Core Lightning

This commit adds GitHub Actions workflows to automatically build and publish a documentation website to GitHub Pages. It only touches CI/CD configuration and static HTML pages; it does not change any Core Lightning node code, wallet logic, or network handling. There is no apparent security vulnerability in the diff itself.

This commit simply removes leftover debugging code from a test file that was writing temporary data dumps to /tmp. It is a cleanup change with no security relevance.

This commit only changes how the project's automated test suite handles a few tests that sometimes fail randomly. It removes the 'flaky' test dependency from the project configuration and instead marks five specific tests as flaky directly. There is no change to the actual Core Lightning software that users run, so there is no security impact.

This commit only changes the project's automated testing configuration. It increases the number of parallel test shards for the AddressSanitizer and UndefinedBehaviorSanitizer CI runs from 10 to 12. There is no change to the actual Core Lightning software, its network behavior, or any user-facing functionality.

This commit only changes how the project's automated tests are run. It swaps one pytest plugin (flaky) for another (pytest-rerunfailures), adds a global retry option, and updates the Python package lock file. There is no change to the Core Lightning node software itself, its network behavior, or any user-facing functionality. It is purely a CI/test-infrastructure change.

This commit simply adds two newly-created program names to the .gitignore file, which tells Git not to track compiled binaries. It is a routine housekeeping change with no security relevance.

This commit removes a Nix flake validation job from the project's GitHub Actions CI workflow. It is a routine build-infrastructure change with no direct security relevance to the Core Lightning software itself.

This commit adds a new pytest plugin called pytest-trackflaky that reports test results (test names, pass/fail status, timing, GitHub Actions metadata, and git commit info) to a configurable server URL. It is a CI/testing infrastructure change, not a change to the Core Lightning node software itself. There is no direct security vulnerability in the diff, but it introduces a new data-exfiltration-like path: if an attacker can set the CI_SERVER_URL environment variable in a CI environment, test metadata could be sent to an unexpected destination. The plugin also runs git commands and reads environment variables, which is normal for CI tooling but worth noting.

This commit is a routine update to the project's automated Docker publishing workflow. It adds a second Docker image variant tagged with '-vls' that includes an extra signer component from the Validating Lightning Signer (VLS) project. There is no code change to Core Lightning itself, no bug fix, and no security patch.

This commit is a routine Docker build change. It adds a new optional container image that bundles an external signing tool (VLS) with Core Lightning, and renames the final image stage for clarity. There is no indication of a security vulnerability being fixed or introduced.

This commit only adds documentation explaining how to run a Core Lightning node with an external, optional signing component called VLS remote_hsmd_socket. It changes no source code, no configuration defaults, and no runtime behavior. There is no security issue in the commit itself.

This commit only updates the project's internal release checklist documentation. It changes wording and commands used by maintainers when publishing a new version, such as pushing a specific tag to the origin remote instead of pushing all tags. There is no change to the actual Core Lightning software, its network behavior, or any user-facing functionality, so it has no security impact on users.

This is a release-script fix that changes which files get their checksums recorded. Previously, the script would include every file whose name started with the current version string, which could accidentally pick up leftover files from older releases sitting in the same directory. Now it only records checksums for the exact tarballs and zip file produced for this release. The risk is low, but a bad checksum list could in theory mislead users or build systems about what they are downloading.

This commit is purely a release-versioning change. It renames the release candidate label from v25.12rc3 to the final v25.12 across version files, changelogs, and Python package metadata. There are no code behavior changes, bug fixes, or security fixes in the diff.

This commit simply adds two generated tool names to .gitignore files so that Git does not accidentally track compiled binaries. It does not change any executable code, configuration defaults, or security behavior.

This commit is a routine release-candidate version bump from v25.12rc2 to v25.12rc3. It updates version strings across packaging files and adds changelog notes for the new release candidate. The commit itself does not change any executable logic, cryptographic code, network handling, or security-sensitive behavior.

This is a tiny update to a helper shell script used only for local developer testing. It changes the address type the script asks for from 'bech32' (SegWit) to 'p2tr' (Taproot) because the software now defaults to Taproot addresses. It does not touch any production code, network protocol, wallet security, or cryptographic logic.

This is a tiny test-only cleanup. It replaces a direct Unix socket connection helper with a shared test helper and explicitly closes an old socket to avoid a resource leak during automated tests. There is no change to production code or user-facing security.

This commit fixes a wording bug in error messages produced by the xpay plugin. Previously, when an invoice had a single-hop route hint, any failed channel along the payment path could be incorrectly labeled as 'the invoice's route hint' in the error message, even if the failure happened on an unrelated intermediate channel. The fix adds a check that the failed channel actually matches the route hint's channel ID before using that label. This is a user-facing diagnostic improvement, not a security vulnerability.

This commit only adds a new regression test for an existing wallet fix. It does not change any production code, so it cannot introduce a new security vulnerability or directly fix one in the shipped software. The test verifies that Core Lightning correctly rescans older blocks to find UTXOs it previously missed after a database upgrade.

This commit adds a one-time background scan that re-examines old blocks to find UTXOs (unspent transaction outputs) the wallet may have missed earlier. It is a data-recovery / consistency fix, not an obvious exploit patch. The commit message does not call it a security fix, and there are no supplied references linking it to an attack. The change could matter for security because missed UTXOs can affect channel balances and on-chain funds, but the diff itself is defensive housekeeping.

This fix corrects a startup bug in Core Lightning where, after rolling back recent blocks to re-read them, the node could forget to keep watching certain spent transaction outputs. The main visible symptom was stale network gossip, but it could also cause the node to miss on-chain transactions if it restarted at the wrong time. The patch makes the node refresh its watch list after block rollbacks.

This commit only adds a new automated test to the project's test suite. It does not change any production code, so it cannot directly introduce or fix a security vulnerability in running software. The test is currently marked as expected to fail (xfail), meaning it documents behavior that is not yet working correctly—specifically, how the wallet tracks whether a coin is spent across a blockchain reorganization and a node restart. It may be a regression test for a future bug fix, but by itself it poses no security risk.

This is a routine GitHub Actions CI maintenance change. It removes two unnecessary setup commands (installing a documentation tool called lowdown and running a build configuration script) from the automated step that signs release artifacts. There is no security-relevant change visible in the diff.

This commit simply deletes an old, accidentally included binary file named hsmtool from the repository and adds its name to the ignore list so it won't be committed again. There is no code change, no vulnerability fix, and no security issue introduced or resolved by this commit.