Core Lightning

This change is a minor log/noise reduction fix. When a peer sends a channel announcement for a channel whose funding transaction output has already been spent, the node used to send a warning message back every single time. Now it sends that warning at most once per second. The old behavior could annoy or overload peers (especially older CLN versions that keep sending stale announcements), but it does not create a direct security vulnerability like theft or remote crash.

This commit rewrites Core Lightning's internal log storage from a dynamically pruned array into a fixed 16 MB ring buffer. It is a refactoring/cleanup change: the old pruning logic is removed, the log size is now hard-capped, and the 'SKIPPED' entries in the getlog RPC are eliminated. There is no direct security fix described by the author, and the diff does not show an obvious exploitable vulnerability. The main security-relevant side effect is that crash logs and the getlog output now contain only the most recent 16 MB of messages, which could slightly reduce forensic information after an incident.

This commit adds a spelling-check tool called codespell to the project's pre-commit hooks. It only touches configuration files for checking typos in documentation and source comments, and does not change any actual Lightning node code. There is no security relevance.

This commit adds a code-formatting check (clang-format) to the project's pre-commit tooling. It does not change any executable code, protocol logic, or security-sensitive behavior. It is purely a developer workflow improvement to enforce consistent C code style before commits.

This commit only adds new pre-commit checks for JSON documentation files. It validates that JSON schema files in the doc/schemas directory follow a defined schema and are consistently formatted. There is no change to application code, no bug fix, and no security-related behavior change.

This commit simply swaps one Python code-style checker (Ruff) for another (Flake8) in the project's pre-commit configuration. It does not change any application code, network behavior, or security-sensitive logic. There is no security issue here.

This commit adds a new developer tool that automatically sorts #include lines in C source files to match the project's coding style. It also wires that tool into the pre-commit checks and removes one stray blank line from a single file. There is no security-relevant code change here.

This is a one-line build system fix in a Makefile. It changes a list of header files so that it references 'json.h' instead of 'json.c'. There is no runtime code change and no security relevance.

This commit only adds documentation explaining how contributors can install and use the pre-commit tool for local code checks. It does not change any program code, build scripts, or security-sensitive behavior.

This commit adds a new automated code-quality check that runs before code is committed. It scans C code for direct access to certain monetary fields (like amount_msat and amount_sat) that could lead to arithmetic overflow if handled incorrectly. It is purely a defensive development tool and does not change any runtime behavior or fix a specific bug.

This commit adds a new automated code-quality check that flags risky C functions like gets, scanf, sprintf, fgets, and fputs during pre-commit. It is a defensive tooling change, not a fix for an active security bug. There is no patch to any runtime code, so it does not directly change the software's security posture, but it helps prevent unsafe functions from being introduced in the future.

This commit only changes the project's pre-commit configuration file. It tells the pre-commit tool to use the system's installed NodeJS and Python 3 versions, and makes a minor formatting tweak to a hook stage. There is no change to Core Lightning's runtime code, network behavior, or anything that handles funds, keys, or peer messages.

This change adds an automated commit-message style checker to the project's development workflow. It does not modify any payment, network, or cryptographic code, and there is no security relevance.

This commit adds a new developer helper script that automatically fixes code style problems in Python and C files and corrects spelling mistakes. It is a tooling addition for maintainers and contributors, not a change to the wallet, network, or cryptographic code of Core Lightning. There is no security issue visible in the commit itself.

This commit only adds two cosmetic code-style checks to the project's pre-commit tooling: one that removes trailing whitespace and one that ensures files end with a newline. It does not change any production code, cryptographic logic, network handling, or user-facing behavior. There is no security relevance.

This commit only adds a development tool called 'pre-commit' to the project's Python development dependencies. It does not change any production code, runtime behavior, or network-facing functionality. There is no security issue here.

This commit adds a development tool called shellcheck to the project's pre-commit checks. It is purely a code-quality and linting change; it does not modify any runtime code, fix a bug, or change how the software behaves. There is no security issue in this commit itself.

This commit removes old, deprecated fee-estimate response handling from Core Lightning's Bitcoin backend plugin interface. It was already disabled by default in v24.05 and was scheduled for removal. The change makes the code stricter: if a plugin still returns the old format, Core Lightning will now log an error and stop rather than silently accepting it. This is a cleanup of technical debt, not a fix for an active security vulnerability.

This commit simply updates a code comment and developer documentation. It removes an outdated note that said the old way of listing plugin hooks (by name only) should be removed in the future, and instead documents that both the old and new formats are officially supported. There is no security issue here.

This is a routine post-release maintenance commit for Core Lightning. It updates version numbers in the build files and test infrastructure after a new release, adjusts downgrade tests to reflect that downgrading past the new release no longer fails on a recently-added database feature, and removes some temporary test workarounds for APIs that are no longer considered deprecated. There is no direct security fix here; it is housekeeping that keeps the CI and downgrade tooling aligned with the current release cycle.

This is a small cleanup change that removes an obsolete setting related to announcing websocket addresses. It does not change any security behavior; the feature was already unused.

This commit removes an old, renamed label from the list of features shown for Lightning peers and channels. The old label 'option_anchors_zero_fee_htlc_tx' is replaced by the current spec name 'option_anchors'. It is a routine cleanup of a deprecated JSON-RPC field, not a security fix.

This commit only corrects a typo in the documentation: the planned end-of-life version for a deprecated setting was listed as v26.06, but the actual code uses v26.03. There is no code change and no security impact.

This commit removes two old, single-value fields (`tx` and `txid`) from the JSON-RPC and gRPC response of the `close` command. They were already marked as deprecated in version 24.11 and are being replaced by the newer `txs` and `txids` list fields. This is a routine API cleanup, not a security fix.

This commit is a trivial Git configuration fix. It updates the .gitattributes file so that a different auto-generated Python file is treated as binary by Git, preventing Git from trying to show text diffs for it. There is no security relevance.