Core Lightning

This commit adds a single step to the project's Mac CI workflow that verifies generated documentation files are up to date. It is a build/test hygiene change with no security relevance.

This commit only updates the project's README file to add company information and a badge for Blockstream. It does not change any program code, configuration defaults, or security behavior.

This commit only edits the project's changelog. It corrects the nicknames of two prior releases (changing Roman numeral III to II and II to I) and updates the pull-request reference numbers for a previously released fix about including root certificates. No program code is changed, so this cannot introduce or fix any security vulnerability by itself.

This commit changes a single line in a test file, switching a test from using the older `pay` RPC command to the newer `xpay` RPC command. It is purely a test/quality change and does not modify any production code, fix a bug, or address a security issue.

This commit fixes a bug in how the xpay plugin reports payment status. Previously, when listing ongoing payments, it only checked the payment hash, which could incorrectly mark unrelated payment attempts as 'pending' instead of 'failed'. Now it also checks the group ID, so each distinct payment attempt is judged correctly. There is no direct security exploit here, but the bug could mislead users or automated tools about whether a payment succeeded or failed.

This commit is a harmless developer tooling improvement. It adds a new --markdown option to a helper script that generates contributor lists for release notes, and updates the release checklist to use it. There is no security relevance.

This commit updates a bundled helper library (ccan) and fixes a small but meaningful networking bug in its event loop. Previously, when a socket reported an error, the code always assumed the generic error 'bad file descriptor' (EBADF). Now it asks the operating system for the specific socket error. This is particularly important on macOS, where a failed outgoing connection can be reported differently than on Linux, and the real reason (for example, 'connection refused') was being lost. The change improves cross-platform correctness and debugging, but it is a bug-fix/correctness improvement rather than a clear-cut security vulnerability.

This commit changes a single line in the build Makefile. It updates the 'update-ccan' recipe so that when the project copies code from the CCAN library, it records the exact Git commit hash instead of a Git tag-based version string. This is a maintenance change because CCAN moved its hosting to GitHub. There is no security-relevant change to the software itself.

This commit fixes a flaky automated test for a Core Lightning plugin called bwatch. The test was sometimes failing because it reorged a block before the plugin had actually recorded it, so the plugin saw the replacement as a normal new block instead of a reorg. The fix simply makes the test wait until the plugin has stored the block before triggering the reorg. There is no change to production code and no security issue.

This commit fixes a startup failure in the cln-currencyrate plugin on systems that do not have operating-system root certificates installed. Previously the plugin would crash with a generic 'builder error' because it had no trusted certificates to verify HTTPS connections to currency-rate sources. The fix bundles a known set of root certificates directly into the plugin and improves the error messages shown when configuration or client setup fails. It is a reliability/usability fix rather than a security vulnerability in the traditional sense, though missing certificate validation could in theory have allowed network attackers to impersonate rate sources on affected systems.

This commit is a routine release bookkeeping change: it bumps version strings and adds a CHANGELOG entry for Core Lightning v26.06.2. The changelog describes the actual fix as a build-time issue in the cln-currencyrate plugin where missing TLS root certificates caused a 'builder error' on minimal operating systems. There is no code change in this commit that alters runtime behavior, cryptographic handling, network protocol, or node security.

This commit only updates two security policy documents so they match each other. It reorders one contact entry, adds four missing team members to the second file, and fixes a small grammar note ('addresses' to 'address'). There are no code changes and no security vulnerability is being fixed.

This commit adds a new automated CI check that verifies two security policy documents stay in sync. It does not change any runtime code, fix a bug, or alter security behavior. It is purely a process improvement for documentation consistency.

This commit adds the 'automake' package to three Ubuntu Dockerfiles used for reproducible builds. It is a build-system maintenance fix: newer Ubuntu versions no longer pull in automake automatically, which caused builds to fail because a tool called aclocal was missing. There is no security vulnerability being fixed here.

This commit fixes a harmless but noisy bug in Core Lightning. On every restart, the node was trying to re-broadcast the funding transaction for channels that were already confirmed long ago. Bitcoin rejected these with a routine 'already known' error, which just cluttered the logs. The fix changes the startup check so re-broadcast only happens for channels that are actually still waiting for their first confirmation.

This commit only adds a new pytest test case that reproduces a minor startup logging bug. Core Lightning was unnecessarily trying to re-broadcast already-confirmed channel funding transactions every time it restarted. Bitcoin rejected the rebroadcast, causing harmless but noisy 'UNUSUAL' log messages. There is no loss of funds, remote attacker capability, or code change to the daemon itself in this commit.

This is a one-line build configuration fix for macOS. The script that checks whether the compiler supports a certain optimization flag was mistakenly passing a 'compile-only' flag during a link test. On macOS, this caused the test to behave incorrectly. The change removes that flag so the test properly attempts to link. There is no runtime security issue here.

This commit fixes a flaky automated test, not a security issue. The test sometimes received an extra timing-related notification when the machine was slow. The change makes the test tolerate that extra notification by tracking which notification it is currently checking instead of assuming exactly one notification has arrived. There is no change to production code or to how the software protects users.

This commit updates Core Lightning's implementation of Lightning protocol (BOLT) rules for reconnecting after a channel disruption and for sending channel announcement signatures. It adds handling for newer 'splicing' scenarios—where an existing channel's funding transaction is changed—so that nodes correctly retransmit messages, detect mismatched funding states, and send announcement signatures for splice transactions. The changes appear to be protocol-compliance fixes rather than fixes for an active security flaw, but incorrect reconnection behavior could theoretically lead to channel confusion or stale state between peers.

This commit is a routine renaming and cleanup of internal Lightning protocol message names and fields to match a newer version of the BOLTs specification. It does not fix a security bug, add a security feature, or change any security-critical behavior. The only functional logic change is a small, clearly described fix to avoid re-sending a 'channel_ready' message during an active splice on reconnection.

This commit fixes a bug in Core Lightning's channel reconnection handshake for v2 (dual-funded) channel opens. Before the fix, the code could not tell whether it had itself sent a 'next_funding' field in its own reconnection message, so it always responded to a peer's mismatched 'next_funding' with a gentler 'tx_abort'. The BOLT specification requires a stronger 'error' and channel failure when both sides sent 'next_funding' but disagree, and only a 'tx_abort' when only the peer sent it. The patch tracks that distinction correctly and adds a regression test that corrupts one side's stored funding transaction ID to force the mismatch.

This commit is a routine post-release housekeeping update. It bumps the project's version strings from the just-released v26.06 to the upcoming v26.09, updates the pull-request template deadlines, shifts the CI downgrade test to use the v26.06 release as the 'old' version, and adds v26.06 to the downgrade tool's known version list. There are no code behavior changes that affect security.

This commit is a code cleanup change. It removes an unused 'import json' statement and adds a second space before inline comments in a Python code generator and its generated output. These changes only affect style (flake8 linting rules F401 and E261) and do not alter program behavior or fix any security issue.

This commit simply removes one email address (Rusty Russell's personal address) from the project's public security contact list, leaving only the Blockstream security address. It is a documentation-only administrative change with no code changes and no security vulnerability.

This commit is a one-line documentation edit to the project's release checklist. It adds the instruction to merge the release-candidate pull request before tagging a release. There is no code change, no security fix, and no vulnerability.