Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…
Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…
Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
This commit adds a regression test for Core Lightning's database downgrade path. It ensures that when a user downgrades from an upcoming v26.09 release to an older version (v26.06), the new 'impressions' data added by the askrene routing s…
Database downgrade path for new askrene schema (impressions table)Regression test only; no production code changeNo input validation, cryptography, network, or authorization changes
This is a bug fix in a command-line helper tool used by Core Lightning node operators. The `getsecret` command was accidentally refusing to show the wallet recovery words (mnemonic) when the wallet was protected by a passphrase. After the …
Functional bug in secret-recovery pathError path blocked legitimate mnemonic recoveryNo input validation, memory-safety, or cryptographic change
This commit only adds and updates a regression test in the project's test suite. It checks that the hsmtool utility correctly handles both empty and non-empty passphrases when working with BIP39 mnemonic-based wallet secrets. There is no c…
Regression test added for passphrase handling in hsmtoolNo production code changes observedTest-only change to tests/test_wallet.py
This commit updates the bundled libwally library to version 1.5.6. The practical effect is that calling the JSON-RPC `signpsbt` command on a PSBT that is already signed now succeeds as a harmless no-op, instead of returning an error on Bit…
Dependency update to incorporate upstream bug fixBehavior change from error to no-op on re-signing signed PSBTsTaproot keypath handling change in upstream cryptographic library
This commit is a simple variable rename inside a Bitcoin/Lightning wallet file. The old name 'b32script' suggested all change addresses were bech32 format, but the project now uses a newer address type (p2tr) by default. The developer rena…
This change makes Core Lightning register long-lasting 'watches' for all wallet deposit addresses when the node starts up, so the new bwatch plugin can spot incoming payments from the first block it scans. It also removes a now-redundant p…
Change is part of an experimental chain-watcher (bwatch) featureAdds startup registration of scriptPubKey watches for all derived wallet keysRemoves a redundant unconfirmed-change watch, relying on the new blanket coverage
This is a database refactoring commit in Core Lightning. It makes the wallet write UTXO (unspent transaction output) state to a new table called our_outputs in addition to the legacy outputs table, while reads still use the old table. The …
Database schema migration with dual-write mirror patternNo security claim in commit title or messageNo CVE, advisory, or researcher attribution in commit metadata
This commit adds new wallet bookkeeping code for Core Lightning. It records Bitcoin deposits found by a new chain-watcher ('bwatch') into database tables and handles blockchain reorganizations by demoting transactions back to unconfirmed r…
New database write paths for wallet UTXOs and transactionsReorg revert logic demotes rather than deletes rows to preserve metadataOwner-string constructors added to avoid silent unwatch failures from format mismatches
This commit only adds two new empty database tables (our_outputs and our_txs) to Core Lightning's wallet. It is a preparatory schema change for a future feature; no code reads from or writes to these tables yet, and no existing behavior is…
Schema-only migration with no runtime codeNew tables are not yet populated or queried by any code pathDesign note: sentinel 0 replaces NULL for blockheight/txindex/reserved_til, which could reduce NULL-handling bugs in future code
This commit adds a database migration that copies existing wallet data into new tables used by an upcoming 'bwatch' wallet component. It is a data backfill, not a code fix for an active vulnerability. The main risk is that if the migration…
Database migration touching wallet UTXO and transaction tablesPotential for data inconsistency if mapping logic is wrongON CONFLICT DO NOTHING prevents overwrite but could hide duplicate-key anomalies
This change is a behind-the-scenes bookkeeping patch for Core Lightning's wallet database. The project is moving to a new table (`our_outputs`) for tracking spendable coins, but older versions of the software still read from the old table …
Race-condition guard for foreign-key-backed confirmation_height and spend_height when bwatch is ahead of chaintopologyTemporary mirroring to keep legacy outputs table consistent with new our_outputs tableON CONFLICT DO NOTHING used for legacy insert to avoid duplicate-key failures
This commit fixes a bug where Core Lightning's in-memory record of the highest address index could fall out of step with the database. When a user generated a new on-chain address, the code updated the database directly but left the cached…
Cache/database inconsistency in address index trackingPotential for stale lower index to overwrite newer persisted indexFreshly generated addresses invisible to wallet rescan/listing until restart
This commit is a straightforward performance optimization. It caches two address-index values in memory instead of reading them from the database twice for every transaction output in every scanned block. The change fixes a slowdown during…
This commit adds a developer-only feature that lets programmers override the randomness source used by Core Lightning during testing, via an environment variable. It is explicitly gated behind 'developer mode' and is not intended for produ…
New cryptographic-randomness override mechanism, but explicitly developer-mode onlyEnvironment-variable seeding could reduce entropy if accidentally enabled in productionNo production code changes visible in the diff
This change fixes a subtle bug in Core Lightning's tracing code. When running with a special developer-only deterministic randomness override (CLN_DEV_ENTROPY_SEED), trace IDs were being drawn from the same predictable random stream used f…
Deterministic RNG stream contamination by observability codeTransaction output divergence between instrumented and non-instrumented buildsDeveloper-only entropy override affecting reproducibility of transaction generation
This is a small bug-fix commit in Core Lightning's tracing code. It fixes a situation where enabling tracing accidentally changed the sequence of random numbers used elsewhere in the program, causing test outputs to differ between builds w…
No direct memory safety issueNo input validation bypassNo authentication or authorization change
This commit changes Core Lightning's internal test tooling so that automatically generated RPC documentation examples use predictable randomness and a fixed clock time. It only affects test/example generation code, not the production Light…
This commit only changes an internal test script that automatically generates example RPC commands for documentation. It makes the examples more deterministic by explicitly selecting which coins the test wallet uses, so the generated docum…
We missed this. It's experimental, so no changelog needed.
Spotted-by: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedfuzz-tests: Add a seed corpus for the new testby Chandra Pratap · 8a4ffea7 · May 7, 2026 · 538 filesMessage 78 · AdequateTriage 5Details
Commit message · Chandra Pratap
fuzz-tests: Add a seed corpus for the new test
Add a minimal input set as a seed corpus for the newly introduced test. This leads to discovery of interesting code paths faster.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesecond-pass: unusually broad change
AI review queuedfuzz-tests: Add a seed corpus for the new testby Chandra Pratap · 45ee23f0 · May 7, 2026 · 67 filesMessage 78 · AdequateTriage 5Details
Commit message · Chandra Pratap
fuzz-tests: Add a seed corpus for the new test
Add a minimal input set as a seed corpus for the newly introduced test. This leads to discovery of interesting code paths faster.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesecond-pass: unusually broad change
AI review queuedtests: test funds don't get stuck as reserved after `withdraw` fails due to broadcast rejection (e.g. feerate below mempoolminfee).by enaples · 36f02d32 · May 4, 2026 · 1 fileMessage 72 · AdequateTriage 12Details
Commit message · enaples
tests: test funds don't get stuck as reserved after `withdraw` fails due to broadcast rejection (e.g. feerate below mempoolminfee).
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Explains rationale or failure mode✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedflake8: fixed trailing whitespaceby MSimeZ · db9ea1a4 · May 4, 2026 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · MSimeZ
flake8: fixed trailing whitespace
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedcrates: weekly dependency updateby daywalker90 · 199ecd27 · May 4, 2026 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · daywalker90
crates: weekly dependency update
Changelog-None
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedsql: fix crash for large channelmoves tables.by Rusty Russell · 2ba55cc6 · Apr 9, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · Rusty Russell
sql: fix crash for large channelmoves tables.
I've reworked this: in general we should clear the refresh bit before calling the jsonrpc to do the update. This allows the wait callback to set the bit again if there's more to do, so we won't lose entries.
Now it's clear that we can remove the overzealous assert.
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedmsggen: generate native notification bindings from schemasby Peter Neuroth · 8b6374e1 · Apr 2, 2026 · 22 filesMessage 85 · StrongTriage 0Details
Commit message · Peter Neuroth
msggen: generate native notification bindings from schemas
Expand the native notification list consumed by msggen and regenerate the Rust and gRPC outputs for the documented notification schemas.
This wires the new schema-backed native notifications through cln-rpc, cln-grpc, and the bundled msggen schema metadata. Keep the temporary xpay-prefixed plugin notifications out of generation for now.
coin_movement.extra_tags remains a repeated string in the generated gRPC surface for now because msggen does not currently emit enums nested under repeated array items correctly.
Changelog-Changed: cln-rpc and cln-grpc now expose notification bindings for balance_snapshot, coin_movement, deprecated_oneshot, disconnect, forward_event, invoice_creation, invoice_payment, log, onionmessage_forward_fail, openchannel_peer_sigs, plugin_started, plugin_stopped, sendpay_failure, sendpay_success, shutdown, and warning.
msggen: generate xpay notification bindings
Treat xpay as a built-in plugin for notification generation and include its documented notification schemas in the msggen output.
This extends the generated cln-rpc and cln-grpc notification surfaces with the flat xpay schema files, while exposing the actual notification names `pay_part_start` and `pay_part_end` in generated APIs.
Changelog-Changed: cln-rpc and cln-grpc now expose xpay notification bindings for `pay_part_start` and `pay_part_end`.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
second-pass: unusually broad change
AI review queuedlightningd: don't hand 0 to dualopend as anchor feerate if we cannot estimate fees.by Rusty Russell · 5dec676c · Apr 2, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Rusty Russell
lightningd: don't hand 0 to dualopend as anchor feerate if we cannot estimate fees.
Fixes: https://github.com/ElementsProject/lightning/issues/8847 Reported-by: https://github.com/mdance Changelog-EXPERIMENTAL: fixed crash with dual funding if we cannot estimate fees.
81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedpytest: removed old testby enaples · 2cc1abcf · Apr 2, 2026 · 1 fileMessage 38 · OpaqueTriage 0Details
Commit message · enaples
pytest: removed old test
38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! No meaningful explanatory body
