EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Repository coverage

1856 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue1853AI analyses
140commits · 30 days
227commits · 60 days
803commits · 180 days
1839commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
432Strong · 80–100
1164Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dovgopoly15015164
Rusty Russell95873958072
Sangbida Chaudhuri14731146066
Dusty Daemon771377066
ShahanaFarooqui931093063
daywalker9090589062
Níckolas Goline40540076
Lagrang376476069
Christian Decker36436072
Vincenzo Palazzo838080
Chandra Pratap56256082
ekzyis222063
Analysis record

Published AI watches

Last scanned 54 minutes ago

Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: require Homebrew GNU make and gpatch on macOS

This commit only updates macOS installation instructions in the documentation. It tells macOS users to install newer GNU versions of 'make' and 'patch' from Homebrew because Apple's built-in tools are too old for building and running sourc…

d3ff1474by Sangbida Chaudhuri+8−41 file
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: drop obsolete x-prefix in compacter-slow.sh

This commit is a trivial shell script cleanup. It removes an old-fashioned 'x' prefix from a string comparison in a test helper script so that a newer version of the Shellcheck linter stops warning about it. The change does not alter progr…

474c272aby Sangbida Chaudhuri+1−11 file
No security note in commit
Informational 18 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist amount+currency parsing into common code.

This commit moves existing code that parses payment amounts (Bitcoin millisatoshis, 'any' amount, or fiat currency amounts) from one plugin file into a shared library so it can be reused by a future feature. It is a code refactoring with n…

Refactoring of amount-parsing code into a shared helperAddition of explicit u64 overflow guards (mul_overflows_u64, add_overflows_u64) in the new common codeNo change to wire protocol or RPC interface semantics
e0f86c17by Rusty Russell+112−723 files
No security note in commit
Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist hash_str helper into its own header.

This commit is a routine code cleanup: it moves a small string-hashing helper function into a shared header file so it can be reused without being copied and pasted. There is no change to behavior, no bug fix, and no security relevance.

581bbb1fby Rusty Russell+16−176 files
No security note in commit
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Informational 24 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: actually tell askrene when a payment succeeded.

This commit fixes a bookkeeping bug in Core Lightning's xpay plugin. Previously, when a payment succeeded, xpay did not tell the askrene routing-helper that the route worked. As a result, askrene kept stale or overly pessimistic ideas abou…

Missing success feedback to routing layer can degrade payment reliabilityStale negative impressions may bias future path selection toward worse or failing routesNo direct funds-loss primitive is introduced or fixed
a66fabd4by Rusty Russell+40−02 files
No security note in commit
Low 49 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: correctly order constraints.

This commit fixes a bug in Core Lightning's routing helper (askrene) where two kinds of channel information—hard limits called 'constraints' and usage estimates called 'impressions'—were being applied in the wrong order. Because impression…

Routing decision bug caused by incorrect ordering of time-relative channel statePotential payment failure or acceptance of an over-capacity routeRegression test added demonstrating incorrect route acceptance before fix
4b6fe4a1by Rusty Russell+211−1182 files
No security note in commit
Low 35 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: don't leak channel intel entries

This commit fixes a memory leak in the askrene plugin of Core Lightning. When individual channel intelligence entries were deleted, the code removed the entry from its array but forgot to free two internal pointers (impression and constrai…

Memory leak in plugin data structure cleanupMissing deallocation of nested pointers before array removalFix located in routing/intelligence plugin (askrene)
8891f414by Lagrang3+5−01 file
No security note in commit
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: tests should expect the new error messages

This commit only updates test files so that automated checks expect slightly different error wording from the xpay payment command. It does not change any production code, so it cannot introduce a security vulnerability or fix one on its o…

0b67601fby Lagrang3+24−32 files
No security note in commit
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Low 45 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit expiry to offer limit, or 10 minutes with currency conversion.

This commit tightens the expiration time on invoices created from BOLT12 offers. Previously, all such invoices defaulted to a 2-hour payment window. Now, if the offer has an absolute expiry, the invoice expires when the offer expires; and …

BOLT12 invoice expiry now bounded by offer absolute expiryCurrency-converted invoices use short expiry to limit exchange-rate exposureNew regression test added for expiry behavior
a6cf4915by Rusty Russell+55−22 files
No security note in commit
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Low 32 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't do previous invoice checking in createinvoicerequest.

This commit removes a local sanity check in Core Lightning's experimental 'createinvoicerequest' command. Previously, when creating a recurring invoice request, the code looked up past payments by label to verify the previous recurrence wa…

Removal of local payment-state validation for recurring invoice requestsParameter rename from recurrence_label to label in internal RPC callsTest expectations changed from local 'previous invoice has not been paid' errors to remote failure messages
4348d8acby Rusty Russell+5−1224 files
No security note in commit
Low 35 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: handle weird labels in recurrence_label parameter.

This commit fixes how the fetchinvoice plugin handles user-supplied labels that contain special characters such as backslashes, quotes, tabs, and newlines. Previously these labels were passed as raw strings, which could cause JSON encoding…

JSON injection / improper escaping of user-controlled input passed between RPC componentsPotential mismatch between label parsing and label serialization leading to functional failures or unexpected behaviorFix is narrowly scoped to a single plugin and parameter
d7f87f2dby Rusty Russell+37−102 files
No security note in commit
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Add unit tests for str_to_u64

This commit only adds a new automated test file that checks how a helper function (str_to_u64) converts text strings to unsigned 64-bit integers. It does not change any production code, so it cannot by itself introduce a security vulnerabi…

dddb455dby Lagrang3+203−01 file
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: add tests for what we want askrene to do.

This commit only adds a new pytest test file. It does not change any production code. The test describes desired future behavior for the askrene routing module's error messages when a payment source or destination lacks enough channel capa…

518620aeby Rusty Russell+67−01 file
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityplugins/sql: use modern data style, not globals.by Rusty Russell · b63034bd · Nov 20, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Rusty Russell

plugins/sql: use modern data style, not globals.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a straightforward internal cleanup in the SQL plugin of Core Lightning. It replaces global variables (shared data that any part of the program could accidentally touch) with a dedicated data structure attached to the plugin instance. There is no security fix here; it is a code-quality and maintainability change.

Lower-prioritylightningd: don't process more than 100 commands from a plugin at once.by Rusty Russell · 94d582f2 · Nov 20, 2025 · 1 fileMessage 83 · StrongLow 36Details
Commit message · Rusty Russell

lightningd: don't process more than 100 commands from a plugin at once.

Now that ccan/io rotates through callbacks, we can call io_always() to
yield.

We're now fast enough that this doesn't have any effect on this test,
bit it's still good to have.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Low 36/100

This change adds a limit so that Core Lightning processes at most 100 plugin responses in one go before yielding control back to the main event loop. The stated goal is to prevent a misbehaving or malicious plugin from flooding the daemon with responses and starving other work. It is framed by the author as a hardening measure rather than a fix for a known exploitable bug.

Lower-prioritylightningd: don't process more than 100 commands from a JSONRPC at once.by Rusty Russell · b51e2827 · Nov 20, 2025 · 1 fileMessage 73 · AdequateLow 37Details
Commit message · Rusty Russell

lightningd: don't process more than 100 commands from a JSONRPC at once.

Now that ccan/io rotates through callbacks, we can call io_always() to yield.

Though it doesn't fire on our benchmark, it's a good thing to do.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 37/100

This change tweaks how Core Lightning handles incoming JSON-RPC commands so it never processes more than 100 commands or 250 milliseconds in one go without taking a break to let other connections and tasks run. The goal is to prevent a single busy connection from starving the rest of the node. The commit itself frames it as a hardening improvement rather than a fix for a known active bug or vulnerability.

Lower-priorityccan: update to get io_loop fairness.by Rusty Russell · 5fc9e5a4 · Nov 20, 2025 · 2 filesMessage 80 · StrongInformational 16Details
Commit message · Rusty Russell

ccan: update to get io_loop fairness.

This rotates through fds explicitly, to avoid unfairness.
This doesn't really make a difference until we start using it.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 16/100

This commit updates an internal helper library (CCAN) used by Core Lightning to make the program's main event loop fairer when handling many network connections. Previously, lower-numbered file descriptors could be serviced first every time, which in extreme cases might let one connection starve others. The change rotates through connections and interleaves 'always-run' callbacks. The commit message explicitly says this is not currently security-relevant for Core Lightning ('This doesn't really make a difference until we start using it').

Lower-prioritycommon: optimize json parsing.by Rusty Russell · 54d4bf11 · Nov 20, 2025 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Rusty Russell

common: optimize json parsing.

We would keep parsing if we were out of tokens, even if we had actually
finished one object!

These are comparison against the "xpay: use filtering on rpc_command
so we only get called on "pay"." not the disasterous previous one!

tests/test_coinmoves.py::test_generate_coinmoves (2,000,000, sqlite3):
Time (from start to end of l2 node): 126 seconds (was 135)
Worst latency: 5.1 seconds **WAS 12.1**

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This is a performance optimization for JSON parsing in Core Lightning. The change fixes a bug where the parser would keep re-parsing unnecessarily when it ran out of tokens, even though it had already successfully parsed a complete JSON object. The commit message frames this as an optimization, not a security fix, and shows benchmark improvements (worst latency dropping from 12.1 seconds to 5.1 seconds).

Lower-prioritycommando, chanbackup: use custommsg hooks.by Rusty Russell · aff1d6b9 · Nov 20, 2025 · 2 filesMessage 60 · AdequateLow 29Details
Commit message · Rusty Russell

commando, chanbackup: use custommsg hooks.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Low 29/100

This commit changes two Core Lightning plugins—commando and chanbackup—so they only process specific peer message types instead of listening to every custom peer message. It is a hardening/refactoring change that narrows what each plugin handles, likely improving performance and reducing the attack surface, but the diff alone does not show a fix for an exploitable vulnerability.

Lower-prioritylibplugin: don't wait for clean_tmpctx() to free requests as we process them.by Rusty Russell · 1d4a1cdd · Nov 20, 2025 · 1 fileMessage 73 · AdequateLow 29Details
Commit message · Rusty Russell

libplugin: don't wait for clean_tmpctx() to free requests as we process them.

xpay is relying on the destructor to send another request. This means
that it doesn't actually submit the request until *next time* we wake.

This has been in xpay from the start, but it is not noticeable until
xpay stops subscribing to every command on the rpc_command hook.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 29/100

This is a bug-fix patch for Core Lightning's plugin library. It changes when plugin-to-JSON-RPC request objects are freed so that an internal plugin called xpay can immediately send follow-up commands instead of waiting until the next event loop wakeup. The commit describes it as a functional bug that was hidden until xpay stopped monitoring every command, not as a security vulnerability.

Lower-prioritylibplugin: allow plugins to register optional filters for each hook they want.by Rusty Russell · ebe5f2e6 · Nov 20, 2025 · 2 filesMessage 65 · AdequateInformational 12Details
Commit message · Rusty Russell

libplugin: allow plugins to register optional filters for each hook they want.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 12/100

This commit adds a new plugin-library feature that lets plugin authors register optional filters when subscribing to hooks. It is a straightforward API extension: plugins can now declare string or integer filters in their hook manifest, which the main daemon can use to decide whether to invoke the hook. There is no indication in the commit that this fixes a bug or addresses a security issue; it appears to be a normal feature addition.

Lower-prioritylightningd: add support for filters on "rpc_command" hook.by Rusty Russell · d9d82ac5 · Nov 20, 2025 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

lightningd: add support for filters on "rpc_command" hook.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Added: Plugins: the `rpc_command` hook can now specify a "filter" on what commands it is interested in.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit adds a new optional feature to Core Lightning plugins. Plugin authors can now tell the 'rpc_command' hook to only intercept specific RPC commands by name, rather than being sent every single command. This is a convenience/performance improvement, not a security fix or vulnerability.

Lower-priorityRevert "bookkeeper: don't flood logs if we have many channelmoves all at once."by Rusty Russell · 673729bd · Nov 20, 2025 · 1 fileMessage 83 · StrongInformational 18Details
Commit message · Rusty Russell

Revert "bookkeeper: don't flood logs if we have many channelmoves all at once."

This reverts commit 1dda0c07530d01dfa50f6121ba30530659a1475b so we can test
what its like to be flooded with logs again.

This benefits from other improvements we've made this release, to handling
plugin input (i.e. converting to use common/jsonrpc_io), so this doesn't
make much difference.

tests/test_coinmoves.py::test_generate_coinmoves (100,000, sqlite3):
Time (from start to end of l2 node): 211 seconds
Worst latency: 108 seconds

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 18/100

This commit removes a small log-throttling feature in Core Lightning's bookkeeper plugin. Previously, if many channel balance updates arrived at once, the plugin only logged the first and last one to avoid spamming debug logs. This change reverts that behavior so every update is logged again. The author says this is acceptable because other performance improvements this release make the flood less of a problem. There is no direct security vulnerability here; the main effect is more debug log output, which could slightly increase disk use or log-noise under heavy load.

Lower-priorityJSONRPC: use a bigger default buffer.by Rusty Russell · 9e04d044 · Nov 20, 2025 · 1 fileMessage 90 · StrongInformational 18Details
Commit message · Rusty Russell

JSONRPC: use a bigger default buffer.

This potentially saves us some reads (not measurably though), at cost
of less fairness. It's important to measure though, because a single
large request will increase buffer size for successive requests, so we
can see this pattern in real usage.

tests/test_coinmoves.py::test_generate_coinmoves (2,000,000, sqlite3):
Time (from start to end of l2 node): 227 seconds (was 239)
Worst latency: 62.4 seconds (was 56.9)

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 18/100

This commit simply increases the default memory buffer size used when reading JSON-RPC messages. The change is described by the author as a performance tweak to reduce the number of small reads, not a security fix. There is no indication in the commit or supplied references that this resolves a vulnerability.

Lower-prioritycommon: increase jsonrpc_io buffer size temporarily to aggrevate perf issues.by Rusty Russell · d2a60911 · Nov 20, 2025 · 1 fileMessage 83 · StrongInformational 21Details
Commit message · Rusty Russell

common: increase jsonrpc_io buffer size temporarily to aggrevate perf issues.

A client can do this by sending a large request, so this allows us to see what
happens if they do that, even though 1MB (2MB buffer) is more than we need.

This drives our performance through the floor: see next patch which gets
us back on track.

tests/test_coinmoves.py::test_generate_coinmoves (2,000,000, sqlite3):
Time (from start to end of l2 node): 271 seconds **WAS 135**
Worst latency: 105 seconds **WAS 12.1**

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 21/100

This commit is a temporary debugging change that increases an internal buffer size from 2 KB to 1 MB. The author explicitly states it is meant to expose and measure performance problems caused by large JSON-RPC requests, not to fix a security bug. By itself, it makes the node slower when handling big requests, but it does not introduce a clear vulnerability such as a crash or memory corruption.

Lower-priorityplugins/sql: remove size limit.by Rusty Russell · 69778003 · Nov 20, 2025 · 1 fileMessage 78 · AdequateInformational 18Details
Commit message · Rusty Russell

plugins/sql: remove size limit.

Nobody has hit this yet, but we're about to with our tests.

The size of the db is going to be whatever the total size of the tables are; bigger nodes,
bigger db.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 18/100

This commit removes a 500 megabyte cap on the SQL plugin's internal SQLite database. Previously, the code artificially limited how large the database file could grow. Now it lets SQLite use its own default limits, which are effectively unlimited. The stated reason is to support larger nodes with bigger databases, not to fix a security bug. There is no direct evidence this change introduces a vulnerability, but removing any resource limit can theoretically make it easier for a bug or abuse to consume more disk space than before.

Lower-prioritypytest: increase test_generate_coinmoves to 2M entries.by Rusty Russell · 60064678 · Nov 20, 2025 · 1 fileMessage 95 · StrongInformational 15Details
Commit message · Rusty Russell

pytest: increase test_generate_coinmoves to 2M entries.

Now we've rid ourselves of the worst offenders, we can make this a real
stress test. We remove plugin io saving and low-level logging, to avoid
benchmarking testing artifacts.

Here are the results:

tests/test_coinmoves.py::test_generate_coinmoves (2,000,000, sqlite3):
Time (from start to end of l2 node): 518 seconds
Worst latency: 353 seconds

tests/test_coinmoves.py::test_generate_coinmoves (2,000,000, Postgres):
Time (from start to end of l2 node): 417 seconds
Worst latency: 96.6 seconds

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only changes a test file. It increases the number of entries in a performance stress test from 100,000 to 2 million and adjusts test settings to reduce measurement artifacts. There is no change to production code and no security relevance.

Lower-prioritybookkeeper: restore limit on asking for all channelmoves at once.by Rusty Russell · 873d4102 · Nov 20, 2025 · 1 fileMessage 85 · StrongInformational 18Details
Commit message · Rusty Russell

bookkeeper: restore limit on asking for all channelmoves at once.

Now we've found all the issues, the latency spike (4 seconds on my laptop)
for querying 2M elements remains.

Restore the limited sampling which we reverted, but make it 10,000 now.

This doesn't help our worst-case latency, because sql still asks for all 2M entries on
first access. We address that next.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 18/100

This is a performance fix for the bookkeeper plugin. It changes how the plugin asks Core Lightning for lists of channel movements, requesting them in batches of 10,000 instead of all at once. The commit message says this avoids a multi-second delay when there are millions of entries. There is no direct security vulnerability here, but very large unbounded queries can contribute to denial-of-service-like latency or memory pressure, so the patch is defensively relevant.

Lower-prioritycommon: avoid allocations for small numbers of traces.by Rusty Russell · cbd52d49 · Nov 20, 2025 · 1 fileMessage 73 · AdequateInformational 16Details
Commit message · Rusty Russell

common: avoid allocations for small numbers of traces.

If we only have 8 or fewer spans at once (as is the normal case), don't
do allocation, which might interfere with tracing.

This doesn't change our test_generate_coinmoves() benchmark.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 16/100

This is a small internal cleanup in Core Lightning's tracing code. It replaces some heap memory allocations with a fixed set of pre-allocated slots for the common case of having 8 or fewer active trace spans. The change also adjusts how the memory-leak detector scans these objects because some are no longer allocated through the usual memory tracker. There is no direct security vulnerability visible in the diff; it is a performance and robustness improvement for developer/tracing instrumentation.

Lower-prioritypytest: increase test_generate_coinmoves to 5M entries.by Rusty Russell · 6865fe38 · Nov 20, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

pytest: increase test_generate_coinmoves to 5M entries.

This is slow, but will make sure we find out if we add latency spikes in future.

tests/test_coinmoves.py::test_generate_coinmoves (5,000,000, sqlite3):
Time (from start to end of l2 node): 223 seconds
Latency min/median/max: 0.0023 / 0.0033 / 0.113 seconds

tests/test_coinmoves.py::test_generate_coinmoves (5,000,000, Postgres):
Time (from start to end of l2 node): 470 seconds
Worst latency: 0.0024 / 0.0098 / 0.124 seconds

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: lightningd: multiple signficant speedups for large nodes, especially preventing "freezes" under exceptionally high load.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only changes a test file. It increases the number of simulated accounting entries in a performance benchmark from 2 million to 5 million and prints more detailed latency statistics. There is no change to the actual Core Lightning node software, no security fix, and no vulnerability introduced.

Lower-prioritycommon: remove tracing exponential behaviour from large numbers of requests.by Rusty Russell · 7f55a8ea · Nov 20, 2025 · 1 fileMessage 83 · StrongInformational 18Details
Commit message · Rusty Russell

common: remove tracing exponential behaviour from large numbers of requests.

If we have USDT compiled in, scanning the array of spans becomes
prohibitive if we have really large numbers of requests. In the
bookkeeper code, when catching up with 1.6M channel events, this
became clear in profiling.

Use a hash table instead.

Before:
tests/test_coinmoves.py::test_generate_coinmoves (100,000, sqlite3):
Time (from start to end of l2 node): 269 seconds (vs 14 with HAVE_USDT=0)
Worst latency: 4.0 seconds

After:
tests/test_coinmoves.py::test_generate_coinmoves (100,000, sqlite3):
Time (from start to end of l2 node): 14 seconds
Worst latency: 4.3 seconds

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 18/100

This is a performance fix, not a security fix. The developer replaced a slow list-scan with a fast lookup table in the optional USDT tracing code. It removes a severe slowdown when handling very large numbers of tracing events, but there is no indication it could be exploited to attack the node or steal funds.

Lower-prioritylightningd: don't loop through all commands every time one finishes.by Rusty Russell · cfa89f64 · Nov 20, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

lightningd: don't loop through all commands every time one finishes.

When we have many commands, this is where we spend all our time, and it's
just for an old assertion.

tests/test_coinmoves.py::test_generate_coinmoves (100,000, sqlite3):
Time (from start to end of l2 node): 13 seconds **WAS 34**
Worst latency: 4.0 seconds **WAS 24*

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit removes an old debugging assertion that was causing severe performance slowdowns when many JSON-RPC commands were active. It is a pure performance optimization with no security relevance visible in the commit or supplied references.

Lower-prioritylightningd: don't copy hooks array into hook request, simply don't shrink it.by Rusty Russell · 6e5a5b0f · Nov 20, 2025 · 1 fileMessage 83 · StrongInformational 22Details
Commit message · Rusty Russell

lightningd: don't copy hooks array into hook request, simply don't shrink it.

We make a copy, then attach a destructor to the hook in case that plugin exits, so we
can NULL it out in the local copy. When we have 300,000 requests pending, this means
we have 300,000 destructors, which don't scale (it's a single-linked list).

Simply NULL out (rather than shrink) the array in the `plugin_hook`.
Then we can keep using that.

tests/test_coinmoves.py::test_generate_coinmoves (100,000, sqlite3):
Time (from start to end of l2 node): 34 seconds **WAS 85**
Worst latency: 24 seconds **WAS 75**

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 22/100

This is a performance cleanup, not a security fix. Core Lightning used to make a private copy of every plugin-hook list for each pending request and attach a cleanup handler (a destructor) to every entry. With hundreds of thousands of pending requests, that created hundreds of thousands of destructor entries in a single-linked list, slowing the node dramatically. The patch removes the copy and instead marks removed hooks as NULL in the shared list. The commit message explicitly frames this as a speed improvement (test time dropped from 85 seconds to 34 seconds). There is no claim that the old code was unsafe, only that it did not scale.

Lower-prioritypytest: latency and speed test on large coinmoves.by Rusty Russell · fd2bf0dc · Nov 20, 2025 · 2 filesMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

pytest: latency and speed test on large coinmoves.

We start with 100,000 entries. We will scale this to 2M as we fix the
O(N^2) bottlenecks.

I measure the node time after we modify the db, like so:

while guilt push && rm -rf /tmp/ltests* && uv run make -s RUST=0; do RUST=0 VALGRIND=0 TIMEOUT=100 TEST_DEBUG=1 eatmydata uv run pytest -vvv -p no:logging tests/test_coinmoves.py::test_generate_coinmoves > /tmp/`guilt top`-sql 2>&1; done

Then analyzed the results with:
FILE=/tmp/synthetic-data.patch-sql; START=$(grep 'lightningd-2 .* Server started with public key' $FILE | tail -n1 | cut -d\ -f2 | cut -d. -f1); END=$(grep 'lightningd-2 .* JSON-RPC shutdown' $FILE | tail -n1 | cut -d\ -f2 | cut -d. -f1); echo $(( $(date +%s -d $END) - $(date +%s -d $START) )); grep 'E assert' $FILE;

tests/test_coinmoves.py::test_generate_coinmoves (100,000, sqlite3):
Time (from start to end of l2 node): 85 seconds
Worst latency: 75 seconds

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit adds a new performance test and improves database helper methods to use parameterized queries. It is purely a testing/infrastructure change and does not fix or introduce any security vulnerability.

Lower-prioritybookkeeper: no longer read listchannelmoves 1000 entries at a time.by Rusty Russell · 2f2eacaa · Nov 20, 2025 · 1 fileMessage 83 · StrongInformational 11Details
Commit message · Rusty Russell

bookkeeper: no longer read listchannelmoves 1000 entries at a time.

This reverts `bookkeeper: only read listchannelmoves 1000 entries at a time.` commit,
so we can properly fix the scalability in the coming patches.

tests/test_coinmoves.py::test_generate_coinmoves (100,000):
Time (from start to end of l2 node): 207 seconds
Worst latency: 106 seconds

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 11/100

This commit removes a performance workaround in the bookkeeper plugin that read channel movement records 1,000 entries at a time. It reverts that batching behavior so the developers can implement a proper scalability fix later. The change itself is described as a temporary step backward in performance, not a security fix or vulnerability.

Lower-priorityplugins/sql: print times taken to do list comand, populate table, and create index.by Rusty Russell · 459e2136 · Nov 20, 2025 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

plugins/sql: print times taken to do list comand, populate table, and create index.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit adds debug-only timing messages to the SQL plugin. It records how long table refresh and index creation take, and prints those durations to the log at the LOG_DBG (debug) level. There is no change to network behavior, cryptography, authentication, data handling, or any security-sensitive logic.

Lower-prioritybookkeeper: fix printing of bad JSON results.by Rusty Russell · ef5a9bd0 · Nov 20, 2025 · 1 fileMessage 68 · AdequateInformational 18Details
Commit message · Rusty Russell

bookkeeper: fix printing of bad JSON results.

I noticed this in the logs:

```
listinvoices: description/bolt11/bolt12 not found (

{"jsonrpc":"2)
```

And we make the same formatting mistake in several places.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit fixes a logging bug in the bookkeeper plugin where error messages printed only the start of a JSON response instead of the intended snippet. The code used the wrong pointer offset, so log lines showed garbage like '{"jsonrpc":"2' rather than the relevant data. It is a cosmetic/log-quality fix with no direct security impact.

Lower-prioritypytest: fix changed msg on plugin failure.by Rusty Russell · d66e7de9 · Nov 20, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: fix changed msg on plugin failure.

bc4bb2b0ef7261a82cb6ff84e635dadf4f283e89 "libplugin: use jsonrpc_io logic for sync requests too."
changed this message, and test was not updated.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only updates a single test's expected error message string to match a wording change introduced by an earlier code change. It is a test-only fix with no security relevance.