Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 18 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
63497b31 · Feb 3, 2026 · 6 filesInformational 18pytest: fix flake in test_even_sendcustommsg
We need to make sure the message is fully processed before
removing the plugin.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a flaky test by adding a completion handshake so connectd knows when lightningd has finished processing a custom peer message. It is a reliability/test-hardening change, not a fix for an exploitable security vulnerability.
f799c4c5 · Feb 3, 2026 · 1 fileInformational 15pytest: fix flake in test_sql.
If l2 hasn't seen l1's node_announcement yet:
```
# Correctly handles missing object.
> assert l2.rpc.sql("SELECT option_will_fund_lease_fee_base_msat,"
" option_will_fund_lease_fee_basis,"
" option_will_fund_funding_weight,"
" option_will_fund_channel_fee_max_base_msat,"
" option_will_fund_channel_fee_max_proportional_thousandths,"
" option_will_fund_compact_lease"
" FROM nodes WHERE HEX(nodeid) = '{}';".format(l1.info['id'].upper())) == {'rows': [[None] * 6]}
E AssertionError: assert {'rows': []} == {'rows': [[None, None, None, None, None, None]]}
E
E Differing items:
E {'rows': []} != {'rows': [[None, None, None, None, None, None]]}
E
E Full diff:
E {
E - 'rows': [
E + 'rows': [],
E ? ++
E - [
E - None,
E - None,
E - None,
E - None,
E - None,
E - None,
E - ],
E - ],
E }
tests/test_plugin.py:4131: AssertionError
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a flaky test in the project's automated test suite. It adds a wait condition so that one test node has received network information about another node before the test checks database query results. There is no security issue here—just a timing problem in tests.
13545124 · Feb 3, 2026 · 1 fileInformational 15pytest: fix flake in test_channel_lease_unilat_closes
```
2026-01-30T05:55:13.6654636Z # Note that l3 has the whole lease delay (minus blocks already mined)
2026-01-30T05:55:13.6655396Z _, _, l3blocks = l3.wait_for_onchaind_tx('OUR_DELAYED_RETURN_TO_WALLET',
2026-01-30T05:55:13.6656086Z 'OUR_UNILATERAL/DELAYED_OUTPUT_TO_US')
2026-01-30T05:55:13.6656618Z > assert l3blocks == 4032 - 6 - 2 - 1
2026-01-30T05:55:13.6657033Z E assert 4025 == (((4032 - 6) - 2) - 1)
```
Turns out that 43420433829 (tests: de-flake test that was failing on
cltv expiry) added a line to mine two more blocks, but the hardcoded
110 was not changed to 112, so we weren't actually waiting correctly.
Remove hardcoded numbers in favor of calculation, and do the same in
test_channel_lease_post_expiry (which was correct, for now).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a flaky test in Core Lightning's test suite. The test was using a hardcoded block number that became outdated after a previous change added more mined blocks. The fix replaces the hardcoded number with a dynamic calculation based on the actual blockchain height. This is purely a test reliability improvement and does not change any production code or affect real users.
e36564f6 · Feb 3, 2026 · 1 fileInformational 15pytest: make test_connect_ratelimit more robust
We were sending SIGSTOP to the lightningds, but that doesn't always
mean the connectd would stop it seems:
```
lightningd-1 2026-01-27T04:49:16.979Z DEBUG 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-connectd: Initializing important peer with 1 addresses
lightningd-1 2026-01-27T04:49:16.979Z DEBUG connectd: Got 10 bad cupdates, ignoring them (expected on mainnet)
lightningd-1 2026-01-27T04:49:16.979Z DEBUG 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-connectd: Connected out, starting crypto
lightningd-1 2026-01-27T04:49:16.980Z DEBUG 038194b5f32bdf0aa59812c86c4ef7ad2f294104fa027d1ace9b469bb6f88cf37b-hsmd: Got WIRE_HSMD_ECDH_REQ
lightningd-1 2026-01-27T04:49:16.981Z DEBUG hsmd: Client: Received message 1 from client
lightningd-1 2026-01-27T04:49:16.985Z TRACE 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-gossipd: handle_recv_gossip: WIRE_CHANNEL_ANNOUNCEMENT
lightningd-1 2026-01-27T04:49:16.985Z TRACE 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-gossipd: handle_recv_gossip: WIRE_CHANNEL_UPDATE
lightningd-1 2026-01-27T04:49:16.985Z TRACE 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-gossipd: handle_recv_gossip: WIRE_CHANNEL_UPDATE
lightningd-1 2026-01-27T04:49:16.985Z TRACE 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-gossipd: handle_recv_gossip: WIRE_NODE_ANNOUNCEMENT
lightningd-1 2026-01-27T04:49:16.985Z DEBUG 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-connectd: Connect OUT
lightningd-1 2026-01-27T04:49:16.986Z DEBUG 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-connectd: peer_out WIRE_INIT
lightningd-1 2026-01-27T04:49:16.986Z DEBUG 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-connectd: peer_in WIRE_INIT
lightningd-1 2026-01-27T04:49:16.986Z TRACE lightningd: Calling peer_connected hook of plugin chanbackup
lightningd-1 2026-01-27T04:49:16.986Z DEBUG 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-connectd: Handed peer, entering loop
lightningd-1 2026-01-27T04:49:16.986Z DEBUG 03cecbfdc68544cc596223b68ce0710c9e5d2c9cb317ee07822d95079acc703d31-connectd: Initializing important peer with 1 addresses
lightningd-1 2026-01-27T04:49:16.986Z DEBUG 033845802d25b4e074ccfd7cd8b339a41dc75bf9978a034800444b51d42b07799a-connectd: Initializing important peer with 1 addresses
lightningd-1 2026-01-27T04:49:16.987Z DEBUG 033845802d25b4e074ccfd7cd8b339a41dc75bf9978a034800444b51d42b07799a-connectd: Too many connections, waiting...
lightningd-1 2026-01-27T04:49:16.987Z DEBUG 02186115cb7e93e2cb4d9d9fe7a9cf5ff7a5784bfdda4f164ff041655e4bcd4fd0-connectd: Initializing important peer with 1 addresses
lightningd-1 2026-01-27T04:49:16.987Z DEBUG 02186115cb7e93e2cb4d9d9fe7a9cf5ff7a5784bfdda4f164ff041655e4bcd4fd0-connectd: Too many connections, waiting...
lightningd-1 2026-01-27T04:49:16.987Z DEBUG 02287bfac8b99b35477ebe9334eede1e32b189e24644eb701c079614712331cec0-connectd: Initializing important peer with 1 addresses
lightningd-1 2026-01-27T04:49:16.987Z DEBUG 02287bfac8b99b35477ebe9334eede1e32b189e24644eb701c079614712331cec0-connectd: Too many connections, waiting...
lightningd-1 2026-01-27T04:49:16.987Z DEBUG 03cecbfdc68544cc596223b68ce0710c9e5d2c9cb317ee07822d95079acc703d31-connectd: Connected out, starting crypto
lightningd-1 2026-01-27T04:49:16.989Z DEBUG 038194b5f32bdf0aa59812c86c4ef7ad2f294104fa027d1ace9b469bb6f88cf37b-hsmd: Got WIRE_HSMD_ECDH_REQ
lightningd-1 2026-01-27T04:49:16.989Z DEBUG hsmd: Client: Received message 1 from client
lightningd-1 2026-01-27T04:49:16.990Z DEBUG 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-connectd: peer_in WIRE_GOSSIP_TIMESTAMP_FILTER
lightningd-1 2026-01-27T04:49:16.991Z DEBUG 03cecbfdc68544cc596223b68ce0710c9e5d2c9cb317ee07822d95079acc703d31-connectd: Connect OUT
lightningd-1 2026-01-27T04:49:16.991Z DEBUG 03cecbfdc68544cc596223b68ce0710c9e5d2c9cb317ee07822d95079acc703d31-connectd: peer_out WIRE_INIT
lightningd-1 2026-01-27T04:49:16.991Z DEBUG 0258f3ff3e0853ccc09f6fe89823056d7c0c55c95fab97674df5e1ad97a72f6265-connectd: peer_out WIRE_PEER_STORAGE
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only changes a test file to make an existing test more reliable. Instead of pausing the whole lightning node process during a test, it now pauses only the 'connectd' sub-process. There is no change to production code and no security fix or vulnerability.
9e8e85de · Feb 3, 2026 · 1 fileInformational 15pytest: allow pushed after onchain_fee in test_bookkeeping_missed_chans_pushed
It can happen, and it's perfectly reasonable. If this happens in other places, we might need to allow
arbitrary reordering?
```
2026-01-29T05:55:58.5474967Z exp_events = [{'tag': 'channel_open', 'credit_msat': open_amt * 1000, 'debit_msat': 0},
2026-01-29T05:55:58.5475765Z {'tag': 'pushed', 'credit_msat': 0, 'debit_msat': push_amt},
2026-01-29T05:55:58.5476454Z {'tag': 'onchain_fee', 'credit_msat': 4927000, 'debit_msat': 0},
2026-01-29T05:55:58.5477168Z {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': invoice_msat}]
2026-01-29T05:55:58.5477797Z > check_events(l1, channel_id, exp_events)
2026-01-29T05:55:58.5478120Z
2026-01-29T05:55:58.5478282Z tests/test_bookkeeper.py:402:
2026-01-29T05:55:58.5478777Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
2026-01-29T05:55:58.5479162Z
2026-01-29T05:55:58.5479396Z node = <fixtures.LightningNode object at 0x7fa3660a6140>
2026-01-29T05:55:58.5480158Z channel_id = 'a4e913b2d143efc3d90cfa66a56aeed3eb9e1533b350c8e84124bdec37bcf74a'
2026-01-29T05:55:58.5481929Z exp_events = [{'credit_msat': 10000000000, 'debit_msat': 0, 'tag': 'channel_open'}, {'credit_msat': 0, 'debit_msat': 1000000000, 'tag': 'pushed'}, {'credit_msat': 4927000, 'debit_msat': 0, 'tag': 'onchain_fee'}, {'credit_msat': 0, 'debit_msat': 11000000, 'tag': 'invoice'}]
2026-01-29T05:55:58.5483442Z
2026-01-29T05:55:58.5483671Z def check_events(node, channel_id, exp_events):
2026-01-29T05:55:58.5484551Z chan_events = [ev for ev in node.rpc.bkpr_listaccountevents()['events'] if ev['account'] == channel_id]
2026-01-29T05:55:58.5485684Z stripped = [{k: d[k] for k in ('tag', 'credit_msat', 'debit_msat') if k in d} for d in chan_events]
2026-01-29T05:55:58.5486455Z > assert stripped == exp_events
2026-01-29T05:55:58.5489277Z E AssertionError: assert [{'tag': 'channel_open', 'credit_msat': 10000000000, 'debit_msat': 0}, {'tag': 'onchain_fee', 'credit_msat': 4927000, 'debit_msat': 0}, {'tag': 'pushed', 'credit_msat': 0, 'debit_msat': 1000000000}, {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': 11000000}] == [{'tag': 'channel_open', 'credit_msat': 10000000000, 'debit_msat': 0}, {'tag': 'pushed', 'credit_msat': 0, 'debit_msat': 1000000000}, {'tag': 'onchain_fee', 'credit_msat': 4927000, 'debit_msat': 0}, {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': 11000000}]
2026-01-29T05:55:58.5492021Z E
2026-01-29T05:55:58.5492767Z E At index 1 diff: {'tag': 'onchain_fee', 'credit_msat': 4927000, 'debit_msat': 0} != {'tag': 'pushed', 'credit_msat': 0, 'debit_msat': 1000000000}
2026-01-29T05:55:58.5493812Z E
2026-01-29T05:55:58.5494078Z E Full diff:
2026-01-29T05:55:58.5494373Z E [
2026-01-29T05:55:58.5494863Z E {
2026-01-29T05:55:58.5495166Z E 'credit_msat': 10000000000,
2026-01-29T05:55:58.5495565Z E 'debit_msat': 0,
2026-01-29T05:55:58.5495946Z E 'tag': 'channel_open',
2026-01-29T05:55:58.5496330Z E - },
2026-01-29T05:55:58.5496613Z E - {
2026-01-29T05:55:58.5496906Z E - 'credit_msat': 0,
2026-01-29T05:55:58.5497285Z E - 'debit_msat': 1000000000,
2026-01-29T05:55:58.5497900Z E - 'tag': 'pushed',
2026-01-29T05:55:58.5498264Z E },
2026-01-29T05:55:58.5498531Z E {
2026-01-29T05:55:58.5498818Z E 'credit_msat': 4927000,
2026-01-29T05:55:58.5499200Z E 'debit_msat': 0,
2026-01-29T05:55:58.5499563Z E 'tag': 'onchain_fee',
2026-01-29T05:55:58.5499925Z E },
2026-01-29T05:55:58.5500190Z E {
2026-01-29T05:55:58.5500477Z E 'credit_msat': 0,
2026-01-29T05:55:58.5500863Z E + 'debit_msat': 1000000000,
2026-01-29T05:55:58.5501255Z E + 'tag': 'pushed',
2026-01-29T05:55:58.5501592Z E + },
2026-01-29T05:55:58.5501853Z E + {
2026-01-29T05:55:58.5502141Z E + 'credit_msat': 0,
2026-01-29T05:55:58.5502511Z E 'debit_msat': 11000000,
2026-01-29T05:55:58.5502889Z E 'tag': 'invoice',
2026-01-29T05:55:58.5503424Z E },
2026-01-29T05:55:58.5503698Z E ]
2026-01-29T05:55:58.5503861Z
2026-01-29T05:55:58.5504027Z tests/test_bookkeeper.py:29: AssertionError
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a test-only change that makes a bookkeeping test accept either of two possible event orderings. It does not change production code, network behavior, or security properties. There is no vulnerability or security fix here.
18a416be · Feb 3, 2026 · 1 fileInformational 15connectd: unify IO logging calls.
Normally, connectd forwards messages and then the subds do logging,
but it logs manually for msgs which are handled internally.
Clarify this logic in one place for all callers.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a small internal code cleanup in Core Lightning's connection handling. It moves repeated logging calls into a single helper function so the code is easier to read. There is no change to security behavior, no bug fix, and no vulnerability.
cf3583ff · Feb 3, 2026 · 1 fileInformational 11pytest: mark renepay's self-pay test flaky
Not sure this is worth getting to the bottom of, if we're going for xpay?
```
2026-01-20T05:25:55.4375717Z lightningd-1 2026-01-20T05:22:41.062Z DEBUG plugin-cln-renepay: sendpay_failure notification: {"sendpay_failure":{"code":202,"message":"Malformed error reply","data":{"created_index":2,"id":2,"payment_hash":"8447592dc3786c3181746bd7bf17fe9e84d3de3dfff847f9f2b8c1a65c2d3ff6","groupid":1,"partid":1,"destination":"038194b5f32bdf0aa59812c86c4ef7ad2f294104fa027d1ace9b469bb6f88cf37b","amount_msat":10000,"amount_sent_msat":10000,"created_at":1768886560,"status":"pending","bolt11":"lnbcrt100n1p5k7yfqsp5g072rrl6jn7wu8nlxk279zpkacz34hr22n089j4elguccfxmg0gqpp5s3r4jtwr0pkrrqt5d0tm79l7n6zd8h3alluy070jhrq6vhpd8lmqdqgw3jhxapjxqyjw5qcqp99qxpqysgq6dd74sj0vpyjy9he8pep73tt8pljhv6mc74y28rr8995yjyahgh9kc2jqwqz62h6u6jpqz0u9x6gcahdw3pe2x8r5eyppp53mlpru8sp4p4nf6","onionreply":"c5a02ce5372635959d87818f723767efe3137bbc40568fb04e1f2eedee0a6149000e400f00000000000027100000006c00f20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}}}
2026-01-20T05:25:55.4386158Z lightningd-1 2026-01-20T05:22:41.067Z **BROKEN** plugin-cln-renepay: Unable to parse sendpay_failure: {"code":202,"message":"Malformed error reply","data":{"created_index":2,"id":2,"payment_hash":"8447592dc3786c3181746bd7bf17fe9e84d3de3dfff847f9f2b8c1a65c2d3ff6","groupid":1,"partid":1,"destination":"038194b5f32bdf0aa59812c86c4ef7ad2f294104fa027d1ace9b469bb6f88cf37b","amount_msat":10000,"amount_sent_msat":10000,"created_at":1768886560,"status":"pending","bolt11":"lnbcrt100n1p5k7yfqsp5g072rrl6jn7wu8nlxk279zpkacz34hr22n089j4elguccfxmg0gqpp5s3r4jtwr0pkrrqt5d0tm79l7n6zd8h3alluy070jhrq6vhpd8lmqdqgw3jhxapjxqyjw5qcqp99qxpqysgq6dd74sj0vpyjy9he8pep73tt8pljhv6mc74y28rr8995yjyahgh9kc2jqwqz62h6u6jpqz0u9x6gcahdw3pe2x8r5eyppp53mlpru8sp4p4nf6","onionreply":"c5a02ce5372635959d87818f723767efe3137bbc40568fb04e1f2eedee0a6149000e400f00000000000027100000006c00f20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}}
```
```
2026-01-20T05:25:55.4465729Z with pytest.raises(RpcError, match=r"Unknown invoice") as excinfo:
2026-01-20T05:25:55.4466111Z > l1.rpc.call("renepay", {"invstring": inv2})
2026-01-20T05:25:55.4466310Z
2026-01-20T05:25:55.4466402Z tests/test_renepay.py:423:
...
2026-01-20T05:25:55.4489732Z elif "error" in resp:
2026-01-20T05:25:55.4490005Z > raise RpcError(method, payload, resp['error'])
2026-01-20T05:25:55.4492135Z E pyln.client.lightning.RpcError: RPC call failed: method: renepay, payload: {'invstring': 'lnbcrt100n1p5k7yfqsp5g072rrl6jn7wu8nlxk279zpkacz34hr22n089j4elguccfxmg0gqpp5s3r4jtwr0pkrrqt5d0tm79l7n6zd8h3alluy070jhrq6vhpd8lmqdqgw3jhxapjxqyjw5qcqp99qxpqysgq6dd74sj0vpyjy9he8pep73tt8pljhv6mc74y28rr8995yjyahgh9kc2jqwqz62h6u6jpqz0u9x6gcahdw3pe2x8r5eyppp53mlpru8sp4p4nf6'}, error: {'code': -4, 'message': 'Plugin terminated before replying to RPC call.'}
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only adds a test-flakiness marker to an existing automated test. It does not change any production code, and the commit message treats the underlying crash as a low-priority test reliability issue rather than a security problem.
5c31d337 · Feb 3, 2026 · 2 filesLow 25common: remove legacy onion translation.
This was added in 24.05, but LND since 0.18.3 no longer ever creates
such onions, and even that version (September 2024) is now a long way
behind.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Removed: Protocol: we no longer support legacy onions (never sent by LND >= 0.18.3, which was the last)
This commit removes support for an old-style Lightning payment onion format called 'legacy onions.' These were only produced by older versions of LND and had already been partially removed in a previous release. The change is a protocol cleanup, not a fix for an active security bug. It does not add new code paths that handle untrusted data differently; it simply stops accepting a deprecated format. The main risk is reduced interoperability with very old nodes, not a new vulnerability.
2c0214f2 · Feb 3, 2026 · 1 fileInformational 15common: remove unused type field.
We always use modern TLV style: in fact, this field was never set!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit removes an unused 'type' field and its associated enum from a data structure used when building Lightning Network onion-routed payment packets. The commit message states the field was never actually set. This is a straightforward code cleanup with no apparent security relevance.
1de4e1dc · Feb 3, 2026 · 1 fileInformational 12pytest: test for amountless offer with currency.
Should fail: see https://github.com/lightning/bolts/pull/1279
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only adds a new pytest test case. The test is marked as expected to fail (xfail) and checks that decoding a specific kind of Lightning offer (one with a currency but no amount) is correctly rejected as invalid. It does not change any production code, fix a bug, or introduce a vulnerability. It is a test addition tied to an ongoing BOLT specification discussion.
5053e2e3 · Feb 3, 2026 · 2 filesLow 44common: enforce currency-requires-amount check.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change makes Core Lightning refuse BOLT12 offers that specify a currency but no amount. Previously the code did not enforce this rule, which could let a node process malformed offers in ways the protocol says it must not. The fix is small and adds a test that now passes.
6a937307 · Feb 3, 2026 · 6 filesInformational 19decode: don't treat every failure as a rune.
If we can't decode something, and it decodes as a rune (and all bech32
strings do!), then we would usually just complain it was a malformed
rune. Be a big more useful, when the parameter looks like somthing else.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: JSON-RPC: `decode` is now more informative with malformed strings (won't claim everything is a malformed rune!).
This commit improves the 'decode' command in Core Lightning so that when it receives a malformed string, it no longer incorrectly labels every failure as a 'malformed rune'. It adds logic to guess the intended type of the input (e.g., a BOLT11 invoice, BOLT12 offer, emergency recovery string, or rune) and returns a more useful error message. There is no direct security vulnerability being fixed; it is a usability and diagnostic improvement.
01736105 · Feb 2, 2026 · 2 filesInformational 15Fix Reckless search command not finding partial matches
The Reckless search command was only returning a result if you
searched a perfect match, which is not too helpful. This updates the
command so that partial search matches return a result.
Before:
reckless search bolt
Search exhausted all sources
reckless search bol
Search exhausted all sources
reckless search bolt12-pris
Search exhausted all sources
After:
reckless search bolt
Plugins matching 'bolt':
bolt12-prism (https://github.com/lightningd/plugins)
reckless search bol
Plugins matching 'bol':
bolt12-prism (https://github.com/lightningd/plugins)
reckless search bolt12-pris
Plugins matching 'bolt12-pris':
bolt12-prism (https://github.com/lightningd/plugins)
Changelog-Fixed: reckless search now returns partial matches instead of requiring exact plugin names.
This commit fixes a user-experience bug in the 'reckless' plugin manager tool. Previously, the 'search' command only found plugins if you typed the exact name. Now it also returns plugins whose names contain the search term as a substring. There is no security issue here—it's a straightforward feature/bug-fix for a command-line search tool.
ff34e485 · Feb 2, 2026 · 2 filesInformational 15feat: Enhance JUnit XML reporting with environment variables and add import to conftest.py
Changelog-None
This commit only changes test reporting code. It adds GitHub Actions environment variables to JUnit XML test reports and adds a missing `import os` statement. There is no change to Core Lightning's wallet, network, or node logic, and no security relevance.
e2d17cea · Feb 2, 2026 · 1 fileLow 42pytest: test for crash when enableoffer called on a used single-use offer.
Assertion happens here:
newstatus = offer_status_in_db(s | OFFER_STATUS_ACTIVE_F);
Since OFFER_STATUS_SINGLE_F|OFFER_STATUS_USED_F|OFFER_STATUS_ACTIVE_F
is not a valid combination:
```
lightningd-3 2026-01-28T04:45:21.184Z **BROKEN** lightningd: offer_status_in_db: 7 is invalid
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: FATAL SIGNAL 6 (version v25.12-92-g7fff32d-modded)
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: common/daemon.c:83 (crashdump) 0x5a883759dbb7
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 ((null)) 0x79a2b0c4532f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:44 (__pthread_kill_implementation) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:78 (__pthread_kill_internal) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:89 (__GI___pthread_kill) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../sysdeps/posix/raise.c:26 (__GI_raise) 0x79a2b0c4527d
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./stdlib/abort.c:79 (__GI_abort) 0x79a2b0c288fe
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/log.c:1054 (fatal_vfmt) 0x5a8837509557
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/log.c:1064 (fatal) 0x5a88375095fe
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./wallet/wallet.h:1451 (offer_status_in_db) 0x5a88375491dc
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: wallet/wallet.c:6160 (offer_status_in_db) 0x5a8837555388
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: wallet/wallet.c:6162 (wallet_offer_enable) 0x5a8837555388
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/offer.c:288 (json_enableoffer) 0x5a8837540939
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:769 (command_exec) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:910 (rpc_command_hook_final) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:884 (rpc_command_hook_final) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:243 (hook_done) 0x5a8837535383
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:343 (plugin_hook_call_next) 0x5a8837535383
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:998 (plugin_hook_call_rpc_command) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:1123 (parse_request) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:1217 (read_json) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:60 (next_plan) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:422 (do_plan) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:439 (io_ready) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/poll.c:470 (io_loop) 0x5a88375eead5
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/io_loop_with_timers.c:22 (io_loop_with_timers) 0x5a8837501f8e
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/lightningd.c:1492 (main) 0x5a88374d3c27
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../sysdeps/nptl/libc_start_call_main.h:58 (__libc_start_call_main) 0x79a2b0c2a1c9
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../csu/libc-start.c:360 (__libc_start_main_impl) 0x79a2b0c2a28a
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x5a88374d5aa4
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0xffffffffffffffff
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit adds a test that exposes a bug in Core Lightning: if you try to re-enable a single-use offer that has already been used, the daemon hits an internal assertion and crashes. The test is marked as expected-to-fail for now, meaning the actual crash is not fixed by this commit—it only documents the failure. A user with RPC access could trigger a denial-of-service by calling enableoffer on a used single-use offer.
d76e4e71 · Feb 2, 2026 · 3 filesLow 44lightningd: don't allow enableoffer on single-use offer.
Changelog-Fixed: enableoffer: Adding an error when trying to activate an used single use offer (don't crash!)
This commit fixes a bug in Core Lightning's offer management. A 'single-use offer' is meant to be used once and then become inactive. Previously, calling the enableoffer command on an already-used single-use offer could cause the node to crash. The fix adds a clear error message instead of crashing. It also removes an 'expected failure' marker from a related test, meaning that test now passes.
bb3be7e8 · Feb 1, 2026 · 1 fileInformational 15askrene: remove unnecessary print in test
Changelog-None
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit simply removes a leftover debug print statement from a test file. It has no effect on the actual Core Lightning software users run, no security implications, and does not change any behavior beyond making one test slightly less noisy in its output.
41a5c68a · Feb 1, 2026 · 1 fileLow 37askrene: consider fees during *explain failure*
We would try to explain a failure by simply finding a path between
source and destination and then checking the constraints.
However, we did not add fees.
Changelog-None
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit fixes a bug in Core Lightning's 'askrene' plugin, which is used to explain why a Lightning Network payment failed. Previously, when explaining a failure, the plugin checked whether each channel along a route could carry the payment amount, but it ignored the fees that must also be carried by earlier channels. This could cause askrene to incorrectly report that a path should have worked, or to miss the real reason a payment failed. The fix calculates the rolling amount including fees from destination back to source, and uses that larger amount when checking channel capacity and limits.
597da1fe · Feb 1, 2026 · 1 fileLow 25askrene: add test that triggers infinite loop
Changelog-None
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit only adds a new test case for the askrene routing module. The test is marked to be skipped and demonstrates a scenario where an impossible payment could cause askrene's main loop to run forever. It does not change any production code, so it cannot by itself introduce or fix a vulnerability. It is a diagnostic test that documents a potential bug.
f1bf66c9 · Feb 1, 2026 · 2 filesLow 32askrene: fixed a timeout corner case
Changelog-Fixed: askrene: fixed a class of corner cases that cause askrene main loop to timeout instead of quickly failing, thus wasting runtime.
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit fixes a bug in Core Lightning's payment routing plugin (askrene) where certain impossible or severely constrained payments would make the routing engine loop until a timeout instead of quickly giving up. The fix detects tiny or nearly-undeliverable payment paths, disables the bottleneck channel, and removes the bad path so the engine can fail fast. It is a denial-of-service/availability issue rather than theft of funds, and it only affects routing attempts that already violate constraints.
461ca686 · Jan 30, 2026 · 31 filesInformational 15fuzz-tests: Add coverage increasing inputs to seed corpora
Improvements in the fuzz-testing scheme of
`fuzz-bolt12-offer-decode` led to the discovery of test inputs
that result in greater in code coverage.
Add these inputs to the test's seed corpus.
This commit only adds 31 new test input files to a fuzz-testing seed corpus for BOLT12 offer decoding. It does not change any production code, so it cannot introduce or fix a runtime security vulnerability on its own. It is a routine test-data update intended to improve code-coverage during automated fuzzing.
557a744b · Jan 30, 2026 · 1 fileInformational 15fuzz-tests: Make `fuzz-bolt12-offer-decode` roundrip
Changelog-None: Currently, the `BOLT #12` offer parsing test only
tests the offer decode function. Add a test for the encoding
function as well by making the test roundtrip.
This commit only changes a fuzz test file. It extends an existing test for BOLT 12 offer decoding to also check that re-encoding the decoded offer produces the same result (a roundtrip test). It does not modify any production code, so it cannot introduce a runtime security vulnerability in the Core Lightning software itself.
4c10cb76 · Jan 29, 2026 · 1 fileInformational 15Docs: Update mac instructions to gmake
Apple bundles a rather old version of GNU Make: 3.81. Our Makefiles use the &: feature which requires version 4.3. Apparently Apple isn’t updating GNU Make anymore due to a licensing issue.
Switching the instructions over to using gmake installed from the brew package manager, which currently installs 4.4.1
Changelog-None
This commit only updates the macOS build instructions in the documentation. It tells users to install a newer version of GNU Make (called 'gmake') from Homebrew instead of using the old 'make' that Apple ships. There is no code change and no security issue.
cc227ed2 · Jan 29, 2026 · 1 fileLow 40common: tighten restrictions on periods, as per latest draft.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change adds stricter validation rules when a Core Lightning node receives a BOLT12 offer that includes recurring payment terms. It now rejects offers with invalid time units, zero-length periods, zero recurrence limits, or recurrence-related fields that appear without an actual recurrence definition. This prevents the node from accepting malformed or contradictory offers that could lead to confusion, failed payments, or protocol edge-case abuse.
3822a670 · Jan 29, 2026 · 4 filesInformational 21askrene: add auto.include_fees layer
Changelog-Added: askrene: add a new layer auto.include_fees thhat makes fees be deducted from the payment amount making in effect the receiver pay for routing fees.
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit adds a new optional routing layer called auto.include_fees to Core Lightning's askrene plugin. Normally, when sending a Lightning payment, the sender adds extra money on top of the requested amount to cover routing fees. With this new layer, the total amount sent is fixed, and the fees are subtracted from what the receiver gets instead. This is a deliberate feature change, not a bug fix, and it only affects routing calculations when a user explicitly requests the new layer. There is no direct security vulnerability in the code shown, but any mistake in fee arithmetic could in theory cause incorrect payment amounts.