Core Lightning

This is a one-line documentation fix in the release checklist. It removes the `--without-zip` flag from an example command because using that flag would produce an empty SHA256SUMS file. There is no code change and no security vulnerability.

This commit fixes Docker build problems after the project switched its Python tooling from Poetry to uv. The main change replaces a Rust dependency that was pinned to a specific orphaned Git commit with a published crate version, because GitHub no longer advertises unreachable commits. It also cleans up Dockerfile commands and environment variables so builds work again. There is no direct evidence this fixes an exploitable security vulnerability; it appears to be a build/maintenance fix.

This change fixes how Core Lightning calculates the cryptographic hash of a BOLT11 invoice when the invoice contains a 'fallback address' whose version number is not recognized. Previously, the code would first read the version into the hash, then decide it was unknown and skip the field. That caused the hash to include data that the BOLT11 specification says should be left out, creating a mismatch with other implementations and potentially making the invoice unpayable or causing validation failures. The fix reads the version first without hashing it, skips unknown versions entirely, and only hashes the field for known versions.

This change simplifies how Core Lightning's bitcoin-cli plugin waits for the Bitcoin node to finish starting up. It replaces a custom retry loop with bitcoin-cli's built-in -rpcwait flag. The main effect is cleaner code and slightly different error handling when bitcoin-cli cannot connect. There is no direct evidence this fixes an active security vulnerability, but any change in startup error handling can have subtle reliability implications.

This commit fixes a one-line memory-management bug in Core Lightning. A helper function that creates internal connection objects was allocating them with no owner (NULL context) instead of using the caller-provided owner. That meant the objects could become 'dangling' allocations that are not automatically freed when their parent object is destroyed, leading to memory leaks. The fix passes the intended owner context into the allocation function so cleanup happens correctly.

This commit changes the project's GitHub Actions CI configuration so that the workflow also runs when a pull request description is edited, but only if the edit includes the word 'Changelog'. It is a developer-convenience change to avoid re-pushing commits just to satisfy a changelog-check bot. There is no security relevance.

This commit simply updates the dates in the GitHub pull request template for the next software release cycle. It changes no code, no configuration, and no security-related documentation. There is no security issue here.

This commit is a routine maintenance update. It bumps the planned next release version from v25.09 to v25.12 in the Makefile and adds log-message suppressions to a few test cases that intentionally use deprecated features. There is no security-relevant code change.

This is a small bugfix inside Core Lightning's connection handling code. It corrects a diagnostic timer so that latency measurements blame the right network message. The commit itself is not a security fix and does not appear exploitable; it is described by the author as a debugging aid for real-world ping latency issues.

This is a build-script fix for the Core Lightning release process. When building inside Docker, the script now runs the `make` commands inside the project's Python environment (managed by `uv`) so that required Python modules like `mako` are found. It is a build reliability fix, not a security patch.

This commit fixes a build script used to create official releases inside a Fedora Docker container. It adds one command to create a Python virtual environment before installing dependencies. There is no security issue here—it's a routine build-fix.

This is a routine fix to the project's automated Python package publishing workflow after switching to a new Python tooling system called 'uv'. It changes command-line options and a Makefile target name so packages build and publish correctly. There is no security issue visible in the commit.

This is a routine build-maintenance patch. It fixes the developer-only 'make update-versions' command so it also updates a Python package version string inside source files and runs the uv lock tool after version changes. There is no user-facing or security-relevant change.

This is a build-maintenance patch. It adds one command (`uv lock`) to the Makefile's version-update target so that Python dependency lock files are refreshed after version numbers are changed. There is no security relevance in the commit itself.

This commit simply removes one build step (update-doc-examples) from a Makefile target used during release version updates. It is a temporary developer workflow change with no visible security relevance. The author promises to restore the step in the next release.

This commit swaps the Python package tool used inside Core Lightning's reproducible build Docker containers, replacing Poetry with a newer tool called 'uv'. It only touches build infrastructure files and does not change any wallet, network, or consensus code. There is no indication this fixes or introduces a security vulnerability.

This commit changes where the project's automated build system downloads the Bitcoin Core software (bitcoind) for testing. Previously it came from bitcoincore.org; now it comes from a Google Cloud Storage bucket controlled by the project. The stated reason is to reduce load on bitcoincore.org's servers and avoid slow downloads. There is no code vulnerability in the change itself, but it shifts trust to a different download source.

This commit updates a Fedora-based CI build container to use a newer Python packaging tool called 'uv' instead of the older pip/virtualenv/poetry setup. It is a routine build-infrastructure change with no apparent security relevance.

This commit changes Python packaging metadata to declare that the top-level directory is not itself an installable Python package. It adds two configuration lines telling Poetry and uv (Python build tools) not to treat the root project as a package. There is no code change and no apparent security relevance.

This commit updates the project's Docker build file to replace the Poetry Python package manager with a newer tool called 'uv'. It also removes build steps for built-in Python plugins because the project no longer includes them. There is no security-relevant change here—this is a routine build tooling cleanup.

This commit simply adds a new PGP public key file for a person named Madeline to the project's contributor key directory. It is a routine administrative change with no code modifications and no direct security impact.

This commit only updates the release notes file (CHANGELOG.md), changing the version label from a release candidate (25.09rc4) to the final release (25.09) and updating the release date and download link. No program code was changed, so it cannot introduce or fix any security issue by itself.

This commit is a routine version bump from a release candidate (25.09rc4) to the final release number (25.09). It only changes version strings in packaging files and contains no functional code changes. There is no security relevance.

This commit only updates the project's changelog file to change the release candidate version number from 25.09rc3 to 25.09rc4 and update the release date. No code, configuration, or security-related content was modified.

This commit is a routine release-candidate version bump from 25.09rc3 to 25.09rc4 across several Python package metadata files and a lock file. It changes only version strings and contains no functional code modifications, bug fixes, or security-related changes.