Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 39 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
932ba950 · Feb 24, 2026 · 3 filesInformational 15Makefile: don't build the sources in make check-source.
check-source-bolt needs devtools, and check-python needs a full build.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a build-system and CI housekeeping change. It reorganizes which automated code-quality checks run before versus after compilation, and explicitly stops the 'check-source' Makefile target from compiling source code. There is no change to the actual Core Lightning node software, its network behavior, or its handling of funds, keys, or messages.
6c5883e5 · Feb 24, 2026 · 1 fileInformational 15Makefile: make testpack.tar.gz from (almost) all changed files.
Here are the speeds and sizes of different compressors (just
compressing the raw tar file):
bzip2: 34.15s 412MB
gzip -1: 9.96s 420MB
gzip -2: 10.39s 417MB
gzip -3: 11.63s 414MB
gzip -4: 12.29s 409MB
gzip -5: 14.41s 406MB
gzip -6: 19.02s 405MB
gzip -7: 22.96s 405MB
gzip -8: 39.63s 404MB
gzip -9: 72.19s 404MB
xz: 72.92s 407MB
Uncompressing time:
xz: 2.3 seconds
bzip2: 20 seconds
gzip -5: 3 seconds
Note that this target is only useful on a *freshly built* tree: it
will include everything config.vars and newer.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit changes how the project packages built files for testing in continuous integration (CI). It switches from a hand-maintained list of files bundled into a bzip2 archive to a rule that automatically collects almost all files newer than a build marker and compresses them with gzip. There is no user-facing behavior change, no network code, no cryptography, and no security-sensitive logic. It is purely a build/CI tooling change.
31ad743e · Feb 24, 2026 · 1 fileInformational 15CI: Use -O3 builds for Liquid integration tests.
The other integration tests are taking under an hour, and this is
taking 1hr 30m.
The downside is that backtraces are far less clear, but that's why the
main run uses the full debug version.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit changes one line in the project's automated testing configuration. It switches the Liquid integration tests to use a faster compiler optimization setting (-O3) so the tests finish sooner. It does not change any code that runs in production, does not fix a bug, and has no security relevance.
c1b2fde7 · Feb 24, 2026 · 1 fileInformational 15CI: Use variable to make group counts neater.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a cosmetic cleanup of the project's automated testing configuration. It replaces hard-coded numbers like '6' and '12' with a variable named GROUP_COUNT so the test job labels and command-line options stay consistent. There is no change to the actual Core Lightning software, no security fix, and no vulnerability introduced.
e9a7c942 · Feb 24, 2026 · 1 fileInformational 15plugins: neaten rust plugins, make them intermediate objects.
This keeps it simpler for future expansion, and also means we won't
rebuild them as much.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a minor cleanup of the build system for Rust-based plugins. It replaces several repetitive copy rules with a single pattern rule and marks the original compiled plugin files as intermediate build artifacts so they can be cleaned up automatically. There is no change to the actual plugin code, behavior, or security of the software.
740e35ad · Feb 24, 2026 · 1 fileInformational 15CI: avoid rebuilds on downloads using testpack.tar.gz.
We use the same fragment everywhere for consistency, even though some
stages don't actually call make.
The magic is:
CARGO=false CC=devtools/cc-nobuild SUPPRESS_GENERATION=1
Which causes us to fail if we want to rebuild.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only changes the project's GitHub Actions CI workflow. It switches the test artifact format from .tar.bz2 to .tar.gz, adds flags to prevent unnecessary rebuilds when running tests on prebuilt binaries, and cleans up some matrix configuration. There is no change to the actual Core Lightning software that users run, and nothing in the commit suggests a security fix or vulnerability.
bc518726 · Feb 24, 2026 · 1 fileInformational 15CI: do cargo test --all as part of post-build step
No point spending 1m24 seconds for *each* different compiler variant.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit simply reorganizes the project's automated testing pipeline. It moves a Rust test step ('cargo test --all') from one place in the CI workflow to another so it runs once after builds instead of once per compiler variant. There is no change to the actual Core Lightning software, its configuration, or its security behavior.
1047c484 · Feb 24, 2026 · 1 fileInformational 15CI: use more optimized builds sometimes.
1. Don't --enable-debugbuild for sanitizer runs (slow) or -O3 compilations.
2. Use -O3 build for splicing and postgres tests runs (speed them a
little), make sure builds without --enable-debugbuild work.
3. Remove clang test run, because we already use that for
minimum-btc-version test: this saves another 2 hour CI job.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only changes how the project's automated continuous integration (CI) tests are built. It turns off debug builds for some test configurations, enables more compiler optimization (-O3) for a couple of test runs, and removes one redundant clang test job. There is no change to the actual Core Lightning software that users run, and no security relevance is apparent.
b3978d94 · Feb 24, 2026 · 1 fileInformational 15CI: Don't explicitly invoke .github/scripts/install-bitcoind.sh
It's done by setup.sh, so simply set the env var for that. Don't try
to reinstall valgrind or call `sudo apt-get update -qq` either, since
setup.sh does that too.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a routine cleanup of the project's automated CI (Continuous Integration) workflow file. It removes duplicated steps by letting a single setup script handle installing bitcoind, updating package lists, and installing valgrind. There is no change to the actual Core Lightning software that users run, and no security issue is present.
5d444c61 · Feb 24, 2026 · 3 filesInformational 15Makefile: mark more things as intermediaries.
This means we don't have to include them in our bundle.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only changes build-system instructions (Makefiles). It tells the build process that certain temporary files (intermediate build artifacts like generated source files and compiled library objects) can be deleted automatically after they are no longer needed, so they don't have to be bundled in release packages. There is no change to the actual Lightning node software, its networking, cryptography, or wallet logic, and no security-relevant behavior is introduced or fixed.
d39ba340 · Feb 24, 2026 · 1 fileInformational 15CI: make downgrade and slow integration tests depend on check-compiled-source step.
As pointed out by Alex Myers: we don't want to waste time running the
complex steps if the generated files are not up-to-date.
But we still run the faster "integration" tests (not valgrind or
sanitizer ones), since they often reveal early failures.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit changes the GitHub Actions CI workflow so that three slower, more complex test jobs now wait for a 'check-compiled-source' step instead of the plain 'compile' step. It is purely a build-pipeline efficiency tweak to avoid wasting time on long tests when generated source files are stale. There is no change to application code, no security fix, and no vulnerability.
77251ec1 · Feb 24, 2026 · 1 fileInformational 15CI: use nproc + 1 for pytest parallelism..
More future proof, better for self-hosted runners.
Example run times before:
4s CI completion
2m 36s Check we can downgrade the node (compile-gcc, sqlite3, liquid-regtest)
2m 52s Check we can downgrade the node (compile-gcc, postgres, regtest)
3m 20s Check we can downgrade the node (compile-gcc, sqlite3, regtest, 1)
3m 20s Check we can downgrade the node (compile-gcc, sqlite3, regtest, 1)
8m 1s Run fuzz regression tests
11m 46s Run unit tests (compile-clang-sanitizers, 0)
12m 59s Compile CLN compile-gcc
13m 42s Compile CLN compile-clang
14m 10s Compile CLN compile-gcc-O3
14m 15s Compile CLN compile-clang-sanitizers
15m 23s Pre-build checks
19m 37s Test CLN dual-fund
26m 49s Run unit tests (compile-gcc, 1)
43m 19s Valgrind Test CLN Valgrind (06/10)
43m 21s Valgrind Test CLN Valgrind (08/10)
43m 40s Valgrind Test CLN Valgrind (05/10)
43m 59s Valgrind Test CLN Valgrind (03/10)
44m 4s Valgrind Test CLN Valgrind (07/10)
47m 28s Valgrind Test CLN Valgrind (09/10)
47m 37s Valgrind Test CLN Valgrind (02/10)
47m 45s Valgrind Test CLN Valgrind (01/10)
52m 51s Valgrind Test CLN Valgrind (04/10)
54m 6s Valgrind Test CLN Valgrind (10/10)
1h 14m 13s Sanitizers Test CLN (ASan/UBSan (03/12), 3, --test-group=3 --test-group-count=12)
1h 14m 6s Sanitizers Test CLN (ASan/UBSan (06/12), 6, --test-group=6 --test-group-count=12)
1h 15m 23s Sanitizers Test CLN (ASan/UBSan (01/12), 1, --test-group=1 --test-group-count=12)
1h 20m 30s Sanitizers Test CLN (ASan/UBSan (08/12), 8, --test-group=8 --test-group-count=12)
1h 22m 35s Sanitizers Test CLN (ASan/UBSan (12/12), 12, --test-group=12 --test-group-count=12)
1h 23m 49s Sanitizers Test CLN (ASan/UBSan (04/12), 4, --test-group=4 --test-group-count=12)
1h 26m 11s Sanitizers Test CLN (ASan/UBSan (07/12), 7, --test-group=7 --test-group-count=12)
1h 28m 44s Sanitizers Test CLN (ASan/UBSan (05/12), 5, --test-group=5 --test-group-count=12)
1h 29m 1s Sanitizers Test CLN (ASan/UBSan (02/12), 2, --test-group=2 --test-group-count=12)
1h 29m 4s Sanitizers Test CLN (ASan/UBSan (11/12), 11, --test-group=11 --test-group-count=12)
1h 31m 36s Sanitizers Test CLN (ASan/UBSan (09/12), 9, --test-group=9 --test-group-count=12)
1h 38m 54s Sanitizers Test CLN (ASan/UBSan (10/12), 10, --test-group=10 --test-group-count=12)
1h 39m 22s Test CLN liquid
1h 52m 23s Test minimum supported BTC v25.0 with clang
1h 52m 28s Test CLN gcc
1h 53m 57s Test CLN splicing
1h 57m 25s Test CLN postgres
1h 59m 25s Test CLN clang
2d 17h 56m 16s TOTAL
Example runtimes afterwards:
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only changes how many parallel test jobs run in the project's automated continuous integration (CI) system. It replaces hard-coded numbers like 4 or 2 with a dynamic value based on the number of available CPU cores. There is no change to the Core Lightning node software itself, its network behavior, wallet handling, or any user-facing feature. It is purely an infrastructure speed-up.
b1031e56 · Feb 24, 2026 · 4 filesInformational 15Makefile: support overriding of CC and CARGO for catching unintended builds.
For CI we want to make sure we don't rebuild. CC=false doesn't work because
we reply on the output of "$CC -dumpmachine" for the external build directory.
So we would use:
make CC=devtools/cc-nobuild CARGO=false
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a build-system maintenance change. It lets the project’s Makefiles accept custom values for the C compiler (CC) and Rust tool (CARGO) variables, and adds a small helper script used only in CI to detect accidental rebuilds. There is no change to the actual Lightning node software, no bug fix, and no security-related behavior.
7a58575a · Feb 24, 2026 · 1 fileInformational 15pytest: mark test_partial_payment_restart slow.
We can actually be slow enough that we get a (60 second) MPP timeout
under valgrind:
```
# Restart, and make sure it's reconnected to l2.
l3.restart()
print(l2.rpc.listpeers())
wait_for(lambda: [p['connected'] for p in l2.rpc.listpeers()['peers']] == [True, True])
# Pay second part.
l1.rpc.sendpay(
route=route,
payment_hash=inv['payment_hash'],
amount_msat=1000,
bolt11=inv['bolt11'],
payment_secret=paysecret,
partid=2,
groupid=1,
)
> l1.rpc.waitsendpay(payment_hash=inv['payment_hash'], timeout=TIMEOUT, partid=1)
tests/test_pay.py:3352:
...
E pyln.client.lightning.RpcError: RPC call failed: method: waitsendpay, payload: {'payment_hash': 'd73e10b604f53afb05da052d1fc90c45269321169196e31b7ccc312eabc26557', 'timeout': 180, 'partid': 1}, error: {'code': 204, 'message': 'failed: WIRE_MPP_TIMEOUT (reply from remote)', 'data': {'created_index': 1, 'id': 1, 'payment_hash': 'd73e10b604f53afb05da052d1fc90c45269321169196e31b7ccc312eabc26557', 'groupid': 1, 'partid': 1, 'destination': '03cecbfdc68544cc596223b68ce0710c9e5d2c9cb317ee07822d95079acc703d31', 'amount_msat': 500, 'amount_sent_msat': 501, 'created_at': 1771551338, 'status': 'pending', 'bolt11': 'lnbcrt10n1p5e0wnfsp5vpgn0adhmyjecp47yfc6dtefett7d3qqzh4j908ane7tezyy0evqpp56ulppdsy75a0kpw6q5k3ljgvg5nfxggkjxtwxxmuescja27zv4tsdq9d9h8vxqyjw5qcqp9rzjqvuytqpdyk6wqaxvl47d3vee5swuwklej79qxjqqg394r4ptqaue5qqqvuqqqqgqqqqqqqqpqqqqqzsqqc9qxpqysgq6ur4cclfhnzs0tgenmxhvx8glw3q9eylp3pdck73x58cukwtfxj5zjg6g0a4p4plgj6qd0s0uxkuntzcn4l6vvndgrjj7gndma3t7pcqmr9q3j', 'erring_index': 2, 'failcode': 23, 'failcodename': 'WIRE_MPP_TIMEOUT', 'erring_node': '03cecbfdc68544cc596223b68ce0710c9e5d2c9cb317ee07822d95079acc703d31', 'erring_channel': '103x1x0', 'erring_direction': 0, 'raw_message': '0017'}}
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only adds a 'slow_test' marker to an existing test. The test was sometimes failing under valgrind because the simulated network was too slow and a multi-part payment timed out before the test could complete. This is a test-suite reliability fix, not a security fix in the actual lightning node software.
e50ea420 · Feb 24, 2026 · 2 filesInformational 15CI: Don't do release target build, create "small" profile
Using RUST_TARGET=release is slower than RUST_TARGET=debug, *but*
the images are much bigger.
On my laptop, but restricted to 4 CPUs. I added a target to build all
the prerequisited but not compress the bzip2:
RUST_TARGET Time to build Size (testpack.tar.bz2)
release 4m49s 133MB
debug 2m34s 343MB
small 2m9s 155MB
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit changes the project's automated build settings to use a new 'small' Rust compilation profile instead of the 'release' profile. The goal is to make CI builds faster and produce smaller artifacts for testing, with no intended functional change to the software itself.
c22538ec · Feb 23, 2026 · 4 filesInformational 24misc: fix uninitialised errors for macOS
MacOS SDK is quite strict so treats these uninitialised variable warnings as errors.
This commit fixes compiler warnings that macOS treats as errors. Most changes simply initialize variables to zero or remove an unused variable. One change in the dual-funding code replaces a previously declared but uninitialized channel identifier with an existing one from the state object, which could prevent use of stale or random memory.
6d252dca · Feb 23, 2026 · 4 filesLow 49ccan: import new version to change vsprintfs to vsnprintfs
This commit updates an internal helper library (CCAN) used by Core Lightning. The headline change replaces an unsafe string-formatting call (vsprintf) with a safer bounded version (vsnprintf), and adds a new helper for adding strings of a known length. These are defensive hardening changes that reduce the risk of buffer overflows when building JSON messages, but the commit itself does not claim to fix a specific exploitable vulnerability.
9eee744d · Feb 23, 2026 · 5 filesLow 36lightningd: honor `payment-fronting-node` when making bolt12 offers.
We use all the fronting nodes when creating offers.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a feature gap in Core Lightning's BOLT12 offer creation. Previously, the `payment-fronting-node` setting—which lets a node hide behind one or more public 'front' nodes for privacy—was ignored when creating BOLT12 offers. The patch makes the offer plugin read the configured fronting nodes and include them all as blinded paths in generated offers, matching the behavior already intended for invoices. It is a correctness/privacy fix rather than a remote-exploitable vulnerability.
2a1f647b · Feb 23, 2026 · 4 filesInformational 15lightningd: add payment-fronting-node option.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Added: Config: `payment-fronting-node` option to specify neighbor node(s) to use for all bolt11 invoices, bolt12 offers, invoices and invoice_requests.
This commit adds a new optional configuration setting called `payment-fronting-node` to Core Lightning. It lets a node operator choose one or more neighboring nodes to appear as the entry point on invoices and offers, routing payments to themselves through those neighbors. This is a privacy feature, not a security fix or vulnerability.
5ecb1ef2 · Feb 23, 2026 · 3 filesLow 30lightningd: honor `payment-fronting-node` when making bolt11 invoices.
We use all the fronting nodes when creating invoices.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a bug where Core Lightning's `payment-fronting-node` configuration option was ignored when creating BOLT11 invoices. The option lets a node designate one or more 'fronting' nodes that should always appear as the first hop in invoice route hints, even if those channels would normally be skipped as private, offline, or low-capacity. The change makes invoice generation honor that setting so the intended routing path is advertised.
c168f6a7 · Feb 23, 2026 · 5 filesInformational 15libplugin: support multi options.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Added: libplugin: support for options which accumulate if specified more than once ("multi": true).
This commit adds a new feature to Core Lightning's plugin helper library: plugin options can now be declared as 'multi', meaning they can be specified multiple times and the values accumulate into a list. It is a straightforward feature addition with no security relevance visible in the code or commit message.
9fa7c937 · Feb 23, 2026 · 2 filesLow 35offers: only use blinded path nodes from offers when creating invoice for invoice_request.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change fixes how Core Lightning creates invoices in response to BOLT12 offers. Previously, when replying to an invoice_request, the node used its own configured 'fronting nodes' rather than the ones actually listed in the offer. That meant an offer that specified a particular privacy/fronting path could be ignored, potentially exposing the recipient's real node identity in the invoice. The patch makes the invoice reuse the offer's blinded-path fronting nodes, falling back to defaults only if the offer did not specify any. It also adds tests showing offers can now enforce specific fronting nodes or no fronting at all.
25e2374f · Feb 23, 2026 · 4 filesLow 25offers: modify find_best_peer() to only select from fronting nodes if set.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change adds an optional filter to a peer-selection helper in the Lightning node's 'offers' plugin. When a caller provides a list of allowed 'fronting' nodes, the helper now restricts its choice to those nodes and still keeps disconnected ones as a last resort. The commit message and diff do not describe any security bug; it reads like a feature refinement for offer/blinded-path routing.
ae21089a · Feb 23, 2026 · 2 filesLow 32offers: honor `payment-fronting-nodes` when creating invoices.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change fixes a bug in Core Lightning's BOLT12 'offers' feature where a node operator's explicit request to use specific 'payment-fronting nodes' was ignored when creating invoices. Previously, the node could silently issue a bare invoice without the requested privacy/relay path. Now it either honors the configured fronting nodes or fails the invoice request if it cannot. This is a correctness and privacy-hardening fix rather than a critical remote-exploitable vulnerability.
611341dd · Feb 23, 2026 · 1 fileLow 26lightningd: don't assert if plugin crashes early.
If a plugin exits early, we will not exit with ret == plugins: return
from this function and we will exit because ld->exit_code is set.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change removes a hard crash (assert) that occurred when a plugin exited unexpectedly during startup. Instead of the main lightning daemon crashing with an assertion failure, it now allows the daemon to shut down cleanly using the already-set exit code. This is a robustness fix that prevents a misbehaving plugin from causing an uncontrolled crash, but it does not appear to be a security vulnerability on its own.