Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 48 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
fb8b81d0 · Jun 16, 2026 · 1 fileInformational 15DEV.md: cheat sheet for developers and LLMs.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit adds a new developer cheat-sheet file (DEV.md) with tips for building, testing, and contributing to Core Lightning. It contains only documentation and no code changes. There is no security issue.
aff06192 · Jun 16, 2026 · 1 fileInformational 15CI: Update Mac CI to use gmake
`gmake` is kept up to date while `make` is apple’s built in mac that is not updated and very old at this point.
Changelog-None
This commit is a routine update to the project's Mac CI (Continuous Integration) workflow. It installs the GNU version of make (called gmake) via Homebrew and uses gmake instead of the older Apple-provided make when building the project in CI. There is no security relevance in this change.
fe0c4522 · Jun 16, 2026 · 2 filesInformational 21cargo: update dependencies
cargo update output:
Updating bitflags v2.11.1 -> v2.13.0
Updating cc v1.2.63 -> v1.2.64
Updating chrono v0.4.44 -> v0.4.45
Updating h2 v0.4.14 -> v0.4.15
Updating http v1.4.1 -> v1.4.2
Updating js-sys v0.3.99 -> v0.3.102
Updating log v0.4.30 -> v0.4.32
Updating memchr v2.8.1 -> v2.8.2
Updating prost v0.14.3 -> v0.14.4
Updating prost-build v0.14.3 -> v0.14.4
Updating prost-derive v0.14.3 -> v0.14.4
Updating prost-types v0.14.3 -> v0.14.4
Updating regex v1.12.3 -> v1.12.4
Updating regex-syntax v0.8.10 -> v0.8.11
Updating rustls-native-certs v0.8.3 -> v0.8.4
Updating smallvec v1.15.1 -> v1.15.2
Updating wasm-bindgen v0.2.122 -> v0.2.125
Updating wasm-bindgen-futures v0.4.72 -> v0.4.75
Updating wasm-bindgen-macro v0.2.122 -> v0.2.125
Updating wasm-bindgen-macro-support v0.2.122 -> v0.2.125
Updating wasm-bindgen-shared v0.2.122 -> v0.2.125
Updating web-sys v0.3.99 -> v0.3.102
Updating yoke v0.8.2 -> v0.8.3
Updating zerocopy v0.8.50 -> v0.8.52
Updating zerocopy-derive v0.8.50 -> v0.8.52
Updating zeroize v1.8.2 -> v1.9.0
Also upgraded quick-xml to 0.40
Changelog-None
This commit is a routine update of third-party Rust libraries used by Core Lightning's REST plugin. It bumps versions in the package lock file and raises one direct dependency (quick-xml) from 0.39 to 0.40. The commit message does not say it fixes any security bug, and no verified security advisory was supplied. Dependency updates can sometimes include security fixes, but this change alone does not demonstrate a vulnerability in Core Lightning.
46b039d5 · Jun 10, 2026 · 8 filesInformational 15schemas: add offer_id to invoice_creation notification
Also partially reverts f96099691bee5df41c4ce87f396bcabad0d547d3 which was not properly rebased
Changelog-None
This commit adds a new optional field, offer_id, to the invoice_creation notification that Core Lightning sends when an invoice is created. It is a schema/API enhancement so plugins and gRPC clients can see which BOLT 12 offer an invoice came from. There is no security-relevant change in the diff.
8be2335a · Jun 10, 2026 · 3 filesInformational 15lightningd: add watchman.h declarations
watchman is the lightningd-side counterpart to the bwatch plugin
landed in the previous group: it tracks how far we've processed
the chain, queues outbound watch ops while bwatch is starting up,
and dispatches watch_found/watch_revert/blockdepth notifications
to subdaemon-specific handlers.
This commit adds only the public surface (struct watchman, the
three handler typedefs, and prototypes for watchman_new,
watchman_ack, watchman_replay_pending) plus an empty watchman.c
so the header is exercised by the build. Definitions land in
subsequent commits.
This commit only adds a new header file describing a future component and an empty source file. No actual code logic is implemented, so there is nothing an attacker could exploit or that could directly affect users. It is a structural preparation step for later work.
f3d1c5d6 · Jun 10, 2026 · 2 filesInformational 14lightningd: add watchman RPC handlers and typed watch API
Register watch_found, watch_revert, block_processed, revert_block_processed,
getwatchmanheight, and chaininfo handlers. Add typed watchman_watch_* helpers
and the dispatch-table skeleton for future subsystem handlers.
Changelog-Added: lightningd: watchman module registers getwatchmanheight, chaininfo, watch_found, watch_revert, block_processed and revert_block_processed RPCs for bwatch plugin integration.
This commit adds new internal JSON-RPC handlers and helper functions for a 'watchman' component that tracks Bitcoin blockchain events (like transactions and block reorganizations) for the Core Lightning node. It is a feature/refactoring commit that wires up a new plugin interface. There is no direct evidence in the commit that it fixes a security vulnerability, and the changelog describes it as a new feature, not a security fix.
3df0fbbb · Jun 10, 2026 · 5 filesInformational 18lightningd: instantiate watchman at startup
Create watchman after setup_topology so it can queue bwatch RPC requests
and replay pending ops once the plugin is ready. No subsystems register
watches yet — that lands in the wallet migration PR.
This commit changes when Core Lightning starts its internal 'watchman' component, which tracks blockchain events. Previously the watchman was created later; now it is created earlier at startup so it can queue requests for the bwatch plugin and replay them once that plugin is ready. The commit also wraps database loading in a transaction and replaces a callback hook with an explicit notification function. No subsystems actually register watches yet, so this is preparatory infrastructure work rather than a live security fix.
549ca307 · Jun 10, 2026 · 1 fileLow 31lightningd: replay pending ops on plugin ready
Both bwatch and watchman must be crash-resistant: a watch_send or an
add_watch/del_watch op may be in flight when lightningd crashes, and
neither side is allowed to lose it. We solve this by persisting every
pending op to the datastore in enqueue_op and dropping it from the
datastore in watchman_ack. On startup load_pending_ops rebuilds the
in-memory queue from the datastore, and watchman_on_plugin_ready
replays it once bwatch reaches INIT_COMPLETE.
watchman_add cancels any prior add for the same owner; watchman_del
cancels any pending add for the same owner before queueing the
delete. This keeps the queue from accumulating stale or
self-cancelling op pairs across restarts.
This commit makes the bitcoin 'watchman' subsystem crash-resistant. Previously, if the lightning node crashed while telling its external plugin to add or remove a watch on a bitcoin address, that instruction could be lost. Now each pending instruction is saved to the database, reloaded on startup, and resent once the plugin is ready again. It also cancels stale paired requests (e.g. a pending 'add' is dropped if a matching 'del' arrives). This is a reliability/robustness improvement rather than a fix for an active exploit.
a202ae63 · Jun 10, 2026 · 1 fileInformational 15lightningd: add send_to_bwatch and watchman_ack
Introduce the outbound RPC path from watchman to the bwatch plugin
plus the ack lifecycle that drops a pending op once bwatch confirms
it.
- struct pending_op carries an op_id of the form "{method}:{owner}"
(e.g. "addscriptpubkeywatch:wallet/p2wpkh/42"); method and owner
are recoverable without a separate field.
- Datastore helpers (make_key, db_save, db_remove) persist pending
ops at ["watchman", "pending", op_id] for crash recovery.
- send_to_bwatch finds the bwatch plugin via find_plugin_for_command
on the method name; if bwatch is not yet INIT_COMPLETE, the send is
silently dropped (the op stays queued and will be replayed when
bwatch comes up). Otherwise it builds a JSON-RPC request with the
owner suffix and the caller-supplied json_params body, registers
bwatch_ack_response as the callback, and sends it.
- watchman_ack searches pending_ops by op_id; on a hit it removes the
datastore entry and drops the in-memory op.
db_save and send_to_bwatch are marked __attribute__((unused)) here
because their callers (enqueue_op, watchman_replay_pending) land in
the next commit; the markers are removed there.
This commit adds internal plumbing for a new 'watchman' component in Core Lightning. It introduces a queue of pending operations, a way to send them to a plugin called 'bwatch', and a way to remove them once acknowledged. The code is not yet wired up to actual callers in this commit (some functions are explicitly marked unused), so it cannot by itself change node behavior or be exploited. It is a normal, incremental infrastructure change.
dbbd7579 · Jun 10, 2026 · 5 filesInformational 12lightningd: add watchman storage and persistence skeleton
Introduce the minimal storage scaffolding for the watchman module:
- db_set_blobvar / db_get_blobvar helpers for persisting binary
values (e.g. block hashes) in the SQL `vars` table.
- load_tip(): recover last_processed_height and last_processed_hash
from the wallet db.
- apply_rescan(): honour --rescan by adjusting the loaded tip
downward (negative = absolute height, positive = N blocks back).
- watchman_new(): allocate the struct, initialise the pending-op
array, and call load_tip + apply_rescan.
Wire the watchman field into struct lightningd via a forward
declaration; instantiation at startup lands in a later commit
along with the rest of the wiring.
This commit adds the first pieces of a new 'watchman' subsystem in Core Lightning. It creates helper functions to save and load binary data (like block hashes) from the wallet database, reads the last processed blockchain height/hash at startup, and applies the existing --rescan option to move the starting height backward if requested. The watchman object is declared in the main daemon structure but is not yet created or used anywhere. There is no user-facing functionality or active network behavior in this commit.
5b64c92b · Jun 10, 2026 · 1 fileLow 27lightningd: register getwatchmanheight + chaininfo bwatch RPCs
Register the two startup RPCs that bwatch calls on launch:
- getwatchmanheight: bwatch asks how far we've already processed the
chain so it knows what height to (re)scan from. Returns
{height, blockhash?} from wm->last_processed_{height,hash}.
- chaininfo: bwatch reports the chain name, header/block counts, and
IBD status. We fatal() on a network mismatch (wrong bitcoind),
toggle bitcoind->synced based on IBD/header-vs-block lag, fire
notify_new_block on the transition to synced, and remember the
blockcount on watchman.
This commit adds two internal startup RPC endpoints used by a new component called bwatch. One endpoint reports how far the node has processed the blockchain; the other receives chain status from bwatch and updates the node's sync state. The code includes a safety check that shuts down the node if the connected Bitcoin backend is on the wrong network. There is no obvious vulnerability in the diff, but the commit is adding new RPC surface area and changing sync-state logic, which is security-relevant infrastructure.
97700774 · Jun 10, 2026 · 2 filesInformational 19currencyrate: propagate http errors to currencyrate rpc if a source is provided
specifically coindesk was constantly hitting API rate limits causing our tests to fail
so lets unit tests all endpoints with a snapshot of real responses and only allow for http
error 401/429 in integration tests
Also fix a flake in test_bkpr_currencyrate_persisted that would pick up a cached rate from CLN's own caching
Changelog-None
This commit improves error reporting in the currency-rate plugin. Previously, when a price source like CoinDesk returned an HTTP error (for example, rate-limiting or authentication failure), the plugin treated it as a generic failure and did not tell the user what actually went wrong. Now the HTTP status code and response body are passed through to the RPC caller. It also adds unit tests using saved real-world API responses and fixes a flaky test by waiting out an internal cache. There is no indication this fixes an exploitable vulnerability; it is a reliability and diagnostics improvement.
0b43e919 · Jun 10, 2026 · 3 filesInformational 17docker: Fix base image inconsistency in reprobuild for noble and resolute
Switch `Dockerfile.noble` and `Dockerfile.resolute` to noble / resolute to match the debootstrap-based minimal image approach.
This commit adjusts the reproducible build Dockerfiles for Core Lightning so they use a locally-built minimal base image named 'noble' or 'resolute' instead of the official Ubuntu Docker Hub images. It also updates expected package checksums and adds the 'universe' software repository. There is no direct security vulnerability in the diff itself; it is a build-maintenance change aimed at making builds more consistent and reproducible.
19992371 · Jun 10, 2026 · 1 fileInformational 15tools: Fix `sign` and `docker` target detection when passed as single argument
The sign target detection uses pattern matching that requires spaces on
both sides of "sign" in the TARGETS variable. When only "sign" is passed
as an argument, TARGETS becomes " sign" (leading space only), causing
the condition to fail.
Add an additional pattern match to detect "sign" with a leading space
but no trailing space, which occurs when "sign" is the only target or
the last target in the list.
This regression seems to have been exposed by GitHub Actions runner
updates (Ubuntu 22.04 → 24.04), which changed argument passing behavior.
Changelog-None: Fixes the release signing issue in CI only.
This commit fixes a shell-script pattern-matching bug in the release build tool. When a maintainer ran the release script with only 'sign' or 'docker' as the target, the script failed to detect it because it expected spaces on both sides of the word. The fix adds an extra check for when the word appears at the end of the target list. It is a CI/release workflow bug, not a vulnerability in the Lightning node software itself.
d07eb809 · Jun 9, 2026 · 1 fileInformational 15pytest: fix broken test_pay_bolt11_metadata
It uses a canned, but now expired invoice. Instead, use bolt11-cli to add metadata to
an existing invoice.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a failing test in the Core Lightning test suite. The test previously relied on a hard-coded invoice that has now expired, causing automated tests to fail. The update dynamically generates a fresh invoice and adds payment metadata using a developer tool. There is no security vulnerability or product code change here—only a test maintenance fix.
bfe5dd4f · Jun 5, 2026 · 2 filesInformational 15contrib: add nGoline's signing key
Changelog-None
This commit simply adds a new developer's PGP public key to the project's list of trusted signing keys. It is an administrative/key-management change, not a code change, and introduces no security vulnerability.
628d6558 · Jun 5, 2026 · 1 fileInformational 15changelog: update v26.06.1 release notes
Why it was queuedThis commit only updates the project's release notes in CHANGELOG.md. It documents that version 26.06.1 fixes a plugin registration problem and corrects the configuration option name for the new bwatch plugin. There are no code changes and no security issue is described.
1c346a51 · Jun 5, 2026 · 2 filesInformational 20plugins: rename bwatch output binary to cln-bwatch
The bwatch plugin lived in plugins/bwatch/ and output its binary as
plugins/bwatch/bwatch. This caused make install to install it flat as
<plugindir>/bwatch, while lightningd expected it at <plugindir>/bwatch/bwatch, so plugin registration failed at startup with "failed to register plugin".
Fix by renaming the output to plugins/cln-bwatch, following the same
convention as cln-renepay, cln-xpay and cln-askrene.
Changelog-Fixed: bwatch plugin failed to register on startup after make install
This commit fixes a build/installation bug where a newly added plugin, bwatch, was not being registered when Core Lightning started after running 'make install'. The plugin's binary was being installed to the wrong path, so lightningd could not find it. The fix renames the plugin binary to follow the same naming convention as other plugins. There is no security vulnerability here—just a packaging/startup bug.
dfc7d557 · Jun 4, 2026 · 2 filesInformational 15contrib: add daywalker90's signing key
Changelog-None
This commit simply adds a new developer's PGP public key to the project's list of trusted signing keys. It is an administrative/key-management change, not a code change, and introduces no security vulnerability by itself.
dd71edd8 · Jun 4, 2026 · 1 fileInformational 15security: remove rustcorp.com contact
Why it was queuedThis commit simply updates the project's security contact information. It removes a personal email address (rusty@rustcorp.com.au) and keeps only the corporate security address (security@blockstream.com). There is no code change, no vulnerability fix, and no security flaw introduced.
0bdb5b0c · Jun 4, 2026 · 2 filesInformational 15contrib: add Lagrang3's signing key
Changelog-None
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit simply adds a new developer's PGP public key to the project's list of trusted signing keys. It is an administrative/key-management change, not a code change, and introduces no security vulnerability by itself.
a98d2e46 · Jun 4, 2026 · 9 filesInformational 15release: prepare v26.06
Why it was queuedThis commit is a routine release version bump from 'v26.06rc2' (release candidate 2) to 'v26.06' (final release). It only changes version strings in packaging files and contains no code logic changes, bug fixes, or security-related modifications.
55617a52 · Jun 1, 2026 · 1 fileInformational 23Describe the change
Why it was queuedThis commit only edits the project's CHANGELOG.md file. It adds a one-line note saying the xpay plugin no longer crashes when handling circular route hints in bolt11 invoices, and adds a link to pull request #9174. The actual code fix is not present in this commit, so we can only judge the issue from the changelog description: a crash bug in a payment plugin triggered by unusual invoice route hints.
18b13b3c · Jun 1, 2026 · 1 fileInformational 15crates: update Cargo.lock dependencies
cargo update output:
Updating crates.io index
Locking 35 packages to latest Rust 1.85.0 compatible versions
Updating asn1-rs v0.7.1 -> v0.7.2
Updating autocfg v1.5.0 -> v1.5.1
Updating base58ck v0.1.0 -> v0.1.100
Updating bitcoin v0.32.9 -> v0.32.100
Removing bitcoin-internals v0.3.0
Updating bitcoin-io v0.1.4 -> v0.1.100
Updating bitcoin-units v0.1.3 -> v0.1.100
Updating bitcoin_hashes v0.14.1 -> v0.14.100
Updating bumpalo v3.20.2 -> v3.20.3
Updating cc v1.2.62 -> v1.2.63
Updating displaydoc v0.2.5 -> v0.2.6
Updating either v1.15.0 -> v1.16.0
Updating http v1.4.0 -> v1.4.1
Updating hyper v1.9.0 -> v1.10.1
Updating jiff v0.2.24 -> v0.2.28
Updating jiff-static v0.2.24 -> v0.2.28
Updating js-sys v0.3.98 -> v0.3.99
Updating log v0.4.29 -> v0.4.30
Updating memchr v2.8.0 -> v2.8.1
Updating mio v1.2.0 -> v1.2.1
Updating pulldown-cmark v0.13.3 -> v0.13.4
Updating reqwest v0.13.3 -> v0.13.4
Updating serde_json v1.0.149 -> v1.0.150
Updating shlex v1.3.0 -> v2.0.1
Updating socket2 v0.6.3 -> v0.6.4
Updating tokio-socks v0.5.2 -> v0.5.3
Updating tower-http v0.6.10 -> v0.6.11
Updating typenum v1.20.0 -> v1.20.1
Updating wasm-bindgen v0.2.121 -> v0.2.122
Updating wasm-bindgen-futures v0.4.71 -> v0.4.72
Updating wasm-bindgen-macro v0.2.121 -> v0.2.122
Updating wasm-bindgen-macro-support v0.2.121 -> v0.2.122
Updating wasm-bindgen-shared v0.2.121 -> v0.2.122
Updating web-sys v0.3.98 -> v0.3.99
Updating zerocopy v0.8.48 -> v0.8.50
Updating zerocopy-derive v0.8.48 -> v0.8.50
Changelog-None
This commit is a routine update to the Rust dependency lock file (Cargo.lock). It bumps many third-party libraries to their latest compatible patch or minor versions, including Bitcoin-related crates, HTTP libraries, and various utility crates. There is no indication in the commit message or diff that this update fixes any specific security vulnerability, and no security advisory references are provided.
703d737d · Jun 1, 2026 · 9 filesLow 45xpay: don't crash on circular routehints.
We earlier fixed the cases of gossipd inserting a same-node channel,
but didn't prevent it for local modifications:
```
cln-askrene: common/gossmap.c:52: nodeidx_htable_add: Assertion `!nodeidx_htable_getmatch_(ht, k, h, v, &i)' failed.
cln-askrene: FATAL SIGNAL 6 (version v26.06rc2-5-gd389c3f-modded)
0x5c50e80dd5cb send_backtrace
common/daemon.c:38
0x5c50e80dd685 crashdump
common/daemon.c:83
0x70a5b1e4532f ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x70a5b1e9eb2c __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x70a5b1e9eb2c __pthread_kill_internal
./nptl/pthread_kill.c:78
0x70a5b1e9eb2c __GI___pthread_kill
./nptl/pthread_kill.c:89
0x70a5b1e4527d __GI_raise
../sysdeps/posix/raise.c:26
0x70a5b1e288fe __GI_abort
./stdlib/abort.c:79
0x70a5b1e2881a __assert_fail_base
./assert/assert.c:96
0x70a5b1e3b516 __assert_fail
./assert/assert.c:105
0x5c50e80dfb44 nodeidx_htable_add
common/gossmap.c:52
0x5c50e80e1066 add_channel
common/gossmap.c:515
0x5c50e80e327c gossmap_apply_localmods
common/gossmap.c:1239
0x5c50e80bed55 do_getroutes
plugins/askrene/askrene.c:620
0x5c50e80bf919 listpeerchannels_done
```
Reported-by: Won Hoi Kim and Ahmad Elmoursi
Changelog-Fixed: Plugins: xpay no longer crashes on circular bolt11 routehints.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a crash in Core Lightning's xpay plugin. When processing a BOLT11 invoice containing a circular route hint (where the start and end node are the same), the code would create an invalid self-loop channel and trigger a fatal assertion failure, killing the cln-askrene process. The patch rejects such self-loop channels at multiple layers so the payment plugin can skip them gracefully instead of crashing.