Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit updates the PostgreSQL database driver used by Eclair from version 42.7.11 to 42.7.12. It is a routine dependency bump by an automated tool. The commit itself does not say what bugs the new driver fixes, but small point-release…
Dependency version bump of a database driverPoint-release upgrade may include upstream security fixes, but none are named in the commitNo application code changes or direct vulnerability evidence in the diff
This commit updates Eclair's Bitcoin library dependency from version 0.48 to 0.49, which internally uses newer versions of bitcoin-kmp and secp256k1-kmp. The code changes only replace old property accesses (like `.txid`) with new method ca…
Dependency version bump for Bitcoin and secp256k1 cryptographic librariesSource changes are API adaptations (.txid -> .getTxid), not logic changesSecurity-critical validation code is touched (PSBT/transaction integrity checks against malicious Bitcoin Core)
This commit is a routine build-system update. It upgrades several Maven plugin versions, removes the git commit ID from one jar manifest field to avoid a build-time circular dependency, and adds an optional build profile for a fuzz-testing…
This commit closes a cross-site request forgery (CSRF) hole in Eclair's admin API. Before the change, a malicious web page visited by a node operator could silently submit authenticated API requests (for example, to send funds or close Lig…
New origin-check directive rejecting all requests with an Origin headerRemoval of CORS response headers from API responsesCSRF protection described in commit message and release notes
This commit is a routine post-release housekeeping change. It bumps the project version from 0.14.3 to 0.15.0-SNAPSHOT across several build files, re-enables a Maven trusted-checksum feature used for build verification, adds a placeholder …
No security-relevant code changesNo vulnerability indicatorsNo bug fixes or patches
This commit adjusts build packaging settings to make compiled releases more reproducible across different computers. It sets consistent file permissions and line endings for packaged documentation and runtime files. There is no indication …
This is a large security patch for the Eclair Lightning node that fixes multiple ways an attacker could steal funds, burn money to miners, or lock funds forever. The fixes include: preventing force-closes with un-publishable splice transac…
Force-close uses latest publishable commitment to avoid unconfirmable splice commit txsClosing fee bounded by maxClosingFeerate when local node pays feesNew max-funding-feerate configuration caps funding/splice miner fees
This change expands when Eclair will allow password-based authentication to a Tor control port. Previously, only loopback addresses (the same machine) were considered safe enough for password auth. Now, private/site-local and link-local ne…
Relaxation of authentication-method restriction for Tor control portPassword authentication now permitted on site-local and link-local addressesOriginal code explicitly rejected password auth for non-loopback addresses
This commit is a routine post-release housekeeping change. It bumps the project version from 0.14.2 to 0.15.0-SNAPSHOT, re-enables a Maven trusted-checksum feature used for build verification, adds a placeholder release-notes file, and del…
No security-relevant code changes indicating a vulnerabilityBoot.scala startup guard prevents accidental deployment of an unsafe development snapshotMaven trusted checksum verification is re-enabled, improving supply-chain/build integrity
This commit hardens Eclair's handling of the Lightning 'splicing' feature when a peer misbehaves. Splicing lets two nodes resize an open payment channel without closing it on-chain. The patch adds extra checks so that if a peer sends unexp…
Adds commitment-index consistency checks before completing splice/RBF funding attemptsRejects forbidden update messages while remote peer is quiescingRejects commit_sig during quiescence to prevent commitment-index desync
This commit adds a safety net to the Eclair Lightning node to limit how many incoming peer connections can sit unfinished before completing the cryptographic handshake. Previously, an attacker could open many TCP connections and leave them…
Resource-exhaustion mitigation: bounds unauthenticated incoming connections to prevent memory/file-descriptor/CPU exhaustionNew kill reason TooManyPendingConnections added to PeerConnection.KillReasonNew metrics incomingconnections.pending/evicted/rejected for monitoring abuse
This commit fixes three security issues in how Eclair connects to the Tor network and stores sensitive files. First, it changes the default Tor authentication from password to safecookie, and blocks password mode when the Tor control port …
Default authentication changed from password to safecookiePassword authentication rejected for remote Tor control portsTor cookie length validated to be exactly 32 bytes
This commit fixes a bug in the Eclair Lightning node where a peer could send a message containing both a correct standard signature and an incorrect partial signature. The old code would verify the correct signature but then store the inva…
Type-confusion between IndividualSignature and PartialSignatureWithNonce in channel messagesInvalid partial signature could be stored after valid individual signature was verifiedNew signatureFor helper enforces commitment-format-aware signature selection
This change makes the Eclair Lightning node force-close a payment channel if a peer tries to add a payment whose timeout value (cltv_expiry) is 500,000,000 or higher. Such large values are invalid according to the Lightning BOLT 2 specific…
BOLT 2 compliance check added for HTLC cltv_expiry >= 500,000,000Invalid cltv_expiry now triggers local error and channel force-closeOff-by-one fix in locktime threshold interpretation (<= changed to <)
This commit adds a new optional encrypted payload to Lightning payment fulfillment messages. It is a feature implementation, not a fix for an active vulnerability. The code does introduce a safety check: if a peer sends an oversized fulfil…
New cryptographic payload handling added to payment fulfillment pathSize limits and silent truncation applied to failure packets, fulfillment payloads, and attribution dataChannel force-close triggered on oversized peer fulfillment payload
This commit fixes five low-severity security or robustness issues in the Eclair Lightning node. It removes a risky type cast that could crash the node on corrupted channel data, forces encrypted cluster communication to prevent private dat…
Unsafe type cast removed from channel codecCluster mode now requires tls-tcp transportAPI error responses no longer include exception messages
This commit fixes a bug in the Eclair Lightning node where, after a restart, the node could be tricked into keeping the wrong incoming payments alive. An attacker could reuse the same payment identifier (payment_hash) from a legitimate in-…
Fixes a logic bug that could lead to forced channel closuresAttack vector: payment_hash reuse to pin unrelated HTLCsChanges identifier from payment_hash to unique (channel_id, htlc_id)
This commit only updates user documentation. It adds warnings that the Bitcoin node (bitcoind) should run on the same machine as Eclair, and if it runs remotely, operators must use a secure encrypted tunnel. No code was changed, so this pa…
Documentation-only changeNo code, configuration, or cryptographic modificationsDescribes pre-existing deployment risk rather than a new vulnerability
This commit fixes several bugs in Eclair's 'on-the-fly funding' feature, which lets a node open a Lightning channel and pay for it using future payment fees. The bugs could allow a malicious peer to make the node pay twice, lose money on f…
Double-payment vulnerability fixed: paymentAlreadyRelayed now checks commitment transactions in addition to pending local changes, preventing relay of already-cross-signed HTLCs after restart.Loss-of-funds vulnerability fixed: funded channels with unpaid future-HTLC fees are force-closed before upstream HTLCs are failed, avoiding a race where the peer fulfills a cross-signed downstream HTLC after we failed upstream.Upstream settlement gap fixed: preimages received after HTLC expiry are now relayed upstream, preventing the node from paying downstream without being paid upstream.
This commit tightens file and folder permissions for Eclair's sensitive data. It ensures that seed files (which protect the node's identity and Lightning channel funds) and the data directory are readable only by the owner on Linux/macOS s…
Hardening of seed file permissions to owner-only read/writeHardening of datadir and chaindir permissions to owner-onlyMigration path also re-permissions copied seed files
Extract `CommitParams` to individual commitments (#3118)
We introduce a new channel codec version where:
- we extract per-commitment parameters (commitment format and params such as `dust_limit` which we may want to dynamically update in the future) - we clean-up the splice iterations on the `Commitments` structure - we remove the funding transaction from the confirmed local funding status (once confirmed, we don't need it anymore: it is wasting DB space for no good reason, we can get it from the blockchain) - we add a `maxClosingFeerate_opt` to the closing state, to allow limiting the feerate used in RBF attempts for safe transactions - we add the commitment format to interactive-tx parameters - we make channel type feature non permanent
We add a mechanism to prevent the node from starting-up, unless an override is provided. This provides an opportunity to iterate on codecs while knowing that node operators won't be affected if we make changes that are backwards-incompatible. This is meant to be temporary.
93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 35/100
This is a large internal refactoring of Eclair's Lightning channel data structures. It moves commitment-specific settings (such as dust limits and HTLC limits) from the overall channel parameters into each individual commitment, so future splices can change them. It also removes the full confirmed funding transaction from the local database record, adds a cap on closing fee rates for RBF attempts, and introduces a startup-blocking guard when the database serialization format changes. The commit is not described by the vendor as a security fix; it is a forward-looking infrastructure change with some safety mechanisms.