EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkActive incident
Repository coverage

2009 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

184security candidates280second-pass queue1894AI analyses
56commits · 30 days
193commits · 60 days
682commits · 180 days
1671commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
489Strong · 80–100
1231Adequate · 60–79
259Thin · 40–59
30Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
cdecker14910384
Níckolas Goline63844277
Rusty Russell96475958172
daywalker90118895165
Lagrang386578170
Vincenzo Palazzo13411182
dovgopoly15015164
Sangbida Chaudhuri14931146066
Dusty Daemon821378066
ShahanaFarooqui931093063
Peter Neuroth1024101071
Christian Decker36436072
Analysis record

Published AI watches

Last scanned 53 minutes ago

Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

contrib: add jaonoctus's signing key

This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.

41278b4eby jaonoctus+2−02 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: fixed timestamps for invented bookkeeper deposits

This is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…

498e5086by daywalker90+2−01 file
No security note in commit
Informational 21 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

docs: document missing and fix erroneous JSON-RPC error codes

This commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…

Documentation-only change with no executable code modificationsCorrects RPC schema error-code metadata to match actual handler behaviorNo change to input parsing, authorization, cryptography, or network behavior
d1b6963bby daywalker90+204−1224 files
No security note in commit
Low 46 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

channeld: initialize tx_sigs_allowed on startup

This commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …

use of uninitialized variableundefined behavior (invalid bool load)network-triggered code path
c09c4520by Erick Cestari+1−01 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

ci: fix the coverage nightly's profile handling

This commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…

5685c9a3by cdecker+12−211 file
No security note in commit
Low 37 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

schemas: make required fields match the code

This commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…

Large schema-only change with no accompanying security advisory or CVEOne semantic change to plugin hook response: invoice_payment hook can now reject with only failure_message and no resultMany fields change from optional to required in public RPC/protobuf interfaces
ddbd2963by daywalker90+1786−173950 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: document error 313 on every command which can return it

This commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …

a34b9758by Peter Neuroth+30−86 files
No security note in commit
Low 25 AI analysisMessage 88 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tools/build-release.sh: name the checksum file when verifying the signature

This commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…

Incorrect cryptographic verification logic in release toolingPotential false-positive signature verification with inline-signed .asc substitutionRelease-integrity hardening
8e495707by Peter Neuroth+5−21 file
No security note in commit
Low 42 AI analysisMessage 95 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: pass the manifest explicitly to gpg --verify

This commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…

Verification bypass risk in release artifact validationgpg --verify single-argument form can exit 0 without reading the intended manifestDocumentation-only hardening of release process
2dee8699by Peter Neuroth+9−62 files
Vendor flagged security relevance
Low 25 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

Cargo.lock: update dependencies

This commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…

Routine dependency refresh with no stated security rationaleUpdates to security-sensitive transitive crates (rustls, hyper, h2, tokio, webpki-roots) but no evidence these versions fix known vulnerabilitiesNo source-code changes or patch-specific fixes visible in the diff
c1551c55by daywalker90+298−2761 file
No security note in commit
High 80 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

common: bound JSON nesting depth when parsing

This commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…

Stack-overflow via deeply nested JSONRecursive JSON traversal without depth boundDenial-of-service vector in JSON-RPC input parsing
83f92e4bby Níckolas Goline+90−22 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 28 · Opaque
EP Elements ProjectCore Lightning BitcoinLightning Network

common: minor typo fixes

This commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…

273d7f02by w3lld1+3−32 files
No security note in commit
Informational 20 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

pyln-testing: truncate long testnames

This change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …

No security-relevant signal: change is in test framework code onlyFixes a test reliability issue, not a runtime vulnerabilityNo input sanitization, authentication, cryptography, or network changes
c4fe4cbaby Peter Neuroth+59−12 files
No security note in commit
Moderate 60 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: exclude immature coinbase outputs from fee rescue selection

This fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…

Consensus-invalid transaction generation preventedFee rescue / CPFP failure mode mitigatedCoinbase maturity check added to coin selection
34883ff7by cdecker+5−12 files
Vendor flagged security relevance
Moderate 59 AI analysisMessage 91 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: fix crash loading node bias with description

This commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…

Use-after-free / double-take of a tal-allocated string during plugin startupDenial-of-service-like symptom: lightningd aborts before replying to init, node cannot restartFixes publicly reported issue #9433 by endothermicdev
4681177dby Vincenzo Palazzo+2−32 files
No security note in commit
Informational 12 AI analysisMessage 91 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: restart the node which owns the layer in node bias test

This commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …

0f3f67a0by Vincenzo Palazzo+3−21 file
No security note in commit
High 78 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

dualopend: bound the feerates a peer opens at

This commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …

Missing input validation on wire-parsed feerate fieldsPeer could induce signing and storage of feerate == 0RBF remote path allowed unbounded upward feerate walks
ba08356fby cdecker+140−04 files
Vendor flagged security relevance
High 72 AI analysisMessage 100 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: regression coverage for out-of-range feerates

This commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…

Integer overflow in feerate conversion (u32 wrap from 0xFFFFFFFF perkb to 0 perkw)Absurd feerate from external fee source bypassing sanity ceilingDatabase-stored out-of-range feerate causing startup abort/crash loop
65bdbc47by cdecker+137−02 files
No security note in commit
Moderate 64 AI analysisMessage 86 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't assert on funding feerates read from the db

This update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…

Integer overflow in RBF escalation (u32 * 25 / 24) leading to assertion failureAssertion failure in read-only introspection RPC (listpeerchannels) causing crash-loop at startupDatabase value treated as invariant despite originating from external fee estimator
d67c4936by cdecker+72−227 files
Vendor flagged security relevance
Moderate 53 AI analysisMessage 86 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: clamp absurd inflight funding feerates on upgrade

This commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …

Integer overflow in fee-rate calculation (u32 overflow when multiplying by 25/24)Assertion failure leading to daemon crash loop at startupDatabase migration clamps out-of-range stored funding feerates
f057c692by cdecker+34−01 file
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityplugins: lsps: add own trait for blockheight providerby Peter Neuroth · 38c84be2 · Dec 16, 2025 · 1 fileMessage 73 · AdequateInformational 14Details
Commit message · Peter Neuroth

plugins: lsps: add own trait for blockheight provider

The ClnApi trait is way overloaded. We break things down to make it more
modular on the service side.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 14/100

This is a routine internal code cleanup in Core Lightning's LSPS (Lightning Service Provider Specification) plugin. It splits an overloaded interface into smaller, more focused pieces. There is no user-facing behavior change, no bug fix, and no security relevance visible in the commit.

Lower-priorityplugins: lsps: move transport to core moduleby Peter Neuroth · 6e868443 · Dec 16, 2025 · 9 filesMessage 68 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: move transport to core module

This commit is part of a series of commits to make the lsps plugin crate
layered and modular for efficient reuse in external projects.

The core module is responsible for common business logic and interfaces
and acts as the intermediate layer for an actual implementation

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a straightforward internal code reorganization in the Core Lightning LSPS plugin. It moves the JSON-RPC transport/client code from one module to another and updates import paths. There is no security-relevant change to behavior, no bug fix, and no disclosed vulnerability.

AI review queuedplugins: lsps: replace heavy transportby Peter Neuroth · 462ca844 · Dec 16, 2025 · 6 filesMessage 68 · AdequateLow 27Details
Commit message · Peter Neuroth

plugins: lsps: replace heavy transport

We replace the legacy transport by a slim custommsg hook that makes use
of the lightweight multiplexed transport and avoids deserialization and
serialization through this extra layer

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Low 27/100

This commit refactors the LSPS (Lightning Service Provider Specification) plugin in Core Lightning to replace a heavier custom-message transport layer with a slimmer one. It removes a 536-line transport module and introduces a simpler hook-based multiplexer. The change is a code-quality/architecture refactor; there is no direct evidence in the commit or supplied references that it fixes a security vulnerability.

AI review queuedplugins: lsps: remove anyhow from tlvsby Peter Neuroth · 4a1c9220 · Dec 16, 2025 · 1 fileMessage 68 · AdequateInformational 12Details
Commit message · Peter Neuroth

plugins: lsps: remove anyhow from tlvs

Remove anyhow as a dependency from the tlv module. This allows for a
cleaner error handling

Changelog-None

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 12/100

This commit is a routine code cleanup in a Core Lightning plugin. It swaps one Rust error-handling library (anyhow) for another (thiserror) in the TLV (type-length-value) parsing module. The actual parsing logic and security checks remain the same; only the way errors are represented and reported is changed. There is no indication this fixes a security bug.

Lower-priorityplugins: lsps: use transport specific errorby Peter Neuroth · e08756cd · Dec 16, 2025 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: use transport specific error

instead of using std::error, this is more specific and keeps the errors
"type-safe"

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a tiny code cleanup in a Lightning plugin. The developer replaced a generic Rust error type with a project-specific error type in two function signatures. There is no functional change visible in the diff, no bug fix, and no security-relevant behavior change.

Lower-priorityplugins: lsps: move lsps2 model to proto moduleby Peter Neuroth · b88dc597 · Dec 16, 2025 · 6 filesMessage 68 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: move lsps2 model to proto module

This commit is part of a series that refactor the lsp plugin crate into
a modularized crate with the goal to separate the actual plugin runtime
as much as possible from library code to make it accessible for 3rd
party plugin implementations.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a pure code refactor: it moves the LSPS2 data model (request/response types, fee calculation, validation, and tests) from one internal module path to another within the same plugin crate. No functionality, logic, or security behavior changes. It is not a security fix.

Lower-priorityplugins: lsps: add slim multiplexing transportby Peter Neuroth · 3cf99c35 · Dec 16, 2025 · 1 fileMessage 68 · AdequateInformational 12Details
Commit message · Peter Neuroth

plugins: lsps: add slim multiplexing transport

We can separate concerns here by adding a lightweight multiplexing
transport client. This helps us to clean up any direct dependencies on
CLN

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 12/100

This commit adds a new internal helper for the LSPS (Lightning Service Provider Specification) plugin that multiplexes JSON-RPC request/response messages over a generic sender. It is purely a refactor/addition of new code with no obvious security bug, no disclosed vulnerability, and no change to existing behavior that callers rely on.

Lower-priorityplugins: lsps: split up handlersby Peter Neuroth · fa62c64d · Dec 16, 2025 · 8 filesMessage 78 · AdequateInformational 12Details
Commit message · Peter Neuroth

plugins: lsps: split up handlers

This commit separates the business logic from core-lighting behaviour
and moves the core-lightning related implementations into the
cln_adapters module.

Splits up tests as well

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 12/100

This commit is a routine code reorganization (refactor) for the LSPS (Lightning Service Provider Specification) plugin in Core Lightning. It splits business logic from Core-Lightning-specific RPC calls by moving RPC implementations into a new 'cln_adapters::rpc' module and separating HTLC handling, service handling, and provider traits. There is no indication of a security fix or vulnerability being patched.

Lower-priorityplugins: lsps: implement ClnSender for bolt8 transportby Peter Neuroth · d5bcde09 · Dec 16, 2025 · 2 filesMessage 73 · AdequateInformational 12Details
Commit message · Peter Neuroth

plugins: lsps: implement ClnSender for bolt8 transport

Implement the MessageSender trait for Bolt8 transport via core-lightning

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 12/100

This commit adds a new Rust module that lets the LSPS plugin send custom Lightning messages through Core Lightning's RPC interface. It is a straightforward feature implementation with no obvious security bug. There is no indication in the commit that it fixes a vulnerability or addresses a security issue.

Lower-priorityplugins: lsps: refactor service hookby Peter Neuroth · e50f5ee8 · Dec 16, 2025 · 7 filesMessage 68 · AdequateInformational 12Details
Commit message · Peter Neuroth

plugins: lsps: refactor service hook

We have some shared behavior and can use the MessageSender for the
service hook as well

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 12/100

This commit is a routine internal code cleanup (refactor) in the LSPS (Lightning Service Provider Specification) plugin for Core Lightning. It merges two similar message-handling paths into one shared implementation and switches the service-side response path to use the same message-sender component already used elsewhere. There is no indication from the commit itself that this fixes a security bug or introduces a vulnerability.

Lower-priorityplugins: lsps: move feature types into proto moduleby Peter Neuroth · bd9fd581 · Dec 16, 2025 · 5 filesMessage 73 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: move feature types into proto module

This commit is part of a series that refactor the lsp plugin crate into
a modularized crate with the goal to separate the actual plugin runtime
as much as possible from library code to make it accessible for 3rd
party plugin implementations.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a routine code reorganization. Two numeric constants used by the Lightning Service Provider (LSP) plugin are moved from one Rust source file to another so that third-party plugin code can import them more cleanly. The actual values (feature bit 729 and message type 37913) and how they are used do not change.

Lower-priorityplugins: lsps: add router compatible lsps2 service handlerby Peter Neuroth · 461065af · Dec 16, 2025 · 4 filesMessage 73 · AdequateInformational 10Details
Commit message · Peter Neuroth

plugins: lsps: add router compatible lsps2 service handler

This commit copys and adapts the lsps2 service handlers to match the
slim router handlers

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 10/100

This commit adds a new experimental plugin feature for the LSPS2 protocol, which lets a Core Lightning node act as a service provider that opens just-in-time channels for payments. The change is purely additive (about 1,500 lines of new Rust code plus tests) and does not patch any reported vulnerability. There is no vendor statement or external report linking it to a security incident.

Lower-priorityplugins: lsps: move client transport to cln_adaptersby Peter Neuroth · 74015850 · Dec 16, 2025 · 5 filesMessage 73 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: move client transport to cln_adapters

cln_adapters is the layer that holds concrete implementations that are
related to core-lightning.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a pure code reorganization: it moves the client transport module from one directory (lsps0) to another (cln_adapters) without changing any behavior. The same code is deleted from one file and added to another, with only import paths updated. There is no security fix or vulnerability introduced.

Lower-priorityplugins: lsps: replace owned types by referencesby Peter Neuroth · 0927179f · Dec 16, 2025 · 3 filesMessage 60 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: replace owned types by references

Improves flexibility in transport implementations.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a routine Rust code cleanup in a Core Lightning plugin. It changes several function signatures to accept string and byte references instead of owned values, reducing unnecessary memory copies. There is no security-relevant change visible in the diff.

Lower-priorityplugins: lsps: remove peer_id from transportby Peter Neuroth · e591323a · Dec 16, 2025 · 3 filesMessage 68 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: remove peer_id from transport

As we pass the peer_id through the transport methods, there is no need
to store the peer_id in the Bolt8Transport struct anymore

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a small internal code cleanup in the experimental LSPS (Lightning Service Provider Specification) plugin. It removes a stored peer/node ID from a transport helper struct and instead passes the peer ID as a function argument when sending messages. There is no user-visible behavior change and no security fix.

Lower-priorityplugins: lsps: add request to transport traitby Peter Neuroth · 1bb76f84 · Dec 16, 2025 · 1 fileMessage 80 · StrongInformational 12Details
Commit message · Peter Neuroth

plugins: lsps: add request to transport trait

Introducing "request" to the transport trait that uses the RequestObject
and JsonRpcResponse directly reduces some overhead and unnecessary
conversions. Why do we implement a generic transport over &str when we
already know that we are dealing with JSON-RPC 2.0 here.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 12/100

This is a routine internal code cleanup in Core Lightning's experimental LSPS plugin. It changes how JSON-RPC messages are passed between components, removing unnecessary string conversions and an Arc wrapper. There is no indication this fixes or introduces a security vulnerability.

Lower-priorityplugins: lsps: refactor client to use jsonrpcresponseby Peter Neuroth · 52745565 · Dec 16, 2025 · 3 filesMessage 73 · AdequateInformational 14Details
Commit message · Peter Neuroth

plugins: lsps: refactor client to use jsonrpcresponse

This makes it easier for client implementations to separate transport or
parser related issues from actuall json-rpc error responses. Also this
helps to segregate the individual responsibilities of the crates
further.

This further alows us to remove the error enum from proto/jsonrpc
completely as this now only deals as a from/to-wire module

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 14/100

This commit is a straightforward internal code cleanup in Core Lightning's LSPS (Lightning Service Provider Specification) plugin. It changes how JSON-RPC responses are handled so that transport/parser problems are kept separate from actual JSON-RPC error responses returned by a remote server. There is no indication this fixes a security bug or introduces a vulnerability; it is a refactoring for better code organization.

Lower-priorityplugins: lsps: move errors into proto moduleby Peter Neuroth · a94885ba · Dec 16, 2025 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: move errors into proto module

This commit is part of a series that refactor the lsp plugin crate into
a modularized crate with the goal to separate the actual plugin runtime
as much as possible from library code to make it accessible for 3rd
party plugin implementations.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine code reorganization in Core Lightning's experimental LSPS plugin. It moves standard JSON-RPC error code constants from one internal Rust module to another and adds a new client-rejected error type. There is no security-relevant behavior change, no bug fix, and no vulnerability patch.

Lower-priorityplugins: lsps: move primitives into lsps0by Peter Neuroth · ba93a7ca · Dec 16, 2025 · 6 filesMessage 68 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: move primitives into lsps0

Those primitives are actually defined in lsps0

This commit is part of a series that refactor the lsp plugin crate into
a modularized crate with the goal to separate the actual plugin runtime
as much as possible from library code to make it accessible for 3rd
party plugin implementations.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a straightforward code reorganization: the developer moved shared data types (like monetary amounts and channel identifiers) from a file called 'primitives.rs' into a file called 'lsps0.rs' because the LSPS0 specification actually defines those types. Other files were updated to import from the new location. No behavior changes, bug fixes, or security fixes are visible in the diff.

Lower-priorityplugins: lsps: add lsps0 encoding and decodingby Peter Neuroth · 5ed743e1 · Dec 16, 2025 · 1 fileMessage 80 · StrongInformational 12Details
Commit message · Peter Neuroth

plugins: lsps: add lsps0 encoding and decoding

In order to seperate concerns, this adds the basic encoding of an lsps0
frame to the proto module.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 12/100

This commit adds routine helper functions for packaging and unpackaging LSPS0 protocol messages in a new Core Lightning plugin. It is a small, self-contained code addition with no obvious security bug. The functions validate message headers and return clear errors for malformed input.

Lower-priorityplugins: lsps: move feature helpers to core moduleby Peter Neuroth · 30268ad9 · Dec 16, 2025 · 4 filesMessage 73 · AdequateInformational 15Details
Commit message · Peter Neuroth

plugins: lsps: move feature helpers to core module

This removes the util.rs module and leaves us with proto, core and
cln_adapters

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a simple code reorganization: it moves helper functions for checking feature bits from a general 'util.rs' file into a new 'core/features.rs' module. No behavior changes are visible in the diff, and no security fixes or vulnerabilities are introduced.

Lower-priorityCI: add artifact upload for pytest JUnit XML reports.by Christian Decker · 82b7b39d · Dec 16, 2025 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · Christian Decker

CI: add artifact upload for pytest JUnit XML reports.

Adds upload-artifact steps after each test run to preserve test
results as GitHub artifacts. Each job uploads its report.xml with
a unique name based on the job and matrix configuration.

Artifacts are uploaded even when tests fail (if: always()) to
ensure test results are available for debugging.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only changes GitHub Actions CI configuration. It adds steps to upload pytest test result files (report.xml) as build artifacts after tests run, even when tests fail. There is no change to application code, no security fix, and no vulnerability introduced.

Lower-priorityrefactor: use GROUP variable for artifact names instead of sanitizing NAMEby Christian Decker · 0b6f739f · Dec 16, 2025 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · Christian Decker

refactor: use GROUP variable for artifact names instead of sanitizing NAME

Add a GROUP matrix variable to valgrind and sanitizer test configurations
with simple numeric values. Use matrix.GROUP in artifact names instead of
sanitizing the descriptive NAME, which contains special characters.

This is cleaner and more maintainable than string replacement logic.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validationdocumentation-only discount
AI analysis · Informational 15/100

This commit is a routine cleanup of the project's automated testing configuration. It replaces a messy string-cleanup trick used to name test output files with a simple numeric group identifier. There is no change to the actual Core Lightning software, user data, or network behavior, and no security relevance.

Lower-priorityCI: consolidate GLOBAL_PYTEST_OPTS into PYTEST_OPTS_BASE.by Christian Decker · bca2db63 · Dec 16, 2025 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · Christian Decker

CI: consolidate GLOBAL_PYTEST_OPTS into PYTEST_OPTS_BASE.

Replaces GLOBAL_PYTEST_OPTS with PYTEST_OPTS_BASE that includes all
common pytest options: --reruns=10, -vvv, --junit-xml=report.xml,
--timeout=1800, and --durations=10.

Removes redundant option specifications from individual jobs and
simplifies pytest command invocations by removing direct references
to GLOBAL_PYTEST_OPTS (now inherited via PYTEST_OPTS).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Changelog-None

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This is a routine cleanup of the project's automated testing configuration. It renames a shared pytest option variable and removes duplicate option settings from individual test jobs. There is no change to the Core Lightning software itself, its network behavior, or its security.

Lower-priorityCI: fix env context reference in job-level env sections.by Christian Decker · c7d7a007 · Dec 16, 2025 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · Christian Decker

CI: fix env context reference in job-level env sections.

GitHub Actions doesn't allow referencing workflow-level env variables
from job-level env sections. Fixed by:
- Replacing ${{ env.PYTEST_OPTS_BASE }} with full values in job-level env
- Keeping ${{ env.PYTEST_OPTS_BASE }} in step-level env (which is valid)

This resolves the "Unrecognized named-value: 'env'" errors.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit fixes a GitHub Actions workflow syntax error. It replaces an invalid reference to a workflow-level environment variable inside job-level environment sections with the actual values. There is no security issue here—it's purely a CI configuration bug fix that stops 'Unrecognized named-value: env' errors.