Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 44 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
537308c3 · Jan 8, 2026 · 1 fileInformational 15pytest: remove channel upgrade tests.
We removed the functionality, but only disabled the tests.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit simply deletes three test cases from the test suite. The underlying feature (experimental channel upgrade protocol) had already been removed from the actual software; this change only cleans up the now-unused tests. There is no code change to the running program, so it does not introduce or fix a security vulnerability on its own.
9443487e · Jan 8, 2026 · 1 fileInformational 13pytest: enable test_offline.
Not clear why it was disabled, but it never got re-enabled.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit simply re-enables an existing test and makes it more thorough. It checks that a Core Lightning node started in 'offline' mode does not accept incoming connections but can still connect out to other nodes. There is no code change to the actual lightning software—only a test file was modified.
749f5040 · Jan 8, 2026 · 1 fileInformational 15pytest: fix flake race in test_even_sendcustommsg.
It failed, because it got the message before connectd has processed
the updated allow list:
```
lightningd-2 2026-01-06T07:53:02.817Z INFO plugin-allow_even_msgs.py: Killing plugin: stopped by lightningd via RPC
...
lightningd-1 2026-01-06T07:53:02.820Z DEBUG 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-lightningd: sendcustommsg id="-c:sendcustommsg#16" sending a custom even message (43690)
...
lightningd-1 2026-01-06T07:53:02.820Z 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-connectd: [OUT] aaaaffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffbb
lightningd-2 2026-01-06T07:53:02.823Z 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518-connectd: [IN] aaaaffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffbb
...
lightningd-2 2026-01-06T07:53:02.823Z DEBUG connectd: Now allowing 0 custom message types
```
Resulting in:
``
l2.daemon.wait_for_log(r'\[IN\] {}'.format(msg))
> l1.daemon.wait_for_log('Invalid unknown even msg')
tests/test_misc.py:4673:
...
> raise TimeoutError('Unable to find "{}" in logs.'.format(exs))
E TimeoutError: Unable to find "[re.compile('Invalid unknown even msg')]" in logs.
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a test-only fix for a flaky automated test. It adds a wait step so the test does not proceed before a background component has finished updating its settings. There is no change to production code and no security issue.
98a19df4 · Jan 8, 2026 · 6 filesInformational 15pytest: don't run tests marked slow_test at all if VALGRIND and SLOW_MACHINE.
We used to just run these without valgrind, but we already run them in
CI (which sets SLOW_MACHINE) without valgrind, so this just doubles
up.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only changes how the project's automated test suite decides which tests to run. It makes tests marked as 'slow' get skipped when both Valgrind memory-checking and a slow-machine flag are active, because those tests are already run separately without Valgrind. There is no change to the actual Core Lightning node software, wallet handling, network protocol, or any user-facing behavior.
f4ff1e59 · Jan 8, 2026 · 5 filesInformational 15pytest: disable remaining flaky and skip markers to see what else fails.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only changes test-suite annotations. It removes 'skip' and 'flaky' markers from several pytest test cases so they will run again during automated testing. There is no change to the actual Core Lightning node software, wallet logic, network protocol, or any code that users run in production.
04ad660c · Jan 8, 2026 · 1 fileInformational 11pytest: mark test_connection.py::test_disconnect_opener flaky.
It's a real bug, which I've reported in
https://github.com/ElementsProject/lightning/issues/8822
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only marks an existing test as flaky because it exposes a known bug. It does not fix any code, change protocol behavior, or introduce a security vulnerability. The underlying bug is reported separately and is not described here as security-relevant.
bba924ad · Jan 8, 2026 · 1 fileInformational 15pytest: fix flake in test_coin_movement_notices
We restart the nodeL if the coin_movements.py plugin hasn't processed the
notification yet, it will be incorrect:
```
> assert account_balance(l2, chanid_1) == 100001001
E AssertionError: assert 150_001_001msat == 100_001_001
E + where 150001001msat = account_balance(<fixtures.LightningNode object at 0x7f0634e1eb00>, '39ac52c818c5304cf0664940ff236c4e3f8f4ceb8993cb1491347142d61b62bc')
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a flaky automated test, not a security issue. The test sometimes failed because it restarted a node before a logging plugin had finished recording a payment event. The fix adds a wait for the plugin's log line before restarting. There is no vulnerability in the production software.
71750019 · Jan 8, 2026 · 1 fileInformational 15pytest: get more\ information when test_funding_v2_cancel_race fails.
```
2026-01-05T00:11:22.0447771Z # Only up to one should succeed.
2026-01-05T00:11:22.0448201Z success = False
2026-01-05T00:11:22.0448571Z for c in completes:
2026-01-05T00:11:22.0448957Z try:
2026-01-05T00:11:22.0449322Z c.result(TIMEOUT)
2026-01-05T00:11:22.0449934Z num_complete += 1
2026-01-05T00:11:22.0450378Z > assert not success
2026-01-05T00:11:22.0451005Z E assert not True
2026-01-05T00:11:22.0451201Z
2026-01-05T00:11:22.0451331Z tests/test_connection.py:1596: AssertionError
```
We don't know *which* ones succeeded. Fix that.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only improves a test so that when it fails, the error message shows which specific operations succeeded. It does not change any production code or fix a security issue.
3d59af6f · Jan 8, 2026 · 1 fileInformational 15pytest: fix coinmoves flake, where routing credit/debit can appear in either order.
It's done as HTLCs finalize, but we can close the incoming HTLC as soon as we get the
preimage, so that entire thing could finish before the outgoing HTLC.
```
> check_channel_moves(l1, expected_channel1)
tests/test_coinmoves.py:307:
...
E Full diff:
E [
E {
E 'account_id': '58d371ab100e0ea847a11c9550add273ef8531bc12bb51b0e30c8f833506a772',
E 'created_index': 1,
E 'credit_msat': 0,
E 'debit_msat': 1000000,
E 'fees_msat': 0,
E 'group_id': 1318196858430961660,
E 'part_id': 1,
E 'payment_hash': '8da829ab29715106a4e767facc0b58776ae5bfc11c4e9dcda3063013e1ef8ef0',
E 'primary_tag': 'invoice',
E },
E {
E 'account_id': '0b872506f67b363803cd85cf9ff6807ebc1dc8a4521aa191386b4c5366d490d7',
E 'created_index': 2,
E 'credit_msat': 100000,
E 'debit_msat': 0,
E 'fees_msat': 0,
E 'primary_tag': 'pushed',
E },
E {
E + 'account_id': '0b872506f67b363803cd85cf9ff6807ebc1dc8a4521aa191386b4c5366d490d7',
E + 'created_index': 3,
E + 'credit_msat': 10000100001,
E + 'debit_msat': 0,
E + 'fees_msat': 100001,
E + 'payment_hash': '0ebfa5387de5fd12c15089833b0193fb6007e9f494ec24d479e327a96ac8e8c0',
E + 'primary_tag': 'routed',
E + },
E + {
E 'account_id': '58d371ab100e0ea847a11c9550add273ef8531bc12bb51b0e30c8f833506a772',
E - 'created_index': 3,
E ? ^
E + 'created_index': 4,
E ? ^
E 'credit_msat': 0,
E 'debit_msat': 10000000000,
E 'fees_msat': 100001,
E 'payment_hash': '0ebfa5387de5fd12c15089833b0193fb6007e9f494ec24d479e327a96ac8e8c0',
E 'primary_tag': 'routed',
E },
E - {
E - 'account_id': '0b872506f67b363803cd85cf9ff6807ebc1dc8a4521aa191386b4c5366d490d7',
E - 'created_index': 4,
E - 'credit_msat': 10000100001,
E - 'debit_msat': 0,
E - 'fees_msat': 100001,
E - 'payment_hash': '0ebfa5387de5fd12c15089833b0193fb6007e9f494ec24d479e327a96ac8e8c0',
E - 'primary_tag': 'routed',
E - },
E ]
```
This commit fixes a flaky test, not a security bug. The test was checking the order of accounting records for routed payments, but the two records can legitimately appear in either order depending on which payment step finishes first. The patch makes the test accept either order. There is no product vulnerability or user impact.
8f09f0c1 · Jan 6, 2026 · 1 fileInformational 17common: fix ubsan trigger in param test.
```
common/test/run-param.c:381:8: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior common/test/run-param.c:381:8
```
Probably because CI now on 24.04, so more recent clang. But the test really does
want to see what happens when the callback is NULL, so workaround.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a test-only issue where a newer compiler's undefined-behavior sanitizer (UBSan) complained about a test that deliberately passes a NULL callback. The fix changes how the test constructs that NULL case so the sanitizer no longer flags it. It is not a security vulnerability in production code.
8d372999 · Dec 22, 2025 · 2 filesInformational 15ci: Update GitHub Actions runner to Ubuntu 24.04 due to timeout reports on 22.04
Changelog-None: CI fixes only.
This commit only updates the version of Ubuntu used by automated GitHub test runners from 22.04 to 24.04. It also adjusts a couple of package names to match what Ubuntu 24.04 calls them. There is no change to the Core Lightning software itself, its network code, wallet handling, or cryptography. It is purely a testing infrastructure maintenance patch.
2bba6f0d · Dec 22, 2025 · 1 fileInformational 15ci: Increase timeout
Increased it to 120 since prebuild check is taking 97 minutes locally.
This commit only changes a GitHub Actions CI workflow setting, increasing the maximum allowed runtime for automated pre-build checks from 30 minutes to 120 minutes. It does not modify any wallet, network, or cryptographic code, and has no direct security relevance to the Lightning node software itself.
767ece8f · Dec 22, 2025 · 2 filesInformational 15contrib: add Sangbida's signing key
Why it was queuedThis commit simply adds a new team member's PGP public key to the project so they can sign future releases. There is no code change, no bug fix, and no security vulnerability present in the diff.
a1a4affe · Dec 22, 2025 · 1 fileHigh 72lightningd: fix segfault when parse_filter fails
We need to initialize ->json_cmd *before* complaining about malformed
filters.
```
lightningd: FATAL SIGNAL 11 (version v25.12-21-g3851187-modded)
0x1042d2023 ???
send_backtrace+0x4f:0
0x1042d20cb ???
crashdump+0x43:0
0x19fe3b743 ???
???:0
0x104180173 command_log
lightningd/jsonrpc.c:1406
0x10420d8f7 command_fail_badparam
common/json_command.c:25
0x104181a07 parse_request
lightningd/jsonrpc.c:1075
0x104181a07 read_json
lightningd/jsonrpc.c:1216
0x10424c65b next_plan
ccan/ccan/io/io.c:60
0x10424c65b do_plan
ccan/ccan/io/io.c:422
0x10424c587 io_ready
ccan/ccan/io/io.c:439
0x10424dd9b io_loop
ccan/ccan/io/poll.c:470
0x10417ede7 io_loop_with_timers
lightningd/io_loop_with_timers.c:22
0x104183a33 main
lightningd/lightningd.c:1492
```
Co-authored-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: JSON-RPC: malformed filters no longer crash lightningd.
This commit fixes a bug where a malformed JSON-RPC filter could crash the Core Lightning daemon (lightningd) with a segmentation fault. The crash happened because the code tried to report the malformed filter before it had looked up the command it was processing. The fix moves the command lookup earlier, so the error can be reported safely without dereferencing a null pointer.
dcaa529a · Dec 22, 2025 · 1 fileLow 42tests: added *non-developer mode* test for invalid filtering
This commit adds a test for a crash that only happens when Core Lightning runs in normal (non-developer) mode. A user sending a malformed JSON filter through the command-line tool could cause the node to crash because a logging function expects data that isn't set in non-dev mode. The test confirms the crash and the expected error message.
1f302cd2 · Dec 19, 2025 · 1 fileInformational 15lightningd: add description field to offer related responces
Changelog-Added: Expose decoded offer description in `offer` and `listoffers` RPC responses.
This commit simply adds a human-readable 'description' field to several RPC responses that already expose a BOLT12 offer string. It decodes the existing offer string and, if the offer contains a description, includes it in the JSON output. There is no security-relevant change.
bb5b8d70 · Dec 19, 2025 · 1 fileInformational 15test: test_sql: fix missing description field
This is a minor test-only fix. A developer added a missing 'description' field to an expected list of fields inside a test file. It does not change any production code, user-facing behavior, or security logic.
54af71c5 · Dec 19, 2025 · 11 filesInformational 19doc: Added doc schemas with description and update proto
This commit is a routine documentation and code-generation update. It adds a new optional 'description' field to the responses of three RPC commands that manage BOLT12 offers (disableoffer, enableoffer, listoffers), and propagates that field through the generated gRPC/Protobuf and Rust/Python client bindings. There is no indication of a security vulnerability, bug fix, or behavior change beyond surfacing existing data to API consumers.
1887ed4a · Dec 19, 2025 · 1 fileInformational 12test: Add tests to confirm that description is added to RPCs
This commit only adds new automated tests to verify that a user-provided description is returned by two existing RPC commands (disableoffer and enableoffer). It does not change any production code, fix a bug, or alter security behavior. There is no security issue in this change.
a05150bd · Dec 19, 2025 · 1 fileInformational 15tools: Fixed shellcheck error from promote-stable script
Changelog-None: Fixed script.
This commit is a routine cleanup of a developer/release script. It fixes a shellcheck linting warning and restructures how a Docker Hub login token is requested. There is no security-relevant change: the same credentials are still sent to the same Docker Hub API endpoint, just with slightly different shell syntax and error handling.
bc3b9b4f · Dec 19, 2025 · 2 filesLow 47pay: Enforce maxdelay for direct channel payments
When paying through a direct channel, direct_pay_override() creates a
route bypassing the normal routing path, which skips the CLTV budget
check in payment_getroute(). This allows payments to succeed even when
maxdelay is set below the required min_final_cltv_expiry.
Add a check in direct_pay_override() to verify the required CLTV
doesn't exceed cltv_budget before using the direct channel shortcut.
If it exceeds, skip the direct channel and let normal routing handle
the failure with a proper error message.
Fixes: #8609
Changelog-Fixed: pay: `maxdelay` parameter now enforced for direct channel payments
This fix closes a loophole in Core Lightning's payment plugin. When a payer had a direct channel to the recipient, the plugin could bypass the normal route-finding step that checks whether the requested payment delay (CLTV) fits within the user's configured 'maxdelay' budget. As a result, a payment could go through even though the user explicitly asked not to accept such a long delay. The patch adds the missing budget check before taking the direct-channel shortcut and now rejects the payment with a clear error when the delay is too high.
4c8d656f · Dec 19, 2025 · 3 filesInformational 15gossipd: don't need hsm fd any more.
gossipd no longer makes gossip messages, and hasn't since v24.02, so it
doesn't actually need to talk to the hsm daemon.
Also, various comments were out of date, so fix those too.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a routine cleanup patch. The gossipd subdaemon used to need a secure connection to the wallet's signing daemon (hsmd) to sign network gossip messages, but that work was moved elsewhere in version 24.02. The patch removes the now-unused connection and updates stale comments. There is no security bug being fixed here.
d6f6d46c · Dec 19, 2025 · 3 filesInformational 15gossipd: move timestamp_reasonable into gossmap_manage.c.
It's only used in there anyway.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a simple internal code cleanup: a helper function that checks whether a gossip timestamp is reasonable is moved from a shared header file into the only file that actually uses it, and its visibility is changed from public to private (static). There is no change to what the function does, no bug fix, and no security-relevant behavior change.
d065d369 · Dec 18, 2025 · 1 fileInformational 15tests: add payer_note case for xpay
This commit only changes a test file. It updates an existing test case to pass a new optional parameter, payer_note, when calling the xpay command for a BOLT 12 invoice. There is no change to production code, no bug fix, and no security relevance.
bcdce8f4 · Dec 18, 2025 · 9 filesInformational 15cln-rpc: update schema, update proto for xpay payer_note field
This commit adds a new optional 'payer_note' field to the xpay RPC command and its generated protocol bindings. It is a routine feature addition that lets a payer attach a short message when requesting a BOLT12 invoice. There is no indication of a security bug or fix.