Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 44 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
abe09ec0 · Oct 22, 2025 · 3 filesInformational 12common/node_id: runtime assertion override, not separate compile time for fuzzing.
This makes it trivial to run the fuzz tests as unit tests in non-fuzzing mode.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a developer-only test refactor. It changes how a sanity check is disabled during fuzz testing so that the same code can run as a normal unit test without needing a special fuzzing compiler flag. There is no change to production behavior: the assertion that a node ID starts with a valid public-key prefix remains active in normal builds.
61ecc408 · Oct 22, 2025 · 1 fileInformational 20common: remove take() leak if new_initial_channel() fails.
This happens in the fuzzer corpora, but that doesn't check for take()
leaks. Our unit tests do:
```
fuzz-initial_channel: outstanding taken(): 0x626c3b3affc8
make: *** [Makefile:823: unittest/tests/fuzz/fuzz-initial_channel] Error 1
```
This doesn't matter in real life, since we exit the subdaemon if this
fails, but it's still a bug.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a small memory leak in a helper function used when setting up a new Lightning channel. The leak only occurs if the function fails partway through, and the project already exits the affected sub-program when that happens, so it is not considered a real-world security issue. The fix moves a few memory allocations to the very beginning of the function so they can be cleaned up correctly if an error occurs later.
365add06 · Oct 22, 2025 · 1 fileInformational 15fuzz/fuzz-hsm_encryption: don't run as unit test under valgrind.
Thanks to Argon hashing, this is intolerably slow under valgrind, and
times out under CI.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit changes a fuzz test so it exits early when run under the Valgrind memory-checking tool. The reason is that the test uses Argon password hashing, which is extremely slow under Valgrind and was causing CI timeouts. It is a test-infrastructure/performance fix, not a security fix.
a6ea4282 · Oct 22, 2025 · 1 fileInformational 15fuzz: fix build undr FreeBSD.
They have a `struct splice` already:
```
2025-10-22T08:33:39.2432203Z tests/fuzz/fuzz-wire-splice.c:6:8: error: redefinition of 'splice'
2025-10-22T08:33:39.2434453Z 6 | struct splice {
2025-10-22T08:33:39.2435520Z | ^
2025-10-22T08:33:39.2436087Z /usr/include/sys/socket.h:683:8: note: previous definition is here
2025-10-22T08:33:39.2436709Z 683 | struct splice {
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a build failure when compiling the fuzz tests on FreeBSD. FreeBSD's system headers already define a 'struct splice', so the project's own test-only structure with the same name clashed. The developer renamed it to 'struct fuzzsplice'. This is a portability/build fix, not a security issue.
f6a4e794 · Oct 22, 2025 · 212 filesInformational 15global: remove unnecessary includes from headers.
Each header should only include the other headers it needs to compile;
`devtools/reduce-includes.sh */*.h` does this. The C files then need
additional includes if they don't compile.
And remove the entirely useless wire/onion_wire.h, which only serves to include wire/onion_wiregen.h.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a large but purely mechanical cleanup of C header file #include directives across the Core Lightning codebase. The goal is to make each header include only what it actually needs, and to add missing includes to the .c source files that now need them. It also deletes a tiny wrapper header that did nothing but include another generated header. There is no change to program logic, data handling, or security behavior.
bc44d3c6 · Oct 22, 2025 · 1 fileInformational 15devtools/reduce-includes.sh: don't remove our own .h from .c file includes.
Even if we would currently include it indirectly, we must include it directly.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a developer helper script so it no longer suggests removing a C source file's own matching header file from its #include list. It is a code-quality/build-hygiene fix, not a security patch.
2114e617 · Oct 22, 2025 · 5 filesLow 48lightningd: fix scb remote_to_self_delay information.
This was changing all the time when I tried to make
autogenerate-rpc-examples.py reproducible. Turns out it was being
corrupted (it does suspicious things with pointers); rather than try
to diagnose it, I simply rewrote the code to create it only when we
need it.
```
Valgrind error file: valgrind-errors.34506
==34506== Uninitialised byte(s) found during client check request
==34506== at 0x241732: memcheck_ (mem.h:247)
==34506== by 0x2417BC: towire (towire.c:17)
==34506== by 0x24185C: towire_u16 (towire.c:28)
==34506== by 0x20C8E4: towire_tlv_scb_tlvs_remote_to_self_delay (scb_wiregen.c:213)
==34506== by 0x240E78: towire_tlv (tlvstream.c:342)
==34506== by 0x20C99F: towire_tlv_scb_tlvs (scb_wiregen.c:234)
==34506== by 0x20C298: towire_modern_scb_chan (scb_wiregen.c:89)
==34506== by 0x1A6CF3: json_add_scb (peer_control.c:2488)
==34506== by 0x1A6E0C: json_staticbackup (peer_control.c:2519)
==34506== by 0x177E3F: command_exec (jsonrpc.c:799)
==34506== by 0x1785AE: rpc_command_hook_final (jsonrpc.c:945)
==34506== by 0x1BEC2D: plugin_hook_call_next (plugin_hook.c:199)
==34506== Address 0x1ffeffe736 is on thread 1's stack
==34506== in frame #2, created by towire_u16 (towire.c:26)
==34506==
{
<insert_a_suppression_name_here>
Memcheck:User
fun:memcheck_
fun:towire
fun:towire_u16
fun:towire_tlv_scb_tlvs_remote_to_self_delay
fun:towire_tlv
fun:towire_tlv_scb_tlvs
fun:towire_modern_scb_chan
fun:json_add_scb
fun:json_staticbackup
fun:command_exec
fun:rpc_command_hook_final
fun:plugin_hook_call_next
}
==34506== Uninitialised byte(s) found during client check request
==34506== at 0x241732: memcheck_ (mem.h:247)
==34506== by 0x2417BC: towire (towire.c:17)
==34506== by 0x240EF0: towire_tlv (tlvstream.c:354)
==34506== by 0x20C99F: towire_tlv_scb_tlvs (scb_wiregen.c:234)
==34506== by 0x20C298: towire_modern_scb_chan (scb_wiregen.c:89)
==34506== by 0x1A6CF3: json_add_scb (peer_control.c:2488)
==34506== by 0x1A6E0C: json_staticbackup (peer_control.c:2519)
==34506== by 0x177E3F: command_exec (jsonrpc.c:799)
==34506== by 0x1785AE: rpc_command_hook_final (jsonrpc.c:945)
==34506== by 0x1BEC2D: plugin_hook_call_next (plugin_hook.c:199)
==34506== by 0x1BEBA8: plugin_hook_callback (plugin_hook.c:186)
==34506== by 0x1B771E: plugin_response_handle (plugin.c:705)
==34506== Address 0x7bd1d08 is 40 bytes inside a block of size 42 alloc'd
==34506== at 0x484DCD3: realloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==34506== by 0x3C8614: tal_resize_ (tal.c:755)
==34506== by 0x2417A2: towire (towire.c:14)
==34506== by 0x24185C: towire_u16 (towire.c:28)
==34506== by 0x20C8E4: towire_tlv_scb_tlvs_remote_to_self_delay (scb_wiregen.c:213)
==34506== by 0x240E78: towire_tlv (tlvstream.c:342)
==34506== by 0x20C99F: towire_tlv_scb_tlvs (scb_wiregen.c:234)
==34506== by 0x20C298: towire_modern_scb_chan (scb_wiregen.c:89)
==34506== by 0x1A6CF3: json_add_scb (peer_control.c:2488)
==34506== by 0x1A6E0C: json_staticbackup (peer_control.c:2519)
==34506== by 0x177E3F: command_exec (jsonrpc.c:799)
==34506== by 0x1785AE: rpc_command_hook_final (jsonrpc.c:945)
==34506==
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a bug in Core Lightning's static channel backup (SCB) feature. Previously, the backup data structure was stored inside the channel object and contained pointers to other channel fields. Those pointers could become stale or point to uninitialized memory, causing the backup to include corrupt or changing data. The fix rebuilds the backup data fresh each time it is requested, using current channel values, which removes the stale-pointer problem. The commit message and Valgrind output show uninitialized bytes being serialized into the backup, but the bug is described as corruption rather than a deliberate security vulnerability.
c821e410 · Oct 22, 2025 · 3 filesInformational 21common: assert that they don't call setup_tmpctx() twice.
Otherwise, leaks will occur. And fix up dualopend and devtool/route,
which do this!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit adds a safety check to prevent a temporary memory context from being created twice, which would leak memory. It also fixes two places in the code that were accidentally doing so. The change is defensive and improves reliability, but it does not appear to be a directly exploitable security vulnerability.
6b509944 · Oct 22, 2025 · 1 fileInformational 15Makefile: helper to print the binary sizes.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit adds a simple Makefile helper that prints the sizes of compiled programs and test binaries. It is a development convenience tool with no effect on the actual Core Lightning software, its network behavior, or user funds.
65d99784 · Oct 22, 2025 · 8 filesInformational 15Makefiles: remove redundant dependencies, and have objects depend on their Makefile.
1. $(JSMN_OBJS) is not set anywhere.
2. You don't need to depend on CCAN_HEADERS, COMMON_HEADERS or JSMN_HEADERS: the top level Makefile has all object depedning on it.
3. Similarly, CCAN_OBJS.
4. Every object file should be rebuilt if its Makefile changes.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a routine cleanup of build files (Makefiles). It removes unnecessary dependency declarations and ensures object files are rebuilt when their Makefile changes. There is no change to the actual Lightning node software or its security behavior.
e0c60cf9 · Oct 22, 2025 · 1 fileInformational 15pytest: more flakes with "lucky sigs" in coinmoves.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only updates test code to handle variable Bitcoin transaction fees caused by signature size differences. It does not change any production code, so it has no security impact on users running Core Lightning.
5bf5f3b3 · Oct 22, 2025 · 1 fileInformational 15pytest: print useful information if we don't get our channelmoves/chainmoves
The equality check will fail, but it will show is what is missing, rather than:
FAILED tests/test_coinmoves.py::test_coinmoves_unilateral_htlc_fulfill - ValueError: Timeout while waiting for <function check_chain_moves.<locals>.<lambda> at 0x7f7800941ab0>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only improves a test helper so that when a test times out waiting for coin-movement records, it prints extra diagnostic information before failing. It does not change any production code, network behavior, or security logic.
ad0c7318 · Oct 22, 2025 · 1 fileInformational 15makefile: fix glob expansion for macOS
when bash expands bitcoin/*.h, it returns the files in lexicographically sorted order by default this is not necessarily the case for macOS so it has be explicitly sorted. I get a fairly uninformative error like this:
make: *** [check-bitcoin-makefile] Error 1
The error is now more informative and does not error on a clean branch on macOS:
BITCOIN_HEADERS missing: bitcoin/signature.h bitcoin/tx_parts.h bitcoin/tx.h bitcoin/varint.h
make: *** [check-bitcoin-makefile] Error 1
This commit fixes a build script check that was too strict on macOS. The Makefile check compares a manually maintained list of Bitcoin header files against files found on disk. On Linux, the shell lists files in sorted order, but macOS does not, causing the check to fail even when nothing is wrong. The patch makes the comparison order-independent and prints clearer error messages. It is a build tooling fix with no security relevance.
c758672a · Oct 21, 2025 · 4 filesInformational 19bookkeeper: honor start and ent times when consolidating onchain fees.
Fixes: https://github.com/ElementsProject/lightning/issues/8318
Reported-by: Shahaha
Changelog-Fixed: Plugins: `bkpr_listincome` now honors `start_time` and `end_time` parameters for onchain fees.
This is a bug fix in the bookkeeper plugin, which is used for accounting and reporting. Previously, when summarizing on-chain transaction fees, the plugin ignored user-supplied start and end times and included all fees instead. The fix makes the fee summary respect those time boundaries. It is a correctness issue for financial reporting, not a security vulnerability that allows theft, unauthorized access, or denial of service.
2c02f6d1 · Oct 21, 2025 · 1 fileInformational 11pytest: test (failing) for bkpr-listincome filtering times on onchain events.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only adds a new test case to the project's test suite. The test is marked as expected to fail (xfail) and checks whether a bookkeeping command correctly filters on-chain income events by timestamp. There is no change to production code, no fix, and no disclosed security issue.
2539b4f1 · Oct 21, 2025 · 4 filesInformational 16bookkeeper: save last timestamp to avoid another query in find_consolidated_fees.
If the fees are not *all* of the fees (as we do in next patch), the
query would be wrong. Plus, as the FIXME suggests, we should just save
it as we're getting the fee_sums, not do a whole new query!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a small internal cleanup in the bookkeeper plugin, which tracks on-chain Bitcoin fees for accounting. It removes a redundant database-style lookup by remembering the latest timestamp while fees are being added up. The commit message says this change is needed so a follow-up patch can correctly report fees that are not the complete set. There is no direct evidence this fixes an exploitable security bug.
9255c255 · Oct 21, 2025 · 3 filesInformational 15gpg: Updating Shahana's expired keys
Also added Madeline's missing keys on security-policy page.
Changelog-None.
This commit updates a team member's expired PGP key and adds another team member's key to the security policy page. It is purely an administrative/key-management documentation change and does not modify any software code, cryptographic algorithms, or runtime behavior.
766db613 · Oct 21, 2025 · 10 filesInformational 15Meta: Adding changelog and version update for 25.09.1
This commit is purely administrative: it bumps version numbers from 25.09 to 25.09.1 and adds a changelog describing fixes already made in other commits. The actual code changes are only version strings and documentation. There is no new executable logic, no security patch, and no vulnerability introduced here.
aa86e137 · Oct 21, 2025 · 1 fileInformational 15doc: Add step for point release checklist to merge updates from `update-versions` and `CHANGELOG.md` into `master`
Changelog-None.
This commit simply adds one extra step to the project's internal release checklist document. It reminds maintainers to merge version and changelog updates back into the main development branch after a point release. There is no code change, no configuration change, and no security relevance.
51e6387c · Oct 20, 2025 · 2 filesInformational 15test: refactor plugin to use parameter not envvar
Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>
This commit is a test-only cleanup. It changes a single test plugin and its corresponding test to pass a setting as a normal plugin option instead of reading it from an environment variable. There is no change to production code, no security fix, and no vulnerability.
652b3c2b · Oct 20, 2025 · 1 fileLow 43plugin: fix feature_set allocation
Using `tal_dup_or_null` does not set the tal context to the included
bytes array. Luckily we already have a function tha deeply duplicates
a `feature_set`: `feature_set_dup`
Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>
This commit fixes a memory-management bug in Core Lightning's plugin handling. The old code used a shallow copy (`tal_dup_or_null`) to duplicate a plugin's feature set, which did not properly copy the underlying byte arrays. The fix switches to `feature_set_dup`, which performs a deep copy. The bug could lead to use-after-free or memory corruption if the original feature set's data was freed while the plugin still held a reference. There is no direct evidence in the commit or supplied references of an exploitable security vulnerability, remote trigger, or disclosed incident.
5932d3b7 · Oct 20, 2025 · 2 filesInformational 12test: check that features get removed when ...
a plugin is disabled during init.
Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>
This commit only adds a new test case to verify an existing behavior: when a Core Lightning plugin disables itself during startup, any feature bits it advertised should be removed from the node's public feature announcements. It does not change production code, so it cannot by itself introduce a security vulnerability or fix one.
ea2f7607 · Oct 20, 2025 · 1 fileInformational 18tools: Read the correct default-key from gpgconf
Workflow error `gpg: using "4129A994AA7E9852" is thrown due to incorrect gpg parsing. Update the awk parsing logic to properly locate and extract the key fingerprint within the gpgconf --list-options output structure, ensuring automated signing uses the correct key.
Changelog-None.
This is a one-line fix in the release build script. It changes how the script tells GnuPG which key to use when signing release checksum files. Previously the key fingerprint was accidentally passed as a filename argument to gpg, which caused a harmless workflow error and could have led to the wrong key being used for signing. The fix moves the fingerprint to the proper --default-key option so signing uses the intended key.
8578d6cd · Oct 20, 2025 · 3 filesInformational 15makefile: enable fuzzing support on macOS
Enable fuzzing support on macOS by configuring the build system to use Homebrew LLVM toolchain and handle macOS-specific linking requirements.
The `make check-fuzz` command was failing on macOS because:
- System clang lacks fuzzer runtime library support
- Linking issues with fuzzer targets
- Test script attempts to execute debug symbol files
This PR adds macOS-specific configuration to:
- Use Homebrew LLVM toolchain for fuzzer support
- Explicitly link fuzzer libraries
- Exclude `.dSYM` directories from test discovery
All 76 fuzzer targets now build and pass on macOS.
This commit is a build-system fix that lets developers run fuzz tests on macOS. It changes compiler/linker paths, adds Homebrew LLVM detection, and skips macOS debug-symbol folders when looking for test programs. There is no change to how the lightning node handles money, network messages, or cryptography, and nothing here looks like a security vulnerability or backdoor.
e522aedc · Oct 20, 2025 · 1 fileModerate 53bookkeeper: only read listchannelmoves 1000 entries at a time.
If we read all of them, we might get 1.6M at once (after initial
migration). Then we submit a few hundred thousand simultaneous
requests to lightningd, and it gets upset, queueing them all on the
xpay command hook and running out of memory.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: plugins: bookkeeper first invocation after migration from prior to 25.09 with very large databases will not crash.
This update fixes a bug in the bookkeeper plugin of Core Lightning. After a large database migration, the plugin could ask for too many records at once, flood the main lightningd process with hundreds of thousands of requests, and cause it to run out of memory and crash. The fix reads records in batches of 1,000 instead of all at once.