Core Lightning

This commit fixes a minor bug in Core Lightning's xpay plugin where an error message about unsupported foreign-currency offers could print garbage or truncated text instead of the actual currency code (like 'USD'). It is a correctness and usability fix, not a security vulnerability.

This commit only adds a new test case for the xpay payment feature. It checks that xpay can handle a malformed invoice route hint where a node points to itself, and that the payment still succeeds through a normal direct channel. There is no code fix or behavior change in this commit.

This commit is a routine release-preparation change. It only updates the CHANGELOG.md file, renaming the release title from '26.06rc2' to '26.06' and adjusting the release date and tag link. No code, configuration, or security-related content was changed.

This commit updates the project's release automation to drop support for the older Ubuntu 20.04 ('focal') build environment and add support for the upcoming Ubuntu 26.04 ('resolute'). It also fixes a GitHub Actions workflow bug where boolean inputs were being compared as strings. There is no change to the Core Lightning node software itself, and nothing in the commit indicates a security vulnerability or fix.

This commit fixes a non-determinism bug in the code generator that produces gRPC protocol definitions for Core Lightning. The generator sometimes produced message definitions in a different order, which could cause unnecessary changes in generated files between builds. The fix sorts dictionary keys when merging schemas and iterating over properties. There is no direct security vulnerability here—this is a build reproducibility and code hygiene fix.

This commit is a routine version bump for three Rust software packages (cln-rpc, cln-grpc, and cln-plugin) from version 0.6.0 to 0.7.0. It only changes version numbers in package metadata files. There is no code change, no bug fix, and no security-related content.

This commit fixes a crash bug inside a fuzz test, not in the main Core Lightning software. A fuzz test is an automated testing tool that feeds random data to a program to find crashes. The bug occurred because a safety net (setjmp/longjmp) could jump to cleanup code before a local variable (run_ctx) was initialized, causing the cleanup code to use an invalid memory address and crash. The fix simply moves the safety-net setup to after the variable is initialized. This does not affect real Lightning nodes or their users.

This commit is a routine version bump from v26.06rc1 to v26.06rc2 across several package metadata files. It changes only version strings and contains no functional code modifications, bug fixes, or security-related changes.

This commit is a routine documentation update that renames the upcoming release candidate in the project's changelog. It changes 'v26.06rc1' to 'v26.06rc2', updates the release date, and adds a release name credit. No code, configuration, or security-related content was modified.

This commit only edits the project's CHANGELOG.md file. It adds documentation notes about two previously-merged changes (a plugin notification field and a renamed JSON-RPC value) and a link to a pull request. No code behavior changes, no bug fixes, and no security-related content are present.

This update fixes a memory exhaustion weakness in Core Lightning's gossip daemon. An unauthenticated remote peer could send a flood of fake Lightning channel identifiers, causing the node to keep allocating memory until the process crashed or the host ran out of memory. The patch caps two internal queues at 10,000 entries so memory use stays bounded.

This commit is a code-generation cleanup for the Core Lightning message/serialization layer. It removes hand-maintained 'omit' overrides and lets the generator produce more complete protocol definitions for gRPC, JSON-RPC, and Python bindings. The changes add missing fields such as channel type, state change history, invoice paths, and unknown TLV fields to generated API models. There is no direct security fix or vulnerability here; it is a maintenance change that may affect API compatibility and could expose more raw data to callers.

This commit removes several outdated or unused fields from the JSON schemas and generated API definitions for the `decode` command in Core Lightning. It is a cleanup change that narrows the API surface by deleting fields that are no longer produced by the implementation. There is no direct evidence in the commit that this fixes an active security vulnerability.

This commit only adds a new test to the codebase. It checks that changing any field in a BOLT12 payer proof breaks the cryptographic signature, which is a defensive correctness test. There is no code fix, behavior change, or vulnerability being patched.

This change fixes a test-vector generator used only in Core Lightning's own test suite. The generator was accidentally printing the invoice merkle root twice and labeling the second copy as the 'proof merkle root.' The fix computes and prints the actual proof merkle root. This is a test-data bug, not a bug in live payment code, so it does not directly endanger user funds or node security.

This commit updates how payment proofs are digitally signed in Core Lightning. Previously, the code inserted a fake empty field (type 0, length 0) when computing the proof signature. The new code follows a simplified specification and signs the proof data directly without that dummy field. This is a standards-compliance/spec-simplification change rather than a fix for an active vulnerability.

This commit only updates a test program that prints sample data for BOLT12 invoice proofs. It changes the test to leave the optional 'note' field blank (NULL) instead of using an empty string, matching a recent specification change that says the field may be omitted when empty. There is no change to production code, no security fix, and no vulnerability.

This commit is a routine code-generation update for Core Lightning's gRPC and RPC bindings. It adds support for three new JSON-RPC commands (createproof, xkeysend, graceful) and a new primitive type (ProofField) used by createproof. The changes are entirely in generated binding code, not in the core daemon logic that actually processes payments, proofs, or shutdowns. There is no indication of a security fix or vulnerability.

This commit only updates the versions of GitHub Actions used in the project's automated build and test pipelines. It does not change any Core Lightning code that runs on users' computers, nor does it introduce any known security vulnerability. It is a routine maintenance change to stay ahead of GitHub's deprecation of older Node.js versions.

This commit is a large, routine cleanup of API metadata in Core Lightning. It marks many old RPC commands and fields as deprecated, removes some long-deprecated fields from generated gRPC/JSON schemas, and fixes version annotations in the code generator. There is no direct evidence of a security vulnerability being patched; the changes are about API lifecycle management and generated bindings.

This fix corrects a routing bug in Core Lightning's 'renepay' payment plugin. Previously, renepay could try to send payments through Lightning channels that the wider network had already marked as disabled, causing payment attempts to fail and wasting network round-trips. The patch makes renepay respect the disabled flag from network gossip, so it avoids those channels upfront. It is a reliability/efficiency fix rather than a direct theft-of-funds vulnerability.

This is a routine weekly update to the Rust dependency lock file (Cargo.lock), bumping four small helper libraries to their latest patch versions. There is no indication in the commit or supplied references that any of these updates fix a security issue, and the commit message explicitly says 'Changelog-None'.

This commit adds a single entry named 'bwatch' to the .gitignore file inside the plugins directory. A .gitignore file simply tells Git which files or folders to ignore when tracking changes. There is no code change, no bug fix, and no security relevance visible in this commit.

This commit is a routine version bump for a new release candidate (v26.06rc1) of Core Lightning. It updates version strings in packaging files and adds a detailed changelog. No actual source code behavior changes are included in this commit, so it does not introduce or fix any security issue by itself.

This is a routine weekly update to the Rust dependency lock file (Cargo.lock). It bumps several third-party library versions by patch or minor increments and removes one unused dependency. There is no indication in the commit of any security fix, vulnerability, or behavior change in Core Lightning itself.