Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 24 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
a45c9072 · Nov 27, 2025 · 3 filesLow 44lightningd-downgrade: downgrade askrene's layer info too.
If they had a channel bias, and ran xpay, it will update the bias
to a v2 bias (with a timestamp). We must downgrade that, or the
older version won't load!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a bug in Core Lightning's downgrade tool. If a user ran a newer version that stored an updated 'channel bias' record (used by the xpay payment plugin to influence routing), then tried to downgrade to v25.09, the older version would fail to load because it didn't understand the newer data format. The patch teaches the downgrade tool to convert those newer records back to the older format. It is a data-compatibility fix, not a remote exploit.
640888aa · Nov 27, 2025 · 1 fileInformational 15CI: add test that we can downgrade the node and run it under v25.09.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only adds a new automated CI test job that checks whether Core Lightning can be downgraded to the previous release (v25.09). It does not change any production code, wallet logic, network handling, or cryptographic operations. There is no security-relevant change visible in the diff.
acc41ddc · Nov 27, 2025 · 1 fileInformational 12connectd: don't log at INFO level for known issue.
We get spammed by this, because we somehow missed occasional channel closes.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change simply reduces how often one routine log message is printed. It does not fix a security bug or change how the program handles money or network connections. The underlying behavior—occasionally missing channel close notifications—remains unchanged, only the logging level is quieter for one specific known message.
fc23b538 · Nov 27, 2025 · 2 filesInformational 15lightningd: print UNUSUAL log message if a command is very slow.
We don't expect an internal command to take 5 seconds to service
without explicitly pausing: if it does, log at a higher level.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change simply adds a warning message to the log file when an internal command takes unusually long (more than 5 seconds). It does not fix a vulnerability, change permissions, or alter how commands are processed. It is a diagnostic/monitoring improvement.
ff0ee6df · Nov 27, 2025 · 15 filesInformational 15doc: Fix mdx format errors generated due to Readme v2 migrations
Changelog-None: Documentation fixes only.
This commit is a documentation-only cleanup. It fixes Markdown/MDX formatting errors caused by migrating documentation to a new platform (ReadMe v2). The changes include removing old platform-specific image and tutorial tile blocks, fixing broken links, correcting typos, adjusting whitespace, and converting formatting to standard Markdown. No source code, configuration defaults, or runtime behavior of Core Lightning was changed.
edfb64c7 · Nov 27, 2025 · 1 fileInformational 15contrib: Remove litecoin keys as CLN has recently stopped supporting litecoin
This commit simply deletes a public PGP key file for a Litecoin developer from the repository. Core Lightning (CLN) has dropped Litecoin support, so the key is no longer needed. There is no code change, no vulnerability, and no security risk.
4c7e2d44 · Nov 27, 2025 · 2 filesLow 32hsmd: fix HSM sent an unknown message type error
When we enter the wrong passphrase hsmd crashes like this with an unknown message type:
lightning_hsmd: Failed to load hsm_secret: Wrong passphrase (version v25.12rc1-7-g7713a42-modded)
0x102ba44bf ???
send_backtrace+0x4f:0
0x102b0900f status_failed
common/status.c:207
0x102af1a37 hsmd_send_init_reply_failure
hsmd/hsmd.c:301
0x102af1497 load_hsm
hsmd/hsmd.c:446
0x102af1497 init_hsm
hsmd/hsmd.c:548
0x102b29e63 next_plan
ccan/ccan/io/io.c:60
0x102b29e63 do_plan
ccan/ccan/io/io.c:422
0x102b29d8b io_ready
ccan/ccan/io/io.c:439
0x102b2b4bf io_loop
ccan/ccan/io/poll.c:470
0x102af0a83 main
hsmd/hsmd.c:886
lightningd: HSM sent unknown message type
This change swaps write_all() to wire_synce_write() because write_all() is missing the wire protocol length prefix. We also don't send a stack trace anymore if the user has entered the wrong passphrase and exit cleanly.
This commit fixes a bug in Core Lightning's Hardware Security Module daemon (hsmd). When a user entered the wrong wallet passphrase, the daemon would crash with a confusing 'HSM sent unknown message type' error and print a stack trace. The fix ensures the error message is sent using the correct wire protocol format and that wrong-passphrase failures exit cleanly without a stack trace. It is primarily a reliability and user-experience fix, not a security vulnerability that allows remote exploitation.
e04153f1 · Nov 27, 2025 · 1 fileInformational 18tools: Sort Fedora tar by name
And do not replace Fedora shasums from verification because Fedora binaries are deterministic now.
This commit changes the release build script for Core Lightning. It makes the Fedora release tarball list its files in a fixed alphabetical order and removes a workaround that copied Fedora checksums from an external source. The change improves build reproducibility and simplifies verification, but it does not appear to fix or introduce a security vulnerability.
4a67100c · Nov 27, 2025 · 1 fileInformational 15ci: Add skip_validation option to test the release on non-tagged commit
Changelog-None: Improved release action CI testing
This commit changes the project's automated release workflow to add a manual testing option. It lets maintainers run the release build process on a non-tagged commit by skipping the normal validation check and forcing a specific version. There is no security vulnerability in the change itself; it is a CI/testing convenience feature.
192fc6ae · Nov 27, 2025 · 1 fileInformational 15doc: Update documentation for reproducible Fedora binaries
Changelog-None: Already added details in PR #8692.
This commit only updates the project's release checklist documentation. It changes the example command for building release binaries to include Fedora alongside Ubuntu, and corrects a line that incorrectly said the Fedora image was non-reproducible. There are no code changes, no configuration changes, and no changes to how the software runs or handles data.
7713a427 · Nov 24, 2025 · 1 fileInformational 15change log for release candidate 1 to include 8690
Why it was queuedThis commit only edits the project's CHANGELOG.md file. It adds a one-line note that a bug fix for the `listpays` plugin was included in the release candidate, updates the release date, and adds a link to pull request #8690. There are no code changes and no security relevance in the diff itself.
9627bf9b · Nov 24, 2025 · 1 fileInformational 15CI: don't run configure on *host* for release.
It breaks, but more importantly we don't need to install lowdown any more,
since the check in build-release.sh has been removed.
```
Run sudo apt-get install -y lowdown
Reading package lists...
Building dependency tree...
Reading state information...
The following NEW packages will be installed:
lowdown
0 upgraded, 1 newly installed, 0 to remove and 21 not upgraded.
Need to get 129 kB of archives.
After this operation, 314 kB of additional disk space will be used.
Get:1 file:/etc/apt/apt-mirrors.txt Mirrorlist [144 B]
Get:2 http://azure.archive.ubuntu.com/ubuntu noble/universe amd64 lowdown amd64 1.1.0-1 [129 kB]
Fetched 129 kB in 0s (2971 kB/s)
Selecting previously unselected package lowdown.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 216225 files and directories currently installed.)
Preparing to unpack .../lowdown_1.1.0-1_amd64.deb ...
Unpacking lowdown (1.1.0-1) ...
Setting up lowdown (1.1.0-1) ...
Processing triggers for man-db (2.12.0-4build2) ...
Not building database; man-db/auto-update is not 'true'.
Running kernel seems to be up-to-date.
No services need to be restarted.
No containers need to be restarted.
checking for getpagesize() in <unistd.h>... yes
checking for isblank() in <ctype.h>... yes
checking for little endian... yes
checking for memmem in <string.h>... yes
checking for memrchr in <string.h>... yes
checking for mmap() declaration... yes
checking for /proc/self/maps exists... yes
checking for qsort_r cmp takes trailing arg... yes
checking for __attribute__((section)) and __start/__stop... yes
checking for stack grows upwards... no
checking for statement expression support... yes
checking for <sys/filio.h>... no
checking for <sys/termios.h>... yes
checking for <sys/unistd.h>... yes
checking for __typeof__ support... yes
checking for unaligned access to int... yes
checking for utime() declaration... yes
checking for __attribute__((warn_unused_result))... yes
checking for #pragma omp and -fopenmp support... yes
checking for <valgrind/memcheck.h>... no
checking for working <ucontext.h... yes
checking for passing pointers via makecontext()... yes
checking for __builtin_cpu_supports()... yes
checking for closefrom() offered by system... yes
checking for F_CLOSEM defined for fctnl.... no
checking for close_range syscall available as __NR_close_range.... yes
checking for F_MAXFD defined for fcntl.... no
checking for zlib support... yes
checking for libsodium with IETF chacha20 variants... no
checking for sqlite3... yes
checking for postgres... yes
checking for User Statically-Defined Tracing (USDT)... no
checking for compiler is GCC... yes
checking for GCC version is 7 or above... yes
Writing variables to config.vars.2200... yes
Writing header to ccan/config.h.2200... yes
checking for python3-mako... not found
checking for lowdown... found
checking for sha256sum... found
checking for jq... found
Setting PREFIX... /usr/local
Setting CC... cc
Setting CONFIGURATOR_CC... cc
Setting CWARNFLAGS... -Wall -Wundef -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wold-style-definition -Werror -Wno-maybe-uninitialized -Wshadow=local
Setting CDEBUGFLAGS... -std=gnu11 -g -fstack-protector-strong
Setting COPTFLAGS... -Og
CSANFLAGS not found
FUZZFLAGS not found
FUZZER_LIB not found
LLVM_LDFLAGS not found
SQLITE3_CFLAGS not found
Setting SQLITE3_LDLIBS... -lsqlite3
Setting POSTGRES_INCLUDE... -I/usr/include/postgresql
Setting POSTGRES_LDLIBS... -L/usr/lib/x86_64-linux-gnu -lpq
SODIUM_CFLAGS not found
SODIUM_LDLIBS not found
Setting VALGRIND... 0
Setting DEBUGBUILD... 0
Setting COMPAT... 1
Setting PYTEST... python3 -m pytest
Setting STATIC... 0
Setting CLANG_COVERAGE... 0
Setting ASAN... 0
Setting UBSAN... 0
Setting TEST_NETWORK... regtest
Setting HAVE_PYTHON3_MAKO... 0
Setting SHA256SUM... sha256sum
Setting FUZZING... 0
Setting RUST... 1
Setting PYTHON... python3
Setting SED... sed
*** We need a libsodium >= 1.0.4 (released 2015-06-11).
Error: Process completed with exit code 1.
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a routine fix to the project's automated release build script on GitHub. It removes an unnecessary step that installed a documentation tool and ran a configuration script on the build host. The change only affects how release binaries are produced internally and does not change any code that users run.
b9065079 · Nov 24, 2025 · 1 fileLow 30Fix BOLT11 annotation loss after sendonion failure
Fixes #6978 where bolt11 annotations were lost when sendonion failed early and payment was retried.
When sendonion RPC fails before saving payment to database, invstring_used flag would remain true, causing retry attempts to omit bolt11 parameter. Successful retries would then save to DB without bolt11 annotation.
Move invstring_used flag setting from payment_createonion_success to payment_sendonion_success. This ensures the flag is only set after sendonion actually succeeds. The bolt11 will be sent with every sendonion attempt until the first successful one, accepting the minor redundancy for cleaner state management.
Changelog-Fixed: Plugins: `listpays` can be missing the bolt11 information in some cases where `pay` is used.
This commit fixes a bookkeeping bug in Core Lightning's payment plugin. When a user pays a BOLT11 invoice using the `pay` command, the plugin can retry the payment if the first attempt fails early. Previously, a flag was set too soon, causing retries to omit the original invoice string. If a retry then succeeded, the stored payment record would permanently lack the BOLT11 invoice information. The fix moves the flag so it is only set after `sendonion` succeeds, ensuring the invoice string is included on every retry attempt. This is a data-integrity/user-experience bug, not a security vulnerability.
ea0b8040 · Nov 24, 2025 · 13 filesInformational 15doc: include delnetworkevent in generated documentation, and grpc.
Also added missing "added" annotation. This meant that I had to manually
change contrib/msggen/msggen/patch.py to insert that added notation where it
was missing from .msggen.json.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-None: introduced this release.
This commit is purely a documentation and generated-code update. It exposes an existing RPC command, delnetworkevent, in the gRPC and generated documentation files. There is no change to runtime logic, no bug fix, and no security-relevant behavior.
b4ef5d9a · Nov 24, 2025 · 2 filesInformational 16msggen: fix primitive serialization for special names
Changelog-None
This is a small code-generator bug fix. The tool that automatically creates Rust data structures from message definitions was using the wrong internal name when deciding whether to apply a special Serde rename annotation. As a result, fields whose original JSON name is a Rust reserved word (like 'type') were not being renamed correctly in the generated code. The patch corrects the generator and updates one generated struct so the field serializes as 'type' in JSON again. It is a correctness/serialization fix, not an obvious security vulnerability.
5166fd55 · Nov 24, 2025 · 8 filesInformational 15release candidate PR for 25.12 with Shahana's Makefile update
Changelog-None
This commit is a routine release-candidate housekeeping change. It adds the letter 'v' in front of the version number (from '25.12rc1' to 'v25.12rc1') in a handful of package metadata files and a tool script. There is no change to any payment, network, cryptographic, or node logic, and no security relevance.
147ffecc · Nov 24, 2025 · 1 fileInformational 15make: Remove printing the version from Makefile
Changelog-None: Fixes error from `tools/check-release.sh`
This is a tiny build-script fix. The release-checking script now takes only the last line of the `make version` command when comparing versions, and prints slightly more detailed error messages. It has no security relevance.
10b10eb9 · Nov 21, 2025 · 1 fileInformational 15CHANGELOG.md: fix header format for rc1
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a trivial formatting fix in the project's changelog. It changes the heading style for a release candidate entry from '## v25.12rc1' to '## [25.12rc1]' to match the Keep a Changelog format. There is no code change and no security relevance.
f16b198c · Nov 21, 2025 · 11 filesInformational 15change log for 25.12rc1
Why it was queuedThis commit is a routine release-candidate version bump and changelog update for Core Lightning v25.12rc1. It only changes version strings in packaging files and adds a changelog entry; it does not modify any executable code. The changelog itself lists many unrelated fixes and features from prior pull requests, but this commit is purely administrative release preparation.
d125b3c7 · Nov 21, 2025 · 10 filesInformational 15msggen: add missing methods from v25.12
Changelog-None
This commit is a routine code-generation update for Core Lightning's gRPC and RPC bindings. It adds two newly introduced API methods—'askrene-bias-node' and 'listnetworkevents'—that were already present in the v25.12 JSON-RPC interface but had not yet been exposed through the generated gRPC/proto, Rust, and Python bindings. There is no indication of a security bug or vulnerability fix.
ab733889 · Nov 21, 2025 · 12 filesInformational 15msggen: add missing methods from v25.09
This is a routine code-generation update for Core Lightning's gRPC and RPC bindings. It adds support for three newly introduced JSON-RPC commands—CancelRecurringInvoice, ListChannelMoves, and ListChainMoves—so they are also available through the gRPC and Python interfaces. There is no indication of a security bug or fix in the commit itself.
719fb2ce · Nov 21, 2025 · 2 filesInformational 15plugin: change method name of lsps-jitchannel
The original method name was lsps-lsps2-invoice but I somehow messed it
up and renamed during a rebase.
Changelog-Changed: lsps-jitchannel is now lsps-lsps2-invoice
Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>
This commit simply renames a plugin command from 'lsps-jitchannel' to 'lsps-lsps2-invoice' and updates the matching test calls. It is a routine naming consistency fix with no security relevance.
87324103 · Nov 20, 2025 · 1 fileInformational 15lightningd: print last method we called if we abort processing loop.
We are seeing this in the CI logs, eg tests/test_connection.py::test_reconnect_sender_add1:
lightningd-1 2025-11-17T05:48:00.665Z DEBUG jsonrpc#84: Pausing parsing after 1 requests
followed by:
lightningd-1 2025-11-17T05:48:02.068Z **BROKEN** 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-connectd: wake delay for WIRE_CHANNEL_REESTABLISH: 8512msec
So, what is consuming lightningd for 8 or so seconds?
This message helped diagnose that the issue was dev-memleak: fixed in a different branch.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only adds extra debugging information to a log message. When the lightning daemon pauses processing JSON-RPC commands, it now records the name of the last command it handled and how long it spent. There is no security fix or behavior change.
9961f6bf · Nov 20, 2025 · 2 filesInformational 18xpay: use filtering on rpc_command so we only get called on "pay".
tests/test_coinmoves.py::test_generate_coinmoves (2,000,000, sqlite3):
Time (from start to end of l2 node): 135 seconds **WAS 227**
Worst latency: 12.1 seconds **WAS 62.4**
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change is a performance optimization for the xpay plugin in Core Lightning. Previously, the plugin's hook was called for every RPC command, which slowed things down. Now it only listens for the 'pay' command. There is no direct security vulnerability here, but running a hook on every command can slightly increase attack surface and resource use.
b4f17508 · Nov 20, 2025 · 2 filesInformational 15libplugin: add spamlistcommand
This hammers lightingd with `listinvoices` commands.
$ VALGRIND=0 TEST_DB_PROVIDER=postgres eatmydata uv run pytest -v tests/benchmark.py::test_spam_listcommands
sqlite3:
test_spam_listcommands 2.1193 2.4524 2.2343 0.1341 2.2229 0.1709 1;0 0.4476 5 1
PostgreSQL:
test_spam_listcommands 6.5572 6.8440 6.7067 0.1032 6.6967 0.1063 2;0 0.1491 5 1
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit adds a new internal benchmark/test plugin command called 'spamlistcommand'. It is only used in automated performance tests to repeatedly call the 'listinvoices' RPC and measure speed. It does not change normal wallet behavior, add user-facing features, or fix any bug. There is no security relevance.