs the same filter.
Give the closing node a single immature block reward as its only wallet
output, and check that it declines to boost rather than selecting it.
Marked xfail(strict=True) since the selector is not yet fixed; the next
commit removes the marker.
(cherry picked from commit daa5654d480381147f9084c6557b972d023a77e4)
cea73b83 · Aug 18, 2026 · 1 fileTriage 0tests: reproduce zero next_commitment_number on advanced channel
BOLT #2 says if next_commitment_number is zero we MUST immediately
fail the channel and broadcast the latest commitment. On an
advanced channel a reset peer sends 0 for both numbers; we warn
about the stale revocation_number and never reach the zero check,
so the channel stays up.
The test funds, pays so next_index is past 1, then injects that
reestablish. It fails until the next commit.
Reproduces: #9425
Reported-by: Leo Nash (@tankyleo)
Signed-off-by: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
eafdd938 · Aug 18, 2026 · 1 fileTriage 0channeld: fail channel on zero next_commitment_number
The existing BOLT #2 quote already required this, but the first
bullet was unimplemented: the only zero check sat under
next_commitment_number == next_index[REMOTE] - 1, after the
stale-revocation warning.
Implement that bullet next to the quote, and drop the nested copy.
Fixes: #9425
Changelog-Fixed: Protocol: immediately fail the channel if channel_reestablish next_commitment_number is zero.
Reported-by: Leo Nash (@tankyleo)
Signed-off-by: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
bfd66b3a · Aug 18, 2026 · 4 filesTriage 0hsmd: test that a NULL reply closes the client exactly once
libhsmd returning NULL has no black-box behaviour change, so drive
hsmd.c's io loop directly: io_set_finish counts the close, and a
write after close aborts.
Changelog-None
(cherry picked from commit 523be992eb1b16df30c3e366129854539cce36ab)
4681177d · Aug 18, 2026 · 2 filesModerate 59askrene: fix crash loading node bias with description
load_node_bias() passed take(description) to two consecutive
set_node_bias() calls. The first call's tal_strdup() consumes the
take (tal_resize_ + tal_steal), so the second take() was on freed
memory and we aborted in to_tal_hdr() with "Not a valid header"
while loading the layer at startup. Since askrene is an important
plugin, lightningd shuts down and the node cannot restart at all.
The description is already a copy off tmpctx, so simply don't take()
it: set_node_bias() strdups it into the bias anyway.
With this, the test from the previous commit passes.
Fixes: #9433
Reported-by: endothermicdev
Changelog-Fixed: askrene: node failed to start (`exited before replying to init`) when a persistent layer contains a node bias with a description
Signed-off-by: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
This commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using it a second time, causing an immediate crash during startup. The fix removes the incorrect 'take ownership' call so the description remains valid for both uses. There is no evidence this crash can be triggered remotely or used as an attack; it appears to be a reliability bug that only affects nodes that already have such saved data.