CommitWatch RSS
LL
← All projectsLightning Labs

LND

Go implementation of a complete Lightning Network node.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1373 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

141security candidates192second-pass queue1283AI analyses
65commits · 30 days
160commits · 60 days
586commits · 180 days
1224commits · 365 days
Backfill bands
Aug 5 → Feb 6405 seen5 candidatesComplete
Feb 6 → Jun 6665 seen28 candidatesComplete
Jun 6 → Jul 689 seen4 candidatesComplete
Jul 6 → Aug 569 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
314Strong · 80–100
642Adequate · 60–79
386Thin · 40–59
31Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Olaoluwa Osuntokun20942204474
Elle Mouton26832268167
ziggie43516412164
Yong26513172
LNBiG111173
Jared Tobin909171
bitromortac531051069
yyforyongyu83861068
Erick Cestari26726070
Andras Banki-Horvath11311072
Gijs van Dam33230073
ziggieXXX1925071
Analysis record

Published AI watches

Last scanned 0 minutes ago

Moderate 56 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11223 from gijswijs/legacy-dust-retribution-fix

This update fixes a bug in how LND handles old-style punishment transactions when a channel partner tries to cheat. Previously, tiny (dust) HTLCs were left as blank placeholder entries in the punishment data, which could cause the node to …

nil-pointer dereference risk in breach retribution pathlegacy revocation log handling inconsistency with modern formatdefensive hardening added for trimmed/dust HTLCs
500ca51fby ziggieXXX+168−146 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11190 from Roasbeef/zpay32-reject-duplicate-payment-hashes

This change tightens how LND reads Lightning invoices (BOLT 11). Previously, if an invoice contained more than one payment hash field, LND would silently keep the first one and ignore the rest. Now it rejects the invoice entirely. The rele…

Behavior change from 'use first duplicate field' to 'reject duplicate fields'New error type ErrDuplicatePaymentHash returned on duplicate payment hash fieldsMalformed/unsupported-length duplicate payment hash now treated as duplicate and rejected
86306f89by Yong+147−106 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 98 · Strong
LL Lightning LabsLND BitcoinLightning Network

zpay32: reject duplicate payment hash fields

This change tightens how LND reads Lightning invoices. Previously, if an invoice contained more than one payment hash field, LND would silently keep the first valid one and ignore the rest. Now it rejects such invoices outright. This preve…

Behavioral change from silent first-field acceptance to explicit rejection of duplicate payment hash fieldsPrevents invoice parsing from depending on field ordering when multiple payment hashes are presentCovers malformed first field + valid second field, closing a potential bypass
e2f27063by Olaoluwa Osuntokun+147−106 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 53 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11132 from yyforyongyu/task-11129-pong

This change fixes how LND answers network 'ping' messages from other Lightning nodes. Previously, LND would sometimes silently ignore valid pings to limit reply traffic, which violates the Lightning protocol (BOLT 1) and could make a peer …

Protocol compliance fix: BOLT 1 requires a Pong for every valid PingRemoved silent suppression of Pong replies that could cause peer timeout/misbehaviorUnified rate limiting now accounts for amplification bandwidth, not just ping count
d3d1f1d0by Olaoluwa Osuntokun+274−1715 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11198 from gijswijs/amp-setlocal-reconstruction-fix

This change fixes a bug in LND's handling of AMP (Atomic Multi-Path) payments. Previously, if one partial payment set failed to reconstruct its secret preimage, the entire invoice was canceled, including unrelated partial payment sets from…

Denial-of-service against reusable static AMP invoices by causing unrelated accepted HTLC sets to be canceledIncorrect invoice state transition from set-local failure to global invoice cancellationAvailability impact on multi-payer AMP invoice scenarios
88959aecby Olaoluwa Osuntokun+155−44 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11200 from ziggie1984/build-go-1.27.1

This commit updates the Go programming language version used to build LND from 1.25.13/1.26.6 to 1.26.8 (language version) and 1.27.1 (toolchain). It also regenerates many automatically generated RPC files and adjusts linter settings. The …

Go version bump may indirectly address unlisted runtime/standard-library security fixesLarge regenerated protobuf files suggest dependency/toolchain refresh rather than logic changeLinter configuration expanded to suppress new checks, consistent with a toolchain upgrade
ef4820e5by Olaoluwa Osuntokun+4932−412670 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 92 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: adopt focused golangci-lint v2.13 checks

This commit is a routine build-maintenance change. It updates the project's Go linter configuration to a newer version and fixes the resulting style warnings: a WebSocket header spelling and several documentation comments that didn't start…

bada7ea3by ziggie+27−1911 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnrpc: regenerate protos with Go 1.27

This commit is a housekeeping change that regenerates automatically generated RPC binding files using a newer Go compiler version. The only differences are in code comments (doc-comment formatting), not in actual program logic or API behav…

dd523108by ziggie+4501−369826 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 100 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: fix Go 1.27 compatibility

This commit is a routine build-and-test maintenance patch to make the LND codebase compile and pass tests with the upcoming Go 1.27 release. It upgrades the project's custom linter tool, refreshes many indirect tool dependencies, adjusts o…

No production code changesNo vulnerability fix or CVE reference presentDependency-only refresh in tools module (development tooling)
6b54a387by ziggie+365−3706 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: bump Go language and toolchain versions

This commit is a routine maintenance update that changes which version of the Go programming language is used to build the lnd project. It does not change any application logic, fix a bug, or address a security vulnerability. The project i…

b1f9ca66by ziggie+39−3930 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

invoices: cancel only the failing AMP set on reconstruction failure

This commit fixes a bug in LND's invoice handling for reusable AMP (Atomic Multi-Path) invoices. Previously, if one payment set failed to reconstruct its preimage, the entire invoice was canceled, even though other valid payment sets on th…

Denial-of-service-like availability impact: a malicious or buggy payer could cause a whole reusable AMP invoice to be canceled, blocking legitimate concurrent payersSet-local failure incorrectly escalated to invoice-global cancellationRegression test added for concurrent-set survival after reconstruction failure
d74ab6faby Gijs van Dam+141−42 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11061 from bitromortac/2604-bolt12-1f

This commit adds the missing cryptographic signature layer for BOLT 12 offers in LND. It builds a Merkle tree from the message fields, signs that tree with a BIP-340 Schnorr signature, and now rejects invoice requests and invoices whose si…

Adds BIP-340 Schnorr signature verification for BOLT 12 invoice_request and invoice messagesMerkle tree commits to canonical re-encoded TLV records; non-minimal feature/amount encodings now rejected to preserve byte-exactnessSignature TLV type 240 and reserved range 240-1000 excluded from the signed Merkle root
1049d301by Yong+2076−7815 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11125 from bhandras/codex/reorg-aware-output-lock-20260825

This commit adds a new optional wallet feature to LND that lets users lock UTXOs until the transaction spending them reaches a chosen confirmation depth, instead of relying on a wall-clock timeout. It is a feature addition with safety chec…

New RPC fields release_after_spend_confs and confirmed_spend_height added to LeaseOutput and FundPsbtCustom lock ID enforced as required for confirmation-controlled FundPsbt leases; all-zero and reserved internal IDs rejectedCapability check (ResolveOutputLeaser) prevents silent downgrade to time-only lease when confirmation control is requested
80dde144by Yong+1293−10021 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10812 from ziggie1984/chanstate-kv-store-move

This commit is a large internal code reorganization for the LND Lightning node. It moves channel state storage logic from the `channeldb` package into a new `chanstate` package, while keeping the same database keys, serialization formats, …

Large refactoring with no change to cryptographic or consensus-critical logicCodec serialization moved verbatim to new package; wire format unchangedDatabase bucket keys and TLV record types preserved
62b0a073by Olaoluwa Osuntokun+3923−310924 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10804 from GeorgeTsagk/close-immediately-itest-lnd-7c38

This change fixes a data-handling bug in LND's channel-opening code. When opening a Lightning channel using an optional 'auxiliary funding controller' (used for custom channel types such as Taproot Assets), the funding manager was previous…

Data-correctness fix in funding handshake: negotiated channel configs now exposed to auxiliary funding controllerAuxiliary funding controller receives incomplete channel state before patch, complete state after patchNo explicit security claim, CVE, or advisory referenced in commit or supplied materials
1e127653by Olaoluwa Osuntokun+291−254 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: verify invoice_request and invoice signatures on read

This change makes LND's BOLT 12 invoice and invoice-request reader actually check that the digital signature is valid, instead of only checking that a signature field exists. Before, an attacker could craft or modify a BOLT 12 message and …

Missing cryptographic verification on parsed BOLT 12 messages replaced with BIP-340 Schnorr signature verificationReader accepted any 64-byte placeholder signature before the patchNew negative tests verify rejection of wrong-signer and tampered Merkle-root fields
aa8bd19fby bitromortac+272−723 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

itest: cover confirmation-controlled leases

This commit only adds a new integration test for an existing feature called confirmation-controlled leases. It does not change production code, so it cannot introduce a security vulnerability or fix one directly. The test exercises how lon…

a1ab4e92by Andras Banki-Horvath+152−02 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 68 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11122 from gijswijs/websocket-proxy-hardening

This update fixes two security-related bugs in LND's REST WebSocket proxy. First, a specially crafted WebSocket protocol header could crash the proxy (a panic). Second, the proxy previously had no limit on how large an incoming WebSocket m…

panic fix in request header parsingunbounded incoming WebSocket message read now cappedincorrect header value assignment possible before fix
c662f853by Yong+227−104 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 85 · Strong
LL Lightning LabsLND BitcoinLightning Network

docs: add v0.21.3 release notes for ws proxy fixes

This commit adds release notes for two fixes in LND's REST WebSocket proxy: one that could crash the proxy with a malformed header, and another that limits how large incoming WebSocket messages can be. The actual code changes happened in a…

Denial-of-service vector: malformed Sec-Websocket-Protocol header could panic the REST WebSocket proxyInput validation improvement: header now parsed as comma-separated sub-protocol listResource-exhaustion mitigation: incoming WebSocket message size now bounded by MaxWsMsgSize
d3e02876by Gijs van Dam+15−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 85 · Strong
LL Lightning LabsLND BitcoinLightning Network

docs: add v0.20.4 release notes for ws proxy fixes

This commit adds release notes for two fixes in LND's REST WebSocket proxy. One fix prevents a server crash (panic) triggered by a malformed WebSocket protocol header. The other fix limits how large incoming WebSocket messages can be, reje…

Denial-of-service vector: malformed Sec-Websocket-Protocol header caused a panic in the REST WebSocket proxyInput validation improvement: WebSocket sub-protocol header now parsed as a comma-separated listResource exhaustion mitigation: incoming WebSocket message size now bounded by MaxWsMsgSize with early rejection
307c1ac1by Gijs van Dam+15−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritydocs: move graph migration fix note to v0.21.4by ziggie · d29a3224 · Sep 7, 2026 · 2 filesMessage 57 · ThinTriage 0Details
Commit message · ziggie

docs: move graph migration fix note to v0.21.4

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritydocs: note legacy graph feature migration fixby ziggie · 1e947458 · Sep 7, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · ziggie

docs: note legacy graph feature migration fix

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritygraph/db: fix legacy feature decoding in SQL migrationby ziggie · 7e0b32df · Sep 7, 2026 · 2 filesMessage 100 · StrongTriage 5Details
Commit message · ziggie

graph/db: fix legacy feature decoding in SQL migration

Apply the existing graph reader compatibility helper to the frozen
migration reader, which missed the fix introduced in #10529. Empty
legacy feature payloads otherwise fail with EOF when the decoder tries
to read a two-byte length prefix.

Add a migration regression test using mixed legacy and length-prefixed
channel records. Capture expected state before replacing the feature
payloads and verify that channel features and both policies survive.

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidence
Lower-prioritydocs: clarify invoice processing errorsby ziggie · 0e6f2fbd · Sep 4, 2026 · 2 filesMessage 80 · StrongTriage 0Details
Commit message · ziggie

docs: clarify invoice processing errors

Document that lookup errors remain retryable, interceptor errors fail
new HTLCs individually, and replayed HTLCs retain their recorded
outcomes.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
Lower-priorityitest: assert malformed payment keeps channelby ziggie · 80b930de · Sep 4, 2026 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · ziggie

itest: assert malformed payment keeps channel

Assert that malformed invoice payments fail only the HTLC and leave
the channel active on both peers.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritymulti: preserve invoice HTLC replay outcomesby ziggie · 044d260b · Sep 4, 2026 · 12 filesMessage 78 · AdequateTriage 5Details
Commit message · ziggie

multi: preserve invoice HTLC replay outcomes

Keep unexpected invoice lookup errors retryable instead of
turning them into terminal HTLC failures. Resolve recorded HTLCs
before invoking the interceptor, while retaining the atomic replay
check during the invoice update.

Only turn interceptor errors for confirmed-new HTLCs into individual
failures. Update failure reporting and multi-backend regression tests
to cover the final behavior.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI review queuedMerge pull request #11125 from bhandras/codex/reorg-aware-output-lock-20260825by Yong · 80dde144 · Sep 4, 2026 · 21 filesMessage 73 · AdequateLow 35Details
Commit message · Yong

Merge pull request #11125 from bhandras/codex/reorg-aware-output-lock-20260825

walletrpc: retain input leases through spend confirmation

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Low 35/100

This commit adds a new optional wallet feature to LND that lets users lock UTXOs until the transaction spending them reaches a chosen confirmation depth, instead of relying on a wall-clock timeout. It is a feature addition with safety checks (required custom lock ID, capability checks, rollback on partial failure) and is not a fix for a known exploit. The main risk is that a bug in the new reorg-aware lease logic could keep coins locked longer than intended or, in a worst case, allow double-spending of locked UTXOs, but the diff itself does not show such a vulnerability.

Lower-priorityMerge pull request #11162 from ziggie1984/add-release-notes-0.20.5-and-0.21.4by Yong · d66a7c13 · Sep 3, 2026 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · Yong

Merge pull request #11162 from ziggie1984/add-release-notes-0.20.5-and-0.21.4

docs: add empty release notes for v0.20.5 and v0.21.4

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountmerge-commit duplicate discount
Lower-prioritydocs: add empty release notes for v0.21.4by ziggie · 69eaa2e6 · Sep 3, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · ziggie

docs: add empty release notes for v0.21.4

Scaffold release-notes-0.21.4.md with the standard section structure so
contributors have a place to add entries for the next v0.21 patch
release. The pending 0.22 deprecation warnings are carried over from
release-notes-0.21.3.md, matching the rest of the v0.21 series.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
Lower-prioritydocs: add empty release notes for v0.20.5by ziggie · 2ce5089b · Sep 3, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · ziggie

docs: add empty release notes for v0.20.5

Scaffold release-notes-0.20.5.md with the standard section structure so
contributors have a place to add entries for the next v0.20 patch
release.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
Lower-priorityhtlcswitch: retain held replay expiry decisionsby Olaoluwa Osuntokun · a8662b58 · Sep 2, 2026 · 3 filesMessage 78 · AdequateTriage 5Details
Commit message · Olaoluwa Osuntokun

htlcswitch: retain held replay expiry decisions

In this commit, we recognize held duplicates before applying the current-height
expiry check.

The original held forward keeps its resolution handle and auto-fail deadline.
This prevents a near-expiry replay from failing upstream while the interceptor
can still resume the outgoing HTLC. The regression test verifies that the
original handle opens and settles exactly one circuit.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI review queuedMerge pull request #10812 from ziggie1984/chanstate-kv-store-moveby Olaoluwa Osuntokun · 62b0a073 · Sep 2, 2026 · 24 filesMessage 58 · ThinInformational 19Details
Commit message · Olaoluwa Osuntokun

Merge pull request #10812 from ziggie1984/chanstate-kv-store-move

chanstate: move channel state kv store

58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
merge-commit duplicate discountsecond-pass: unusually broad change
AI analysis · Informational 19/100

This commit is a large internal code reorganization for the LND Lightning node. It moves channel state storage logic from the `channeldb` package into a new `chanstate` package, while keeping the same database keys, serialization formats, and public behavior. There is no new feature or obvious security fix in the visible diff; it is primarily a refactoring to separate concerns.

AI review queuedMerge pull request #10804 from GeorgeTsagk/close-immediately-itest-lnd-7c38by Olaoluwa Osuntokun · 1e127653 · Sep 2, 2026 · 4 filesMessage 73 · AdequateLow 25Details
Commit message · Olaoluwa Osuntokun

Merge pull request #10804 from GeorgeTsagk/close-immediately-itest-lnd-7c38

lnwallet: expose negotiated configs in aux chan state

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Low 25/100

This change fixes a data-handling bug in LND's channel-opening code. When opening a Lightning channel using an optional 'auxiliary funding controller' (used for custom channel types such as Taproot Assets), the funding manager was previously passing an incomplete channel state object that lacked the negotiated local and remote channel settings. The patch adds a new method that builds a complete view including both sides' agreed configuration, and updates the funding manager to use it. There is no direct evidence this is exploitable as a security vulnerability; it appears to be a correctness fix that could prevent misbehavior or failures in custom channel flows.

Security candidatebolt12: verify invoice_request and invoice signatures on readby bitromortac · aa8bd19f · Sep 2, 2026 · 3 filesMessage 88 · StrongModerate 60Details
Commit message · bitromortac

bolt12: verify invoice_request and invoice signatures on read

ValidateInvoiceRequestRead and ValidateInvoiceRead now run
VerifyInvoiceRequest and VerifyInvoice as their final step, so a
decoded message whose BIP-340 signature does not verify against
invreq_payer_id or invoice_node_id is rejected instead of only
checked for presence. This satisfies the reader-side MUSTs of the
BOLT 12 invoice_request and invoice requirements, and the docstrings
now state the contract instead of deferring it to callers.

The invoice_request wiring is pinned by the spec's signed vector; no
signed invoice vector exists, so the invoice side is pinned by
round-trip tests. Reader-validation fixtures now sign with Bob's
key, and the happy-path invoice_request test reuses the shared
validInvoiceRequest fixture.

88/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarydefensive validation
AI analysis · Moderate 60/100

This change makes LND's BOLT 12 invoice and invoice-request reader actually check that the digital signature is valid, instead of only checking that a signature field exists. Before, an attacker could craft or modify a BOLT 12 message and include any 64-byte placeholder as a 'signature'; the reader would accept it as long as the field was present. Now the reader verifies the signature cryptographically against the claimed sender public key, rejecting forgeries and tampered messages. This is a security-hardening fix that closes a real authentication gap.

AI review queueditest: cover confirmation-controlled leasesby Andras Banki-Horvath · a1ab4e92 · Sep 2, 2026 · 2 filesMessage 78 · AdequateInformational 15Details
Commit message · Andras Banki-Horvath

itest: cover confirmation-controlled leases

Exercise the WalletKit and btcwallet lease lifecycle with a real node
and miner. Let the wall-clock deadline pass before broadcasting. Confirm
the spend, disconnect it, restart the node, and reconfirm it.

Assert persisted spend progress at each transition and verify that the
lease remains active until the requested confirmation depth is reached.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a new integration test for an existing feature called confirmation-controlled leases. It does not change production code, so it cannot introduce a security vulnerability or fix one directly. The test exercises how long a wallet lease stays locked under various conditions (time passing, blockchain reorganization, node restart, and multiple confirmations).

Lower-priorityMerge pull request #11064 from NishantBansal2003/explicit-chan-typeby Yong · 1f324ebd · Aug 31, 2026 · 10 filesMessage 73 · AdequateTriage 0Details
Commit message · Yong

Merge pull request #11064 from NishantBansal2003/explicit-chan-type

funding: require explicit channel type in all negotiations

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
AI review queuedMerge pull request #11122 from gijswijs/websocket-proxy-hardeningby Yong · c662f853 · Aug 29, 2026 · 4 filesMessage 73 · AdequateModerate 68Details
Commit message · Yong

Merge pull request #11122 from gijswijs/websocket-proxy-hardening

lnrpc: websocket proxy hardening (protocol header panic, missing read limit)

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validationmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Moderate 68/100

This update fixes two security-related bugs in LND's REST WebSocket proxy. First, a specially crafted WebSocket protocol header could crash the proxy (a panic). Second, the proxy previously had no limit on how large an incoming WebSocket message it would accept, which could let an attacker exhaust server memory. The patch caps incoming message sizes and correctly parses the protocol header as a comma-separated list.

Lower-priorityMerge branch 'master' into websocket-proxy-hardeningby Yong · 69f6b525 · Aug 29, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Yong

Merge branch 'master' into websocket-proxy-hardening

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
defensive validationdocumentation-only discountmerge-commit duplicate discount
Lower-priorityMerge pull request #11136 from ziggie1984/move-10782-release-note-to-0.21.3by Yong · 602d7854 · Aug 29, 2026 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · Yong

Merge pull request #11136 from ziggie1984/move-10782-release-note-to-0.21.3

docs: move coop close limbo fix to v0.21.3 notes

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountmerge-commit duplicate discount
Lower-priorityMerge pull request #11140 from starius/fix-stuck-htlcby Yong · a5ff1935 · Aug 29, 2026 · 4 filesMessage 73 · AdequateTriage 0Details
Commit message · Yong

Merge pull request #11140 from starius/fix-stuck-htlc

contractcourt: fix stuck dust HTLC after confirmation

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-prioritydocs: add v0.20.4 release notes (fix stuck HTLC)by Boris Nagaev · a676fbfd · Aug 28, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Boris Nagaev

docs: add v0.20.4 release notes (fix stuck HTLC)

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritydocs: add v0.21.3 release notes (fix stuck HTLC)by Boris Nagaev · 0e3e3db7 · Aug 28, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Boris Nagaev

docs: add v0.21.3 release notes (fix stuck HTLC)

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queueddocs: add v0.21.3 release notes for ws proxy fixesby Gijs van Dam · d3e02876 · Aug 28, 2026 · 1 fileMessage 85 · StrongLow 46Details
Commit message · Gijs van Dam

docs: add v0.21.3 release notes for ws proxy fixes

Adds entries for the Sec-Websocket-Protocol panic under Bug Fixes and for
the incoming message size bound under Functional Updates.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI analysis · Low 46/100

This commit adds release notes for two fixes in LND's REST WebSocket proxy: one that could crash the proxy with a malformed header, and another that limits how large incoming WebSocket messages can be. The actual code changes happened in a different pull request; this commit only documents them.

AI review queueddocs: add v0.20.4 release notes for ws proxy fixesby Gijs van Dam · 307c1ac1 · Aug 28, 2026 · 1 fileMessage 85 · StrongModerate 60Details
Commit message · Gijs van Dam

docs: add v0.20.4 release notes for ws proxy fixes

Adds entries for the Sec-Websocket-Protocol panic under Bug Fixes and for
the incoming message size bound under Functional Updates.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI analysis · Moderate 60/100

This commit adds release notes for two fixes in LND's REST WebSocket proxy. One fix prevents a server crash (panic) triggered by a malformed WebSocket protocol header. The other fix limits how large incoming WebSocket messages can be, rejecting oversized frames early. Both are defensive hardening changes, but the commit itself only documents them; the actual code changes are in a different pull request.

AI review queuedMerge pull request #10969 from darioAnongba/fix/chancloser-include-aux-outputsby Yong · cb58f8bb · Aug 28, 2026 · 10 filesMessage 73 · AdequateLow 44Details
Commit message · Yong

Merge pull request #10969 from darioAnongba/fix/chancloser-include-aux-outputs

chancloser: account for aux close outputs in initial coop close fee baseline

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Low 44/100

This patch fixes a bug in LND's cooperative channel-closing logic where extra 'auxiliary' outputs (used by custom/taproot channel types) were not counted when the initial closing fee was first estimated. If the fee was too low, the resulting close transaction could be rejected by the Bitcoin network's mempool. The fix adds a new 'shape' query so the closer knows the size of these extra outputs up front, includes them in the fee calculation, and then verifies that the final outputs match the declared shape before signing.