CommitWatch RSS
EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1856 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue1853AI analyses
140commits · 30 days
225commits · 60 days
803commits · 180 days
1839commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
432Strong · 80–100
1164Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dovgopoly15015164
Rusty Russell95873958072
Sangbida Chaudhuri14731146066
Dusty Daemon771377066
ShahanaFarooqui931093063
daywalker9090589062
Níckolas Goline40540076
Lagrang376476069
Christian Decker36436072
Vincenzo Palazzo838080
Chandra Pratap56256082
ekzyis222063
Analysis record

Published AI watches

Last scanned 8 minutes ago

Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: require Homebrew GNU make and gpatch on macOS

This commit only updates macOS installation instructions in the documentation. It tells macOS users to install newer GNU versions of 'make' and 'patch' from Homebrew because Apple's built-in tools are too old for building and running sourc…

d3ff1474by Sangbida Chaudhuri+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: drop obsolete x-prefix in compacter-slow.sh

This commit is a trivial shell script cleanup. It removes an old-fashioned 'x' prefix from a string comparison in a test helper script so that a newer version of the Shellcheck linter stops warning about it. The change does not alter progr…

474c272aby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist amount+currency parsing into common code.

This commit moves existing code that parses payment amounts (Bitcoin millisatoshis, 'any' amount, or fiat currency amounts) from one plugin file into a shared library so it can be reused by a future feature. It is a code refactoring with n…

Refactoring of amount-parsing code into a shared helperAddition of explicit u64 overflow guards (mul_overflows_u64, add_overflows_u64) in the new common codeNo change to wire protocol or RPC interface semantics
e0f86c17by Rusty Russell+112−723 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist hash_str helper into its own header.

This commit is a routine code cleanup: it moves a small string-hashing helper function into a shared header file so it can be reused without being copied and pasted. There is no change to behavior, no bug fix, and no security relevance.

581bbb1fby Rusty Russell+16−176 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: actually tell askrene when a payment succeeded.

This commit fixes a bookkeeping bug in Core Lightning's xpay plugin. Previously, when a payment succeeded, xpay did not tell the askrene routing-helper that the route worked. As a result, askrene kept stale or overly pessimistic ideas abou…

Missing success feedback to routing layer can degrade payment reliabilityStale negative impressions may bias future path selection toward worse or failing routesNo direct funds-loss primitive is introduced or fixed
a66fabd4by Rusty Russell+40−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: correctly order constraints.

This commit fixes a bug in Core Lightning's routing helper (askrene) where two kinds of channel information—hard limits called 'constraints' and usage estimates called 'impressions'—were being applied in the wrong order. Because impression…

Routing decision bug caused by incorrect ordering of time-relative channel statePotential payment failure or acceptance of an over-capacity routeRegression test added demonstrating incorrect route acceptance before fix
4b6fe4a1by Rusty Russell+211−1182 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: don't leak channel intel entries

This commit fixes a memory leak in the askrene plugin of Core Lightning. When individual channel intelligence entries were deleted, the code removed the entry from its array but forgot to free two internal pointers (impression and constrai…

Memory leak in plugin data structure cleanupMissing deallocation of nested pointers before array removalFix located in routing/intelligence plugin (askrene)
8891f414by Lagrang3+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: tests should expect the new error messages

This commit only updates test files so that automated checks expect slightly different error wording from the xpay payment command. It does not change any production code, so it cannot introduce a security vulnerability or fix one on its o…

0b67601fby Lagrang3+24−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit expiry to offer limit, or 10 minutes with currency conversion.

This commit tightens the expiration time on invoices created from BOLT12 offers. Previously, all such invoices defaulted to a 2-hour payment window. Now, if the offer has an absolute expiry, the invoice expires when the offer expires; and …

BOLT12 invoice expiry now bounded by offer absolute expiryCurrency-converted invoices use short expiry to limit exchange-rate exposureNew regression test added for expiry behavior
a6cf4915by Rusty Russell+55−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't do previous invoice checking in createinvoicerequest.

This commit removes a local sanity check in Core Lightning's experimental 'createinvoicerequest' command. Previously, when creating a recurring invoice request, the code looked up past payments by label to verify the previous recurrence wa…

Removal of local payment-state validation for recurring invoice requestsParameter rename from recurrence_label to label in internal RPC callsTest expectations changed from local 'previous invoice has not been paid' errors to remote failure messages
4348d8acby Rusty Russell+5−1224 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: handle weird labels in recurrence_label parameter.

This commit fixes how the fetchinvoice plugin handles user-supplied labels that contain special characters such as backslashes, quotes, tabs, and newlines. Previously these labels were passed as raw strings, which could cause JSON encoding…

JSON injection / improper escaping of user-controlled input passed between RPC componentsPotential mismatch between label parsing and label serialization leading to functional failures or unexpected behaviorFix is narrowly scoped to a single plugin and parameter
d7f87f2dby Rusty Russell+37−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Add unit tests for str_to_u64

This commit only adds a new automated test file that checks how a helper function (str_to_u64) converts text strings to unsigned 64-bit integers. It does not change any production code, so it cannot by itself introduce a security vulnerabi…

dddb455dby Lagrang3+203−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: add tests for what we want askrene to do.

This commit only adds a new pytest test file. It does not change any production code. The test describes desired future behavior for the askrene routing module's error messages when a payment source or destination lacks enough channel capa…

518620aeby Rusty Russell+67−01 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedconnectd: simplify logic, and add a "reconnected" message.by Rusty Russell · 0d976310 · Oct 1, 2025 · 14 filesMessage 73 · AdequateLow 34Details
Commit message · Rusty Russell

connectd: simplify logic, and add a "reconnected" message.

One issue we have in CI is reconnection races: if an incoming
connection arrives while an outgoing one is negotiated, we close the
outgoing one and issue a disconnect, which fails any connect attempts.

By sending a "reconnected" message instead of disconnect/connect we
can avoid disturbing in-progress connection attempts which happens in CI
quite a bit.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 34/100

This commit rewrites how Core Lightning handles peer reconnections. Previously, when a new incoming connection arrived while an outgoing one was still being negotiated, the daemon would tear down the old connection and report a full disconnect followed by a new connect. That sequence often caused in-progress connection attempts to fail, especially in automated CI tests. The patch introduces a single 'reconnected' message that replaces the disconnect/connect pair, so the higher-level code sees a smooth handover instead of a failure. It also refactors the cleanup paths for peer objects and subdaemons. The change is described by the author as a reliability improvement for CI races, not as a security fix, and no independent security advisory is supplied.

Security candidatedualopend: handle ANNOUNCEMENT_SIGNATURES from peer.by Rusty Russell · 89bce951 · Oct 1, 2025 · 3 filesMessage 81 · StrongLow 34Details
Commit message · Rusty Russell

dualopend: handle ANNOUNCEMENT_SIGNATURES from peer.

This can happen if we haven't transitioned to channeld yet, but logic is simply to hand
it to lightningd, exactly as channeld does.

```
2025-09-30T03:04:57.8951627Z lightningd-1 2025-09-30T02:59:14.150Z DEBUG 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-dualopend-chan#1: peer_out WIRE_WARNING
2025-09-30T03:04:57.8952126Z lightningd-1 2025-09-30T02:59:14.150Z **BROKEN** 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-dualopend-chan#1: Unexpected message WIRE_ANNOUNCEMENT_SIGNATURES
2025-09-30T03:04:57.8952521Z lightningd-1 2025-09-30T02:59:14.150Z INFO 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-dualopend-chan#1: Peer connection lost
2025-09-30T03:04:57.8953124Z lightningd-1 2025-09-30T02:59:14.150Z INFO 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-chan#1: Peer transient failure in DUALOPEND_AWAITING_LOCKIN: dualopend: Owning subdaemon dualopend died (62208)
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundary
AI analysis · Low 34/100

This patch fixes a bug where Core Lightning's dual-funding channel opener (dualopend) would crash with a 'BROKEN' error if a peer sent ANNOUNCEMENT_SIGNATURES messages before the channel had fully transitioned to the normal channel daemon. The fix simply forwards those messages to the main lightningd process, just as the regular channel daemon already does. Without the patch, a peer could cause transient connection failures and daemon restarts during channel setup.

Lower-priorityccan: update to get ccan/io shutdown fix.by Rusty Russell · d5677301 · Oct 1, 2025 · 2 filesMessage 68 · AdequateLow 44Details
Commit message · Rusty Russell

ccan: update to get ccan/io shutdown fix.

Changelog-Fixed: Protocol: fix occasional lost sending of final packet (usually warnings or errors).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 44/100

This commit updates an internal networking helper library (CCAN) to fix a bug where a Lightning node might not send its final message—often a warning or error—before closing a connection. The fix prevents the node from accidentally trying to write again after it has already initiated a socket shutdown, which could cause the final packet to be dropped. It is a protocol reliability fix rather than a clear-cut security vulnerability, but lost error/warning messages could theoretically hide important protocol state from a peer.

Lower-priorityconnectd: fix race where last msg can still get lost.by Rusty Russell · 694626f0 · Oct 1, 2025 · 4 filesMessage 73 · AdequateLow 49Details
Commit message · Rusty Russell

connectd: fix race where last msg can still get lost.

openingd sends an ERROR, and exits. lightningd tells us to
disconnect. We read from lightningd first, and don't read from
openingd.

We need to drain subds when we're told to disconnect.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 49/100

This patch fixes a timing bug in Core Lightning's connection handler. When a sub-process (like openingd) sends an error message and exits, and the main daemon simultaneously asks connectd to disconnect, connectd could previously read the disconnect order first and never read the final error message from the sub-process. The fix makes connectd first drain any remaining messages from sub-processes before closing the peer connection, so the last message is not lost.

Lower-prioritylibwally: upgrade to 1.5.1by Rusty Russell · a8566222 · Oct 1, 2025 · 1 fileMessage 68 · AdequateInformational 4Details
Commit message · Rusty Russell

libwally: upgrade to 1.5.1

Closes: https://github.com/ElementsProject/lightning/issues/8427
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 4/100

This commit updates an internal dependency called libwally-core from one version to version 1.5.1. The actual code changes are not visible in the supplied materials because only a submodule reference changed. There is no information in the commit message or title saying this fixes a security problem, and no independent references were provided. On its own, a routine dependency upgrade is not evidence of a vulnerability.

AI review queuedchore: Update python dependenciesby Christian Decker · 7a7a48c3 · Oct 1, 2025 · 16 filesMessage 70 · AdequateInformational 18Details
Commit message · Christian Decker

chore: Update python dependencies

I got a bit annoyed by all the "your protobuf gencode is too old"
warnings in downstream packages, so I spent a bit of time updating any
stale dependency and now we're back allowing packages up to the latest
release. That should maximize the compatibility, and allow downstream
packages to chose their own versions, as long as they are
compatible (semantic versioning).

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 18/100

This commit is a routine maintenance update for Python package dependencies in Core Lightning's Python tooling. It bumps versions of libraries like protobuf, grpcio, cryptography, pytest, and Flask, raises the minimum Python version from 3.8 to 3.9, and regenerates protobuf Python code. There is no direct evidence in the commit that this fixes a specific security vulnerability. It is best treated as a hygiene update that may indirectly reduce risk by moving to newer, supported dependency versions, but it also widens version ranges which could allow downstream users to pull in untested or vulnerable versions.

Lower-prioritypytest: clean up JSON sql test.by Rusty Russell · 64541ca8 · Sep 30, 2025 · 1 fileMessage 86 · StrongInformational 15Details
Commit message · Rusty Russell

pytest: clean up JSON sql test.

1. Establish a channel with l3; we already have one with l2.
2. Don't bother generating 6 more blocks (fundchannel ensures it's mined).
3. Allow htlcs to be empty: Whitslack reported that happens for him
4. Use only_one() to access where we insist there is only one element in the list.
5. Tighten tests to assert the exact contents, not just test some.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Fixes: https://github.com/ElementsProject/lightning/issues/8497

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit is a cleanup of an existing automated test for the SQL plugin. It changes which test nodes open channels, removes unnecessary block generation, and makes the test assertions more precise. There is no change to production code, no security fix, and no vulnerability being addressed.

Lower-prioritypytest: fix flake in test_splicing.py::test_route_by_old_scidby Rusty Russell · 77b8a42e · Sep 30, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: fix flake in test_splicing.py::test_route_by_old_scid

```
2025-09-30T00:07:37.3118831Z _________________ ERROR at teardown of test_route_by_old_scid __________________
...
2025-09-30T00:07:37.3131523Z request.node.has_errors = True
2025-09-30T00:07:37.3131989Z > raise ValueError(str(errors))
2025-09-30T00:07:37.3132834Z E ValueError:
2025-09-30T00:07:37.3133226Z E Node errors:
2025-09-30T00:07:37.3133632Z E - lightningd-1: had warning messages
2025-09-30T00:07:37.3134086Z E Global errors:
...
2025-09-30T00:07:37.5835258Z lightningd-2 2025-09-30T00:04:24.544Z TRACE 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518-gossipd: Bad gossip order: channel_announcement: no unspent txout 109x1x1
2025-09-30T00:07:37.5835659Z lightningd-2 2025-09-30T00:04:24.544Z DEBUG 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518-connectd: peer_out WIRE_WARNING
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit fixes a flaky test in Core Lightning's splicing test suite. The test sometimes failed during cleanup because one node hadn't yet received updated network gossip about a newly spliced channel, causing it to log a harmless warning that the test framework treated as an error. The fix adds a wait condition so the test only proceeds after the gossip has propagated. There is no security issue here.

Lower-prioritypytest: fix flake in test_coinmoves_unilateral_htlc_fulfill / test_coinmoves_unilateral_htlc_timeoutby Rusty Russell · 702a88de · Sep 30, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: fix flake in test_coinmoves_unilateral_htlc_fulfill / test_coinmoves_unilateral_htlc_timeout

DER sigs! Normally, the commitment weight is:

```
Anchorspend for local commit tx fee 9751sat (w=722), commit_tx fee 4866sat (w=1284): package feerate 7286 perkw
Creating anchor spend for local commit tx 6a0816ca60d499edc70bfb786ebd164fb7a55d234c84d926102f5bd35087fd45: we're paying fee 9751sat
```

But if we're "lucky" the commitment tx is shorter:

```
Anchorspend for local commit tx fee 9744sat (w=722), commit_tx fee 4866sat (w=1283): package feerate 7286 perkw
Creating anchor spend for local commit tx acf78532a9448dd62a4e6319a3d2712189a88b6e59abc637260067d60df70782: we're paying fee 9744sat
```

The resulting failure:

```
2025-08-21T02:30:34.1906751Z > assert moves == expected
...
...
2025-08-21T02:30:34.1965346Z E {
2025-08-21T02:30:34.1965529Z E 'account_id': 'wallet',
2025-08-21T02:30:34.1965767Z E 'blockheight': 104,
2025-08-21T02:30:34.1965997Z E 'created_index': 6,
2025-08-21T02:30:34.1966229Z E - 'credit_msat': 15579000,
2025-08-21T02:30:34.1966467Z E ? ^^
2025-08-21T02:30:34.1966698Z E + 'credit_msat': 15586000,
2025-08-21T02:30:34.1966927Z E ? ^^
2025-08-21T02:30:34.1967150Z E 'debit_msat': 0,
2025-08-21T02:30:34.1967376Z E 'extra_tags': [],
2025-08-21T02:30:34.1967599Z E - 'output_msat': 15579000,
2025-08-21T02:30:34.1967832Z E ? ^^
2025-08-21T02:30:34.1968061Z E + 'output_msat': 15586000,
2025-08-21T02:30:34.1968294Z E ? ^^
2025-08-21T02:30:34.1968540Z E 'primary_tag': 'deposit',
2025-08-21T02:30:34.1968908Z E 'utxo': 'acf78532a9448dd62a4e6319a3d2712189a88b6e59abc637260067d60df70782:0',
2025-08-21T02:30:34.1969366Z E },
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit fixes a flaky automated test in Core Lightning. The test sometimes failed because the size of a Bitcoin transaction signature can randomly vary by one byte, changing the transaction fee and the leftover change amount. The fix reads the actual change amount from the blockchain instead of hardcoding an expected value. It is not a security fix and does not affect production code.

Lower-prioritypytest: fix test_xpay_fake_channeld flakeby Rusty Russell · 3c3788a2 · Sep 30, 2025 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: fix test_xpay_fake_channeld flake

Also, resulting log was huge, so suppress log level (will probably speed test)

```
2025-09-02T06:01:39.4881086Z > l1.rpc.plugin_start(os.path.join(os.getcwd(), 'plugins/cln-askrene'))
2025-09-02T06:01:39.4881090Z
2025-09-02T06:01:39.4881174Z tests/test_xpay.py:279:
...
2025-09-02T06:01:39.4883193Z > self.sock.connect(str(self.path))
2025-09-02T06:01:39.4883340Z E ConnectionRefusedError: [Errno 111] Connection refused
...
2025-09-02T06:01:41.7767610Z lightningd-1 2025-09-02T06:01:27.235Z **BROKEN** plugin-cln-xpay: askrene-age failed with {"code":-4, "message":"Plugin terminated before replying to RPC call."}
2025-09-02T06:01:41.7768127Z lightningd-1 2025-09-02T06:01:27.305Z INFO plugin-cln-xpay: Killing plugin: exited during normal operation
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit fixes a flaky automated test. It adds a developer-only switch to stop the xpay plugin from periodically calling another plugin (cln-askrene) during the test, because that background call was failing when the test deliberately replaced cln-askrene with a fake version. There is no security vulnerability here; it is purely a test reliability and log-noise reduction change.

Lower-prioritypytest: fix broken message in test_even_sendcustommsg.by Rusty Russell · 7fed03b9 · Sep 30, 2025 · 1 fileMessage 83 · StrongInformational 18Details
Commit message · Rusty Russell

pytest: fix broken message in test_even_sendcustommsg.

We can stop listening on the incoming peer while we are closing, so we don't notice if they close:

```
['lightningd-2 2025-09-03T09:48:19.555Z **BROKEN** 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518-connectd: Peer did not close, forcing close', 'lightningd-2 2025-09-03T09:48:22.918Z **BROKEN** 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518-connectd: Peer did not close, forcing close']
=========================== short test summary info ============================
ERROR tests/test_misc.py::test_even_sendcustommsg - ValueError:
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 18/100

This is a tiny fix inside Core Lightning's connection handling code. It makes the daemon wake up its incoming-message listener when a peer connection is being drained and shut down. Without the wake-up, the test suite could hit a race where the daemon did not notice the peer had closed, causing a harmless but noisy 'BROKEN' log and a test failure. There is no indication this is an exploitable security bug; it is a test-flake / cleanup correctness fix.

Lower-prioritypytest: fix flake in reckless install timeout.by Rusty Russell · f5fe10c4 · Sep 30, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: fix flake in reckless install timeout.

Don't test installing a plugin under valgrind. There's no way to
increase reckless' (completely reasonable) 15 seconds timeout, and that
can happen under valgrind & CI:

```
def test_reckless_uv_install(node_factory):
node = get_reckless_node(node_factory)
node.start()
r = reckless([f"--network={NETWORK}", "-v", "install", "testpluguv"],
dir=node.lightning_dir)
> assert r.returncode == 0
E assert 1 == 0
E + where 1 = self.returncode, self.stdout, self.stderr.returncode

tests/test_reckless.py:359: AssertionError
...
***RECKLESS STDERR***
config file not found: /tmp/ltests-tui1vmrg/test_reckless_uv_install_1/lightning-1/regtest/config
press [Y] to create one now.
config file not found: /tmp/ltests-tui1vmrg/test_reckless_uv_install_1/lightning-1/reckless/regtest-reckless.conf
config file not found: /tmp/ltests-tui1vmrg/test_reckless_uv_install_1/lightning-1/reckless/.sources
Traceback (most recent call last):
File "/home/runner/work/lightning/lightning/tools/reckless", line 2091, in <module>
log.add_result(args.func(target))
File "/home/runner/work/lightning/lightning/tools/reckless", line 1524, in install
return _enable_installed(installed, plugin_name)
File "/home/runner/work/lightning/lightning/tools/reckless", line 1476, in _enable_installed
if enable(installed.name):
File "/home/runner/work/lightning/lightning/tools/reckless", line 1647, in enable
lightning_cli('plugin', 'start', path)
File "/home/runner/work/lightning/lightning/tools/reckless", line 1613, in lightning_cli
clncli = run(cmd, stdout=PIPE, stderr=PIPE, check=False, timeout=timeout)
File "/opt/hostedtoolcache/Python/3.10.18/x64/lib/python3.10/subprocess.py", line 505, in run
stdout, stderr = process.communicate(input, timeout=timeout)
File "/opt/hostedtoolcache/Python/3.10.18/x64/lib/python3.10/subprocess.py", line 1154, in communicate
stdout, stderr = self._communicate(input, endtime, timeout)
File "/opt/hostedtoolcache/Python/3.10.18/x64/lib/python3.10/subprocess.py", line 2022, in _communicate
self._check_timeout(endtime, orig_timeout, stdout, stderr)
File "/opt/hostedtoolcache/Python/3.10.18/x64/lib/python3.10/subprocess.py", line 1198, in _check_timeout
raise TimeoutExpired(
subprocess.TimeoutExpired: Command '['/home/runner/work/lightning/lightning/cli/lightning-cli', '--network=regtest', '--lightning-dir=/tmp/ltests-tui1vmrg/test_reckless_uv_install_1/lightning-1', 'plugin', 'start', '/tmp/ltests-tui1vmrg/test_reckless_uv_install_1/lightning-1/reckless/testpluguv/testpluguv.py']' timed out after 15 seconds
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a test-only change. It skips one pytest test when the code is being run under Valgrind on a slow machine, because the test's 15-second timeout was sometimes exceeded in CI. There is no security issue in the actual Core Lightning software.

Lower-prioritypytest: use rustcorp.com.au for BIP353 test.by Rusty Russell · 5d5a3ef4 · Sep 30, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: use rustcorp.com.au for BIP353 test.

Something changed in Matt's example:

error: {'code': -32700, 'data': None, 'message': 'failed to fetch payment instructions: HrnResolutionError("Multiple TXT records existed for the HRN, which is invalid")'}

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only updates a test to use a different example email address for a BIP353 (Bitcoin payment DNS lookup) test. The old third-party example started returning multiple TXT records, which is invalid for BIP353, so the test was failing. There is no product code change and no security issue.

Lower-prioritypyln-testing: catch special CI string so we can have non-BROKEN CI warnings.by Rusty Russell · 5a52c6bd · Sep 30, 2025 · 2 filesMessage 75 · AdequateInformational 15Details
Commit message · Rusty Russell

pyln-testing: catch special CI string so we can have non-BROKEN CI warnings.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a testing-only change. It adds a new log prefix 'That's weird: ' for unusual but non-fatal real-world events, and updates the test harness to treat those lines similarly to **BROKEN** logs during CI. There is no security-relevant code change and no vulnerability is present or fixed.

Lower-priorityconnectd: demote "Peer did not close, forcing close" to UNUSUALby Matt Whitlock · 7e85f924 · Sep 30, 2025 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · Matt Whitlock

connectd: demote "Peer did not close, forcing close" to UNUSUAL

This message is logged when connectd tries to shut down a peer
connection but the transmit buffer remains full for too long, maybe
because the peer has crashed or has lost connectivity. Logging this
message at the BROKEN level is inappropriate because BROKEN is intended
to flag logic errors that imply incorrect code in CLN. The error in
question here is actually a runtime error, which does not imply
incorrect code (at least on our side), so demote the log message to the
UNUSUAL level. (Even this is still probably too severe, as this message
is logged rather more frequently than "unusual" would suggest.)

Changelog-None
Closes: https://github.com/ElementsProject/lightning/issues/5678

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit changes only the severity level of a single log message. When Core Lightning tries to shut down a peer connection and the peer's transmit buffer stays full too long, the message 'Peer did not close, forcing close' is now logged as UNUSUAL instead of BROKEN. The change prevents automated CI alerts from treating a routine network/runtime condition as an internal software bug. There is no security fix here.

Lower-prioritypytest: fix flake in tests/test_bookkeeper.py::test_bookkeeping_missed_chans_leasesby Rusty Russell · f0448efa · Sep 30, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

pytest: fix flake in tests/test_bookkeeper.py::test_bookkeeping_missed_chans_leases

```
FAILED tests/test_bookkeeper.py::test_bookkeeping_missed_chans_leases - AssertionError: assert [{'tag': 'channel_open', 'credit_msat': 506268000, 'debit_msat': 0}, {'tag': 'lease_fee', 'credit_msat': 0, 'debit_msat': 6268000}, {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': 11000000}, {'tag': 'onchain_fee', 'credit_msat': 1314000, 'debit_msat': 0}] == [{'tag': 'channel_open', 'credit_msat': 506268000, 'debit_msat': 0}, {'tag': 'lease_fee', 'credit_msat': 0, 'debit_msat': 6268000}, {'tag': 'onchain_fee', 'credit_msat': 1314000, 'debit_msat': 0}, {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': 11000000}]

At index 2 diff: {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': 11000000} != {'tag': 'onchain_fee', 'credit_msat': 1314000, 'debit_msat': 0}

Full diff:
[
{
'credit_msat': 506268000,
'debit_msat': 0,
'tag': 'channel_open',
},
{
'credit_msat': 0,
'debit_msat': 6268000,
'tag': 'lease_fee',
},
{
+ 'credit_msat': 0,
+ 'debit_msat': 11000000,
+ 'tag': 'invoice',
+ },
+ {
'credit_msat': 1314000,
'debit_msat': 0,
'tag': 'onchain_fee',
},
- {
- 'credit_msat': 0,
- 'debit_msat': 11000000,
- 'tag': 'invoice',
- },
]
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit fixes a flaky test in the bookkeeper accounting module. The test sometimes failed because two events (an invoice payment and an on-chain fee) had timestamps so close together that their order could vary. The fix adds a short delay and waits for the payment to fully settle before checking the accounting records. There is no security issue here.

Lower-prioritybuild: fix build with no sqlite3 support.by Rusty Russell · 40a44d9a · Sep 29, 2025 · 1 fileMessage 88 · StrongInformational 15Details
Commit message · Rusty Russell

build: fix build with no sqlite3 support.

Reported-by: whitslack
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Fixes: https://github.com/ElementsProject/lightning/issues/8473
Changelog-Fixed: build: we can now build without sqlite3 support.

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This is a build-fix patch for a single test file. It rearranges code so that the bookkeeping plugin's unit test compiles and runs correctly when Core Lightning is built without SQLite3 support. When SQLite3 is absent, the test now simply does nothing instead of failing to compile. There is no security vulnerability here.

Security candidateRefactor Dockerfile, Add TODOsby Claudio Raimondi · 13c5db51 · Sep 28, 2025 · 40 filesMessage 76 · AdequateInformational 17Details
Commit message · Claudio Raimondi

Refactor Dockerfile, Add TODOs

all these changelogs only apply to the Docker image.

Changelog-Added: added verification of GPG keys for the bitcoin and litecoin tarballs.
Changelog-Fixed: fixed compilation on all target architectures; each had their own bugs (poetry, missing packages...).
Changelog-Fixed: fixed cargo cross compilation. it was mistakenly using QEMU before.
Changelog-Fixed: fixed CPU compatibility bug described in issue 8456
Changelog-Changed: improve build time by 8.8x
Changelog-Changed: improve image size by 2.07x

more detailed changelog can be found on the PR: https://github.com/ElementsProject/lightning/pull/8429

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validationauthentication path
AI analysis · Informational 17/100

This commit is a large refactor of the Docker build files for Core Lightning. It mainly improves how Docker images are built, adds verification of downloaded Bitcoin and Litecoin binaries using GPG signatures, fixes cross-compilation issues, and updates build documentation. There is no obvious security vulnerability introduced by the changes; in fact, adding GPG verification is a security improvement. However, the commit removes the use of `tini` as the container init process and switches the entrypoint directly to a shell script, which is a minor operational change. The commit does not appear to fix or introduce a serious security bug in the Core Lightning software itself.

Lower-prioritybuild: suppress amount checking in fuzzing tests.by Rusty Russell · 9fe8f3ab · Sep 22, 2025 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Rusty Russell

build: suppress amount checking in fuzzing tests.

```
tests/fuzz/fuzz-funder-policy.c:32: amt.satoshis %= (MAX_SATS + 1);
tests/fuzz/fuzz-funder-policy.c:132: total.satoshis, tcase->max_channel_size.satoshis);
tests/fuzz/fuzz-funder-policy.c:140: our_funds.satoshis, tcase->policy.per_channel_min.satoshis);
tests/fuzz/fuzz-funder-policy.c:145: our_funds.satoshis, tcase->policy.per_channel_max.satoshis);
tests/fuzz/fuzz-funder-policy.c:155: our_funds.satoshis, tcase->available_funds.satoshis,
tests/fuzz/fuzz-funder-policy.c:156: tcase->policy.reserve_tank.satoshis);
tests/fuzz/fuzz-funder-policy.c:161: tcase->policy.reserve_tank.satoshis, tcase->available_funds.satoshis,
tests/fuzz/fuzz-funder-policy.c:162: our_funds.satoshis);
make: *** [Makefile:577: check-amount-access] Error 1
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This change only adds comments to a fuzz-testing file so that an internal build check no longer flags direct access to Bitcoin amount fields. It does not change any executable code or fix a security bug in the live Lightning node software.

AI review queuedfuzz-tests: Add a seed corpus for the new testby Chandra Pratap · cedf2f9d · Sep 22, 2025 · 431 filesMessage 78 · AdequateInformational 15Details
Commit message · Chandra Pratap

fuzz-tests: Add a seed corpus for the new test

Add a minimal input set as a seed corpus for the newly introduced
test. This leads to discovery of interesting code paths faster.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesecond-pass: unusually broad change
AI analysis · Informational 15/100

This commit only adds test data files (a seed corpus) for a new fuzzing test named fuzz-codex32. It does not change any production code, so it cannot introduce a security vulnerability or fix one. The files are inputs used to exercise the codex32 parsing code during automated testing.

Lower-priorityfuzz-tests: Add a test for `codex32` operationsby Chandra Pratap · d6a7c29a · Sep 22, 2025 · 2 filesMessage 70 · AdequateInformational 15Details
Commit message · Chandra Pratap

fuzz-tests: Add a test for `codex32` operations

Changelog-None: Add a test for `codex32_encode()` and
`codex32_secret_decode()` defined in `common/codex32.{c, h}`.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit only adds a new automated fuzz test for codex32 encoding and decoding functions. It does not change any production wallet, network, or cryptographic code, and it does not fix or introduce any known security issue.

Lower-priorityplugins/libplugin-pay: Add a check for NaN valuesby Chandra Pratap · a77aa50a · Sep 22, 2025 · 1 fileMessage 80 · StrongInformational 23Details
Commit message · Chandra Pratap

plugins/libplugin-pay: Add a check for NaN values

Changelog-Fixed: Due to the imprecision of `htlc_max`'s type (`fp16_t`),
`capacity_bias()` can return `NaN` in some cases. This leads to a
runtime error when compiled with UBSan. Add a check against it.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 23/100

This commit fixes a rare numerical edge case in Core Lightning's payment routing plugin. A calculation that estimates route capacity could, in some situations, produce a special 'not a number' (NaN) value because of the imprecise half-precision floating-point type used for channel capacity limits. The patch adds a guard so that if the result is NaN, it is treated as an out-of-range score and clamped to a safe maximum. The practical security impact appears low: it only affects local route scoring, and the commit message frames it as fixing a runtime error under Undefined Behavior Sanitizer rather than an exploitable vulnerability.

Lower-priorityplugins/test: Add a test to trigger the bugby Chandra Pratap · 5365b44e · Sep 22, 2025 · 1 fileMessage 70 · AdequateModerate 56Details
Commit message · Chandra Pratap

plugins/test: Add a test to trigger the bug

Add a test in `plugins/test/run-route-calc.c` that reproduces the
runtime error when the fix is not applied.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Moderate 56/100

This commit adds a test case that reproduces a bug in Core Lightning's payment routing code. When a payment amount is larger than a channel's capacity, the router should simply report 'no path found.' Instead, due to a precision issue with how channel capacity limits are stored, the router can compute an invalid 'NaN' (not-a-number) score and then try to convert that NaN into an ordinary unsigned integer. That conversion triggers a runtime/undefined-behavior error. The commit only adds the test; the actual fix is in a separate commit not shown here.

Lower-priorityfuzz-tests: Replace manual allocations with `tal_arr()`by Chandra Pratap · 83894faa · Sep 22, 2025 · 1 fileMessage 83 · StrongInformational 16Details
Commit message · Chandra Pratap

fuzz-tests: Replace manual allocations with `tal_arr()`

Changelog-None: Use the common library utilities for temporary
allocations instead of manually calling `malloc` and `free`.

This makes the code conformant with rest of the codebase and
reduces the chances of leaks.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 16/100

This change only affects a fuzz test file, not the main Core Lightning software. It swaps manual malloc/free memory calls for the project's standard temporary-memory helper (tal_arr). That makes the test code match the rest of the codebase and removes the chance of forgetting to free memory inside the test. There is no direct security fix for live users.

Lower-priorityfuzz-tests: test 8-to-5 bit conversionby Chandra Pratap · b6a1c97c · Sep 22, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Chandra Pratap

fuzz-tests: test 8-to-5 bit conversion

Currently, the test only verifies the 5-to-8 bit conversion. Replace
it with a roundtrip check that verifies 8-to-5 bit conversion as well.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit only adds a new fuzz test that checks whether converting data from 5-bit to 8-bit and back to 5-bit produces the original value. It does not change any production code, wallet logic, or network behavior. There is no security fix or vulnerability here.