CommitWatch RSS
EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1856 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue1853AI analyses
140commits · 30 days
227commits · 60 days
803commits · 180 days
1839commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
432Strong · 80–100
1164Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dovgopoly15015164
Rusty Russell95873958072
Sangbida Chaudhuri14731146066
Dusty Daemon771377066
ShahanaFarooqui931093063
daywalker9090589062
Níckolas Goline40540076
Lagrang376476069
Christian Decker36436072
Vincenzo Palazzo838080
Chandra Pratap56256082
ekzyis222063
Analysis record

Published AI watches

Last scanned 44 minutes ago

Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: require Homebrew GNU make and gpatch on macOS

This commit only updates macOS installation instructions in the documentation. It tells macOS users to install newer GNU versions of 'make' and 'patch' from Homebrew because Apple's built-in tools are too old for building and running sourc…

d3ff1474by Sangbida Chaudhuri+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: drop obsolete x-prefix in compacter-slow.sh

This commit is a trivial shell script cleanup. It removes an old-fashioned 'x' prefix from a string comparison in a test helper script so that a newer version of the Shellcheck linter stops warning about it. The change does not alter progr…

474c272aby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist amount+currency parsing into common code.

This commit moves existing code that parses payment amounts (Bitcoin millisatoshis, 'any' amount, or fiat currency amounts) from one plugin file into a shared library so it can be reused by a future feature. It is a code refactoring with n…

Refactoring of amount-parsing code into a shared helperAddition of explicit u64 overflow guards (mul_overflows_u64, add_overflows_u64) in the new common codeNo change to wire protocol or RPC interface semantics
e0f86c17by Rusty Russell+112−723 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist hash_str helper into its own header.

This commit is a routine code cleanup: it moves a small string-hashing helper function into a shared header file so it can be reused without being copied and pasted. There is no change to behavior, no bug fix, and no security relevance.

581bbb1fby Rusty Russell+16−176 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: actually tell askrene when a payment succeeded.

This commit fixes a bookkeeping bug in Core Lightning's xpay plugin. Previously, when a payment succeeded, xpay did not tell the askrene routing-helper that the route worked. As a result, askrene kept stale or overly pessimistic ideas abou…

Missing success feedback to routing layer can degrade payment reliabilityStale negative impressions may bias future path selection toward worse or failing routesNo direct funds-loss primitive is introduced or fixed
a66fabd4by Rusty Russell+40−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: correctly order constraints.

This commit fixes a bug in Core Lightning's routing helper (askrene) where two kinds of channel information—hard limits called 'constraints' and usage estimates called 'impressions'—were being applied in the wrong order. Because impression…

Routing decision bug caused by incorrect ordering of time-relative channel statePotential payment failure or acceptance of an over-capacity routeRegression test added demonstrating incorrect route acceptance before fix
4b6fe4a1by Rusty Russell+211−1182 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: don't leak channel intel entries

This commit fixes a memory leak in the askrene plugin of Core Lightning. When individual channel intelligence entries were deleted, the code removed the entry from its array but forgot to free two internal pointers (impression and constrai…

Memory leak in plugin data structure cleanupMissing deallocation of nested pointers before array removalFix located in routing/intelligence plugin (askrene)
8891f414by Lagrang3+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: tests should expect the new error messages

This commit only updates test files so that automated checks expect slightly different error wording from the xpay payment command. It does not change any production code, so it cannot introduce a security vulnerability or fix one on its o…

0b67601fby Lagrang3+24−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit expiry to offer limit, or 10 minutes with currency conversion.

This commit tightens the expiration time on invoices created from BOLT12 offers. Previously, all such invoices defaulted to a 2-hour payment window. Now, if the offer has an absolute expiry, the invoice expires when the offer expires; and …

BOLT12 invoice expiry now bounded by offer absolute expiryCurrency-converted invoices use short expiry to limit exchange-rate exposureNew regression test added for expiry behavior
a6cf4915by Rusty Russell+55−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't do previous invoice checking in createinvoicerequest.

This commit removes a local sanity check in Core Lightning's experimental 'createinvoicerequest' command. Previously, when creating a recurring invoice request, the code looked up past payments by label to verify the previous recurrence wa…

Removal of local payment-state validation for recurring invoice requestsParameter rename from recurrence_label to label in internal RPC callsTest expectations changed from local 'previous invoice has not been paid' errors to remote failure messages
4348d8acby Rusty Russell+5−1224 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: handle weird labels in recurrence_label parameter.

This commit fixes how the fetchinvoice plugin handles user-supplied labels that contain special characters such as backslashes, quotes, tabs, and newlines. Previously these labels were passed as raw strings, which could cause JSON encoding…

JSON injection / improper escaping of user-controlled input passed between RPC componentsPotential mismatch between label parsing and label serialization leading to functional failures or unexpected behaviorFix is narrowly scoped to a single plugin and parameter
d7f87f2dby Rusty Russell+37−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Add unit tests for str_to_u64

This commit only adds a new automated test file that checks how a helper function (str_to_u64) converts text strings to unsigned 64-bit integers. It does not change any production code, so it cannot by itself introduce a security vulnerabi…

dddb455dby Lagrang3+203−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: add tests for what we want askrene to do.

This commit only adds a new pytest test file. It does not change any production code. The test describes desired future behavior for the askrene routing module's error messages when a payment source or destination lacks enough channel capa…

518620aeby Rusty Russell+67−01 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritysecond release candidate for 25.12by Madeline Paech · c59d9bea · Nov 28, 2025 · 11 filesMessage 45 · ThinInformational 15Details
Commit message · Madeline Paech

second release candidate for 25.12

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a routine version bump from the first to the second release candidate of Core Lightning 25.12. It updates version strings in packaging files, the changelog, and adds a newly compiled helper binary. There is no code change that fixes or introduces a security issue in this commit itself.

Lower-prioritydoc: generate documentation for askrene-bias-node.by Rusty Russell · 385b6a9e · Nov 27, 2025 · 2 filesMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

doc: generate documentation for askrene-bias-node.

I noticed it was missing.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds a missing documentation entry for an existing command. It does not change any executable code, security settings, or user permissions. There is no security issue here.

Lower-prioritycheck-bolt: move to devtools, clean up tools/by Rusty Russell · 76ad32ec · Nov 27, 2025 · 4 filesMessage 60 · AdequateInformational 15Details
Commit message · Rusty Russell

check-bolt: move to devtools, clean up tools/

And leave $(TOOLS) as user-visible tools.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit simply moves a source-code checking tool (check-bolt) from one directory (tools/) to another (devtools/) and updates the build files accordingly. It does not change any code that runs the Core Lightning node, handles payments, or touches network communication. There is no security issue here.

Lower-prioritywire: add explicit-length fromwire_peektype variant.by Rusty Russell · f0524088 · Nov 27, 2025 · 2 filesMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

wire: add explicit-length fromwire_peektype variant.

Useful for continuous streams.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit adds a new helper function for reading message types from raw byte buffers where the caller already knows the buffer length. The existing helper required a special memory-managed pointer; the new variant works with plain length-counted buffers, which is useful for streaming data. There is no security-relevant change here—just a small, clean API addition.

Security candidateaskrene: move datastore wire functions into separate file for lightning-downgrade to use.by Rusty Russell · eb83a205 · Nov 27, 2025 · 4 filesMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

askrene: move datastore wire functions into separate file for lightning-downgrade to use.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
update trust
AI analysis · Informational 15/100

This commit is a straightforward code reorganization: it moves existing data-serialization helper functions for the askrene plugin into a new shared file (datastore_wire.c/h) so another tool (lightning-downgrade) can reuse them. No security bug is introduced or fixed; the logic is essentially unchanged.

Security candidatetools/lightning-downgrade: tool to downgrade (offline) v25.12 to v25.09.by Rusty Russell · 9981e238 · Nov 27, 2025 · 5 filesMessage 73 · AdequateInformational 24Details
Commit message · Rusty Russell

tools/lightning-downgrade: tool to downgrade (offline) v25.12 to v25.09.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Added: tools: `lightningd-downgrade` can downgrade your database from v25.12 to v25.09 if something goes wrong.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
update trustsigning or wallet path
AI analysis · Informational 24/100

This commit adds a new offline command-line tool, lightning-downgrade, that lets a user roll back a Core Lightning node's database from the upcoming v25.12 release to the previous v25.09 release. It is meant as a recovery aid if an upgrade goes wrong. The tool only works when the lightning node is stopped, checks for a running process, and reverses database migrations one by one using built-in revert SQL and functions. It also deletes an incompatible gossip store file after downgrading. There is no direct evidence in the commit that this fixes an active security bug; it is a new operational utility.

Security candidatedoc: add a manual page.by Rusty Russell · 39a92116 · Nov 27, 2025 · 3 filesMessage 53 · ThinInformational 15Details
Commit message · Rusty Russell

doc: add a manual page.

In particular, document when downgrades are not possible.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

53/100 · ThinMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
update trustdocumentation-only discount
AI analysis · Informational 15/100

This commit only adds a new manual page for an existing tool called lightning-downgrade. It does not change any code, commands, or behavior. It simply documents how to use the tool and warns users that downgrades may fail if newer features have been used. There is no security issue in this documentation change itself.

Security candidateCI: add test that we can downgrade the node and run it under v25.09.by Rusty Russell · 640888aa · Nov 27, 2025 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · Rusty Russell

CI: add test that we can downgrade the node and run it under v25.09.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
update trustdocumentation-only discount
AI analysis · Informational 15/100

This commit only adds a new automated CI test job that checks whether Core Lightning can be downgraded to the previous release (v25.09). It does not change any production code, wallet logic, network handling, or cryptographic operations. There is no security-relevant change visible in the diff.

Security candidatelightningd-downgrade: downgrade askrene's layer info too.by Rusty Russell · a45c9072 · Nov 27, 2025 · 3 filesMessage 73 · AdequateLow 44Details
Commit message · Rusty Russell

lightningd-downgrade: downgrade askrene's layer info too.

If they had a channel bias, and ran xpay, it will update the bias
to a v2 bias (with a timestamp). We must downgrade that, or the
older version won't load!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
update trust
AI analysis · Low 44/100

This commit fixes a bug in Core Lightning's downgrade tool. If a user ran a newer version that stored an updated 'channel bias' record (used by the xpay payment plugin to influence routing), then tried to downgrade to v25.09, the older version would fail to load because it didn't understand the newer data format. The patch teaches the downgrade tool to convert those newer records back to the older format. It is a data-compatibility fix, not a remote exploit.

Security candidatepytest: add failing downgrade test.by Rusty Russell · 4d8f1d33 · Nov 27, 2025 · 1 fileMessage 70 · AdequateInformational 12Details
Commit message · Rusty Russell

pytest: add failing downgrade test.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
update trust
AI analysis · Informational 12/100

This commit only adds a new test to the project's test suite. It checks that the database downgrade tool correctly refuses to downgrade when a newer feature (a node bias in the 'askrene' routing layer) is present. There is no change to production code, no fix for a vulnerability, and no security-relevant behavior change in the software itself.

AI review queuedglobal: use lightning-hsmtool not hsmtool.by Rusty Russell · 23f21416 · Nov 27, 2025 · 18 filesMessage 78 · AdequateInformational 15Details
Commit message · Rusty Russell

global: use lightning-hsmtool not hsmtool.

When installed, the name is `lightning-hsmtool`. We actually copy
`tools/hsmtool` to `tools/lightning-hsmtool` but that's a silly step
which we should get rid of.

So:
1. Make sure our documentation always refers to it as lightning-hsmtool.
2. Make sure our tests invoke it as `lightning-hsmtool`.
3. Rename the C file.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathparser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a simple housekeeping rename. The Core Lightning project previously built a tool called `hsmtool`, then copied it to `lightning-hsmtool` during installation. This change removes the extra copy step and makes the installed name `lightning-hsmtool` the canonical name everywhere: source file, build system, documentation, and tests. No security vulnerability is introduced or fixed.

Security candidatewallet: separate datastore access functions for the lightning-downgrade tool to access.by Rusty Russell · 2a066b92 · Nov 27, 2025 · 8 filesMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

wallet: separate datastore access functions for the lightning-downgrade tool to access.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
update trustsigning or wallet path
AI analysis · Informational 15/100

This commit is a straightforward code reorganization: it moves existing datastore (key-value storage) database access functions out of wallet.c into a new pair of files, datastore.c and datastore.h, so a separate downgrade tool can reuse them. No behavior changes, no new features, and no security fixes are visible in the diff.

Security candidatewallet: separate migration table into its own source file.by Rusty Russell · 6dcf4e7b · Nov 27, 2025 · 13 filesMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

wallet: separate migration table into its own source file.

This will make it easier to share with the downgrade tool.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
update trustsigning or wallet path
AI analysis · Informational 15/100

This commit is a pure code refactoring: it moves the large database migration table and related functions from wallet/db.c into a new pair of files, wallet/migrations.c and wallet/migrations.h. The goal stated in the commit message is to make the migration list easier to share with a future downgrade tool. No behavior of the migrations themselves is changed, no SQL statements are modified, and no security fixes or vulnerabilities are introduced.

Security candidatewallet: add optional sql and functions to downgrade db.by Rusty Russell · 378293d2 · Nov 27, 2025 · 1 fileMessage 73 · AdequateInformational 18Details
Commit message · Rusty Russell

wallet: add optional sql and functions to downgrade db.

This will allow a downgrade tool to attempt to downgrade a node to the
previous version.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
update trustsigning or wallet path
AI analysis · Informational 18/100

This commit adds infrastructure to Core Lightning's database code so that future versions can, in some cases, roll back (downgrade) a database to the previous software version. It is a feature addition, not a fix for an active security bug. The new code includes safety checks to refuse downgrade when data would be lost, such as when a newly added 'withheld' column has actually been used. There is no direct evidence in the commit that this resolves a known vulnerability or that an attacker can exploit it.

Lower-prioritylightningd: print UNUSUAL log message if a command is very slow.by Rusty Russell · fc23b538 · Nov 27, 2025 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

lightningd: print UNUSUAL log message if a command is very slow.

We don't expect an internal command to take 5 seconds to service
without explicitly pausing: if it does, log at a higher level.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This change simply adds a warning message to the log file when an internal command takes unusually long (more than 5 seconds). It does not fix a vulnerability, change permissions, or alter how commands are processed. It is a diagnostic/monitoring improvement.

Lower-priorityconnectd: don't log at INFO level for known issue.by Rusty Russell · acc41ddc · Nov 27, 2025 · 1 fileMessage 85 · StrongInformational 12Details
Commit message · Rusty Russell

connectd: don't log at INFO level for known issue.

We get spammed by this, because we somehow missed occasional channel closes.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 12/100

This change simply reduces how often one routine log message is printed. It does not fix a security bug or change how the program handles money or network connections. The underlying behavior—occasionally missing channel close notifications—remains unchanged, only the logging level is quieter for one specific known message.

Lower-prioritycontrib: Remove litecoin keys as CLN has recently stopped supporting litecoinby ShahanaFarooqui · edfb64c7 · Nov 27, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

contrib: Remove litecoin keys as CLN has recently stopped supporting litecoin

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit simply deletes a public PGP key file for a Litecoin developer from the repository. Core Lightning (CLN) has dropped Litecoin support, so the key is no longer needed. There is no code change, no vulnerability, and no security risk.

Lower-prioritydoc: Fix mdx format errors generated due to Readme v2 migrationsby ShahanaFarooqui · ff0ee6df · Nov 27, 2025 · 15 filesMessage 77 · AdequateInformational 15Details
Commit message · ShahanaFarooqui

doc: Fix mdx format errors generated due to Readme v2 migrations

Changelog-None: Documentation fixes only.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit is a documentation-only cleanup. It fixes Markdown/MDX formatting errors caused by migrating documentation to a new platform (ReadMe v2). The changes include removing old platform-specific image and tutorial tile blocks, fixing broken links, correcting typos, adjusting whitespace, and converting formatting to standard Markdown. No source code, configuration defaults, or runtime behavior of Core Lightning was changed.

Security candidatehsmd: fix HSM sent an unknown message type errorby Sangbida Chaudhuri · 4c7e2d44 · Nov 27, 2025 · 2 filesMessage 80 · StrongLow 32Details
Commit message · Sangbida Chaudhuri

hsmd: fix HSM sent an unknown message type error

When we enter the wrong passphrase hsmd crashes like this with an unknown message type:

lightning_hsmd: Failed to load hsm_secret: Wrong passphrase (version v25.12rc1-7-g7713a42-modded)
0x102ba44bf ???
send_backtrace+0x4f:0
0x102b0900f status_failed
common/status.c:207
0x102af1a37 hsmd_send_init_reply_failure
hsmd/hsmd.c:301
0x102af1497 load_hsm
hsmd/hsmd.c:446
0x102af1497 init_hsm
hsmd/hsmd.c:548
0x102b29e63 next_plan
ccan/ccan/io/io.c:60
0x102b29e63 do_plan
ccan/ccan/io/io.c:422
0x102b29d8b io_ready
ccan/ccan/io/io.c:439
0x102b2b4bf io_loop
ccan/ccan/io/poll.c:470
0x102af0a83 main
hsmd/hsmd.c:886
lightningd: HSM sent unknown message type

This change swaps write_all() to wire_synce_write() because write_all() is missing the wire protocol length prefix. We also don't send a stack trace anymore if the user has entered the wrong passphrase and exit cleanly.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
access controlsigning or wallet path
AI analysis · Low 32/100

This commit fixes a bug in Core Lightning's Hardware Security Module daemon (hsmd). When a user entered the wrong wallet passphrase, the daemon would crash with a confusing 'HSM sent unknown message type' error and print a stack trace. The fix ensures the error message is sent using the correct wire protocol format and that wrong-passphrase failures exit cleanly without a stack trace. It is primarily a reliability and user-experience fix, not a security vulnerability that allows remote exploitation.

Lower-prioritytools: Sort Fedora tar by nameby ShahanaFarooqui · e04153f1 · Nov 27, 2025 · 1 fileMessage 82 · StrongInformational 18Details
Commit message · ShahanaFarooqui

tools: Sort Fedora tar by name

And do not replace Fedora shasums from verification because Fedora binaries are deterministic now.

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Informational 18/100

This commit changes the release build script for Core Lightning. It makes the Fedora release tarball list its files in a fixed alphabetical order and removes a workaround that copied Fedora checksums from an external source. The change improves build reproducibility and simplifies verification, but it does not appear to fix or introduce a security vulnerability.

Lower-priorityci: Add skip_validation option to test the release on non-tagged commitby ShahanaFarooqui · 4a67100c · Nov 27, 2025 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · ShahanaFarooqui

ci: Add skip_validation option to test the release on non-tagged commit

Changelog-None: Improved release action CI testing

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit changes the project's automated release workflow to add a manual testing option. It lets maintainers run the release build process on a non-tagged commit by skipping the normal validation check and forcing a specific version. There is no security vulnerability in the change itself; it is a CI/testing convenience feature.

Lower-prioritydoc: Update documentation for reproducible Fedora binariesby ShahanaFarooqui · 192fc6ae · Nov 27, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · ShahanaFarooqui

doc: Update documentation for reproducible Fedora binaries

Changelog-None: Already added details in PR #8692.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates the project's release checklist documentation. It changes the example command for building release binaries to include Fedora alongside Ubuntu, and corrects a line that incorrectly said the Fedora image was non-reproducible. There are no code changes, no configuration changes, and no changes to how the software runs or handles data.

Lower-prioritychange log for release candidate 1 to include 8690by Madeline Paech · 7713a427 · Nov 24, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Madeline Paech

change log for release candidate 1 to include 8690

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only edits the project's CHANGELOG.md file. It adds a one-line note that a bug fix for the `listpays` plugin was included in the release candidate, updates the release date, and adds a link to pull request #8690. There are no code changes and no security relevance in the diff itself.

AI review queuedCI: don't run configure on *host* for release.by Rusty Russell · 9627bf9b · Nov 24, 2025 · 1 fileMessage 88 · StrongInformational 15Details
Commit message · Rusty Russell

CI: don't run configure on *host* for release.

It breaks, but more importantly we don't need to install lowdown any more,
since the check in build-release.sh has been removed.

```
Run sudo apt-get install -y lowdown
Reading package lists...
Building dependency tree...
Reading state information...
The following NEW packages will be installed:
lowdown
0 upgraded, 1 newly installed, 0 to remove and 21 not upgraded.
Need to get 129 kB of archives.
After this operation, 314 kB of additional disk space will be used.
Get:1 file:/etc/apt/apt-mirrors.txt Mirrorlist [144 B]
Get:2 http://azure.archive.ubuntu.com/ubuntu noble/universe amd64 lowdown amd64 1.1.0-1 [129 kB]
Fetched 129 kB in 0s (2971 kB/s)
Selecting previously unselected package lowdown.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 216225 files and directories currently installed.)
Preparing to unpack .../lowdown_1.1.0-1_amd64.deb ...
Unpacking lowdown (1.1.0-1) ...
Setting up lowdown (1.1.0-1) ...
Processing triggers for man-db (2.12.0-4build2) ...
Not building database; man-db/auto-update is not 'true'.

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.
checking for getpagesize() in <unistd.h>... yes
checking for isblank() in <ctype.h>... yes
checking for little endian... yes
checking for memmem in <string.h>... yes
checking for memrchr in <string.h>... yes
checking for mmap() declaration... yes
checking for /proc/self/maps exists... yes
checking for qsort_r cmp takes trailing arg... yes
checking for __attribute__((section)) and __start/__stop... yes
checking for stack grows upwards... no
checking for statement expression support... yes
checking for <sys/filio.h>... no
checking for <sys/termios.h>... yes
checking for <sys/unistd.h>... yes
checking for __typeof__ support... yes
checking for unaligned access to int... yes
checking for utime() declaration... yes
checking for __attribute__((warn_unused_result))... yes
checking for #pragma omp and -fopenmp support... yes
checking for <valgrind/memcheck.h>... no
checking for working <ucontext.h... yes
checking for passing pointers via makecontext()... yes
checking for __builtin_cpu_supports()... yes
checking for closefrom() offered by system... yes
checking for F_CLOSEM defined for fctnl.... no
checking for close_range syscall available as __NR_close_range.... yes
checking for F_MAXFD defined for fcntl.... no
checking for zlib support... yes
checking for libsodium with IETF chacha20 variants... no
checking for sqlite3... yes
checking for postgres... yes
checking for User Statically-Defined Tracing (USDT)... no
checking for compiler is GCC... yes
checking for GCC version is 7 or above... yes
Writing variables to config.vars.2200... yes
Writing header to ccan/config.h.2200... yes
checking for python3-mako... not found
checking for lowdown... found
checking for sha256sum... found
checking for jq... found
Setting PREFIX... /usr/local
Setting CC... cc
Setting CONFIGURATOR_CC... cc
Setting CWARNFLAGS... -Wall -Wundef -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wold-style-definition -Werror -Wno-maybe-uninitialized -Wshadow=local
Setting CDEBUGFLAGS... -std=gnu11 -g -fstack-protector-strong
Setting COPTFLAGS... -Og
CSANFLAGS not found
FUZZFLAGS not found
FUZZER_LIB not found
LLVM_LDFLAGS not found
SQLITE3_CFLAGS not found
Setting SQLITE3_LDLIBS... -lsqlite3
Setting POSTGRES_INCLUDE... -I/usr/include/postgresql
Setting POSTGRES_LDLIBS... -L/usr/lib/x86_64-linux-gnu -lpq
SODIUM_CFLAGS not found
SODIUM_LDLIBS not found
Setting VALGRIND... 0
Setting DEBUGBUILD... 0
Setting COMPAT... 1
Setting PYTEST... python3 -m pytest
Setting STATIC... 0
Setting CLANG_COVERAGE... 0
Setting ASAN... 0
Setting UBSAN... 0
Setting TEST_NETWORK... regtest
Setting HAVE_PYTHON3_MAKO... 0
Setting SHA256SUM... sha256sum
Setting FUZZING... 0
Setting RUST... 1
Setting PYTHON... python3
Setting SED... sed
*** We need a libsodium >= 1.0.4 (released 2015-06-11).
Error: Process completed with exit code 1.
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencedocumentation-only discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine fix to the project's automated release build script on GitHub. It removes an unnecessary step that installed a documentation tool and ran a configuration script on the build host. The change only affects how release binaries are produced internally and does not change any code that users run.

Lower-priorityFix BOLT11 annotation loss after sendonion failureby wqxoxo · b9065079 · Nov 24, 2025 · 1 fileMessage 81 · StrongLow 30Details
Commit message · wqxoxo

Fix BOLT11 annotation loss after sendonion failure

Fixes #6978 where bolt11 annotations were lost when sendonion failed early and payment was retried.

When sendonion RPC fails before saving payment to database, invstring_used flag would remain true, causing retry attempts to omit bolt11 parameter. Successful retries would then save to DB without bolt11 annotation.

Move invstring_used flag setting from payment_createonion_success to payment_sendonion_success. This ensures the flag is only set after sendonion actually succeeds. The bolt11 will be sent with every sendonion attempt until the first successful one, accepting the minor redundancy for cleaner state management.
Changelog-Fixed: Plugins: `listpays` can be missing the bolt11 information in some cases where `pay` is used.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 30/100

This commit fixes a bookkeeping bug in Core Lightning's payment plugin. When a user pays a BOLT11 invoice using the `pay` command, the plugin can retry the payment if the first attempt fails early. Previously, a flag was set too soon, causing retries to omit the original invoice string. If a retry then succeeded, the stored payment record would permanently lack the BOLT11 invoice information. The fix moves the flag so it is only set after `sendonion` succeeds, ensuring the invoice string is included on every retry attempt. This is a data-integrity/user-experience bug, not a security vulnerability.