Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
This is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
This commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
Documentation-only change with no executable code modificationsCorrects RPC schema error-code metadata to match actual handler behaviorNo change to input parsing, authorization, cryptography, or network behavior
This commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
use of uninitialized variableundefined behavior (invalid bool load)network-triggered code path
This commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
This commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
Large schema-only change with no accompanying security advisory or CVEOne semantic change to plugin hook response: invoice_payment hook can now reject with only failure_message and no resultMany fields change from optional to required in public RPC/protobuf interfaces
This commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
This commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
Incorrect cryptographic verification logic in release toolingPotential false-positive signature verification with inline-signed .asc substitutionRelease-integrity hardening
This commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
Verification bypass risk in release artifact validationgpg --verify single-argument form can exit 0 without reading the intended manifestDocumentation-only hardening of release process
This commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
Routine dependency refresh with no stated security rationaleUpdates to security-sensitive transitive crates (rustls, hyper, h2, tokio, webpki-roots) but no evidence these versions fix known vulnerabilitiesNo source-code changes or patch-specific fixes visible in the diff
This commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
Stack-overflow via deeply nested JSONRecursive JSON traversal without depth boundDenial-of-service vector in JSON-RPC input parsing
This commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
This change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
No security-relevant signal: change is in test framework code onlyFixes a test reliability issue, not a runtime vulnerabilityNo input sanitization, authentication, cryptography, or network changes
This fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
This commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
Use-after-free / double-take of a tal-allocated string during plugin startupDenial-of-service-like symptom: lightningd aborts before replying to init, node cannot restartFixes publicly reported issue #9433 by endothermicdev
This commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
This commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
Missing input validation on wire-parsed feerate fieldsPeer could induce signing and storage of feerate == 0RBF remote path allowed unbounded upward feerate walks
This commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
Integer overflow in feerate conversion (u32 wrap from 0xFFFFFFFF perkb to 0 perkw)Absurd feerate from external fee source bypassing sanity ceilingDatabase-stored out-of-range feerate causing startup abort/crash loop
This update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
Integer overflow in RBF escalation (u32 * 25 / 24) leading to assertion failureAssertion failure in read-only introspection RPC (listpeerchannels) causing crash-loop at startupDatabase value treated as invariant despite originating from external fee estimator
This commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
Integer overflow in fee-rate calculation (u32 overflow when multiplying by 25/24)Assertion failure leading to daemon crash loop at startupDatabase migration clamps out-of-range stored funding feerates
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Lower-priorityautogenerate-rpc-examples.py: added feature to be able to rewrite the request in Rewriterby ShahanaFarooqui · cf3467a3 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui
autogenerate-rpc-examples.py: added feature to be able to rewrite the request in Rewriter
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit only changes an internal test helper script used to generate documentation examples. It adds the ability to rewrite request parameters in example snippets, similar to the existing ability to rewrite responses. There is no change to the actual Core Lightning node software, network protocol, wallet handling, or any user-facing runtime behavior. It is not a security fix and does not introduce a security issue.
Security candidateautogenerate-rpc-examples.py: pin the full sorted UTXO set for multiwithdraw examplesby ShahanaFarooqui · 6f464e46 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui
autogenerate-rpc-examples.py: pin the full sorted UTXO set for multiwithdraw examples
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
access control
AI analysis · Informational 15/100
This commit only changes an internal test script that automatically generates example RPC commands for documentation. It makes the examples more deterministic by explicitly selecting which coins the test wallet uses, so the generated documentation does not vary randomly between test runs. There is no change to the actual Core Lightning node software that users run, and no security vulnerability is being fixed.
Lower-priorityautogenerate-rpc-examples.py: added more rewrite for other RPCsby ShahanaFarooqui · 2e608edc · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui
autogenerate-rpc-examples.py: added more rewrite for other RPCs
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit only changes a test helper script that automatically rewrites RPC command examples used in documentation. It adds more rules to make generated examples stable across test runs by replacing variable values like network ports, transaction IDs, and timestamps with fixed placeholder values. There is no change to the actual Core Lightning node software or its security behavior.
Lower-priorityautogenerate-rpc-examples.py: added sorting for some list example to stabilise the responseby ShahanaFarooqui · 9a50cc12 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui
autogenerate-rpc-examples.py: added sorting for some list example to stabilise the response
And flake fixes
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit only changes a test helper script that generates documentation examples for RPC commands. It adds sorting and renumbering of example output fields so the generated documentation stays the same across test runs. There is no change to the actual Core Lightning node software, wallet handling, network code, or any user-facing runtime behavior.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 15/100
This commit is a large documentation-only refresh. It regenerates example outputs in the project's JSON API schema files and test data so that all examples use a newer, more realistic test chain setup called 'newchain'. The values shown in the examples (node IDs, transaction IDs, payment hashes, runes, invoices, etc.) are swapped from placeholder/fake-looking strings to ones that look like real Bitcoin Lightning testnet data. There is no code change to the actual lightning node software, no bug fix, and no security patch.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100
This commit simply turns a disabled GitHub Actions CI job back on. It re-enables automatic checks that update examples in the project's documentation schemas and makes the final documentation build depend on that job completing successfully. There is no code change to the lightning node software itself and no security relevance.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100
This commit only improves GitHub Actions CI debugging. It adds extra logging and uploads test artifacts when a CI job fails. There is no change to the Core Lightning software itself, no user-facing behavior change, and no security issue.
Lower-priorityautogenerate-rpc-examples.py: use fixed port numbers.by Rusty Russell · 8475c95f · Jul 14, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell
autogenerate-rpc-examples.py: use fixed port numbers.
Move the elements config writing into an ElementsD.set_port() override. This makes many of our information outputs consistent.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100
This commit changes internal test tooling so that example-generation scripts use fixed TCP port numbers instead of random unused ports. It is a test-infrastructure and documentation-consistency change, not a fix for a security vulnerability in the Core Lightning node software itself.
Lower-prioritytests/autogenerate-rpc-examples.py: always use largest UTXO for fundchannel example.by Rusty Russell · 86aa1c04 · Jul 14, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell
tests/autogenerate-rpc-examples.py: always use largest UTXO for fundchannel example.
Now order has changed, the first one is insufficient; this is more robust.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100
This is a one-line change to a test script that auto-generates example RPC commands for documentation. It sorts a node's available coins by amount and picks the largest one, instead of picking whichever one happened to be listed first. This only affects documentation generation and has no security relevance.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This is a tiny Makefile fix for an internal developer script that repeatedly runs documentation example tests. The change defines a BASE_PORTNUM variable so each test iteration uses a different network port range, preventing port collisions between iterations. There is no security relevance.
common: add randbytes() wrapper to override cryptographic entropy: $CLN_DEV_ENTROPY_SEED
Only in developer mode, ofc.
Notes: 1. We have to move the initialization before the lightningd main trace_start, since that uses pseudorand(). 2. To make the results stable, we need to use per-caller values to randbytes(). Otherwise external timing changes the call order.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
90/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Names security-relevant behavior explicitly
Why it was queued
entropy or randomness
AI analysis · Informational 18/100
This commit adds a developer-only feature that lets programmers override the randomness source used by Core Lightning during testing, via an environment variable. It is explicitly gated behind 'developer mode' and is not intended for production use. The patch itself only updates test build files and adds missing stub functions so unit tests compile with the new wrapper. There is no indication it weakens real network security.
Lower-prioritymake: Pinning PATH in doc scripts so generation always uses the tree's own binariesby ShahanaFarooqui · 4f5ca1e0 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui
make: Pinning PATH in doc scripts so generation always uses the tree's own binaries
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit changes the build system so that documentation examples are generated using the project's own freshly-built command-line tools, rather than whatever tools happen to be installed on the developer's system. It is a build-hygiene and reproducibility fix, not a security patch, and it does not fix any vulnerability in running software.
AI review queuedlightningd: cancel watching original funding when we switch to the new one via splice.by Rusty Russell · 3226d686 · Jul 14, 2026 · 2 filesMessage 73 · AdequateLow 41Details
Commit message · Rusty Russell
lightningd: cancel watching original funding when we switch to the new one via splice.
This happens if the channel is *not* announcable yet. Then we hit the assertion in funding_depth_cb that the txid is the same as the current funding.txid.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Changelog-EXPERIMENTAL: fixed crash when we splice a channel which hasn't been announced yet.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Low 41/100
This commit fixes a crash in Core Lightning that can happen when a user splices a channel that hasn't been publicly announced yet. Splicing is an experimental feature that changes a channel's funding transaction. The bug caused the program to hit an internal consistency check (assertion) because it was still monitoring the old funding transaction after switching to the new one. The commit only adds test stub functions and does not show the actual fix code, so we can only infer the intended change from the commit message.
common: don't consume deterministic randbytes stream for trace ids
Trace/span ids now come from a plain counter when CLN_DEV_ENTROPY_SEED is active, so tracing (which CI's HAVE_USDT=1 build enables by default) no longer shifts the deterministic RNG stream that PSBT serial ids and locktime fuzz are drawn from.
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
entropy or randomnesssigning boundaryfuzzing or regression evidence
AI analysis · Low 37/100
This change fixes a subtle bug in Core Lightning's tracing code. When running with a special developer-only deterministic randomness override (CLN_DEV_ENTROPY_SEED), trace IDs were being drawn from the same predictable random stream used for actual transaction details like PSBT serial IDs and locktime fuzzing. Because tracing may be enabled or disabled depending on build settings, this meant the same test or operation could produce different transaction outputs depending on whether tracing was compiled in. The fix makes trace IDs use a separate simple counter when deterministic mode is active, so tracing no longer shifts the random stream and transaction results stay consistent.
common: don't trigger siphash_seed() init from span hashing either.
Previous commit stopped trace ids consuming the deterministic randbytes stream, but tracing still touched it once: span_key_hash() calls siphash_seed(), whose lazy init draws 16 bytes from the stream. Since randbytes call sites are assigned their offset blocks in first-use order, that single draw shifts every later draw in the process by 1000 when tracing is active (HAVE_USDT builds, as in CI): keysend preimages and invoicerequest payer keys then differ from a build with tracing disabled, showing up as an 11-file doc-examples diff.
Use a cheap multiplicative hash for span keys when the deterministic override is active, so tracing touches the RNG stream zero times.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
entropy or randomness
AI analysis · Informational 19/100
This is a small bug-fix commit in Core Lightning's tracing code. It fixes a situation where enabling tracing accidentally changed the sequence of random numbers used elsewhere in the program, causing test outputs to differ between builds with and without tracing. The change makes tracing use a simple math hash instead of a randomness-seeded hash when deterministic mode is active. There is no direct security vulnerability here; it is a determinism/reproducibility fix.
Lower-priorityautogenerate-rpc-examples.py: more block generation and synchronization.by Rusty Russell · 03b239a4 · Jul 14, 2026 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell
autogenerate-rpc-examples.py: more block generation and synchronization.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100
This change only touches an internal test script that automatically generates example RPC output for documentation. It adds extra block generation and synchronization steps to make the example generator more reliable. There is no change to the actual Core Lightning node software, wallet logic, or network protocol, so it has no security impact on users.
autogenerate-rpc-examples.py: fixed recover examples via `lightning-hsmtool getsecret`
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit updates a test script that automatically generates documentation examples for backup and recovery commands. It changes how the script retrieves a secret value for examples, switching from a developer tool command to a different command and from a raw hex secret to a 12-word mnemonic phrase. There is no indication this affects real user funds, live nodes, or production code paths.
autogenerate-rpc-examples.py: added 17 new RPC to ignore list
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit only updates a test script's list of RPC commands that should be skipped when automatically generating documentation examples. It adds 17 more RPC names to an existing ignore list. There is no change to production code, network behavior, or security-sensitive logic.
Security candidatecommon: seed deterministic RNG from basename of argv0, not full pathby ShahanaFarooqui · 4ca60ba6 · Jul 14, 2026 · 1 fileMessage 95 · StrongInformational 19Details
Commit message · ShahanaFarooqui
common: seed deterministic RNG from basename of argv0, not full path
dev_override_randbytes() hashes argv0 into the CLN_DEV_ENTROPY_SEED stream, so every plugin and subdaemon gets a distinct seed. But lightningd execs them with absolute paths, so the "deterministic" stream silently depended on where the source tree was checked out: canned blocks generated in one directory would not replay in another (funding tx output order and nlocktime fuzz diverge, so txids change). This is why check-doc-examples passed locally but failed in CI.
Hash only the basename: binaries still get distinct seeds, but the stream no longer depends on the checkout path.
95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
entropy or randomnessfuzzing or regression evidence
AI analysis · Informational 19/100
This change fixes a test-flakiness bug in a developer-only random-number override used during testing. It makes the random stream depend only on the program name, not the full file path, so tests produce the same results on different computers. It is not a security vulnerability fix.
Lower-priorityautogenerate-rpc-examples.py: ensure blockheights are consistent.by Rusty Russell · 5f1a0772 · Jul 14, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell
autogenerate-rpc-examples.py: ensure blockheights are consistent.
This makes our transaction generation (nlocktime) consistent, as well as our htlcs for payment.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100
This change only touches a test helper script that auto-generates example RPC output for documentation. It adds calls to keep all test nodes synchronized on the current block height during example generation. There is no change to production code, no user-facing behavior change, and no security relevance.
global: replace randombytes_buf() with randbytes() wrapper.
This allows us to override it for deterministic results.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet pathparser or protocol path
AI analysis · Informational 15/100
This commit only adds a new header include (<common/randbytes.h>) to 24 test files. It does not change any production code, cryptographic operations, or runtime behavior. The change is a test-infrastructure refactor to support deterministic randomness in tests, not a security fix or vulnerability.
autogenerate-rpc-examples: sanitize plugin paths in plugin examples
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
defensive validation
AI analysis · Informational 15/100
This commit changes a test helper script that auto-generates documentation examples for the 'plugin' RPC command. It replaces real build-directory plugin paths with a generic '/usr/local/libexec/plugins/' path so the generated examples look clean and consistent. There is no change to the actual Core Lightning node code, no security fix, and no vulnerability.
Lower-priorityautogenerate-rpc-examples.py: more refinement.by Rusty Russell · 6f52691e · Jul 14, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Rusty Russell
autogenerate-rpc-examples.py: more refinement.
1. Don't mangle bookkeeper events. 2. Use l3, not l1, for listtransactions: it's more stable. 3. Use l2, not l1, for listpeerchannels and listchannels. 3. Use l2, not l2, for listfunds.
(l1 has a lot of variation).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100
This commit only changes a test helper script that generates documentation examples for RPC commands. It switches which simulated Lightning node is used for some example screenshots and stops filtering bookkeeper events. There is no change to the actual Core Lightning software that users run, so it cannot affect real wallets, payments, or network security.
Lower-prioritytests: use bitcoind.conf_file instead of hardcoded bitcoin.conf in RawProxy mocksby ShahanaFarooqui · 5de2c855 · Jul 14, 2026 · 2 filesMessage 83 · StrongInformational 15Details
Commit message · ShahanaFarooqui
tests: use bitcoind.conf_file instead of hardcoded bitcoin.conf in RawProxy mocks
These tests built their RawProxy against a hardcoded bitcoin.conf in the node's datadir. That only worked on liquid-regtest by accident: BitcoinD.__init__ used to write bitcoin.conf even when the node was actually an ElementsD. Now that config writing is deferred to set_port() and ElementsD only writes elements.conf, the mocks found no config and no .cookie, so their RPC calls failed and bcli's getblock timed out, leaving lightningd stuck during restart.
Use bitcoind.conf_file, which points at the config the running daemon actually uses (elements.conf on liquid-regtest, bitcoin.conf on egtest).
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100
This change only updates internal test code to use the correct configuration file path when simulating Bitcoin RPC connections during automated tests. It does not alter the Core Lightning software that users run, and it has no security relevance for real deployments.
AI review queuedcln-grpc: vendor protoc as a build-dependencyby daywalker90 · 608f6952 · Jul 13, 2026 · 13 filesMessage 68 · AdequateInformational 18Details
Commit message · daywalker90
cln-grpc: vendor protoc as a build-dependency
our current version of `grpcio-tools` 1.75.1 bundles `protoc` version:
``` uv run python -m grpc_tools.protoc --version libprotoc 31.1 ```
In CI/Dockerfiles we use 29.4 or whatever the OS provides with the `protobuf-compiler` package, which for the most part is 21.12.
We actually want to somewhat match these versions but we don't have any control over OS packages' versions.
We can instead bundle `protoc` as a build dependency for `cln-grpc`. The current version for that bundles 31.1 as well.
This way the versions of `protoc` are more consistent everywhere.
One downside is that arm 32-bit hosts get no bundled protoc for `cln-grpc` and have to still install `protobuf-compiler` themselves.
Changelog-None
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 18/100
This change swaps how the project gets its Protocol Buffers compiler (protoc) for one Rust component. Instead of relying on whatever version the operating system or CI happens to install, it bundles a specific protoc version as a build-time dependency. The goal is to make builds more consistent and avoid mismatches between protoc and the Python/Rust protobuf tooling. It is a build-system hygiene patch, not a fix for an active security flaw.