EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkActive incident
Repository coverage

2009 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

184security candidates280second-pass queue1894AI analyses
56commits · 30 days
193commits · 60 days
682commits · 180 days
1671commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
489Strong · 80–100
1231Adequate · 60–79
259Thin · 40–59
30Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
cdecker14910384
Níckolas Goline63844277
Rusty Russell96475958172
daywalker90118895165
Lagrang386578170
Vincenzo Palazzo13411182
dovgopoly15015164
Sangbida Chaudhuri14931146066
Dusty Daemon821378066
ShahanaFarooqui931093063
Peter Neuroth1024101071
Christian Decker36436072
Analysis record

Published AI watches

Last scanned 50 minutes ago

Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

contrib: add jaonoctus's signing key

This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.

41278b4eby jaonoctus+2−02 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: fixed timestamps for invented bookkeeper deposits

This is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…

498e5086by daywalker90+2−01 file
No security note in commit
Informational 21 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

docs: document missing and fix erroneous JSON-RPC error codes

This commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…

Documentation-only change with no executable code modificationsCorrects RPC schema error-code metadata to match actual handler behaviorNo change to input parsing, authorization, cryptography, or network behavior
d1b6963bby daywalker90+204−1224 files
No security note in commit
Low 46 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

channeld: initialize tx_sigs_allowed on startup

This commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …

use of uninitialized variableundefined behavior (invalid bool load)network-triggered code path
c09c4520by Erick Cestari+1−01 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

ci: fix the coverage nightly's profile handling

This commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…

5685c9a3by cdecker+12−211 file
No security note in commit
Low 37 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

schemas: make required fields match the code

This commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…

Large schema-only change with no accompanying security advisory or CVEOne semantic change to plugin hook response: invoice_payment hook can now reject with only failure_message and no resultMany fields change from optional to required in public RPC/protobuf interfaces
ddbd2963by daywalker90+1786−173950 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: document error 313 on every command which can return it

This commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …

a34b9758by Peter Neuroth+30−86 files
No security note in commit
Low 25 AI analysisMessage 88 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tools/build-release.sh: name the checksum file when verifying the signature

This commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…

Incorrect cryptographic verification logic in release toolingPotential false-positive signature verification with inline-signed .asc substitutionRelease-integrity hardening
8e495707by Peter Neuroth+5−21 file
No security note in commit
Low 42 AI analysisMessage 95 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: pass the manifest explicitly to gpg --verify

This commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…

Verification bypass risk in release artifact validationgpg --verify single-argument form can exit 0 without reading the intended manifestDocumentation-only hardening of release process
2dee8699by Peter Neuroth+9−62 files
Vendor flagged security relevance
Low 25 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

Cargo.lock: update dependencies

This commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…

Routine dependency refresh with no stated security rationaleUpdates to security-sensitive transitive crates (rustls, hyper, h2, tokio, webpki-roots) but no evidence these versions fix known vulnerabilitiesNo source-code changes or patch-specific fixes visible in the diff
c1551c55by daywalker90+298−2761 file
No security note in commit
High 80 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

common: bound JSON nesting depth when parsing

This commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…

Stack-overflow via deeply nested JSONRecursive JSON traversal without depth boundDenial-of-service vector in JSON-RPC input parsing
83f92e4bby Níckolas Goline+90−22 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 28 · Opaque
EP Elements ProjectCore Lightning BitcoinLightning Network

common: minor typo fixes

This commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…

273d7f02by w3lld1+3−32 files
No security note in commit
Informational 20 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

pyln-testing: truncate long testnames

This change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …

No security-relevant signal: change is in test framework code onlyFixes a test reliability issue, not a runtime vulnerabilityNo input sanitization, authentication, cryptography, or network changes
c4fe4cbaby Peter Neuroth+59−12 files
No security note in commit
Moderate 60 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: exclude immature coinbase outputs from fee rescue selection

This fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…

Consensus-invalid transaction generation preventedFee rescue / CPFP failure mode mitigatedCoinbase maturity check added to coin selection
34883ff7by cdecker+5−12 files
Vendor flagged security relevance
Moderate 59 AI analysisMessage 91 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: fix crash loading node bias with description

This commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…

Use-after-free / double-take of a tal-allocated string during plugin startupDenial-of-service-like symptom: lightningd aborts before replying to init, node cannot restartFixes publicly reported issue #9433 by endothermicdev
4681177dby Vincenzo Palazzo+2−32 files
No security note in commit
Informational 12 AI analysisMessage 91 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: restart the node which owns the layer in node bias test

This commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …

0f3f67a0by Vincenzo Palazzo+3−21 file
No security note in commit
High 78 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

dualopend: bound the feerates a peer opens at

This commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …

Missing input validation on wire-parsed feerate fieldsPeer could induce signing and storage of feerate == 0RBF remote path allowed unbounded upward feerate walks
ba08356fby cdecker+140−04 files
Vendor flagged security relevance
High 72 AI analysisMessage 100 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: regression coverage for out-of-range feerates

This commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…

Integer overflow in feerate conversion (u32 wrap from 0xFFFFFFFF perkb to 0 perkw)Absurd feerate from external fee source bypassing sanity ceilingDatabase-stored out-of-range feerate causing startup abort/crash loop
65bdbc47by cdecker+137−02 files
No security note in commit
Moderate 64 AI analysisMessage 86 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't assert on funding feerates read from the db

This update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…

Integer overflow in RBF escalation (u32 * 25 / 24) leading to assertion failureAssertion failure in read-only introspection RPC (listpeerchannels) causing crash-loop at startupDatabase value treated as invariant despite originating from external fee estimator
d67c4936by cdecker+72−227 files
Vendor flagged security relevance
Moderate 53 AI analysisMessage 86 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: clamp absurd inflight funding feerates on upgrade

This commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …

Integer overflow in fee-rate calculation (u32 overflow when multiplying by 25/24)Assertion failure leading to daemon crash loop at startupDatabase migration clamps out-of-range stored funding feerates
f057c692by cdecker+34−01 file
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityfix: build on Alpine Linuxby Marcel Hernandez · 3917cee8 · Jan 28, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · Marcel Hernandez

fix: build on Alpine Linux

Reference: https://github.com/ElementsProject/lightning/commit/53154a40a55ab803ceef0dcc8e62f7424111714a

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This is a one-line build fix for Alpine Linux. It adds a missing #include <unistd.h> header in a source file so the code compiles correctly on that platform. There is no security issue here.

Lower-prioritypatch configure-check-function-sections.patchby Rusty Russell · 01c1264c · Jan 28, 2026 · 1 fileMessage 45 · ThinInformational 18Details
Commit message · Rusty Russell

patch configure-check-function-sections.patch

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 18/100

This commit changes the build configuration script so it tests whether the compiler supports a size-optimization feature (placing each function in its own section and removing unused ones during linking). It is a build-system hardening/optimization change, not a fix for an exploitable vulnerability. There is no indication in the commit that it addresses a security issue.

Lower-priorityMakefile: improve print-binary-sizes to be more meaningful.by Rusty Russell · c8eb54be · Jan 28, 2026 · 1 fileMessage 91 · StrongInformational 15Details
Commit message · Rusty Russell

Makefile: improve print-binary-sizes to be more meaningful.

Users care about memory more than disk, and they care about programs
they run more than our test programs and tools.

Also, fix dependencies on print-binary-sizes, as spotted by
https://github.com/Lagrang3

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit changes a Makefile helper target that prints the sizes of compiled programs. It switches from reporting disk file sizes to reporting memory sizes (using the 'size' tool), includes additional binary categories, and fixes a build dependency. There is no security relevance in the change itself.

Lower-priorityconfigure: remove gratuitous CSANFLAGS print.by Rusty Russell · bb7602cd · Jan 28, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Rusty Russell

configure: remove gratuitous CSANFLAGS print.

It's printed at the bottom, no need to print as we're determining it.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit simply removes a debug line that printed the value of a compiler flag variable during the build configuration step. It is a cleanup change with no security relevance.

Lower-priorityBuild: add function sections.by Rusty Russell · 744432dd · Jan 28, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Rusty Russell

Build: add function sections.

This allows further reduction in binary sizes.

Size of all user before:
text data bss dec hex filename
64277932 904968 317576 65500476 3e7753c (TOTALS)

After:
52443036 729560 271720 53444316 32f7edc (TOTALS)

Some are dramatic, such as lightning-cli not pulling in libbacktrace:

174454 2880 296 177630 2b5de cli/lightning-cli
56633 2608 232 59473 e851 cli/lightning-cli

But most things get a 25% trim:

3972339 363568 21760 4357667 427e23 lightningd/lightningd
3300337 247768 21664 3569769 367869 lightningd/lightningd

Changelog-Changed: Build: most binaries are now about 20% smaller.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a build-system optimization that makes the compiled program files smaller by telling the linker to discard unused code sections. It does not change any program behavior or fix any security issue.

Lower-priorityaskrene: speed up when using large number of layers.by Rusty Russell · a3946663 · Jan 27, 2026 · 5 filesMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

askrene: speed up when using large number of layers.

Simple bench.

Before:
Creating 20,000 layers: 20 seconds
Creating 50,000 layers: 107 seconds

After:
Creating 20,000 layers: 7 seconds
Creating 50,000 layers: 15 seconds
Creating 100,000 layers: 29 seconds

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a straightforward performance optimization for the askrene plugin. It replaces a slow linked-list lookup of routing 'layers' with a fast hash table, dramatically speeding up operations when many layers exist. There is no security-relevant change here.

Lower-prioritypytest: add askrene layer creation bench.by Rusty Russell · ff609833 · Jan 27, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: add askrene layer creation bench.

This means it has to do a lookup and an insert.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit adds a new performance benchmark test to the project's test suite. It exercises a feature called 'askrene' by creating 20,000 empty layers through the normal RPC interface. There is no change to production code, no bug fix, and no security-related behavior.

Lower-prioritypytest: also make sure askrene doesn't suffer when reloading many layers on startup.by Rusty Russell · c7d313ea · Jan 27, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: also make sure askrene doesn't suffer when reloading many layers on startup.

We used non-persistent layers before, but what if we save to the datastore and restore?

This takes it from 29 to 45 seconds.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only changes a benchmark test file. It extends an existing performance test for the askrene feature to also measure startup time after saving and restoring many layers. There is no security-relevant change to production code, no bug fix, and no vulnerability patch.

Lower-prioritypytest: test names for new nodes.by Rusty Russell · cb51b7ea · Jan 26, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · Rusty Russell

pytest: test names for new nodes.

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes a test file. It expands an existing test so that it checks node naming behavior for both old and new wallet secret formats. There is no change to production code, no bug fix, and no security relevance.

Lower-prioritypyln-testing: add old_hsmsecret param to get_node.by Sangbida Chaudhuri · 02bfa413 · Jan 26, 2026 · 3 filesMessage 75 · AdequateInformational 14Details
Commit message · Sangbida Chaudhuri

pyln-testing: add old_hsmsecret param to get_node.

This defaults to false for now: this breaks a lot of tests (since node ids change!)
once we switch to true.

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 14/100

This commit is a testing-only change. It adds an option to the Core Lightning Python test framework so that tests can choose whether to create nodes using the older style 'hsm_secret' file or the newer BIP39-style mnemonic secret. It does not change production code, does not fix a vulnerability, and does not introduce an obvious security bug.

Security candidatepytest: make sure to use old_hsmsecret on downgrade tests.by Rusty Russell · c7973b8a · Jan 26, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

pytest: make sure to use old_hsmsecret on downgrade tests.

We only support downgrade if you upgraded, so your hsm_secret will be old.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
update trust
AI analysis · Informational 15/100

This change only updates a test file so that downgrade tests create nodes using an older-format secret key file. It does not change any production code, network protocol, or wallet behavior, and there is no security issue in the commit itself.

Lower-prioritypytest: parameterize test_payerkey and test_exposesecret.by Rusty Russell · dae9140a · Jan 26, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: parameterize test_payerkey and test_exposesecret.

These are explicitly written to check that the values don't accidentally change,
which applies to both old and new styles.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only changes test code. It expands two existing tests so they run against both the old and new styles of HSM secret generation, verifying that expected cryptographic output values remain stable. There is no change to production code, no bug fix, and no security vulnerability.

Lower-prioritypytest: determine scid direction dynamicallyby Sangbida Chaudhuri · 6a9bdb80 · Jan 26, 2026 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Sangbida Chaudhuri

pytest: determine scid direction dynamically

Since we have changed our hsm_secret seed the node ids have all change hence the asseertions on the scids break. This changes it so that the direction is determined when the test executes.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only updates test code. It changes hard-coded channel direction numbers in pytest test expectations to be calculated at runtime based on node IDs. The reason is that a recent change to the test secret seed changed all generated node IDs, which flipped which channel direction value (0 or 1) the tests should expect. There is no change to production code, no security fix, and no vulnerability.

Lower-prioritypytest: test upfront_shutdown_script with new-style hsm_secret too.by Sangbida Chaudhuri · 129b2077 · Jan 26, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Sangbida Chaudhuri

pytest: test upfront_shutdown_script with new-style hsm_secret too.

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds a new test case to the project's test suite. It extends an existing test to also run with a newer wallet format (BIP86 mnemonic), ensuring the upfront shutdown script feature works for both old and new wallet types. There is no change to production code, no bug fix, and no security patch.

Lower-prioritypytest: parameterize test_showrunes.by Rusty Russell · b2b03e6e · Jan 26, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Rusty Russell

pytest: parameterize test_showrunes.

Another one we want to make sure stays unchanged.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only updates a test file. It makes an existing test run twice—once with an old-style secret key and once with a new-style secret key—and checks that the expected rune values differ in each case. There is no change to production code, no bug fix, and no security patch.

Lower-prioritypytest: use hsmtool's getsecret instead of deprecated getcodexsecret, parameterize test_recover_command.by Rusty Russell · 12bc5b04 · Jan 26, 2026 · 2 filesMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

pytest: use hsmtool's getsecret instead of deprecated getcodexsecret, parameterize test_recover_command.

This matters for mnemonic nodes.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a routine test-only change. It updates two test scripts to use a newer, non-deprecated command name ('getsecret' instead of 'getcodexsecret') in the lightning-hsmtool helper, and expands test coverage for recovery with both old-style and new-style HSM secrets. There is no change to production code, no user-facing behavior change, and no security fix.

Lower-prioritytest: use old hsmsecret format for hardcoded onion messageby Sangbida Chaudhuri · c076a100 · Jan 26, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Sangbida Chaudhuri

test: use old hsmsecret format for hardcoded onion message

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This is a tiny test-only change. It updates one test to use an older format for a secret key so that a pre-recorded test message still works. There is no change to production code and no security issue.

Lower-prioritytest: mark bookkeeper test to use old hsm secretby Sangbida Chaudhuri · 9d331f54 · Jan 26, 2026 · 1 fileMessage 90 · StrongInformational 14Details
Commit message · Sangbida Chaudhuri

test: mark bookkeeper test to use old hsm secret

bookkeeper's fee tracking depends on deterministic channel structure, which depends on node ID ordering. I'm marking this with the old_hsmsecret option for now.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 14/100

This commit only changes a single test file. It adds an option called 'old_hsmsecret' to a test setup so that the bookkeeper test produces deterministic (predictable) channel data. There is no change to production code, no bug fix, and no security patch.

Lower-prioritytests: update test so use both node idsby Sangbida Chaudhuri · c653955d · Jan 26, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Sangbida Chaudhuri

tests: update test so use both node ids

This test has been split into two to assert on both the old and the new hsm_secret

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only changes a test file. It expands an existing test to check both an old and a new HSM secret format by running the same test twice with different parameters. There is no change to production code, no bug fix, and no security-relevant behavior change.

AI review queuedpytest: use old hsm secret whenever a canned database files is usedby Sangbida Chaudhuri · 81d1d4a3 · Jan 26, 2026 · 8 filesMessage 65 · AdequateInformational 17Details
Commit message · Sangbida Chaudhuri

pytest: use old hsm secret whenever a canned database files is used

Anything using a canned db depends on the node ids being generated from the old hsm seed.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit only changes test files. It tells the test framework to use an older, fixed HSM (wallet seed) secret whenever a test loads a pre-made ('canned') database snapshot. This ensures the test node's public identity matches the one recorded in the snapshot, so database migration and regression tests keep working after a recent change to how random seeds are generated. It is a test-suite maintenance patch, not a fix for a runtime security vulnerability.

Security candidatewallet: conduct unit tests with both bip86 and bip32.by Rusty Russell · fe5c3c95 · Jan 26, 2026 · 1 fileMessage 75 · AdequateInformational 15Details
Commit message · Rusty Russell

wallet: conduct unit tests with both bip86 and bip32.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
secret or key materialsigning or wallet path
AI analysis · Informational 15/100

This commit only changes test code. It makes the wallet unit tests run twice: once using the older BIP32 key derivation setup and once using the newer BIP86 setup. No production code is modified, so it cannot directly affect real users or introduce a runtime security flaw.

Security candidatepytest: changed old_hsmsecret to default to false.by Sangbida Chaudhuri · 1279a589 · Jan 26, 2026 · 10 filesMessage 83 · StrongInformational 15Details
Commit message · Sangbida Chaudhuri

pytest: changed old_hsmsecret to default to false.

This changes various tests in minor ways:

1. The "l2" secret key in tests/plugins/channeld_fakenet.c is updated.
2. The decompressed gossip data node id needs changing.
3. The coinmoves order changes in bookkeeper for anchors.
4. Various harcoded gossip constants change.
5. Some hardcoded makesecret results change.
6. zeroconf tests which hardcoded node ids change.
7. Arbitrary rune strings change.
8. A log message which uses node ids changes.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
secret or key material
AI analysis · Informational 15/100

This commit only updates test files and test helpers to match a new default wallet-seed format. It does not change production code, does not fix a vulnerability, and has no direct security impact on running Core Lightning nodes.

Lower-prioritygetlog: fix schema.by Rusty Russell · 6749c656 · Jan 26, 2026 · 2 filesMessage 51 · ThinInformational 15Details
Commit message · Rusty Russell

getlog: fix schema.

getlog() only gets recent logs, not all of them (since it prunes, and soon will be a ringbuffer).

And "data" is actually an optional field, not required.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit updates two JSON schema files for the getlog RPC command. It changes the title from 'Command to show logs' to 'Command to show recent logs' and marks the 'data' field as optional rather than required. These are documentation and schema accuracy corrections only; no code behavior changes.

Lower-prioritygossmap: don't log every time we don't like a cupdate.by Rusty Russell · cef86d1e · Jan 26, 2026 · 1 fileMessage 81 · StrongInformational 20Details
Commit message · Rusty Russell

gossmap: don't log every time we don't like a cupdate.

This happens for about 300 channels, from every process that loads the gossmap.

It's not very useful to flood the logs, so just log a summary.

To be fair, on my node, this is only the 11th most common message, so we will
revisit the others too:

```
1589311 DEBUG 02e01367e1d7818a7e9a0e8a52badd5c32615e07568dbe0497b6a47f9bef89d6af-connectd: peer_out WIRE_WARNING
139993 DEBUG lightningd: fixup_scan: block 786151 with 1203 txs
55388 DEBUG plugin-bcli: Log pruned 1001 entries (mem 10508118 -> 10298662)
33000 DEBUG gossipd: Unreasonable timestamp in 0102000a38ec41f9137a5a560dac6effbde059c12cb727344821cbdd4ef46964a4791a0f67cd997499a6062fc8b4284bf1b47a91541fd0e65129505f02e4d08542b16fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d61900000000000d9d56000ba40001690fe262010100900000000000000001000003e8000001f30000000000989680
23515 DEBUG hsmd: Client: Received message 14 from client
22269 DEBUG 024b9a1fa8e006f1e3937f65f66c408e6da8e1ca728ea43222a7381df1cc449605-hsmd: Got WIRE_HSMD_ECDH_REQ
14409 DEBUG gossipd: Enqueueing update for announce 0102002f7e4b4deb19947c67292e70cb22f7fac837fa9ee6269393f3c513d0431d52672e7387625856c19299cfd584e1a3f39e0f98df13c99090df9f4d5cca8446776fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d61900000000000e216b0008050001692e1c390101009000000000000003e800000000000013880000004526945a00
12534 DEBUG gossipd: Previously-rejected announce for 514127x248x1
===> 12092 DEBUG connectd: Bad cupdate for 641641x1164x1/1, ignoring (delta=80, fee=1073742199/58)
10761 DEBUG 02e01367e1d7818a7e9a0e8a52badd5c32615e07568dbe0497b6a47f9bef89d6af-channeld-chan#70770: Got it!
10761 DEBUG 02e01367e1d7818a7e9a0e8a52badd5c32615e07568dbe0497b6a47f9bef89d6af-channeld-chan#70770: ... , awaiting 1120
10761 DEBUG 02e01367e1d7818a7e9a0e8a52badd5c32615e07568dbe0497b6a47f9bef89d6af-channeld-chan#70770: Sending master 1020
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 20/100

This change is a straightforward log-noise reduction. The program used to print a separate debug message every time it encountered a Lightning network channel update whose fees or delay values were too large to store in its internal format. Because this happens for hundreds of real channels, the logs were being flooded. The patch now counts these occurrences and prints a single summary line instead. It does not alter how the data is handled: the oversized values are still ignored and the channel half is still marked disabled, exactly as before.

Lower-prioritylightningd: move log_prefix and log_entry struct definitions into log.c.by Rusty Russell · 16e91160 · Jan 26, 2026 · 6 filesMessage 85 · StrongInformational 15Details
Commit message · Rusty Russell

lightningd: move log_prefix and log_entry struct definitions into log.c.

They're only exposed because of the notifications, but they are better
off with explicit parameters anyway.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup. It moves two data structure definitions from a public header file into the single source file where they are actually used, and changes notification functions to accept plain values instead of a pointer to those internal structures. There is no user-visible behavior change and no security fix.