Modular C implementation of the Lightning Network protocol and node stack.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61049 seen37 candidatesCompleteFeb 6 → Jun 6579 seen10 candidatesCompleteJun 6 → Jul 678 seen1 candidatesCompleteJul 6 → Aug 5147 seen16 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 48 minutes ago
This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…
c1551c55by daywalker90+298−2761 fileThis commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…
83f92e4bby Níckolas Goline+90−22 filesThis commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…
273d7f02by w3lld1+3−32 filesThis change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …
c4fe4cbaby Peter Neuroth+59−12 filesThis fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…
34883ff7by cdecker+5−12 filesThis commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…
4681177dby Vincenzo Palazzo+2−32 filesThis commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …
0f3f67a0by Vincenzo Palazzo+3−21 fileThis commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …
ba08356fby cdecker+140−04 filesThis commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…
65bdbc47by cdecker+137−02 filesThis update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…
d67c4936by cdecker+72−227 filesThis commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …
f057c692by cdecker+34−01 fileExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
2c1ab4d0 · Jul 27, 2026 · 2 filesLow 32wallet: route transaction reads/writes through our_txs
Now that the bwatch wallet path records every relevant transaction in
our_txs, point the wallet's transaction readers at that table.
Since our_txs.blockheight is NOT NULL with 0 = unconfirmed, the legacy
NULL handling disappears: wallet_transactions_by_height no longer needs
its "IS NULL vs = ?" query split, and wallet_transaction_height reads
the column unconditionally.
wallet_transaction_add keeps dual-writing the legacy transactions
table: the close path still inserts into channeltxs, whose
transaction_id foreign key points at transactions(id), and
wallet_get_funding_spend joins it. That legacy write can only go away
with channeltxs itself.
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit changes how Core Lightning stores and reads wallet-related transactions. It moves most reads to a new table called our_txs while still keeping the old transactions table updated for compatibility. The main concern is that the code now prevents a confirmed transaction from being downgraded back to unconfirmed, which is good, but the change is part of a larger migration and could introduce subtle bugs if the two tables get out of sync. There is no direct evidence this fixes or introduces a security vulnerability.
ae1a3347 · Jul 27, 2026 · 1 fileLow 31wallet: make datastore helpers self-wrap a wallet transaction
The four wallet_datastore_{get,create,update,remove} helpers used to
require the caller to be inside a wallet transaction; otherwise the
underlying db_prepare_v2 fatals at db/utils.c:103 with "Attempting to
prepare a db_stmt outside of a transaction".
watchman persists its pending bwatch ops through these helpers from
plugin callbacks that run outside any transaction, so wrap one on
demand.
Co-authored-by: Cursor <cursoragent@cursor.com>
This change fixes a crash bug in Core Lightning's wallet datastore helpers. Previously, four datastore functions required the caller to already be inside a database transaction, and would fatally crash if called outside one. The patch makes these helpers automatically start and commit a transaction when needed. The commit message says this specifically fixes crashes in the watchman plugin, which saves pending operations through these helpers from plugin callbacks that run outside any transaction.
bcdea215 · Jul 27, 2026 · 1 fileModerate 54wallet: handle reorgs for our_outputs/our_txs by hand
The legacy tables rely on their blocks(height) ON DELETE SET NULL
foreign keys to mark rows unconfirmed/unspent when a block is reorged
out. our_outputs/our_txs deliberately carry no blocks FK (bwatch does
not maintain a blocks table), so block disconnect and rollback must
demote their blockheight/spendheight fields explicitly.
Demote, never delete: a row also carries state the chain cannot
re-deliver (reserved_til, onchaind close metadata), and this path runs
not just on real reorgs but on every startup, when chaintopology
invalidates its rescan window. Rediscovery re-promotes the row via
wallet_add_our_output / wallet_transaction_add; a tx that never
re-confirms just stays unconfirmed and unspendable.
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit fixes how Core Lightning's wallet records handle blockchain reorganizations (reorgs) for two newer database tables, our_outputs and our_txs. Previously, these tables were not properly updated when blocks were removed or rolled back, meaning the wallet could incorrectly believe funds were confirmed or spent when they no longer were. The fix explicitly resets those records to an unconfirmed state during reorgs and startup rescan windows, matching the behavior of older tables. This prevents internal accounting errors and potential loss or misreporting of funds after a reorg.
5b9ff9ff · Jul 23, 2026 · 1 fileInformational 16wallet: Read the max_index for addresses from the in-memory cache
Why it was queuedThis small change makes the wallet's address-listing command read a cached value from memory instead of querying the database each time. It appears to be a performance or consistency cleanup rather than a security fix. There is no direct evidence in the commit that it repairs a vulnerability.
947ed0f3 · Jul 22, 2026 · 1 fileInformational 15docs: Fixing Ubuntu installation docs
- updated release tag references
- removed protobuf-compiler dependency
- removed rustup default installation, changed it to only for Ubuntu <25.10 (rust <1.85)
- added note about tzdata config halting execution
This commit only updates the project's documentation for installing Core Lightning on Ubuntu. It refreshes supported Ubuntu versions, dependency package lists, release tag examples, and Rust setup instructions. There are no code changes and no security fix or vulnerability introduced.
d304d207 · Jul 20, 2026 · 2 filesInformational 15doc: Fix spliceout description
Changelog-None.
This commit only fixes a typo and an incorrect sentence in documentation files describing the 'spliceout' command. It changes 'move funds into a channel' to 'move funds out of a channel' and adds the word 'to' in a usage sentence. No code behavior is changed, and there is no security impact.
563b21e4 · Jul 19, 2026 · 1 fileInformational 15docs: fixing Fedora installation
- `dnf`: switched from `groupinstall` to `group install` which is supported both by `dnf4`and `dnf5` which is used starting from fedora41
- added `openssl` and `openssl-devel` dependency
- `uv` install added, which the build now requires
- bumped latest version
- use `uv` to tun the `make`
This commit only updates the Fedora installation instructions in the documentation. It changes command syntax, adds required build dependencies (openssl, openssl-devel, uv), bumps the example release tag, and switches the build instructions to use the uv Python package manager. There is no code change and no security issue.
eb42ca93 · Jul 15, 2026 · 2 filesInformational 16pyln-proto: use coincurve 21 for python <=3.13 and add self-compiled wheels for python 3.14
coincurve 20 is broken for all python versions since it now pulls in a transient dependency that turned
a warning into an error:
```
× Failed to build `coincurve==20.0.0`
├─▶ The build backend returned an error
╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 7)
[stderr]
ERROR: Use build.verbose instead of cmake.verbose for scikit-build-core >= 0.10
hint: This usually indicates a problem with the package or the build environment.
help: `coincurve` (v20.0.0) was included because `cln-meta-project` (v0.1.0) depends on `pyln-proto` (v26.6.2) which depends on `coincurve`
```
coincurve 21 does not have this issue but it does have another issue with python 3.14:
```
Resolved 1 package in 289ms
× Failed to build `coincurve==21.0.0`
├─▶ The build backend returned an error
╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 1)
[stderr]
Traceback (most recent call last):
File "<string>", line 11, in <module>
wheel_filename = backend.build_wheel("/home/user/.cache/uv/builds-v0/.tmpfcwWrQ", {}, None)
File "/home/user/.cache/uv/builds-v0/.tmpNmyA8G/lib/python3.14/site-packages/hatchling/build.py", line 58, in build_wheel
return os.path.basename(next(builder.build(directory=wheel_directory, versions=["standard"])))
~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/user/.cache/uv/builds-v0/.tmpNmyA8G/lib/python3.14/site-packages/hatchling/builders/plugin/interface.py", line 149, in build
build_hook.initialize(version, build_data)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
File "/home/user/.cache/uv/sdists-v9/pypi/coincurve/21.0.0/sA4L50tQMHeL37XJdHnME/src/hatch_build.py", line 34, in initialize
raise RuntimeError(message)
RuntimeError: Expected exactly one LICENSE file in cffi distribution, got 0
hint: This usually indicates a problem with the package or the build environment.
```
coincurve for python 3.14 is fixed upstream but there is no release yet, so we use self-compiled wheels just for python 3.14
Changelog-None
This change updates how the project installs a cryptographic helper library called coincurve. The old pinned version was failing to build, so the team switched to a newer official version for most Python releases and, only for Python 3.14, to pre-built wheels hosted by an individual contributor (daywalker90) while waiting for an official fix. The main risk is that Python 3.14 users now trust a third-party package index and compiled binaries instead of the official PyPI release.
f40be192 · Jul 14, 2026 · 1 fileLow 47ecdh_hsmd: ensure HSM fd is blocking on setup
On macOS under load, socketpair fds sent via SCM_RIGHTS can have
O_NONBLOCK set (from the sender's io_new_conn call in hsmd's
pass_client_hsmfd). This causes wire_sync_read to return NULL
with EAGAIN, killing connectd or channeld with "No hsmd ECDH response".
The fix mirrors the "Don't trust subd to set it blocking" pattern
already used in lightningd/subd.c:read_fds(): explicitly call
io_fd_block(hsm_fd, true) in ecdh_hsmd_setup.
Changelog-Fixed: connectd: fix intermittent "No hsmd ECDH response" crash on macOS under load.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit fixes a bug where a special internal communication channel (file descriptor) used by Core Lightning could accidentally be left in non-blocking mode on macOS under heavy load. When that happened, a part of the program expecting a blocking read would get an unexpected 'try again' error and crash with 'No hsmd ECDH response.' The fix explicitly forces the channel to blocking mode when it is set up, matching a safety pattern already used elsewhere in the codebase. It is a reliability fix rather than a security vulnerability in the usual attacker-vs-system sense.
3226d686 · Jul 14, 2026 · 2 filesLow 41lightningd: cancel watching original funding when we switch to the new one via splice.
This happens if the channel is *not* announcable yet. Then we hit the assertion
in funding_depth_cb that the txid is the same as the current funding.txid.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-EXPERIMENTAL: fixed crash when we splice a channel which hasn't been announced yet.
This commit fixes a crash in Core Lightning that can happen when a user splices a channel that hasn't been publicly announced yet. Splicing is an experimental feature that changes a channel's funding transaction. The bug caused the program to hit an internal consistency check (assertion) because it was still monitoring the old funding transaction after switching to the new one. The commit only adds test stub functions and does not show the actual fix code, so we can only infer the intended change from the commit message.
608f6952 · Jul 13, 2026 · 13 filesInformational 18cln-grpc: vendor protoc as a build-dependency
our current version of `grpcio-tools` 1.75.1 bundles `protoc` version:
```
uv run python -m grpc_tools.protoc --version
libprotoc 31.1
```
In CI/Dockerfiles we use 29.4 or whatever the OS provides with the
`protobuf-compiler` package, which for the most part is 21.12.
We actually want to somewhat match these versions but we don't have any
control over OS packages' versions.
We can instead bundle `protoc` as a build dependency for `cln-grpc`.
The current version for that bundles 31.1 as well.
This way the versions of `protoc` are more consistent everywhere.
One downside is that arm 32-bit hosts get no bundled protoc for `cln-grpc`
and have to still install `protobuf-compiler` themselves.
Changelog-None
This change swaps how the project gets its Protocol Buffers compiler (protoc) for one Rust component. Instead of relying on whatever version the operating system or CI happens to install, it bundles a specific protoc version as a build-time dependency. The goal is to make builds more consistent and avoid mismatches between protoc and the Python/Rust protobuf tooling. It is a build-system hygiene patch, not a fix for an active security flaw.
5ae0705f · Jul 8, 2026 · 1 fileInformational 15tests: fix flaky test_simple_close_delay_broadcast mempool race
The test mined a block as soon as 'Broadcasting txid' appeared in l2's
log, but that log fires when CLN calls sendrawtransaction, not when
bitcoind has accepted the tx into its mempool. Under rpcproxy timing the
block could be mined empty, leaving the funding output unspent so
'Resolved FUNDING_TRANSACTION/FUNDING_OUTPUT by MUTUAL_CLOSE' never
logged and the test timed out.
Wait for the tx to enter the mempool before generating the block.
Changelog-None
This commit fixes a flaky automated test in Core Lightning. The test was sometimes failing because it mined a Bitcoin block immediately after seeing a log message that said a transaction was being broadcast. That log appears when Core Lightning submits the transaction, not when Bitcoin actually accepts it into the memory pool. Under timing variations, the block could be mined before the transaction arrived, producing an empty block and causing the test to time out. The fix waits for the transaction to enter the memory pool before mining. This is a test-only change and does not affect production code or user funds.
ec7d544c · Jul 7, 2026 · 2 filesInformational 15tests: lower testpluguv's required python version
uv would use python 3.14 which currently leads to an error because of a build dependency update
```
× Failed to build `coincurve==20.0.0`
├─▶ The build backend returned an error
╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 7)
[stderr]
ERROR: Use build.verbose instead of cmake.verbose for scikit-build-core >= 0.10
hint: This usually indicates a problem with the package or the build environment.
help: `coincurve` (v20.0.0) was included because `cln-meta-project` (v0.1.0) depends on `pyln-proto` (v26.6.2) which depends on `coincurve`
```
Changelog-None
This commit is a test-only build fix. It lowers the minimum Python version required for a small test plugin from 3.13 to 3.10 so that the project's test tooling can install a dependency that currently fails to build on Python 3.14. It does not change Core Lightning's runtime code, network protocol, or wallet handling, and it does not fix or introduce a security vulnerability.
b7491a06 · Jun 22, 2026 · 3 filesInformational 15repro: add automake as explicit dependency
noble builds were failing because of a missing aclocal
usual recommendation is to install automake which apparently no longer
is in the dependency graph for noble
we add it to all ubuntu images in case it gets removed in jammy/resolute as well
Changelog-None
This commit adds the 'automake' package to three Ubuntu Dockerfiles used for reproducible builds. It is a build-system maintenance fix: newer Ubuntu versions no longer pull in automake automatically, which caused builds to fail because a tool called aclocal was missing. There is no security vulnerability being fixed here.
0a8a7afe · Jun 18, 2026 · 12 filesLow 26Revert "Bolt quote updates and improvements"
Reverts commits b0e728572b through aa6ecad90e (11 commits).
This PR was accidentally merged without proper review. The `channeld.c` splice-detection logic (`is_splice_active` + txid comparison) was NACKed by @ddustin as deviating from the spec, the correct approach requires a `funding_tx_index` on the inflight rather than a `txid` comparison.
A clean replacement PR will be opened for discussion once the approach is agreed upon.
Changelog-None
This commit is a wholesale revert of an earlier pull request that was accidentally merged without proper review. It removes new splice-handling logic in the channel daemon, stricter bech32 padding checks, and several BOLT 11/12 quote and validation updates. The revert itself is a defensive cleanup: it restores the older, reviewed code because the maintainers decided the new approach was not spec-compliant. It is not a security patch in the usual sense, but it does undo code that had been rejected as incorrect, reducing the risk of protocol misbehavior.
c7e7a5e4 · Jun 18, 2026 · 2 filesModerate 59getroutes: don't crash on source==destination
```
cln-askrene: plugins/askrene/child/child.c:40: final_hop: Assertion `tal_count(hops) > 0' failed.
cln-askrene: FATAL SIGNAL 6 (version v26.06-19-g46b039d)
lightningd-1 2026-06-15T12:34:26.296Z DEBUG plugin-cln-askrene: notify msg debug: Final answer has 1 flows
0x55ab65429902 send_backtrace
common/daemon.c:38
0x55ab6542998c crashdump
common/daemon.c:83
0x7fbc84a8bdef ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7fbc84ae095c __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x7fbc84a8bcc1 __GI_raise
../sysdeps/posix/raise.c:26
0x7fbc84a744ab __GI_abort
./stdlib/abort.c:77
0x7fbc84a7441f __assert_fail_base
./assert/assert.c:118
0x55ab6541b60c final_hop
plugins/askrene/child/child.c:40
0x55ab6541b70d fmt_route
plugins/askrene/child/child.c:48
0x55ab6541ba5b convert_flows_to_routes
plugins/askrene/child/child.c:135
0x55ab6541c037 run_child
plugins/askrene/child/child.c:265
0x55ab65416caa do_getroutes
plugins/askrene/askrene.c:711
0x55ab65416d28 begin_request
plugins/askrene/askrene.c:887
0x55ab654170a2 json_getroutes
plugins/askrene/askrene.c:968
0x55ab654285ec ld_command_handle
plugins/libplugin.c:2206
0x55ab654287f6 ld_read_json
plugins/libplugin.c:2282
0x55ab65439261 next_plan
ccan/ccan/io/io.c:60
0x55ab65439580 do_plan
ccan/ccan/io/io.c:422
0x55ab65439639 io_ready
ccan/ccan/io/io.c:439
0x55ab6543a5fc io_loop
ccan/ccan/io/poll.c:470
0x55ab65428bc4 plugin_main
plugins/libplugin.c:2481
0x55ab65417491 main
plugins/askrene/askrene.c:1551
0x7fbc84a75ca7 __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
0x7fbc84a75d64 __libc_start_main_impl
../csu/libc-start.c:360
0x55ab65413920 ???
_start+0x20:0
0xffffffffffffffff ???
???:0
```
Changelog-Fixed: askrene-getroutes: don't crash on invalid user input, source==destination
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
This commit fixes a crash in Core Lightning's routing plugin (cln-askrene). When a user called the getroutes command with the same node as both source and destination, the plugin hit an internal assertion and aborted. The fix adds a simple input check that rejects source==destination with a normal RPC error instead of crashing the plugin.
4a0538a1 · Jun 16, 2026 · 1 fileInformational 15Update tests after changing deadline from `blockheight + 12` to `blockheight + 72` blocks.
Added 60 blocks to all tests that relied on this parameter in order to fix them. i.e. 12 -> 72, 13 -> 73, etc...
This commit only updates test numbers to match a previously made code change that extended a timeout/deadline from 12 blocks to 72 blocks. It does not change any production code, so it cannot directly affect real users or introduce a security vulnerability.
549ca307 · Jun 10, 2026 · 1 fileLow 31lightningd: replay pending ops on plugin ready
Both bwatch and watchman must be crash-resistant: a watch_send or an
add_watch/del_watch op may be in flight when lightningd crashes, and
neither side is allowed to lose it. We solve this by persisting every
pending op to the datastore in enqueue_op and dropping it from the
datastore in watchman_ack. On startup load_pending_ops rebuilds the
in-memory queue from the datastore, and watchman_on_plugin_ready
replays it once bwatch reaches INIT_COMPLETE.
watchman_add cancels any prior add for the same owner; watchman_del
cancels any pending add for the same owner before queueing the
delete. This keeps the queue from accumulating stale or
self-cancelling op pairs across restarts.
This commit makes the bitcoin 'watchman' subsystem crash-resistant. Previously, if the lightning node crashed while telling its external plugin to add or remove a watch on a bitcoin address, that instruction could be lost. Now each pending instruction is saved to the database, reloaded on startup, and resent once the plugin is ready again. It also cancels stale paired requests (e.g. a pending 'add' is dropped if a matching 'del' arrives). This is a reliability/robustness improvement rather than a fix for an active exploit.
a202ae63 · Jun 10, 2026 · 1 fileInformational 15lightningd: add send_to_bwatch and watchman_ack
Introduce the outbound RPC path from watchman to the bwatch plugin
plus the ack lifecycle that drops a pending op once bwatch confirms
it.
- struct pending_op carries an op_id of the form "{method}:{owner}"
(e.g. "addscriptpubkeywatch:wallet/p2wpkh/42"); method and owner
are recoverable without a separate field.
- Datastore helpers (make_key, db_save, db_remove) persist pending
ops at ["watchman", "pending", op_id] for crash recovery.
- send_to_bwatch finds the bwatch plugin via find_plugin_for_command
on the method name; if bwatch is not yet INIT_COMPLETE, the send is
silently dropped (the op stays queued and will be replayed when
bwatch comes up). Otherwise it builds a JSON-RPC request with the
owner suffix and the caller-supplied json_params body, registers
bwatch_ack_response as the callback, and sends it.
- watchman_ack searches pending_ops by op_id; on a hit it removes the
datastore entry and drops the in-memory op.
db_save and send_to_bwatch are marked __attribute__((unused)) here
because their callers (enqueue_op, watchman_replay_pending) land in
the next commit; the markers are removed there.
This commit adds internal plumbing for a new 'watchman' component in Core Lightning. It introduces a queue of pending operations, a way to send them to a plugin called 'bwatch', and a way to remove them once acknowledged. The code is not yet wired up to actual callers in this commit (some functions are explicitly marked unused), so it cannot by itself change node behavior or be exploited. It is a normal, incremental infrastructure change.
a98d2e46 · Jun 4, 2026 · 9 filesInformational 15release: prepare v26.06
Why it was queuedThis commit is a routine release version bump from 'v26.06rc2' (release candidate 2) to 'v26.06' (final release). It only changes version strings in packaging files and contains no code logic changes, bug fixes, or security-related modifications.
55617a52 · Jun 1, 2026 · 1 fileInformational 23Describe the change
Why it was queuedThis commit only edits the project's CHANGELOG.md file. It adds a one-line note saying the xpay plugin no longer crashes when handling circular route hints in bolt11 invoices, and adds a link to pull request #9174. The actual code fix is not present in this commit, so we can only judge the issue from the changelog description: a crash bug in a payment plugin triggered by unusual invoice route hints.
703d737d · Jun 1, 2026 · 9 filesLow 45xpay: don't crash on circular routehints.
We earlier fixed the cases of gossipd inserting a same-node channel,
but didn't prevent it for local modifications:
```
cln-askrene: common/gossmap.c:52: nodeidx_htable_add: Assertion `!nodeidx_htable_getmatch_(ht, k, h, v, &i)' failed.
cln-askrene: FATAL SIGNAL 6 (version v26.06rc2-5-gd389c3f-modded)
0x5c50e80dd5cb send_backtrace
common/daemon.c:38
0x5c50e80dd685 crashdump
common/daemon.c:83
0x70a5b1e4532f ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x70a5b1e9eb2c __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x70a5b1e9eb2c __pthread_kill_internal
./nptl/pthread_kill.c:78
0x70a5b1e9eb2c __GI___pthread_kill
./nptl/pthread_kill.c:89
0x70a5b1e4527d __GI_raise
../sysdeps/posix/raise.c:26
0x70a5b1e288fe __GI_abort
./stdlib/abort.c:79
0x70a5b1e2881a __assert_fail_base
./assert/assert.c:96
0x70a5b1e3b516 __assert_fail
./assert/assert.c:105
0x5c50e80dfb44 nodeidx_htable_add
common/gossmap.c:52
0x5c50e80e1066 add_channel
common/gossmap.c:515
0x5c50e80e327c gossmap_apply_localmods
common/gossmap.c:1239
0x5c50e80bed55 do_getroutes
plugins/askrene/askrene.c:620
0x5c50e80bf919 listpeerchannels_done
```
Reported-by: Won Hoi Kim and Ahmad Elmoursi
Changelog-Fixed: Plugins: xpay no longer crashes on circular bolt11 routehints.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit fixes a crash in Core Lightning's xpay plugin. When processing a BOLT11 invoice containing a circular route hint (where the start and end node are the same), the code would create an invalid self-loop channel and trigger a fatal assertion failure, killing the cln-askrene process. The patch rejects such self-loop channels at multiple layers so the payment plugin can skip them gracefully instead of crashing.
071093aa · Jun 1, 2026 · 1 fileInformational 15release: prepare v26.06
Why it was queuedThis commit is a routine release-preparation change. It only updates the CHANGELOG.md file, renaming the release title from '26.06rc2' to '26.06' and adjusting the release date and tag link. No code, configuration, or security-related content was changed.
4fd17d73 · May 22, 2026 · 1 fileInformational 17tests/fuzz/fuzz-open_channel: fix bad local variable access after longjmp
You can't access a local variable from a point before it was initialized and
expect it to have the initialized value. Move the setjmp() call to after
run_ctx is initialized so that the tal_free() call at cleanup will see the
correct address and not crash.
Fixes: https://github.com/ElementsProject/lightning/issues/9131
Changelog-None
This commit fixes a crash bug inside a fuzz test, not in the main Core Lightning software. A fuzz test is an automated testing tool that feeds random data to a program to find crashes. The bug occurred because a safety net (setjmp/longjmp) could jump to cleanup code before a local variable (run_ctx) was initialized, causing the cleanup code to use an invalid memory address and crash. The fix simply moves the safety-net setup to after the variable is initialized. This does not affect real Lightning nodes or their users.
b2fc984c · May 21, 2026 · 7 filesInformational 16schemas: remove obsolete fields in decode
Why it was queuedThis commit removes several outdated or unused fields from the JSON schemas and generated API definitions for the `decode` command in Core Lightning. It is a cleanup change that narrows the API surface by deleting fields that are no longer produced by the implementation. There is no direct evidence in the commit that this fixes an active security vulnerability.