Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 53 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
5b3f3270 · Oct 1, 2025 · 1 fileLow 45gossmap: use gossmap_disable_mmap() on corruption.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change makes Core Lightning's gossip map (the data structure tracking network routing announcements) fall back to non-memory-mapped file access when it detects internal inconsistencies. Previously the code just forced the gossip store file to disk with fsync and then crashed if the map still looked wrong. Now it disables memory mapping first and refreshes the view, only crashing if the mismatch persists. This is a robustness improvement that may avoid unnecessary node failures and could prevent or mask a class of crashes/undefined behavior caused by stale mmap views of the gossip store.
75164d2c · Oct 1, 2025 · 3 filesLow 30gossipd: save gossip store writes, try them again (and fsync) if we get a read issue.
This is a last resort, but what else are we supposed to do when we wrote
something and it didn't appear?
In particular, ZFS doesn't just "fix itself":
```
remaining_fd=200001b0c9761dff0000000001009411e26cd56d68aabc285ee1c8ee43d59be6f939b0ce353d80213918680a7438356b9c5ea6bb001a6
bb37a4dea93776f4abc8cd371525b4d1605a74b89d7cb1bfc8865ddf22288c7ea08b9d98b34155b4aed159eb81732957e6bf79b996752bf2a9995aae
ad1d65e7889e826ea0ba42f7746c176fe12f2fe6c04af1a74b4f0a262d20efd57133eb32693c789eb3f09caf4f4c6ecd2f734b3b36e751ffcc2748c5
8feabce4173c4ce6098a2c5397aabf1be5442cb67b5030be11ebd8b9841838dae127fe30000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000002000000a218b9d93000000001005000000000000c060
```
Note the record appended on the end *after all the zeroes*.
Changelog-Changed: gossipd: add gossip_store recovery for filesystems which do not synchronize read and write (e.g. ZFS on Linux), by disabling mmap reads and rewriting the last records.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change is a defensive fix for Core Lightning's gossip daemon, which stores network routing information on disk. On some filesystems (the commit specifically mentions ZFS on Linux), writes to this store can appear incomplete or out of order when later read back, causing the daemon to detect corruption. The patch keeps a short-term copy of recent writes in memory, disables memory-mapped reads when a mismatch is detected, and rewrites the last records with an explicit disk sync. It is a reliability/recovery fix, not a typical security vulnerability patch, and there is no evidence it was triggered by an attacker.
6af7fc64 · Oct 1, 2025 · 1 fileInformational 15configure: remove now-unneeded HAVE_PWRITEV.
gossipd now uses pwrite(), which is more broadly supported.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit removes an old build-system check that tested whether the operating system supports a function called pwritev(). The project no longer uses pwritev() in its code, so the check is unnecessary. This is a routine cleanup with no security relevance.
907f7c66 · Oct 1, 2025 · 10 filesInformational 15unit tests: update all the gossmaps to have the GOSSIP_STORE_COMPLETED_BIT set.
Mostly this meant running them, then running devtools/convert-gossmap and replacing the code.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only updates unit-test data and test helpers so that fake gossip store records carry a 'completed' flag. It does not change any production code, network protocol, or wallet logic. There is no security issue here.
d8db51d8 · Oct 1, 2025 · 2 filesInformational 15devtools: create conversion tool for old gossip stores.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit adds a new developer-only command-line tool called convert-gossmap. It upgrades old Lightning network gossip store files used in testing to a newer format. There is no change to the live node software, no network-facing code, and no indication this fixes or introduces a security issue.
f1a8cfcf · Oct 1, 2025 · 2 filesInformational 15pyln-client: update ancient gossmap in test_gossmap tests.
It was still using private channel announcements, which were removed
in v13.
This commit updates a test fixture and its matching test data in the pyln-client test suite. The old gossip store file used an outdated network message format (private channel announcements) that was removed in Core Lightning v13, so the test was failing. The change replaces the binary fixture with a freshly generated one and updates the expected channel ID and timestamps in the test code. There is no security fix here—this is purely a maintenance update to keep tests passing after a protocol cleanup.
9fb8870f · Oct 1, 2025 · 5 filesLow 44gossip: add COMPLETED bit to mark records which are complete.
This should detect partial writes more robustly, since we make a
separate pwrite() call to update this flag after the record is written.
Previously we were playing a bit loose with synchronization assumptions,
which seemed to work on Linux ext4, but not so well elsewhere.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit hardens how Core Lightning writes its gossip store file. It adds a 'COMPLETED' flag that is set only after a full record has been safely written, so the program can detect and skip partial/corrupted records on restart. The change is defensive: it makes crashes or unclean shutdowns less likely to leave the gossip store in a broken state, especially on filesystems other than Linux ext4. There is no direct evidence in the commit of an exploitable security vulnerability.
7aec8cec · Oct 1, 2025 · 2 filesInformational 15common: remove unused push bit.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit simply removes an unused flag bit and its display in a developer debugging tool. There is no security-relevant change: no code behavior is altered, no vulnerability is fixed, and no new risk is introduced.
74090b0a · Oct 1, 2025 · 3 filesInformational 15pyln-client: update the gossmaps in test data to have the GOSSIP_STORE_COMPLETED_BIT set.
Simply ran them through devtools/convert-gossmap, thought for gossip_store-part2 it
had to be appended to gossip_store-part1, converted, then cut off again.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit only updates test data files used by the Python client library's test suite. The files are compressed binary gossip store snapshots, and the change sets a flag (GOSSIP_STORE_COMPLETED_BIT) so tests match current expectations. There is no change to production code, no user-facing behavior change, and no security issue.
0e4b6ca1 · Oct 1, 2025 · 4 filesLow 44gossip_store: wait for completed bit on reading.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit hardens how Core Lightning reads its own 'gossip store' file so that it skips records that have not been fully written yet. Previously, readers could try to process half-written or incomplete records, which could lead to crashes, incorrect routing data, or corrupted state. The fix adds a 'wait for completed bit' check in C and Python gossip-map readers and in a diagnostic dump tool.
06e3078a · Oct 1, 2025 · 1 fileLow 34gossmap: refresh map even if size hasn't changed.
We might have not read the final entry.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This change fixes a bug in how Core Lightning refreshes its network map (gossmap). Previously, if the gossip store file stayed the same size, the code would skip re-reading it entirely, even though the last entry might have been partially written or updated in place. Now it always re-parses the map contents, which can prevent stale or incomplete routing data from being used.
fe8c3b27 · Oct 1, 2025 · 2 filesInformational 17gossmap: routine gossmap_disable_mmap() to force read() calls.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit adds a way for Core Lightning to deliberately stop using memory-mapped file access for its network gossip data and fall back to ordinary read() calls. The change itself is a routine helper function; it does not fix a crash or stop an attacker on its own. It appears to be infrastructure for a follow-up change, likely to work around a consistency problem between mmap and pwritev() on OpenBSD.
f882b69d · Oct 1, 2025 · 3 filesLow 42gossipd: remove gossmap_fetch_tail.
It only gets called for diagnostics when something goes wrong (and we
were going to exit anyway), and it's only useful with mmap (which we now disable
on error) but it shouldn't crash:
```
**BROKEN** gossipd: Truncated gossmap record @7991501/7991523 (len 0): waiting
**BROKEN** gossipd: FATAL SIGNAL 6 (version v25.09)
**BROKEN** gossipd: backtrace: common/daemon.c:41 (send_backtrace) 0x6506817cc529
**BROKEN** gossipd: backtrace: common/daemon.c:78 (crashdump) 0x6506817cc578
**BROKEN** gossipd: backtrace: ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 ((null)) 0x75e8267a032f
**BROKEN** gossipd: backtrace: ./nptl/pthread_kill.c:44 (__pthread_kill_implementation) 0x75e8267f9b2c
**BROKEN** gossipd: backtrace: ./nptl/pthread_kill.c:78 (__pthread_kill_internal) 0x75e8267f9b2c
**BROKEN** gossipd: backtrace: ./nptl/pthread_kill.c:89 (__GI___pthread_kill) 0x75e8267f9b2c
**BROKEN** gossipd: backtrace: ../sysdeps/posix/raise.c:26 (__GI_raise) 0x75e8267a027d
**BROKEN** gossipd: backtrace: ./stdlib/abort.c:79 (__GI_abort) 0x75e8267838fe
**BROKEN** gossipd: backtrace: ./assert/assert.c:96 (__assert_fail_base) 0x75e82678381a
**BROKEN** gossipd: backtrace: ./assert/assert.c:105 (__assert_fail) 0x75e826796516
**BROKEN** gossipd: backtrace: common/gossmap.c:111 (map_copy) 0x6506817cea77
**BROKEN** gossipd: backtrace: common/gossmap.c:1870 (gossmap_fetch_tail) 0x6506817d1f93
**BROKEN** gossipd: backtrace: gossipd/gossmap_manage.c:1442 (gossmap_manage_get_gossmap) 0x6506817c45fb
**BROKEN** gossipd: backtrace: gossipd/gossmap_manage.c:753 (gossmap_manage_handle_get_txout_reply) 0x6506817c5850
**BROKEN** gossipd: backtrace: gossipd/gossipd.c:574 (recv_req) 0x6506817c172b
```
Reported-by: @grubles
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit removes a rarely-used diagnostic helper called gossmap_fetch_tail that could crash the gossip daemon when it tried to read the tail of a corrupted or truncated gossip map. The crash happened during an internal error path (the daemon was already about to exit), so it is more of a crash-on-failure than an exploitable vulnerability. The fix simply stops calling the helper and reports the remaining file data from the regular file descriptor instead.
89bce951 · Oct 1, 2025 · 3 filesLow 34dualopend: handle ANNOUNCEMENT_SIGNATURES from peer.
This can happen if we haven't transitioned to channeld yet, but logic is simply to hand
it to lightningd, exactly as channeld does.
```
2025-09-30T03:04:57.8951627Z lightningd-1 2025-09-30T02:59:14.150Z DEBUG 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-dualopend-chan#1: peer_out WIRE_WARNING
2025-09-30T03:04:57.8952126Z lightningd-1 2025-09-30T02:59:14.150Z **BROKEN** 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-dualopend-chan#1: Unexpected message WIRE_ANNOUNCEMENT_SIGNATURES
2025-09-30T03:04:57.8952521Z lightningd-1 2025-09-30T02:59:14.150Z INFO 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-dualopend-chan#1: Peer connection lost
2025-09-30T03:04:57.8953124Z lightningd-1 2025-09-30T02:59:14.150Z INFO 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59-chan#1: Peer transient failure in DUALOPEND_AWAITING_LOCKIN: dualopend: Owning subdaemon dualopend died (62208)
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This patch fixes a bug where Core Lightning's dual-funding channel opener (dualopend) would crash with a 'BROKEN' error if a peer sent ANNOUNCEMENT_SIGNATURES messages before the channel had fully transitioned to the normal channel daemon. The fix simply forwards those messages to the main lightningd process, just as the regular channel daemon already does. Without the patch, a peer could cause transient connection failures and daemon restarts during channel setup.
0d976310 · Oct 1, 2025 · 14 filesLow 34connectd: simplify logic, and add a "reconnected" message.
One issue we have in CI is reconnection races: if an incoming
connection arrives while an outgoing one is negotiated, we close the
outgoing one and issue a disconnect, which fails any connect attempts.
By sending a "reconnected" message instead of disconnect/connect we
can avoid disturbing in-progress connection attempts which happens in CI
quite a bit.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit rewrites how Core Lightning handles peer reconnections. Previously, when a new incoming connection arrived while an outgoing one was still being negotiated, the daemon would tear down the old connection and report a full disconnect followed by a new connect. That sequence often caused in-progress connection attempts to fail, especially in automated CI tests. The patch introduces a single 'reconnected' message that replaces the disconnect/connect pair, so the higher-level code sees a smooth handover instead of a failure. It also refactors the cleanup paths for peer objects and subdaemons. The change is described by the author as a reliability improvement for CI races, not as a security fix, and no independent security advisory is supplied.
694626f0 · Oct 1, 2025 · 4 filesLow 49connectd: fix race where last msg can still get lost.
openingd sends an ERROR, and exits. lightningd tells us to
disconnect. We read from lightningd first, and don't read from
openingd.
We need to drain subds when we're told to disconnect.
This patch fixes a timing bug in Core Lightning's connection handler. When a sub-process (like openingd) sends an error message and exits, and the main daemon simultaneously asks connectd to disconnect, connectd could previously read the disconnect order first and never read the final error message from the sub-process. The fix makes connectd first drain any remaining messages from sub-processes before closing the peer connection, so the last message is not lost.
d5677301 · Oct 1, 2025 · 2 filesLow 44ccan: update to get ccan/io shutdown fix.
Changelog-Fixed: Protocol: fix occasional lost sending of final packet (usually warnings or errors).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit updates an internal networking helper library (CCAN) to fix a bug where a Lightning node might not send its final message—often a warning or error—before closing a connection. The fix prevents the node from accidentally trying to write again after it has already initiated a socket shutdown, which could cause the final packet to be dropped. It is a protocol reliability fix rather than a clear-cut security vulnerability, but lost error/warning messages could theoretically hide important protocol state from a peer.
a8566222 · Oct 1, 2025 · 1 fileInformational 4libwally: upgrade to 1.5.1
Closes: https://github.com/ElementsProject/lightning/issues/8427
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit updates an internal dependency called libwally-core from one version to version 1.5.1. The actual code changes are not visible in the supplied materials because only a submodule reference changed. There is no information in the commit message or title saying this fixes a security problem, and no independent references were provided. On its own, a routine dependency upgrade is not evidence of a vulnerability.
7a7a48c3 · Oct 1, 2025 · 16 filesInformational 18chore: Update python dependencies
I got a bit annoyed by all the "your protobuf gencode is too old"
warnings in downstream packages, so I spent a bit of time updating any
stale dependency and now we're back allowing packages up to the latest
release. That should maximize the compatibility, and allow downstream
packages to chose their own versions, as long as they are
compatible (semantic versioning).
This commit is a routine maintenance update for Python package dependencies in Core Lightning's Python tooling. It bumps versions of libraries like protobuf, grpcio, cryptography, pytest, and Flask, raises the minimum Python version from 3.8 to 3.9, and regenerates protobuf Python code. There is no direct evidence in the commit that this fixes a specific security vulnerability. It is best treated as a hygiene update that may indirectly reduce risk by moving to newer, supported dependency versions, but it also widens version ranges which could allow downstream users to pull in untested or vulnerable versions.
7e85f924 · Sep 30, 2025 · 1 fileInformational 15connectd: demote "Peer did not close, forcing close" to UNUSUAL
This message is logged when connectd tries to shut down a peer
connection but the transmit buffer remains full for too long, maybe
because the peer has crashed or has lost connectivity. Logging this
message at the BROKEN level is inappropriate because BROKEN is intended
to flag logic errors that imply incorrect code in CLN. The error in
question here is actually a runtime error, which does not imply
incorrect code (at least on our side), so demote the log message to the
UNUSUAL level. (Even this is still probably too severe, as this message
is logged rather more frequently than "unusual" would suggest.)
Changelog-None
Closes: https://github.com/ElementsProject/lightning/issues/5678
This commit changes only the severity level of a single log message. When Core Lightning tries to shut down a peer connection and the peer's transmit buffer stays full too long, the message 'Peer did not close, forcing close' is now logged as UNUSUAL instead of BROKEN. The change prevents automated CI alerts from treating a routine network/runtime condition as an internal software bug. There is no security fix here.
64541ca8 · Sep 30, 2025 · 1 fileInformational 15pytest: clean up JSON sql test.
1. Establish a channel with l3; we already have one with l2.
2. Don't bother generating 6 more blocks (fundchannel ensures it's mined).
3. Allow htlcs to be empty: Whitslack reported that happens for him
4. Use only_one() to access where we insist there is only one element in the list.
5. Tighten tests to assert the exact contents, not just test some.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Fixes: https://github.com/ElementsProject/lightning/issues/8497
This commit is a cleanup of an existing automated test for the SQL plugin. It changes which test nodes open channels, removes unnecessary block generation, and makes the test assertions more precise. There is no change to production code, no security fix, and no vulnerability being addressed.
5a52c6bd · Sep 30, 2025 · 2 filesInformational 15pyln-testing: catch special CI string so we can have non-BROKEN CI warnings.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is a testing-only change. It adds a new log prefix 'That's weird: ' for unusual but non-fatal real-world events, and updates the test harness to treat those lines similarly to **BROKEN** logs during CI. There is no security-relevant code change and no vulnerability is present or fixed.
f0448efa · Sep 30, 2025 · 1 fileInformational 15pytest: fix flake in tests/test_bookkeeper.py::test_bookkeeping_missed_chans_leases
```
FAILED tests/test_bookkeeper.py::test_bookkeeping_missed_chans_leases - AssertionError: assert [{'tag': 'channel_open', 'credit_msat': 506268000, 'debit_msat': 0}, {'tag': 'lease_fee', 'credit_msat': 0, 'debit_msat': 6268000}, {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': 11000000}, {'tag': 'onchain_fee', 'credit_msat': 1314000, 'debit_msat': 0}] == [{'tag': 'channel_open', 'credit_msat': 506268000, 'debit_msat': 0}, {'tag': 'lease_fee', 'credit_msat': 0, 'debit_msat': 6268000}, {'tag': 'onchain_fee', 'credit_msat': 1314000, 'debit_msat': 0}, {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': 11000000}]
At index 2 diff: {'tag': 'invoice', 'credit_msat': 0, 'debit_msat': 11000000} != {'tag': 'onchain_fee', 'credit_msat': 1314000, 'debit_msat': 0}
Full diff:
[
{
'credit_msat': 506268000,
'debit_msat': 0,
'tag': 'channel_open',
},
{
'credit_msat': 0,
'debit_msat': 6268000,
'tag': 'lease_fee',
},
{
+ 'credit_msat': 0,
+ 'debit_msat': 11000000,
+ 'tag': 'invoice',
+ },
+ {
'credit_msat': 1314000,
'debit_msat': 0,
'tag': 'onchain_fee',
},
- {
- 'credit_msat': 0,
- 'debit_msat': 11000000,
- 'tag': 'invoice',
- },
]
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a flaky test in the bookkeeper accounting module. The test sometimes failed because two events (an invoice payment and an on-chain fee) had timestamps so close together that their order could vary. The fix adds a short delay and waits for the payment to fully settle before checking the accounting records. There is no security issue here.
7fed03b9 · Sep 30, 2025 · 1 fileInformational 18pytest: fix broken message in test_even_sendcustommsg.
We can stop listening on the incoming peer while we are closing, so we don't notice if they close:
```
['lightningd-2 2025-09-03T09:48:19.555Z **BROKEN** 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518-connectd: Peer did not close, forcing close', 'lightningd-2 2025-09-03T09:48:22.918Z **BROKEN** 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518-connectd: Peer did not close, forcing close']
=========================== short test summary info ============================
ERROR tests/test_misc.py::test_even_sendcustommsg - ValueError:
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This is a tiny fix inside Core Lightning's connection handling code. It makes the daemon wake up its incoming-message listener when a peer connection is being drained and shut down. Without the wake-up, the test suite could hit a race where the daemon did not notice the peer had closed, causing a harmless but noisy 'BROKEN' log and a test failure. There is no indication this is an exploitable security bug; it is a test-flake / cleanup correctness fix.
3c3788a2 · Sep 30, 2025 · 2 filesInformational 15pytest: fix test_xpay_fake_channeld flake
Also, resulting log was huge, so suppress log level (will probably speed test)
```
2025-09-02T06:01:39.4881086Z > l1.rpc.plugin_start(os.path.join(os.getcwd(), 'plugins/cln-askrene'))
2025-09-02T06:01:39.4881090Z
2025-09-02T06:01:39.4881174Z tests/test_xpay.py:279:
...
2025-09-02T06:01:39.4883193Z > self.sock.connect(str(self.path))
2025-09-02T06:01:39.4883340Z E ConnectionRefusedError: [Errno 111] Connection refused
...
2025-09-02T06:01:41.7767610Z lightningd-1 2025-09-02T06:01:27.235Z **BROKEN** plugin-cln-xpay: askrene-age failed with {"code":-4, "message":"Plugin terminated before replying to RPC call."}
2025-09-02T06:01:41.7768127Z lightningd-1 2025-09-02T06:01:27.305Z INFO plugin-cln-xpay: Killing plugin: exited during normal operation
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a flaky automated test. It adds a developer-only switch to stop the xpay plugin from periodically calling another plugin (cln-askrene) during the test, because that background call was failing when the test deliberately replaced cln-askrene with a fake version. There is no security vulnerability here; it is purely a test reliability and log-noise reduction change.