Core Lightning

This commit only updates the project's internal release checklist documentation. It changes wording and commands used by maintainers when publishing a new version, such as pushing a specific tag to the origin remote instead of pushing all tags. There is no change to the actual Core Lightning software, its network behavior, or any user-facing functionality, so it has no security impact on users.

This commit is purely a release-versioning change. It renames the release candidate label from v25.12rc3 to the final v25.12 across version files, changelogs, and Python package metadata. There are no code behavior changes, bug fixes, or security fixes in the diff.

This commit simply adds two generated tool names to .gitignore files so that Git does not accidentally track compiled binaries. It does not change any executable code, configuration defaults, or security behavior.

This commit is a routine release-candidate version bump from v25.12rc2 to v25.12rc3. It updates version strings across packaging files and adds changelog notes for the new release candidate. The commit itself does not change any executable logic, cryptographic code, network handling, or security-sensitive behavior.

This is a tiny update to a helper shell script used only for local developer testing. It changes the address type the script asks for from 'bech32' (SegWit) to 'p2tr' (Taproot) because the software now defaults to Taproot addresses. It does not touch any production code, network protocol, wallet security, or cryptographic logic.

This is a tiny test-only cleanup. It replaces a direct Unix socket connection helper with a shared test helper and explicitly closes an old socket to avoid a resource leak during automated tests. There is no change to production code or user-facing security.

This commit fixes a wording bug in error messages produced by the xpay plugin. Previously, when an invoice had a single-hop route hint, any failed channel along the payment path could be incorrectly labeled as 'the invoice's route hint' in the error message, even if the failure happened on an unrelated intermediate channel. The fix adds a check that the failed channel actually matches the route hint's channel ID before using that label. This is a user-facing diagnostic improvement, not a security vulnerability.

This fix corrects a startup bug in Core Lightning where, after rolling back recent blocks to re-read them, the node could forget to keep watching certain spent transaction outputs. The main visible symptom was stale network gossip, but it could also cause the node to miss on-chain transactions if it restarted at the wrong time. The patch makes the node refresh its watch list after block rollbacks.

This commit only adds a new regression test for an existing wallet fix. It does not change any production code, so it cannot introduce a new security vulnerability or directly fix one in the shipped software. The test verifies that Core Lightning correctly rescans older blocks to find UTXOs it previously missed after a database upgrade.

This commit only adds a new automated test to the project's test suite. It does not change any production code, so it cannot directly introduce or fix a security vulnerability in running software. The test is currently marked as expected to fail (xfail), meaning it documents behavior that is not yet working correctly—specifically, how the wallet tracks whether a coin is spent across a blockchain reorganization and a node restart. It may be a regression test for a future bug fix, but by itself it poses no security risk.

This commit adds a one-time background scan that re-examines old blocks to find UTXOs (unspent transaction outputs) the wallet may have missed earlier. It is a data-recovery / consistency fix, not an obvious exploit patch. The commit message does not call it a security fix, and there are no supplied references linking it to an attack. The change could matter for security because missed UTXOs can affect channel balances and on-chain funds, but the diff itself is defensive housekeeping.

This is a routine GitHub Actions CI maintenance change. It removes two unnecessary setup commands (installing a documentation tool called lowdown and running a build configuration script) from the automated step that signs release artifacts. There is no security-relevant change visible in the diff.

This commit simply deletes an old, accidentally included binary file named hsmtool from the repository and adds its name to the ignore list so it won't be committed again. There is no code change, no vulnerability fix, and no security issue introduced or resolved by this commit.

This commit is a routine version bump from the first to the second release candidate of Core Lightning 25.12. It updates version strings in packaging files, the changelog, and adds a newly compiled helper binary. There is no code change that fixes or introduces a security issue in this commit itself.

This commit only adds a missing documentation entry for an existing command. It does not change any executable code, security settings, or user permissions. There is no security issue here.

This commit simply moves a source-code checking tool (check-bolt) from one directory (tools/) to another (devtools/) and updates the build files accordingly. It does not change any code that runs the Core Lightning node, handles payments, or touches network communication. There is no security issue here.

This commit adds a new helper function for reading message types from raw byte buffers where the caller already knows the buffer length. The existing helper required a special memory-managed pointer; the new variant works with plain length-counted buffers, which is useful for streaming data. There is no security-relevant change here—just a small, clean API addition.

This commit adds a new offline command-line tool, lightning-downgrade, that lets a user roll back a Core Lightning node's database from the upcoming v25.12 release to the previous v25.09 release. It is meant as a recovery aid if an upgrade goes wrong. The tool only works when the lightning node is stopped, checks for a running process, and reverses database migrations one by one using built-in revert SQL and functions. It also deletes an incompatible gossip store file after downgrading. There is no direct evidence in the commit that this fixes an active security bug; it is a new operational utility.

This commit is a straightforward code reorganization: it moves existing data-serialization helper functions for the askrene plugin into a new shared file (datastore_wire.c/h) so another tool (lightning-downgrade) can reuse them. No security bug is introduced or fixed; the logic is essentially unchanged.

This commit adds infrastructure to Core Lightning's database code so that future versions can, in some cases, roll back (downgrade) a database to the previous software version. It is a feature addition, not a fix for an active security bug. The new code includes safety checks to refuse downgrade when data would be lost, such as when a newly added 'withheld' column has actually been used. There is no direct evidence in the commit that this resolves a known vulnerability or that an attacker can exploit it.

This commit only adds a new test to the project's test suite. It checks that the database downgrade tool correctly refuses to downgrade when a newer feature (a node bias in the 'askrene' routing layer) is present. There is no change to production code, no fix for a vulnerability, and no security-relevant behavior change in the software itself.

This commit is a pure code refactoring: it moves the large database migration table and related functions from wallet/db.c into a new pair of files, wallet/migrations.c and wallet/migrations.h. The goal stated in the commit message is to make the migration list easier to share with a future downgrade tool. No behavior of the migrations themselves is changed, no SQL statements are modified, and no security fixes or vulnerabilities are introduced.

This commit is a straightforward code reorganization: it moves existing datastore (key-value storage) database access functions out of wallet.c into a new pair of files, datastore.c and datastore.h, so a separate downgrade tool can reuse them. No behavior changes, no new features, and no security fixes are visible in the diff.

This commit is a simple housekeeping rename. The Core Lightning project previously built a tool called `hsmtool`, then copied it to `lightning-hsmtool` during installation. This change removes the extra copy step and makes the installed name `lightning-hsmtool` the canonical name everywhere: source file, build system, documentation, and tests. No security vulnerability is introduced or fixed.

This commit only adds a new manual page for an existing tool called lightning-downgrade. It does not change any code, commands, or behavior. It simply documents how to use the tool and warns users that downgrades may fail if newer features have been used. There is no security issue in this documentation change itself.