Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 12 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
0a8a7afe · Jun 18, 2026 · 12 filesLow 26Revert "Bolt quote updates and improvements"
Reverts commits b0e728572b through aa6ecad90e (11 commits).
This PR was accidentally merged without proper review. The `channeld.c` splice-detection logic (`is_splice_active` + txid comparison) was NACKed by @ddustin as deviating from the spec, the correct approach requires a `funding_tx_index` on the inflight rather than a `txid` comparison.
A clean replacement PR will be opened for discussion once the approach is agreed upon.
Changelog-None
This commit is a wholesale revert of an earlier pull request that was accidentally merged without proper review. It removes new splice-handling logic in the channel daemon, stricter bech32 padding checks, and several BOLT 11/12 quote and validation updates. The revert itself is a defensive cleanup: it restores the older, reviewed code because the maintainers decided the new approach was not spec-compliant. It is not a security patch in the usual sense, but it does undo code that had been rejected as incorrect, reducing the risk of protocol misbehavior.
d0a974d2 · Jun 18, 2026 · 1 fileLow 34askrene-getroutes: add test for source==destination
Changelog-None
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit adds a test that checks Core Lightning's routing plugin (askrene) properly rejects a request where the payment source and destination are the same node. The test is marked as expected to fail for now, meaning the bug it checks for likely still exists in the code. If triggered, such a request could crash the lightning daemon instead of returning a clean error.
c7e7a5e4 · Jun 18, 2026 · 2 filesModerate 59getroutes: don't crash on source==destination
```
cln-askrene: plugins/askrene/child/child.c:40: final_hop: Assertion `tal_count(hops) > 0' failed.
cln-askrene: FATAL SIGNAL 6 (version v26.06-19-g46b039d)
lightningd-1 2026-06-15T12:34:26.296Z DEBUG plugin-cln-askrene: notify msg debug: Final answer has 1 flows
0x55ab65429902 send_backtrace
common/daemon.c:38
0x55ab6542998c crashdump
common/daemon.c:83
0x7fbc84a8bdef ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7fbc84ae095c __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x7fbc84a8bcc1 __GI_raise
../sysdeps/posix/raise.c:26
0x7fbc84a744ab __GI_abort
./stdlib/abort.c:77
0x7fbc84a7441f __assert_fail_base
./assert/assert.c:118
0x55ab6541b60c final_hop
plugins/askrene/child/child.c:40
0x55ab6541b70d fmt_route
plugins/askrene/child/child.c:48
0x55ab6541ba5b convert_flows_to_routes
plugins/askrene/child/child.c:135
0x55ab6541c037 run_child
plugins/askrene/child/child.c:265
0x55ab65416caa do_getroutes
plugins/askrene/askrene.c:711
0x55ab65416d28 begin_request
plugins/askrene/askrene.c:887
0x55ab654170a2 json_getroutes
plugins/askrene/askrene.c:968
0x55ab654285ec ld_command_handle
plugins/libplugin.c:2206
0x55ab654287f6 ld_read_json
plugins/libplugin.c:2282
0x55ab65439261 next_plan
ccan/ccan/io/io.c:60
0x55ab65439580 do_plan
ccan/ccan/io/io.c:422
0x55ab65439639 io_ready
ccan/ccan/io/io.c:439
0x55ab6543a5fc io_loop
ccan/ccan/io/poll.c:470
0x55ab65428bc4 plugin_main
plugins/libplugin.c:2481
0x55ab65417491 main
plugins/askrene/askrene.c:1551
0x7fbc84a75ca7 __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
0x7fbc84a75d64 __libc_start_main_impl
../csu/libc-start.c:360
0x55ab65413920 ???
_start+0x20:0
0xffffffffffffffff ???
???:0
```
Changelog-Fixed: askrene-getroutes: don't crash on invalid user input, source==destination
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit fixes a crash in Core Lightning's routing plugin (cln-askrene). When a user called the getroutes command with the same node as both source and destination, the plugin hit an internal assertion and aborted. The fix adds a simple input check that rejects source==destination with a normal RPC error instead of crashing the plugin.
31741645 · Jun 18, 2026 · 1 fileInformational 15flake: test_no_delay: reduce expected_saving threshold to fix probe variance
The 10-sample probe introduced in 91c8c37ce3 can overestimate per-RTT
Nagle delay by ~2x relative to the full 100-trip run. This caused the
assertion `normal_time < nagle_time - expected_saving` to fail even when
Nagle disabling was clearly working (19-36% actual savings observed).
Apply an extra /2 to the assertion (total 4x discount from raw probe):
assert normal_time < nagle_time - expected_saving / 2
This still catches a real regression: if TCP_NODELAY is not set both runs
are equal speed and the assertion fails.
Changelog-None
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit only adjusts a threshold inside a single automated test. It makes a timing assertion more lenient so that random network-measurement noise does not cause false test failures. There is no change to production code, no user-facing behavior change, and no security relevance.
9e8f4ffd · Jun 17, 2026 · 1 fileInformational 18xpay: age layer before payment instead on timer
We use to call askrene-age on xpay layer every 60 seconds to remove old
entries. But for payments to discard old entries it is enough to call
askrene-age before getroutes. True as long as:
age(t1) * age(t2) * ... * age(tN) = age(tN)
Reduces flakyness caused by xpay failing to call askrene-age during lightningd shutdown.
Changelog-None
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This change adjusts when the xpay plugin cleans up old routing data. Previously, cleanup ran on a 60-second timer, which could fail during shutdown and cause test flakiness. Now cleanup happens right before each payment is routed. The patch is a reliability improvement, not a security fix, and does not introduce obvious new attack paths.
fdb6df88 · Jun 17, 2026 · 1 fileInformational 15xpay: clean preapprove*_succeed functions
preapproveinvoice_succeed and preapprovekeysend_succeed
do the same thing: acknowledge that preapproval rpc call have succeeded
and continue the payment execution via populate_private_layers.
Therefore we use a unique function for both cases: preapprove_succeed.
Changelog-None.
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This is a routine code cleanup in the xpay plugin. Two nearly identical functions that handle successful 'pre-approval' responses for invoice and keysend payments were merged into one shared function. There is no change in behavior, no bug fix, and no security relevance.
c779e165 · Jun 17, 2026 · 1 fileInformational 15CI: change email server port from 587 to 465 for repro errors
Changelog-None
This commit changes the SMTP port used by a GitHub Actions workflow from 587 to 465 when sending automated emails about reproducible-build errors. Port 465 is the standard port for SMTP-over-SSL/TLS, while port 587 is typically used with STARTTLS. The change appears to be a configuration fix to make email delivery work correctly with the chosen secure=true setting. There is no indication this introduces a security vulnerability.
e33f9e3c · Jun 17, 2026 · 3 filesInformational 17cln-subscribe-wildcard: properly handle shutdown notification with an exit
this would cause pytest teardowns to take the full timeout of killing a plugin
that should exit themselves
Changelog-None
This commit fixes a minor quality-of-life issue in an example plugin. The plugin now exits cleanly when it receives a shutdown message, instead of hanging until test cleanup forcibly kills it. It is not a security vulnerability and does not expose user funds or node control to attackers.
fcb81c84 · Jun 17, 2026 · 1 fileInformational 15pytests: make sure test plugin `misc_notifications.py` exits fast
e7fe59bc612a4969422b0c55b44c296234ef6583 changed the way lightningd refuses
rpc calls during shutdown and the now resulting ConnectionRefusedError was never caught
so the test plugin would not exit and the teardown of those tests would hang for the full
timeout
Changelog-None
This commit fixes a test-only plugin used during automated testing. It does not change production code, user-facing behavior, or any security-sensitive logic. The plugin now exits quickly when the underlying lightning daemon refuses connections during shutdown, preventing test teardown timeouts.
c43420de · Jun 17, 2026 · 2 filesInformational 11pyln-testing: replace ephemeral-port-reserve with a filesystem lock approach
For some reason ports go back into the available pool sooner than what we would expect. I'm not sure why, but it clearly happens.
ephemeral_port_reserve puts them in TIME_WAIT, we can bind to them immediately because of SO_REUSEADDR set,
but then, probably because of node restarts, during a test the port is somehow returned
to a state where ephemeral_port_reserve will return it again immediately for another test.
So we need an additional mechanism for the ports to stay consistent during a test with node restarts.
Our current mechanism was flawed in combination with pytest-xdist since it was tracking per worker, not per machine.
This new filesystem approach should work across pytest workers
Changelog-None
This commit fixes a flaky testing bug in Core Lightning's Python test helpers. When running many tests in parallel, the old code could accidentally reuse the same network port for two different test nodes, causing test failures or weird node-restart behavior. The fix switches to a file-based lock shared across all test workers on the same machine. It is a test-infrastructure reliability fix, not a fix for a user-facing security vulnerability.
54c610a8 · Jun 17, 2026 · 2 filesInformational 15pytests: fix flakes in grpc tests by waiting for the channel to be ready first
`test_grpc_custommsg_notification` was often failing with a timeout here:
```
def test_grpc_custommsg_notification(node_factory):
l1, l2 = node_factory.get_nodes(2)
# Test the connect notification
custommsg_stream = l1.grpc.SubscribeCustomMsg(clnpb.StreamCustomMsgRequest())
l2.connect(l1)
# Send the custom-msg to node l1
# The payload doesn't matter.
# It just needs to be valid hex which encodes to an odd BOLT-8 msg id
l2.rpc.sendcustommsg(l1.info["id"], "3131313174657374")
> for custommsg in custommsg_stream:
```
Changelog-None
This commit fixes flaky automated tests for the gRPC interface. It makes the test framework wait until the gRPC connection is fully ready before using it, preventing random timeouts. There is no security issue here—just a test reliability improvement.
181a1e1f · Jun 17, 2026 · 3 filesInformational 15pytest: use l1/l2 naming and get_nodes() where appropriate.
Replace non-standard node variable names (n, n2, node, ln) with l1/l2
across test_plugin.py and test_misc.py. Convert four tests in
test_connection.py to use get_nodes() instead of consecutive get_node()
calls with identical options (slightly faster).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit only renames test variables (like changing 'node' to 'l1' or 'n' to 'l1') and replaces a few pairs of get_node() calls with a single get_nodes(2) call in test files. It does not change any production code, network protocol handling, cryptography, or wallet logic. There is no security relevance.
50bf9193 · Jun 17, 2026 · 19 filesInformational 15pytest: convert many tests to use inline_plugin helper.
Reduces the number of misc test plugins.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a test-code cleanup. It removes 14 small helper plugin files from the test suite and rewrites the same plugin logic directly inside the test functions using an existing 'inline_plugin' helper. No production code, user-facing behavior, or security-sensitive logic was changed.
5b7042f1 · Jun 17, 2026 · 2 filesInformational 15pytest: add shim so we can create plugins inline in tests.
Avoids having to create a special test plugin most of the time.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit adds a testing-only helper that lets developers write small Core Lightning plugins directly inside Python test files, instead of creating separate plugin files. It is purely a developer convenience for the test suite and does not change any production code, network behavior, or wallet logic.
80f2ac64 · Jun 16, 2026 · 1 fileInformational 15gossmap_manage.c: update BOLT quote and logic to wait for 72 blocks instead of 12 blocks before forgetting a channel.
test_gossip.py: Update the tests to reflect the changes.
This commit only adjusts a test file to match an already-implemented change in how long Core Lightning waits before forgetting a closed channel (72 blocks instead of 12). The actual logic change happened elsewhere; this is a test-only fix so the test correctly verifies the new behavior. There is no security issue in this diff.
204240c2 · Jun 16, 2026 · 1 fileLow 34channeld.c: update logic for retransmitting channel_ready
Extracted logic from if clause to variable for readability, and add extra checks to make sure a splice is active
This change adjusts when Core Lightning re-sends a 'channel_ready' message after a peer reconnects. It adds an extra check to avoid retransmitting the message if a splice (a way to resize a Lightning channel) is active. The commit is framed as a readability improvement with added splice-safety checks, but it does not clearly state it fixes a security bug.
aa6ecad9 · Jun 16, 2026 · 1 fileInformational 15test: fix block generation in `test_close_72_block_delay` to reflect correct depth
This is a one-line correction in a test file. The test was generating one too many blocks for the scenario it intended to exercise, so the developer reduced the count from 71 to 70. It does not change any production code, network protocol, or wallet behavior.
d218756e · Jun 16, 2026 · 2 filesLow 38Fix tests for bolt12-decode.
new cases added by autogenerated mocks after updating the default BOLT spec version.
bolt12.c: add new rules to satisfy case `offer_chains with zero entries`.
bech32_util.c: fix padding on `from_bech32_charset` to satisfy case `Bech32 padding exceeds 4-bit limit`
This commit fixes two validation checks in Core Lightning's code for handling BOLT12 offers and Bech32-encoded data. One fix prevents an offer from claiming it supports zero blockchains, which could confuse or misroute payments. The other fix rejects malformed Bech32 strings where leftover padding bits are invalid. These are correctness and protocol-conformance fixes rather than obvious critical vulnerabilities, but they close gaps that could be abused to bypass validation or cause undefined behavior.
878ecdb2 · Jun 16, 2026 · 2 filesLow 36Update BOLT quote for `channel_ready` re-transmission guards.
channeld.c: update logic to comply with BOLT quote.
tests/test_splicing.py: update test to confirm we are not re-transmiting `channel_ready` for that specific case.
This commit tightens the rules for when a Core Lightning node resends a 'channel_ready' message after a peer reconnects during a splice (a way to resize a Lightning channel). Previously, the node would retransmit channel_ready whenever both sides reported they had not yet sent any commitment. The updated BOLT specification says this retransmission must not happen if either side's reconnect message references a pending splice (via next_funding or my_current_funding_locked fields). The code now checks for those splice fields and suppresses the retransmission in those cases, and a test is updated to verify that behavior.
b0e72857 · Jun 16, 2026 · 2 filesInformational 15Update outdated BOLT quotes
common/bolt11.c: Some BOLT quotes had changed slightly.
run-bolt11.c: A test was updated to reflect nomenclature changes (from `signature recovery` to `public-key recovery`).
This commit only changes wording: it renames an internal error message from 'signature recovery failed' to 'public-key recovery failed' to match updated BOLT specification terminology. No program logic, cryptography, or behavior changes.
4a0538a1 · Jun 16, 2026 · 1 fileInformational 15Update tests after changing deadline from `blockheight + 12` to `blockheight + 72` blocks.
Added 60 blocks to all tests that relied on this parameter in order to fix them. i.e. 12 -> 72, 13 -> 73, etc...
This commit only updates test numbers to match a previously made code change that extended a timeout/deadline from 12 blocks to 72 blocks. It does not change any production code, so it cannot directly affect real users or introduce a security vulnerability.
35d6dd6b · Jun 16, 2026 · 2 filesInformational 15Update outdated BOLT quotes in several files.
update BOLT quotes that drifted from the current spec without changing the meaning or expected functionality.
This commit only fixes formatting and wording in code comments that quote the BOLT specification. No actual program logic, behavior, or security checks were changed. It is not a security fix.
b9dc9919 · Jun 16, 2026 · 1 fileInformational 15Update BOLT quotes for channel open flow.
The TLV `channel_type` is now mandatory. The code was correct but the quote was not.
This commit only fixes whitespace formatting in a comment that quotes the BOLT protocol specification. No actual code behavior changed. The surrounding C code that sets the channel_type value was already correct and is untouched.
f1633e0b · Jun 16, 2026 · 1 fileInformational 15Update BOLT quotes
channeld/channeld.c: Some BOLT quotes had changed slightly.
This commit only updates a quoted comment from the Lightning protocol specification (BOLT #2) inside the source code. The actual code logic is unchanged. It is a documentation/comment cleanup with no security relevance.
1a58dd3c · Jun 16, 2026 · 2 filesInformational 12Update outdated BOLT quotes
bolt12.c:
- quote update on `bolt12_chains_match`;
- add a new condition to `offer_decode` to check if the amount is greater than 0;
run-bolt-12-encode-test.c: add check for `offer_amount > 0`
run-bolt12-format-string-test.c: update BOLT quote
bolt12-cli.c: update BOLT quote
This commit only changes test files and BOLT specification comment quotes. It updates test expectations and comment text to match a newer version of the BOLT #12 standard, but does not change any production code that validates offer amounts. There is no security-relevant code change visible in the supplied diff.