CommitWatch RSS
EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1854 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue538AI analyses
145commits · 30 days
226commits · 60 days
804commits · 180 days
1850commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
431Strong · 80–100
1163Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dovgopoly1502164
Rusty Russell95873237072
Sangbida Chaudhuri1473171066
Dusty Daemon771314066
ShahanaFarooqui931020063
daywalker9089532062
Níckolas Goline40513076
Lagrang376428069
Christian Decker3647072
Vincenzo Palazzo834080
Chandra Pratap56250082
ekzyis222063
Analysis record

Published AI watches

Last scanned 8 minutes ago

Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: require Homebrew GNU make and gpatch on macOS

This commit only updates macOS installation instructions in the documentation. It tells macOS users to install newer GNU versions of 'make' and 'patch' from Homebrew because Apple's built-in tools are too old for building and running sourc…

d3ff1474by Sangbida Chaudhuri+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: drop obsolete x-prefix in compacter-slow.sh

This commit is a trivial shell script cleanup. It removes an old-fashioned 'x' prefix from a string comparison in a test helper script so that a newer version of the Shellcheck linter stops warning about it. The change does not alter progr…

474c272aby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist amount+currency parsing into common code.

This commit moves existing code that parses payment amounts (Bitcoin millisatoshis, 'any' amount, or fiat currency amounts) from one plugin file into a shared library so it can be reused by a future feature. It is a code refactoring with n…

Refactoring of amount-parsing code into a shared helperAddition of explicit u64 overflow guards (mul_overflows_u64, add_overflows_u64) in the new common codeNo change to wire protocol or RPC interface semantics
e0f86c17by Rusty Russell+112−723 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist hash_str helper into its own header.

This commit is a routine code cleanup: it moves a small string-hashing helper function into a shared header file so it can be reused without being copied and pasted. There is no change to behavior, no bug fix, and no security relevance.

581bbb1fby Rusty Russell+16−176 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: actually tell askrene when a payment succeeded.

This commit fixes a bookkeeping bug in Core Lightning's xpay plugin. Previously, when a payment succeeded, xpay did not tell the askrene routing-helper that the route worked. As a result, askrene kept stale or overly pessimistic ideas abou…

Missing success feedback to routing layer can degrade payment reliabilityStale negative impressions may bias future path selection toward worse or failing routesNo direct funds-loss primitive is introduced or fixed
a66fabd4by Rusty Russell+40−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: correctly order constraints.

This commit fixes a bug in Core Lightning's routing helper (askrene) where two kinds of channel information—hard limits called 'constraints' and usage estimates called 'impressions'—were being applied in the wrong order. Because impression…

Routing decision bug caused by incorrect ordering of time-relative channel statePotential payment failure or acceptance of an over-capacity routeRegression test added demonstrating incorrect route acceptance before fix
4b6fe4a1by Rusty Russell+211−1182 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: don't leak channel intel entries

This commit fixes a memory leak in the askrene plugin of Core Lightning. When individual channel intelligence entries were deleted, the code removed the entry from its array but forgot to free two internal pointers (impression and constrai…

Memory leak in plugin data structure cleanupMissing deallocation of nested pointers before array removalFix located in routing/intelligence plugin (askrene)
8891f414by Lagrang3+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: tests should expect the new error messages

This commit only updates test files so that automated checks expect slightly different error wording from the xpay payment command. It does not change any production code, so it cannot introduce a security vulnerability or fix one on its o…

0b67601fby Lagrang3+24−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit expiry to offer limit, or 10 minutes with currency conversion.

This commit tightens the expiration time on invoices created from BOLT12 offers. Previously, all such invoices defaulted to a 2-hour payment window. Now, if the offer has an absolute expiry, the invoice expires when the offer expires; and …

BOLT12 invoice expiry now bounded by offer absolute expiryCurrency-converted invoices use short expiry to limit exchange-rate exposureNew regression test added for expiry behavior
a6cf4915by Rusty Russell+55−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't do previous invoice checking in createinvoicerequest.

This commit removes a local sanity check in Core Lightning's experimental 'createinvoicerequest' command. Previously, when creating a recurring invoice request, the code looked up past payments by label to verify the previous recurrence wa…

Removal of local payment-state validation for recurring invoice requestsParameter rename from recurrence_label to label in internal RPC callsTest expectations changed from local 'previous invoice has not been paid' errors to remote failure messages
4348d8acby Rusty Russell+5−1224 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: handle weird labels in recurrence_label parameter.

This commit fixes how the fetchinvoice plugin handles user-supplied labels that contain special characters such as backslashes, quotes, tabs, and newlines. Previously these labels were passed as raw strings, which could cause JSON encoding…

JSON injection / improper escaping of user-controlled input passed between RPC componentsPotential mismatch between label parsing and label serialization leading to functional failures or unexpected behaviorFix is narrowly scoped to a single plugin and parameter
d7f87f2dby Rusty Russell+37−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Add unit tests for str_to_u64

This commit only adds a new automated test file that checks how a helper function (str_to_u64) converts text strings to unsigned 64-bit integers. It does not change any production code, so it cannot by itself introduce a security vulnerabi…

dddb455dby Lagrang3+203−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: add tests for what we want askrene to do.

This commit only adds a new pytest test file. It does not change any production code. The test describes desired future behavior for the askrene routing module's error messages when a payment source or destination lacks enough channel capa…

518620aeby Rusty Russell+67−01 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritykeysend: increase assumed final_cltv_expiry to 42 (to match LDK).by Rusty Russell · b57edd21 · Apr 10, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Rusty Russell

keysend: increase assumed final_cltv_expiry to 42 (to match LDK).

Reported-by: https://github.com/tnull
Fixes: https://github.com/ElementsProject/lightning/issues/9034
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: JSON-RPC: `keysend` now assumes 42, not 22 for final CLTV (should fix sending to LDK nodes)

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-priorityMakefile: don't try to make generate files .INTERMEDIATE.by Rusty Russell · 4831ec24 · Apr 10, 2026 · 1 fileMessage 85 · StrongTriage 0Details
Commit message · Rusty Russell

Makefile: don't try to make generate files .INTERMEDIATE.

Because they get deleted, `make install` ends up regenerating them, and they trigger
object rebuilds.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Lower-prioritypytest: fix flake in test_closing_anchorspend_htlc_tx_rbfby Rusty Russell · d0de3864 · Apr 10, 2026 · 1 fileMessage 83 · StrongTriage 0Details
Commit message · Rusty Russell

pytest: fix flake in test_closing_anchorspend_htlc_tx_rbf

```
2026-04-02T04:45:50.5882651Z > assert 3000 - 1 < total_feerate_perkw < 3000 + 1
2026-04-02T04:45:50.5883085Z E assert 3001.3083296990844 < (3000 + 1)
2026-04-02T04:45:50.5883354Z
2026-04-02T04:45:50.5883508Z tests/test_closing.py:3853: AssertionError
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Security candidateconnectd: rescue constant message size feature by exploiting OPT_ONION_MESSAGES (LND)by Rusty Russell · 52b70043 · Apr 10, 2026 · 1 fileMessage 65 · AdequateLow 34Details
Commit message · Rusty Russell

connectd: rescue constant message size feature by exploiting OPT_ONION_MESSAGES (LND)

I 🧡 Laolu!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
explicit security language
AI analysis · Low 34/100

This change adjusts when Core Lightning pads its network messages to a constant size. Previously padding was controlled by a developer/testing flag. Now it is enabled only when the connected peer advertises support for 'onion messages' (a newer Lightning feature). The commit message says this works around a bug in LND (another Lightning implementation) where LND would disconnect if it received certain padded 'ping' messages. The fix uses onion-message support as a signal that the remote LND version is new enough to tolerate the padding. There is no direct evidence in the diff of a security vulnerability; it reads as a compatibility/interoperability fix that incidentally preserves a privacy feature (uniform packet sizes).

Security candidateconnectd: rescue constant message size feature by exploiting option 154 (Eclair).by Rusty Russell · a65c6975 · Apr 10, 2026 · 1 fileMessage 65 · AdequateLow 35Details
Commit message · Rusty Russell

connectd: rescue constant message size feature by exploiting option 154 (Eclair).

I 🧡 tbast!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
explicit security language
AI analysis · Low 35/100

This commit adjusts when Core Lightning pads ping messages to keep packet sizes uniform. It now skips padding when talking to Eclair nodes that advertise feature bit 154, because Eclair had a similar bug where it did not reply to certain padded pings, which could cause connection problems. The change is a compatibility workaround, not a direct fix for a vulnerability in Core Lightning itself.

Lower-priorityRevert dev-uniform padding.by Rusty Russell · 5be75c0f · Apr 10, 2026 · 8 filesMessage 68 · AdequateTriage 0Details
Commit message · Rusty Russell

Revert dev-uniform padding.

This reverts:

2252bda0de3cb1f48e7efaaeb061efe32462d007 "connectd: gate uniform message padding behind --dev-uniform-padding"
f844eb0864b6048e3a27024e29b2c92aff919cdb "lightningd: add dev-uniform-padding flag to lightningd".
b7c05f604add41cda7e77e58bc25ac32387488b6 "test: add flag to test_constant_packet_size"

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityconnectd: add "use_uniform_writes" per-peer helper.by Rusty Russell · aae2a0b6 · Apr 10, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

connectd: add "use_uniform_writes" per-peer helper.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityconnectd: keep their_features inside struct peer.by Rusty Russell · 7569c6ed · Apr 10, 2026 · 2 filesMessage 60 · AdequateTriage 0Details
Commit message · Rusty Russell

connectd: keep their_features inside struct peer.

We're about to use it.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritydoc: update release-checklist to make CHANGELOG.md more coherent.by Rusty Russell · b13f5db0 · Apr 10, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

doc: update release-checklist to make CHANGELOG.md more coherent.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
Lower-priorityCHANGELOG.md: sort entries into rough coolness order!by Rusty Russell · d2d4002b · Apr 10, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

CHANGELOG.md: sort entries into rough coolness order!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
Lower-priorityCHANGELOG.md: reformat for consistency, combine some lines.by Rusty Russell · 0e9c4953 · Apr 10, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · Rusty Russell

CHANGELOG.md: reformat for consistency, combine some lines.

Remove "Replacing sed by $(SED) in Makefile ([#8786])" which isn't
user-visiable.

Add `Protocol: Splicing is enabled by default` which didn't get
included because of the missing colon in:

Changelog-Deprecated Splicing is now enabled by default!

In 9b51d6618bb83a6d38407e22e21011f8307489ce!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
Lower-priorityCHANGELOG.md: import v25.12.1 CHANGELOG.md, remove duplicate entries.by Rusty Russell · 1e19ebfc · Apr 10, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

CHANGELOG.md: import v25.12.1 CHANGELOG.md, remove duplicate entries.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
Lower-prioritysql: make LIMIT_PER_LIST into a dev option ...by Lagrang3 · bb0553c8 · Apr 9, 2026 · 1 fileMessage 70 · AdequateLow 25Details
Commit message · Lagrang3

sql: make LIMIT_PER_LIST into a dev option ...

for regression tests.

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Low 25/100

This change turns a hard-coded internal batch size (10,000 items) for the SQL plugin into a developer-only command-line option. It is intended to let regression tests use a smaller value. The option is marked 'dev-' and is not meant for production use. There is no direct security bug in the patch, but making the limit configurable could, in theory, allow a tester or misconfigured node to request very large batches and change resource usage or timing behavior.

AI review queuedsql: fix crash for large channelmoves tables.by Rusty Russell · 2ba55cc6 · Apr 9, 2026 · 2 filesMessage 68 · AdequateModerate 50Details
Commit message · Rusty Russell

sql: fix crash for large channelmoves tables.

I've reworked this: in general we should clear the refresh bit before
calling the jsonrpc to do the update. This allows the wait callback to
set the bit again if there's more to do, so we won't lose entries.

Now it's clear that we can remove the overzealous assert.

sql: plugins/sql.c:1749: refresh_by_created_index: Assertion `td->refresh_needs != REFRESH_UNNECESSARY' failed.
sql: FATAL SIGNAL 6 (version v26.04rc2)
0x5618e147892e send_backtrace
common/daemon.c:38
0x5618e14789bb crashdump
common/daemon.c:83
0x7f54d10ea04f ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7f54d1138eec __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x7f54d10e9fb1 __GI_raise
../sysdeps/posix/raise.c:26
0x7f54d10d4471 __GI_abort
./stdlib/abort.c:79
0x7f54d10d4394 __assert_fail_base
./assert/assert.c:94
0x7f54d10e2ec1 __GI___assert_fail
./assert/assert.c:103
0x5618e1472725 refresh_by_created_index
plugins/sql.c:1749
0x5618e14736af one_refresh_done
plugins/sql.c:579
0x5618e1473932 limited_list_done
plugins/sql.c:1738
0x5618e1477418 handle_rpc_reply
plugins/libplugin.c:1093
0x5618e1477548 rpc_conn_read_response
plugins/libplugin.c:1398
0x5618e147ec71 next_plan
ccan/ccan/io/io.c:60
0x5618e147ef90 do_plan
ccan/ccan/io/io.c:422
0x5618e147f049 io_ready
ccan/ccan/io/io.c:439
0x5618e147ffae io_loop
ccan/ccan/io/poll.c:470
0x5618e14786af plugin_main
plugins/libplugin.c:2461
0x5618e1474b12 main
plugins/sql.c:2219
0x7f54d10d5249 __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
0x7f54d10d5304 __libc_start_main_impl
../csu/libc-start.c:360
0x5618e1470710 ???
_start+0x20:0
0xffffffffffffffff ???
???:0

Diagnosed-by: Lagrang3 <lagrang3@protonmail.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-None: Introduced this release.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Moderate 50/100

This commit fixes a crash in Core Lightning's SQL plugin. The bug was a too-strict internal check (an assertion) that could fail when the plugin had a large number of channel moves to refresh. The fix changes how the plugin tracks which refresh work is still needed, so it no longer trips over itself when new work arrives while a refresh is already running. It is a stability fix for a plugin, not a remote exploit.

AI review queuedsql: add test that triggers bug on channelmovesby Lagrang3 · 96b4da92 · Apr 9, 2026 · 1 fileMessage 78 · AdequateLow 40Details
Commit message · Lagrang3

sql: add test that triggers bug on channelmoves

Updating channelmoves table makes sql to crash if there are more
elements in listchannelmoves than limit_per_list.

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI analysis · Low 40/100

This commit only adds a new test case that demonstrates a bug. The test is marked as expected to fail (xfail). It shows that running a SQL query on the 'channelmoves' table can crash a node if the number of channel movements exceeds an internal list limit. The actual crash-causing code is not fixed here, so this commit by itself does not resolve the issue.

Lower-prioritysplice: Enable the splice in default settingsby Dusty Daemon · 9b51d661 · Apr 9, 2026 · 2 filesMessage 60 · AdequateTriage 0Details
Commit message · Dusty Daemon

splice: Enable the splice in default settings

Turn splicing on by default for channel feature sets!

Changelog-Deprecated Splicing is now enabled by default!

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritysplice script: Fix rare memleak in pluginby Dusty Daemon · 72092258 · Apr 9, 2026 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · Dusty Daemon

splice script: Fix rare memleak in plugin

Fix leaking of the `abort_pkg` if our peer does not support splicing.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Security candidatesplice: Remove experiemental splicing featureby daywalker90 · 3a17da61 · Apr 9, 2026 · 29 filesMessage 45 · ThinInformational 15Details
Commit message · daywalker90

splice: Remove experiemental splicing feature

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100

This commit removes the experimental flag that previously had to be enabled for splicing, making splicing a default feature. It is a feature-promotion and cleanup change, not a security fix. There are no code changes that patch a vulnerability, no mention of a CVE, and no security advisory.

Lower-priorityCI: Turn on diff outputs on failed doc genby Dusty Daemon · 48952927 · Apr 9, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · Dusty Daemon

CI: Turn on diff outputs on failed doc gen

When the doc generator fails, make the CI output the diff of how it failed.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
AI review queuedv2604.rc2by Sangbida Chaudhuri · 39c243ce · Apr 2, 2026 · 10 filesMessage 0 · OpaqueInformational 15Details
Commit message · Sangbida Chaudhuri

v2604.rc2

Changelog-None

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is a routine version bump from v26.04rc1 to v26.04rc2 for Core Lightning. It only updates version strings in packaging files and refreshes the changelog. No code behavior changes are included in the diff itself, so this single commit does not introduce or fix any security issue.

Lower-prioritydoc: provide realistic example for bkpr-report.by Rusty Russell · f067b738 · Apr 2, 2026 · 2 filesMessage 60 · AdequateTriage 0Details
Commit message · Rusty Russell

doc: provide realistic example for bkpr-report.

This should make the accountants happy!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritybkpr-report: enhance tag syntax from {tag:replacement} to {tag?if-set:if-not-set}by Rusty Russell · 90b86107 · Apr 2, 2026 · 6 filesMessage 73 · AdequateTriage 0Details
Commit message · Rusty Russell

bkpr-report: enhance tag syntax from {tag:replacement} to {tag?if-set:if-not-set}

This is more powerful, but we need to do this before release. It lets
us do things like: {credit?+{credit}:0} to only put a `+` in front of
no-zero credit, and {txid?TXID {txid}:Outpoint {outpoint}} to print
either `TXID xxx` or `Outpoint xxx`.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritybkpr-report: make ? work as expected on amount fields.by Rusty Russell · bc931451 · Apr 2, 2026 · 4 filesMessage 75 · AdequateTriage 0Details
Commit message · Rusty Russell

bkpr-report: make ? work as expected on amount fields.

They should test if it's zero, not if it's present.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Lower-prioritycln-grpc: add round-trip tests for notification bindingsby Peter Neuroth · 9336e360 · Apr 2, 2026 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · Peter Neuroth

cln-grpc: add round-trip tests for notification bindings

cln-grpc: clean up notification tests

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritydoc: update pay_part_start and pay_part_endby Peter Neuroth · 48271d53 · Apr 2, 2026 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · Peter Neuroth

doc: update pay_part_start and pay_part_end

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount