Core Lightning

This commit only adds and removes test input files used for fuzzing the bech32 address parser. It is a routine test-data update with no changes to the actual software code that runs on users' systems. There is no indication of a security fix or vulnerability.

This commit only changes a fuzz test file. Fuzz tests are automated security exercises that throw random inputs at code to find bugs. The change expands the test to loop through all valid SegWit witness program versions (0 to 16) instead of just versions 0 and 1. It does not modify any production code, so it cannot by itself introduce or fix a vulnerability in the running software.

This commit adds a unit test that reproduces a one-byte buffer overflow when Core Lightning decodes a very long DNS network address. The test itself does not fix the bug; it only demonstrates it so that a separate fix can be verified. The overflow happens because the decoder tries to add a null terminator one byte past the end of a 255-byte address buffer.

This commit fixes a one-byte buffer overflow in Core Lightning's network address parser. When handling a DNS address that is exactly 255 bytes long, the code tried to add a trailing zero byte past the end of a 255-byte buffer. The fix simply removes that extra write, because the buffer is already fully zeroed beforehand. It is a genuine bug fix, but the practical security impact is limited because the overflow is only one byte and occurs in a controlled parsing path.

This commit adds a new automated fuzz test for an existing function called calculate_our_funding(), which decides how much bitcoin a Core Lightning node contributes when opening a payment channel. The commit only creates a test file and does not change the actual funding logic. It includes built-in checks that would crash the test if the function ever returns results violating simple rules, such as contributing more than the allowed channel size or more than available funds. There is no indication this commit fixes a security bug or changes production code.

This commit only adds test data files (a fuzzing seed corpus) for a new fuzz test called fuzz-funder-policy. It does not change any production code, so it cannot directly introduce a security vulnerability or fix one. The files are inputs used by an automated testing tool to exercise the funder policy code more quickly.

This commit fixes a bug in Core Lightning's JSON parsing. A helper function meant to read a number from a quoted JSON string was accidentally stripping one digit from each end. For example, the string "1234" was being read as 23, and single-digit strings failed entirely. The only user of this broken helper was the `keysend` command's handling of extra TLV (custom data) type numbers. As a result, when a user specified extra TLV type numbers as quoted numeric strings of more than two digits, the wrong type number would be stored and sent. This could cause payments to include malformed custom data, potentially making them fail or be misinterpreted by the recipient.

This is a routine fix to the project's automated package-publishing workflow. The change moves a version-update step so it runs from the correct directory before publishing Python packages. There is no security-relevant change and no indication of a vulnerability.

This commit simply adds a new person's name, email, and PGP key fingerprint to the project's SECURITY.md file. It is a documentation-only change with no code modifications and no security vulnerability.

This commit updates a single checksum in a reproducible build script. The script verifies that the exact same SQLite development package is used when building Core Lightning on Ubuntu Noble. Ubuntu released a minor update to the package (from version 3.45.1-1ubuntu2.4 to 3.45.1-1ubuntu2.5), which changed its file hash. The commit simply records the new expected hash so the build can succeed. There is no code change to Core Lightning itself and no security issue introduced or fixed here.

This commit simply removes several noisy debug log messages from the listdatastore command. It does not change program behavior, fix a bug, or affect security. The removed messages were developer-only diagnostics that could leak datastore key names into logs, but they were already at the debug log level and not a security vulnerability.

This change makes Core Lightning's Ubuntu release builds produce identical output every time (reproducible builds). It does not fix a vulnerability in running software; instead, it removes a source of randomness in build timestamps and dependency versions that could make it hard to verify that a published binary truly came from the published source code. Reproducible builds help users and developers detect supply-chain tampering, but the patch itself is a build-hardening improvement, not an exploit fix.

This commit only adds 41 new binary test files to a fuzz-testing seed corpus. Fuzzing seeds are like practice questions used to exercise code during automated testing; they are not part of the live Lightning node software and cannot directly affect real users or funds. There is no code change, no bug fix, and no security patch in this commit.

This commit fixes a variable type bug in a fuzz test, not in the main Core Lightning software. A fuzz test is an automated testing tool that feeds random data to a program to find crashes. The bug was that a calculation used a 32-bit integer (u32) to hold a value far larger than it can represent, causing an overflow. The fix changes the variable type to a 64-bit integer (u64). Because this is only in a test file, it does not directly affect real Lightning nodes or user funds.

This commit only adds new test input files to a fuzz-testing seed corpus. Fuzz testing is an automated quality-assurance technique that feeds random or unusual inputs to a program to find bugs. These added files are not part of the live Core Lightning software that users run, so the commit does not change any production code or fix any security issue. It is purely a testing-data update.

This commit adds a consistency check inside a fuzz test for channel ID encoding and decoding. It does not change production code, fix a vulnerability, or alter any runtime behavior of the Lightning node. The change only strengthens a test to verify that converting a channel ID to wire format and back produces the original bytes.

This commit only cleans up a fuzz test file by replacing hard-coded numbers (36 and 32) with size-of expressions. It does not change any runtime behavior or fix a security bug.

This commit simply removes unused header file imports from a fuzz testing file. It does not change any running code, fix a bug, or alter behavior. There is no security relevance.

This commit adds a new software test (a fuzz test) that exercises an existing invoice encoding function called bolt11_encode(). It does not change any production code, fix a bug, or alter how the software handles user data. It only adds test coverage.

This commit only adds new test input files (seed corpus) for an existing fuzz test that exercises BOLT11 invoice parsing. It does not change any production code, configuration, or behavior of the Core Lightning node. The added files are malformed or unusual invoice strings intended to improve test coverage. There is no indication this commit fixes or introduces a security issue.

This commit only adds a new automated fuzz test for a message-handling function. It does not change the actual network or message-handling code, so it cannot introduce a security vulnerability by itself. It is a testing improvement.

This commit only adds test data files (a fuzzing seed corpus) for a new fuzz test. It does not change any production code, configuration, or runtime behavior, so it has no direct security impact on users of Core Lightning.

This commit simply reorders a list of file names in a Makefile so they are in strict alphabetical order. It does not change any code, fix any bug, or alter how the software behaves. There is no security relevance.

This commit only changes a fuzz test file. Fuzz tests are automated tools used to find bugs by feeding random data into functions. The change makes the test try more input chunk sizes and removes a special-case skip for zero values. There is no change to the actual production code that handles real network data or funds, so this commit does not introduce or fix a security vulnerability in the running software.

This commit only adds an extra self-check to an existing software test. It makes the test verify that encoding a number and then decoding it gives back the same number. There is no change to the actual program code that users run, and nothing in the commit suggests a security problem was found or fixed.