CommitWatch RSS
EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1856 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue1853AI analyses
140commits · 30 days
227commits · 60 days
803commits · 180 days
1839commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
432Strong · 80–100
1164Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dovgopoly15015164
Rusty Russell95873958072
Sangbida Chaudhuri14731146066
Dusty Daemon771377066
ShahanaFarooqui931093063
daywalker9090589062
Níckolas Goline40540076
Lagrang376476069
Christian Decker36436072
Vincenzo Palazzo838080
Chandra Pratap56256082
ekzyis222063
Analysis record

Published AI watches

Last scanned 54 minutes ago

Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: require Homebrew GNU make and gpatch on macOS

This commit only updates macOS installation instructions in the documentation. It tells macOS users to install newer GNU versions of 'make' and 'patch' from Homebrew because Apple's built-in tools are too old for building and running sourc…

d3ff1474by Sangbida Chaudhuri+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: drop obsolete x-prefix in compacter-slow.sh

This commit is a trivial shell script cleanup. It removes an old-fashioned 'x' prefix from a string comparison in a test helper script so that a newer version of the Shellcheck linter stops warning about it. The change does not alter progr…

474c272aby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist amount+currency parsing into common code.

This commit moves existing code that parses payment amounts (Bitcoin millisatoshis, 'any' amount, or fiat currency amounts) from one plugin file into a shared library so it can be reused by a future feature. It is a code refactoring with n…

Refactoring of amount-parsing code into a shared helperAddition of explicit u64 overflow guards (mul_overflows_u64, add_overflows_u64) in the new common codeNo change to wire protocol or RPC interface semantics
e0f86c17by Rusty Russell+112−723 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist hash_str helper into its own header.

This commit is a routine code cleanup: it moves a small string-hashing helper function into a shared header file so it can be reused without being copied and pasted. There is no change to behavior, no bug fix, and no security relevance.

581bbb1fby Rusty Russell+16−176 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: actually tell askrene when a payment succeeded.

This commit fixes a bookkeeping bug in Core Lightning's xpay plugin. Previously, when a payment succeeded, xpay did not tell the askrene routing-helper that the route worked. As a result, askrene kept stale or overly pessimistic ideas abou…

Missing success feedback to routing layer can degrade payment reliabilityStale negative impressions may bias future path selection toward worse or failing routesNo direct funds-loss primitive is introduced or fixed
a66fabd4by Rusty Russell+40−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: correctly order constraints.

This commit fixes a bug in Core Lightning's routing helper (askrene) where two kinds of channel information—hard limits called 'constraints' and usage estimates called 'impressions'—were being applied in the wrong order. Because impression…

Routing decision bug caused by incorrect ordering of time-relative channel statePotential payment failure or acceptance of an over-capacity routeRegression test added demonstrating incorrect route acceptance before fix
4b6fe4a1by Rusty Russell+211−1182 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: don't leak channel intel entries

This commit fixes a memory leak in the askrene plugin of Core Lightning. When individual channel intelligence entries were deleted, the code removed the entry from its array but forgot to free two internal pointers (impression and constrai…

Memory leak in plugin data structure cleanupMissing deallocation of nested pointers before array removalFix located in routing/intelligence plugin (askrene)
8891f414by Lagrang3+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: tests should expect the new error messages

This commit only updates test files so that automated checks expect slightly different error wording from the xpay payment command. It does not change any production code, so it cannot introduce a security vulnerability or fix one on its o…

0b67601fby Lagrang3+24−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit expiry to offer limit, or 10 minutes with currency conversion.

This commit tightens the expiration time on invoices created from BOLT12 offers. Previously, all such invoices defaulted to a 2-hour payment window. Now, if the offer has an absolute expiry, the invoice expires when the offer expires; and …

BOLT12 invoice expiry now bounded by offer absolute expiryCurrency-converted invoices use short expiry to limit exchange-rate exposureNew regression test added for expiry behavior
a6cf4915by Rusty Russell+55−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't do previous invoice checking in createinvoicerequest.

This commit removes a local sanity check in Core Lightning's experimental 'createinvoicerequest' command. Previously, when creating a recurring invoice request, the code looked up past payments by label to verify the previous recurrence wa…

Removal of local payment-state validation for recurring invoice requestsParameter rename from recurrence_label to label in internal RPC callsTest expectations changed from local 'previous invoice has not been paid' errors to remote failure messages
4348d8acby Rusty Russell+5−1224 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: handle weird labels in recurrence_label parameter.

This commit fixes how the fetchinvoice plugin handles user-supplied labels that contain special characters such as backslashes, quotes, tabs, and newlines. Previously these labels were passed as raw strings, which could cause JSON encoding…

JSON injection / improper escaping of user-controlled input passed between RPC componentsPotential mismatch between label parsing and label serialization leading to functional failures or unexpected behaviorFix is narrowly scoped to a single plugin and parameter
d7f87f2dby Rusty Russell+37−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Add unit tests for str_to_u64

This commit only adds a new automated test file that checks how a helper function (str_to_u64) converts text strings to unsigned 64-bit integers. It does not change any production code, so it cannot by itself introduce a security vulnerabi…

dddb455dby Lagrang3+203−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: add tests for what we want askrene to do.

This commit only adds a new pytest test file. It does not change any production code. The test describes desired future behavior for the askrene routing module's error messages when a payment source or destination lacks enough channel capa…

518620aeby Rusty Russell+67−01 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritylightningd: wean pligun_log_handle/plugin_notify_handle/plugin_response_handle off plugin->buffer.by Rusty Russell · 203dbaab · Oct 24, 2025 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

lightningd: wean pligun_log_handle/plugin_notify_handle/plugin_response_handle off plugin->buffer.

Hand buffer in as a parameter to reduce churn in the next patch.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a small internal cleanup in Core Lightning's plugin handling code. It changes several functions so they receive the JSON message buffer as a function argument instead of reading it from a shared plugin structure. There is no change to behavior, no bug fix, and no security-relevant change visible in the diff.

Lower-prioritycommon: add brace hack for jsonrpc_async_parse.by Rusty Russell · eb0d0426 · Oct 24, 2025 · 2 filesMessage 48 · ThinInformational 18Details
Commit message · Rusty Russell

common: add brace hack for jsonrpc_async_parse.

This is a trick from bcli: we ask bitcoind for the block, and it hands
us a 2MB hex blob (which we read in multiple parts). Our parser wades
through it all, but a quick search for '}' makes it much faster.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

48/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context! Contains work-in-progress language
AI analysis · Informational 18/100

This commit is a performance optimization, not a security fix. It speeds up how Core Lightning handles very large JSON responses from Bitcoin by first checking for a closing brace before running the full parser. The test change is just to match the new behavior.

Lower-prioritylightningd: use jsonrpc_io for reading JSON commands.by Rusty Russell · c88c8eac · Oct 24, 2025 · 2 filesMessage 65 · AdequateLow 31Details
Commit message · Rusty Russell

lightningd: use jsonrpc_io for reading JSON commands.

This is more efficient if we have lots of incoming commands, too.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Low 31/100

This commit refactors how the Core Lightning daemon reads JSON commands from RPC connections, switching to a shared helper module called jsonrpc_io. The stated goal is efficiency with many incoming commands. The change removes hand-rolled buffer and JSON parsing state from the connection object and delegates that to the new helper. A test was adjusted because sending a malformed '[]' array now causes the server to close the connection, whereas before it apparently returned an error and kept the connection open. There is no explicit security claim in the commit, but the behavioral change around malformed input handling is a security-relevant signal worth noting.

Lower-prioritylightningd: wean parse_request off referencing jcon->buffer.by Rusty Russell · cbdffe07 · Oct 24, 2025 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

lightningd: wean parse_request off referencing jcon->buffer.

Hand it in as a parameter to reduce churn in the next patch.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a small internal code cleanup in Core Lightning's JSON-RPC request parser. It changes the parse_request function so it receives the JSON text buffer as a parameter instead of reading it from a connection structure. The behavior is unchanged; the same buffer is still passed in at the only call site. There is no security fix or vulnerability here.

Lower-prioritylibplugin: use jsonrpc_io for stdin from lightningd.by Rusty Russell · cbfd65f6 · Oct 24, 2025 · 1 fileMessage 65 · AdequateInformational 11Details
Commit message · Rusty Russell

libplugin: use jsonrpc_io for stdin from lightningd.

This is also more efficient if there are many commands at once.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 11/100

This commit refactors how Core Lightning plugins read JSON commands from the main lightningd process. It replaces a hand-rolled JSON buffering and parsing loop with a shared helper called jsonrpc_io. The change is described by the author as a cleanup and efficiency improvement, not a security fix. There is no direct evidence in the commit or supplied references that this resolves a vulnerability.

Lower-prioritylibplugin: wean ld_command_handle off referncing plugin->buffer.by Rusty Russell · cb2cf034 · Oct 24, 2025 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

libplugin: wean ld_command_handle off referncing plugin->buffer.

Hand it in as a parameter to reduce churn in next patch.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a small internal code cleanup in Core Lightning's plugin library. It changes one function so that it receives its input text buffer as a parameter instead of reading it from a shared plugin object. The behavior is unchanged; the same buffer is passed in at the only call site. There is no security fix or vulnerability here.

Lower-prioritylibplugin: use jsonrpc_io for reading replies to our async commands.by Rusty Russell · 690f95ff · Oct 24, 2025 · 1 fileMessage 65 · AdequateLow 26Details
Commit message · Rusty Russell

libplugin: use jsonrpc_io for reading replies to our async commands.

This will also be more efficient than doing memmove every time.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Low 26/100

This commit refactors how plugin code reads JSON-RPC replies from Core Lightning. It replaces a custom buffer-and-memmove parser with a shared helper called jsonrpc_io. The stated reason is efficiency and code reuse. There is no direct evidence in the commit that this fixes a security bug, but any change to network-facing JSON parsing can affect reliability and potentially security if the old code mishandled malformed input.

Security candidateplugins: fix %*.s typo.by Rusty Russell · 8f6d3d87 · Oct 24, 2025 · 5 filesMessage 64 · AdequateModerate 68Details
Commit message · Rusty Russell

plugins: fix %*.s typo.

And add a check for new uses creeping in, since it got cut & paste
everywhere.

This means "this is a valid string, but truncate it to this many characters"
vs "%.*s" which means "only read this many characters of string":

```
['lightningd-3 2025-10-23T02:31:40.890Z **BROKEN** plugin-funder: Plugin marked as important, shutting down lightningd!']
--------------------------- Captured stderr teardown ---------------------------
#0 0x557da58ad1dc in printf_common(void*, char const*, __va_list_tag*) asan_interceptors.cpp.o
#1 0x557da5aff814 in json_out_addv /home/runner/work/lightning/lightning/ccan/ccan/json_out/json_out.c:239:11
#2 0x557da59740ce in plugin_logv /home/runner/work/lightning/lightning/plugins/libplugin.c:1777:2
#3 0x557da5969b6f in plugin_log /home/runner/work/lightning/lightning/plugins/libplugin.c:1934:2
#4 0x557da595c4f6 in datastore_del_success /home/runner/work/lightning/lightning/plugins/funder.c:161:2
#5 0x557da598b837 in handle_rpc_reply /home/runner/work/lightning/lightning/plugins/libplugin.c:1072:10
#6 0x557da598a4b0 in rpc_conn_read_response /home/runner/work/lightning/lightning/plugins/libplugin.c:1361:3
#7 0x557da5adbea5 in next_plan /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:60:9
#8 0x557da5ae06ff in do_plan /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:422:8
#9 0x557da5adfb58 in io_ready /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:439:10
#10 0x557da5aec2ce in io_loop /home/runner/work/lightning/lightning/ccan/ccan/io/poll.c:455:5
#11 0x557da59757ac in plugin_main /home/runner/work/lightning/lightning/plugins/libplugin.c:2409:3
#12 0x557da594fe23 in main /home/runner/work/lightning/lightning/plugins/funder.c:1723:2
#13 0x7f6572229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#14 0x7f6572229e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#15 0x557da588b584 in _start (/home/runner/work/lightning/lightning/plugins/funder+0x10d584) (BuildId: 71ba63ab577fc6fa60573d3e8555f6db7d5c584d)

0x624000009d28 is located 0 bytes to the right of 7208-byte region [0x624000008100,0x624000009d28)
allocated by thread T0 here:
#0 0x557da590e7f6 in __interceptor_realloc (/home/runner/work/lightning/lightning/plugins/funder+0x1907f6) (BuildId: 71ba63ab577fc6fa60573d3e8555f6db7d5c584d)
#1 0x557da5b2149b in tal_resize_ /home/runner/work/lightning/lightning/ccan/ccan/tal/tal.c:755:13
#2 0x557da59f2032 in membuf_tal_resize /home/runner/work/lightning/lightning/common/utils.c:203:2
#3 0x557da5b03934 in membuf_prepare_space_ /home/runner/work/lightning/lightning/ccan/ccan/membuf/membuf.c:45:12
#4 0x557da59d4289 in jsonrpc_io_read_ /home/runner/work/lightning/lightning/common/jsonrpc_io.c:127:2
#5 0x557da598a635 in rpc_conn_read_response /home/runner/work/lightning/lightning/plugins/libplugin.c:1366:9
#6 0x557da5adbea5 in next_plan /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:60:9
#7 0x557da5ae06ff in do_plan /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:422:8
#8 0x557da5adfb58 in io_ready /home/runner/work/lightning/lightning/ccan/ccan/io/io.c:439:10
#9 0x557da5aec2ce in io_loop /home/runner/work/lightning/lightning/ccan/ccan/io/poll.c:455:5
#10 0x557da59757ac in plugin_main /home/runner/work/lightning/lightning/plugins/libplugin.c:2409:3
#11 0x557da594fe23 in main /home/runner/work/lightning/lightning/plugins/funder.c:1723:2
#12 0x7f6572229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow asan_interceptors.cpp.o in printf_common(void*, char const*, __va_list_tag*)
Shadow bytes around the buggy address:
0x0c487fff9350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c487fff9360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c487fff9370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c487fff9380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c487fff9390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c487fff93a0: 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa
0x0c487fff93b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c487fff93c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c487fff93d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c487fff93e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c487fff93f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==26122==ABORTING
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

64/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetydefensive validation
AI analysis · Moderate 68/100

This commit fixes a typo in several Core Lightning plugins where the wrong printf format string was used. The buggy '%*.s' tells the program to treat a string pointer as a width and then read an unlimited number of bytes from another pointer, which can read past the end of a buffer and crash or leak memory. The fix changes it to '%.*s', which correctly limits how many bytes are read from the string. The commit also adds a build-time check to stop the typo from being reintroduced.

Lower-priorityfuzz/fuzz-hsm_encryption: don't run as unit test under valgrind.by Rusty Russell · 365add06 · Oct 22, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

fuzz/fuzz-hsm_encryption: don't run as unit test under valgrind.

Thanks to Argon hashing, this is intolerably slow under valgrind, and
times out under CI.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit changes a fuzz test so it exits early when run under the Valgrind memory-checking tool. The reason is that the test uses Argon password hashing, which is extremely slow under Valgrind and was causing CI timeouts. It is a test-infrastructure/performance fix, not a security fix.

Security candidateglobal: remove unnecessary includes from C files.by Rusty Russell · 6e5cb299 · Oct 22, 2025 · 177 filesMessage 68 · AdequateInformational 15Details
Commit message · Rusty Russell

global: remove unnecessary includes from C files.

Basically, `devtools/reduce-includes.sh */*.c`.

Build time from make clean (RUST=0) (includes building external libs):

Before:
real 0m38.944000-40.416000(40.1131+/-0.4)s
user 3m6.790000-17.159000(15.0571+/-2.8)s
sys 0m35.304000-37.336000(36.8942+/-0.57)s
After:
real 0m37.872000-39.974000(39.5466+/-0.59)s
user 3m1.211000-14.968000(12.4556+/-3.9)s
sys 0m35.008000-36.830000(36.4143+/-0.5)s

Build time after touch config.vars (RUST=0):

Before:
real 0m19.831000-21.862000(21.5528+/-0.58)s
user 2m15.361000-30.731000(28.4798+/-4.4)s
sys 0m21.056000-22.339000(22.0346+/-0.35)s

After:
real 0m18.384000-21.307000(20.8605+/-0.92)s
user 2m5.585000-26.843000(23.6017+/-6.7)s
sys 0m19.650000-22.003000(21.4943+/-0.69)s

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathauthentication pathparser or protocol path
AI analysis · Informational 15/100

This commit is a routine code cleanup: it removes unused C-language #include directives from many source files and adds a few that were needed but previously inherited indirectly. The stated goal is faster build times, and the diff shows no functional code changes. There is no security-relevant behavior change.

Lower-prioritycommon: remove take() leak if new_initial_channel() fails.by Rusty Russell · 61ecc408 · Oct 22, 2025 · 1 fileMessage 83 · StrongInformational 20Details
Commit message · Rusty Russell

common: remove take() leak if new_initial_channel() fails.

This happens in the fuzzer corpora, but that doesn't check for take()
leaks. Our unit tests do:

```
fuzz-initial_channel: outstanding taken(): 0x626c3b3affc8
make: *** [Makefile:823: unittest/tests/fuzz/fuzz-initial_channel] Error 1
```

This doesn't matter in real life, since we exit the subdaemon if this
fails, but it's still a bug.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 20/100

This commit fixes a small memory leak in a helper function used when setting up a new Lightning channel. The leak only occurs if the function fails partway through, and the project already exits the affected sub-program when that happens, so it is not considered a real-world security issue. The fix moves a few memory allocations to the very beginning of the function so they can be cleaned up correctly if an error occurs later.

Security candidatetests/fuzz: fix include order.by Rusty Russell · d8ee3a5e · Oct 22, 2025 · 7 filesMessage 70 · AdequateInformational 15Details
Commit message · Rusty Russell

tests/fuzz: fix include order.

Nobody ever runs `make check-includes` with fuzzing enabled.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencecryptography-sensitive pathparser or protocol path
AI analysis · Informational 15/100

This commit only reorders #include lines in fuzz-test source files and adds minor indentation to two direct .c file includes. It is a coding-style/build-hygiene fix with no functional code changes and no security relevance.

Security candidateMakefile: run fuzzing corpora as normal unit tests in non-fuzzing mode.by Rusty Russell · 2adfdfd0 · Oct 22, 2025 · 15 filesMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

Makefile: run fuzzing corpora as normal unit tests in non-fuzzing mode.

This means we can make sure the compile and run in normal builds.

Side note: various tests call common_setup(), which means we called it
twice in unit testing mode, so we conditionalize those.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencecryptography-sensitive pathparser or protocol path
AI analysis · Informational 15/100

This commit changes the build system so that existing fuzz tests can also run as ordinary unit tests in normal (non-fuzzing) builds. It does not fix a bug, change runtime behavior of Core Lightning in production, or introduce any user-facing feature. It is purely a testing/CI infrastructure improvement.

Security candidateglobal: remove unnecessary includes from headers.by Rusty Russell · f6a4e794 · Oct 22, 2025 · 212 filesMessage 68 · AdequateInformational 15Details
Commit message · Rusty Russell

global: remove unnecessary includes from headers.

Each header should only include the other headers it needs to compile;
`devtools/reduce-includes.sh */*.h` does this. The C files then need
additional includes if they don't compile.

And remove the entirely useless wire/onion_wire.h, which only serves to include wire/onion_wiregen.h.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive pathsigning or wallet pathparser or protocol path
AI analysis · Informational 15/100

This is a large but purely mechanical cleanup of C header file #include directives across the Core Lightning codebase. The goal is to make each header include only what it actually needs, and to add missing includes to the .c source files that now need them. It also deletes a tiny wrapper header that did nothing but include another generated header. There is no change to program logic, data handling, or security behavior.

Security candidateMakefile: create a library containing common, wire and bitcoin objects.by Rusty Russell · e120f870 · Oct 22, 2025 · 83 filesMessage 95 · StrongInformational 15Details
Commit message · Rusty Russell

Makefile: create a library containing common, wire and bitcoin objects.

This means we don't have to manually choose what to link against,
which is much of the complexity of our Makefiles: the compiler will
automatically use any object files it needs to link.

We already do this for ccan as libccan.a, now we have libcommon.a.

We don't link against it for *everything*, as some tests require their own
versions.

Notes:
1. I get rid of the weird plugins/test/Makefile2 (accidental commit?)
2. Many tests change due to update-mocks.
3. In some places I added the missing dependency on the Makefile itself, though most are in the next
patch.

Before:
Total program size: 221366528
Total tests size: 364243856

After:
Total program size: 190733656
Total tests size: 337880888

Build time from make clean (RUST=0) (includes building external libs):

Before:
real 0m38.227000-44.245000(41.8222+/-1.6)s
user 3m2.105000-33.696000(23.1442+/-8.4)s
sys 0m35.054000-42.269000(39.7231+/-2)s
After:
real 0m38.944000-40.416000(40.1131+/-0.4)s
user 3m6.790000-17.159000(15.0571+/-2.8)s
sys 0m35.304000-37.336000(36.8942+/-0.57)s

Build time after touch config.vars (RUST=0):

Before:
real 0m18.928000-22.776000(21.5084+/-1.1)s
user 2m8.613000-36.567000(27.7281+/-7.7)s
sys 0m20.458000-23.436000(22.3963+/-0.77)s

After:
real 0m19.831000-21.862000(21.5528+/-0.58)s
user 2m15.361000-30.731000(28.4798+/-4.4)s
sys 0m21.056000-22.339000(22.0346+/-0.35)s

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

rusty@rusty-Framework:~/devel/cvs/lightni

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100

This commit is a build-system cleanup. It creates a new static library (libcommon.a) containing common, wire, and bitcoin object files so that Makefiles no longer need to list individual object files by hand. It also removes many auto-generated mock function stubs from unit tests because those functions are now provided by the library. There is no runtime behavior change to Core Lightning itself, and no security issue is introduced or fixed.

Lower-priorityfuzz: fix build undr FreeBSD.by Rusty Russell · a6ea4282 · Oct 22, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Rusty Russell

fuzz: fix build undr FreeBSD.

They have a `struct splice` already:

```
2025-10-22T08:33:39.2432203Z tests/fuzz/fuzz-wire-splice.c:6:8: error: redefinition of 'splice'
2025-10-22T08:33:39.2434453Z 6 | struct splice {
2025-10-22T08:33:39.2435520Z | ^
2025-10-22T08:33:39.2436087Z /usr/include/sys/socket.h:683:8: note: previous definition is here
2025-10-22T08:33:39.2436709Z 683 | struct splice {
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit fixes a build failure when compiling the fuzz tests on FreeBSD. FreeBSD's system headers already define a 'struct splice', so the project's own test-only structure with the same name clashed. The developer renamed it to 'struct fuzzsplice'. This is a portability/build fix, not a security issue.

Lower-prioritycommon/node_id: runtime assertion override, not separate compile time for fuzzing.by Rusty Russell · abe09ec0 · Oct 22, 2025 · 3 filesMessage 83 · StrongInformational 12Details
Commit message · Rusty Russell

common/node_id: runtime assertion override, not separate compile time for fuzzing.

This makes it trivial to run the fuzz tests as unit tests in non-fuzzing mode.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 12/100

This commit is a developer-only test refactor. It changes how a sanity check is disabled during fuzz testing so that the same code can run as a normal unit test without needing a special fuzzing compiler flag. There is no change to production behavior: the assertion that a node ID starts with a valid public-key prefix remains active in normal builds.

Lower-priorityMakefiles: remove redundant dependencies, and have objects depend on their Makefile.by Rusty Russell · 65d99784 · Oct 22, 2025 · 8 filesMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

Makefiles: remove redundant dependencies, and have objects depend on their Makefile.

1. $(JSMN_OBJS) is not set anywhere.
2. You don't need to depend on CCAN_HEADERS, COMMON_HEADERS or JSMN_HEADERS: the top level Makefile has all object depedning on it.
3. Similarly, CCAN_OBJS.
4. Every object file should be rebuilt if its Makefile changes.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine cleanup of build files (Makefiles). It removes unnecessary dependency declarations and ensures object files are rebuilt when their Makefile changes. There is no change to the actual Lightning node software or its security behavior.

Lower-prioritylightningd: fix scb remote_to_self_delay information.by Rusty Russell · 2114e617 · Oct 22, 2025 · 5 filesMessage 81 · StrongLow 48Details
Commit message · Rusty Russell

lightningd: fix scb remote_to_self_delay information.

This was changing all the time when I tried to make
autogenerate-rpc-examples.py reproducible. Turns out it was being
corrupted (it does suspicious things with pointers); rather than try
to diagnose it, I simply rewrote the code to create it only when we
need it.

```
Valgrind error file: valgrind-errors.34506
==34506== Uninitialised byte(s) found during client check request
==34506== at 0x241732: memcheck_ (mem.h:247)
==34506== by 0x2417BC: towire (towire.c:17)
==34506== by 0x24185C: towire_u16 (towire.c:28)
==34506== by 0x20C8E4: towire_tlv_scb_tlvs_remote_to_self_delay (scb_wiregen.c:213)
==34506== by 0x240E78: towire_tlv (tlvstream.c:342)
==34506== by 0x20C99F: towire_tlv_scb_tlvs (scb_wiregen.c:234)
==34506== by 0x20C298: towire_modern_scb_chan (scb_wiregen.c:89)
==34506== by 0x1A6CF3: json_add_scb (peer_control.c:2488)
==34506== by 0x1A6E0C: json_staticbackup (peer_control.c:2519)
==34506== by 0x177E3F: command_exec (jsonrpc.c:799)
==34506== by 0x1785AE: rpc_command_hook_final (jsonrpc.c:945)
==34506== by 0x1BEC2D: plugin_hook_call_next (plugin_hook.c:199)
==34506== Address 0x1ffeffe736 is on thread 1's stack
==34506== in frame #2, created by towire_u16 (towire.c:26)
==34506==
{
<insert_a_suppression_name_here>
Memcheck:User
fun:memcheck_
fun:towire
fun:towire_u16
fun:towire_tlv_scb_tlvs_remote_to_self_delay
fun:towire_tlv
fun:towire_tlv_scb_tlvs
fun:towire_modern_scb_chan
fun:json_add_scb
fun:json_staticbackup
fun:command_exec
fun:rpc_command_hook_final
fun:plugin_hook_call_next
}
==34506== Uninitialised byte(s) found during client check request
==34506== at 0x241732: memcheck_ (mem.h:247)
==34506== by 0x2417BC: towire (towire.c:17)
==34506== by 0x240EF0: towire_tlv (tlvstream.c:354)
==34506== by 0x20C99F: towire_tlv_scb_tlvs (scb_wiregen.c:234)
==34506== by 0x20C298: towire_modern_scb_chan (scb_wiregen.c:89)
==34506== by 0x1A6CF3: json_add_scb (peer_control.c:2488)
==34506== by 0x1A6E0C: json_staticbackup (peer_control.c:2519)
==34506== by 0x177E3F: command_exec (jsonrpc.c:799)
==34506== by 0x1785AE: rpc_command_hook_final (jsonrpc.c:945)
==34506== by 0x1BEC2D: plugin_hook_call_next (plugin_hook.c:199)
==34506== by 0x1BEBA8: plugin_hook_callback (plugin_hook.c:186)
==34506== by 0x1B771E: plugin_response_handle (plugin.c:705)
==34506== Address 0x7bd1d08 is 40 bytes inside a block of size 42 alloc'd
==34506== at 0x484DCD3: realloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==34506== by 0x3C8614: tal_resize_ (tal.c:755)
==34506== by 0x2417A2: towire (towire.c:14)
==34506== by 0x24185C: towire_u16 (towire.c:28)
==34506== by 0x20C8E4: towire_tlv_scb_tlvs_remote_to_self_delay (scb_wiregen.c:213)
==34506== by 0x240E78: towire_tlv (tlvstream.c:342)
==34506== by 0x20C99F: towire_tlv_scb_tlvs (scb_wiregen.c:234)
==34506== by 0x20C298: towire_modern_scb_chan (scb_wiregen.c:89)
==34506== by 0x1A6CF3: json_add_scb (peer_control.c:2488)
==34506== by 0x1A6E0C: json_staticbackup (peer_control.c:2519)
==34506== by 0x177E3F: command_exec (jsonrpc.c:799)
==34506== by 0x1785AE: rpc_command_hook_final (jsonrpc.c:945)
==34506==
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 48/100

This commit fixes a bug in Core Lightning's static channel backup (SCB) feature. Previously, the backup data structure was stored inside the channel object and contained pointers to other channel fields. Those pointers could become stale or point to uninitialized memory, causing the backup to include corrupt or changing data. The fix rebuilds the backup data fresh each time it is requested, using current channel values, which removes the stale-pointer problem. The commit message and Valgrind output show uninitialized bytes being serialized into the backup, but the bug is described as corruption rather than a deliberate security vulnerability.

Lower-prioritydevtools/reduce-includes.sh: don't remove our own .h from .c file includes.by Rusty Russell · bc44d3c6 · Oct 22, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

devtools/reduce-includes.sh: don't remove our own .h from .c file includes.

Even if we would currently include it indirectly, we must include it directly.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit fixes a developer helper script so it no longer suggests removing a C source file's own matching header file from its #include list. It is a code-quality/build-hygiene fix, not a security patch.

Lower-priorityMakefile: helper to print the binary sizes.by Rusty Russell · 6b509944 · Oct 22, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Rusty Russell

Makefile: helper to print the binary sizes.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit adds a simple Makefile helper that prints the sizes of compiled programs and test binaries. It is a development convenience tool with no effect on the actual Core Lightning software, its network behavior, or user funds.

Lower-prioritycommon: assert that they don't call setup_tmpctx() twice.by Rusty Russell · c821e410 · Oct 22, 2025 · 3 filesMessage 85 · StrongInformational 21Details
Commit message · Rusty Russell

common: assert that they don't call setup_tmpctx() twice.

Otherwise, leaks will occur. And fix up dualopend and devtool/route,
which do this!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 21/100

This commit adds a safety check to prevent a temporary memory context from being created twice, which would leak memory. It also fixes two places in the code that were accidentally doing so. The change is defensive and improves reliability, but it does not appear to be a directly exploitable security vulnerability.

Lower-prioritypytest: more flakes with "lucky sigs" in coinmoves.by Rusty Russell · e0c60cf9 · Oct 22, 2025 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: more flakes with "lucky sigs" in coinmoves.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only updates test code to handle variable Bitcoin transaction fees caused by signature size differences. It does not change any production code, so it has no security impact on users running Core Lightning.

Lower-prioritypytest: print useful information if we don't get our channelmoves/chainmovesby Rusty Russell · 5bf5f3b3 · Oct 22, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

pytest: print useful information if we don't get our channelmoves/chainmoves

The equality check will fail, but it will show is what is missing, rather than:

FAILED tests/test_coinmoves.py::test_coinmoves_unilateral_htlc_fulfill - ValueError: Timeout while waiting for <function check_chain_moves.<locals>.<lambda> at 0x7f7800941ab0>

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only improves a test helper so that when a test times out waiting for coin-movement records, it prints extra diagnostic information before failing. It does not change any production code, network behavior, or security logic.

Security candidatemakefile: fix glob expansion for macOSby Sangbida Chaudhuri · ad0c7318 · Oct 22, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Sangbida Chaudhuri

makefile: fix glob expansion for macOS

when bash expands bitcoin/*.h, it returns the files in lexicographically sorted order by default this is not necessarily the case for macOS so it has be explicitly sorted. I get a fairly uninformative error like this:

make: *** [check-bitcoin-makefile] Error 1

The error is now more informative and does not error on a clean branch on macOS:

BITCOIN_HEADERS missing: bitcoin/signature.h bitcoin/tx_parts.h bitcoin/tx.h bitcoin/varint.h
make: *** [check-bitcoin-makefile] Error 1

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit fixes a build script check that was too strict on macOS. The Makefile check compares a manually maintained list of Bitcoin header files against files found on disk. On Linux, the shell lists files in sorted order, but macOS does not, causing the check to fail even when nothing is wrong. The patch makes the comparison order-independent and prints clearer error messages. It is a build tooling fix with no security relevance.