LL
← All projectsLightning Labs

LND

Go implementation of a complete Lightning Network node.

BitcoinLightning NetworkNormal
Repository coverage

1241 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

118security candidates168second-pass queue1236AI analyses
55commits · 30 days
171commits · 60 days
830commits · 180 days
1219commits · 365 days
Backfill bands
Aug 5 → Feb 6405 seen5 candidatesComplete
Feb 6 → Jun 6665 seen28 candidatesComplete
Jun 6 → Jul 689 seen4 candidatesComplete
Jul 6 → Aug 569 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
279Strong · 80–100
564Adequate · 60–79
367Thin · 40–59
31Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Olaoluwa Osuntokun19940198474
Elle Mouton26832268167
ziggie41015408164
Jared Tobin909171
Erick Cestari26726070
bitromortac46546067
yyforyongyu55355065
saubyk15215070
Oli727057
Suheb323075
Yong323073
elnosh323071
Analysis record

Published AI watches

Last scanned 15 minutes ago

Moderate 59 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11023 from ellemouton/update-fee-log

This commit hardens how LND handles Lightning channel fee updates and mailbox message admission. It enforces the protocol rule that only the channel opener can send fee updates, prevents uncommitted fee updates from piling up in the update…

BOLT 2 role validation for UpdateFee senderReplacement of uncommitted fee updates to prevent log bloat and index gapsBounded mailbox wire-message queue (count and bytes)
7f56541dby Yong+750−138 files
No security note in commit
Moderate 57 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11019 from Roasbeef/coop-close-race-public

This update fixes two related problems in LND's cooperative channel-closing code. First, it eliminates a data race where the same state machine was being advanced by two different internal goroutines at once, which could cause crashes or i…

Data race in legacy cooperative close state machine driven concurrently by link and peer goroutinesMissing or inconsistent validation of remote delivery script when no upfront shutdown script is recordedpanic() in DustLimitForSize on unrecognized script sizes replaced with safe fallback
f4ae5656by Yong+463−609 files
Vendor flagged security relevance
Moderate 63 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11024 from ziggie1984/invoices-update-validation

This commit tightens how LND processes invoice payments, especially for newer multi-path (MPP) and AMP invoices, keysend payments, and replayed payments. It adds checks that ensure the right payment preimage is used for each invoice type a…

Preimage validation added for AMP and regular invoice replaysAMP invoices forced into MPP update path, preventing legacy-path processingLegacy settlement now fails when invoice-level preimage is missing
61f3b5a7by ziggieXXX+482−114 files
No security note in commit
Moderate 59 AI analysisMessage 35 · Opaque
LL Lightning LabsLND BitcoinLightning Network

invoices: refine update handling

This commit tightens how LND handles invoice payment updates, especially for newer 'AMP' invoices and old-style 'keysend' payments. It adds checks so that the wrong kind of payment cannot be processed against the wrong kind of invoice, and…

Added preimage/hash mismatch checks for both regular and AMP invoice replaysAMP records now require an MPP payload, preventing AMP processing on the legacy pathLegacy path now rejects AMP invoices and invoices missing invoice-level preimages
6be6350eby ziggie+476−113 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: update 0.21.2 release notes

This commit only updates the release notes document for version 0.21.2. It adds a bullet point describing a previously merged code change about invoice handling and adds a contributor name to the credits list. No actual code was changed, s…

758bbb8eby ziggie+6−01 file
No security note in commit
Moderate 60 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

peer+lnwallet/chancloser: advance the legacy closer from one goroutine

This commit fixes a concurrency bug in how LND negotiates cooperative channel closures. Previously, two different goroutines could update the same channel-closing state machine at the same time, which could corrupt internal data or cause a…

Data race on ChanCloser state field detected under go test -raceConcurrent access to priorFeeOffers map and signing step by two goroutinesSingle-goroutine ownership invariant now documented on ChanCloser type
e5e134ddby Olaoluwa Osuntokun+292−384 files
Vendor flagged security relevance
Low 29 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnwallet/chancloser: record the remote close output only when accepted

This change fixes a bookkeeping bug in how LND records the other party's preferred closing address during a channel close. Previously, a late or unexpected Shutdown message could overwrite the correct address with one from a message that w…

State variable written before validationRejected message could overwrite accepted close outputFix prevents stale/incorrect close metadata
fb89732dby Olaoluwa Osuntokun+7−21 file
No security note in commit
High 72 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch: bound peer-controlled channel ingress

This commit hardens LND's channel message handling against a peer that tries to overwhelm the node. It adds limits on how many ordered messages and how much data a peer can queue up for a channel, and it disconnects the peer if either limi…

Adds resource bounds on peer-controlled channel ingress (count + bytes)Disconnects peer on mailbox admission failure instead of silently dropping ordered channel messagesPrevents unauthorized UpdateFee from channel initiator before fee-exposure calculations
ef24f2c5by Elle Mouton+507−94 files
Vendor flagged security relevance
Moderate 64 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

lnwallet/chancloser: validate delivery scripts in the RBF closer

This commit fixes a bug in LND's cooperative channel-closing code where a peer could supply an invalid, empty, or even money-burning Bitcoin address during a close, and LND would accept it without checking. The fix makes the newer 'RBF' cl…

Missing input validation on remote-supplied shutdown/delivery scriptEmpty/zero-length script accepted as valid due to nil-treatment in validatorMid-negotiation script swap via ClosingComplete not validated
a8e2a0f7by Olaoluwa Osuntokun+131−142 files
Vendor flagged security relevance
Moderate 51 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnwallet: make DustLimitForSize total over the sizes it can be handed

This change removes a deliberate program crash (panic) in LND's fee/dust-limit helper and replaces it with a safe fallback. Previously, if the helper received a script length it didn't explicitly recognize, it would panic and potentially c…

Removal of a panic/default branch in favor of a conservative fallbackDefensive handling of arbitrary and future witness-version script sizesPotential denial-of-service vector eliminated: unhandled script lengths no longer crash the helper
f80f92dcby Olaoluwa Osuntokun+23−62 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: move gossip bounds note to v0.21.2

This commit only moves an existing release-note entry from one version's notes (v0.22.0) to another (v0.21.2). It does not change any code, build files, configuration, or tests. The change is purely editorial documentation bookkeeping.

83e7eb8cby ziggie+11−112 files
No security note in commit
High 72 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

discovery: bound channel range reply buffering

This change fixes a way a malicious or buggy peer could make an LND node use an unpredictable amount of memory while syncing the Lightning channel graph. Before the fix, the node only limited the size of one compressed reply message, but a…

Resource exhaustion / unbounded memory growth in gossip syncRemote peer can influence memory allocation via ReplyChannelRange streamMissing aggregate limit on decoded working set
ceff94faby Olaoluwa Osuntokun+335−153 files
Vendor flagged security relevance
Low 33 AI analysisMessage 47 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: update release notes

This commit updates the release notes for LND 0.21.2 to describe a fix for a bug in the HTLC interceptor RPC. The bug caused LND to fail to forward payments in blinded routes when the next hop was identified by node ID instead of channel I…

Blinded route forwarding failure could disrupt payment routing or be used to probe path structure.Sentinel value change in RPC API could cause client misclassification of forwards if not handled.Release notes describe the change as a fix for a forwarding issue, not as a security vulnerability.
f42b4298by bitromortac+20−01 file
No security note in commit
Informational 14 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

itest: cover blinded route next_node_id forwarding

This commit only adds new integration tests for an existing feature in LND: forwarding blinded payments where the next hop is identified by node ID rather than channel ID. It does not change production code, fix a bug, or introduce any new…

da6a40c0by bitromortac+432−02 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

witness beacon: report node-ID next hop to the on-chain HTLC interceptor

This change fixes a reporting gap in LND's 'witness beacon,' a component that watches on-chain transactions and tells the HTLC interceptor where a payment should go next. Previously, when the next hop was identified by a node ID rather tha…

Missing security-critical metadata in on-chain interception pathBehavioral parity between on-chain and off-chain HTLC interceptionPotential misclassification of node-ID forwards as final receives
9c4b8bfeby bitromortac+59−52 files
No security note in commit
Moderate 59 AI analysisMessage 81 · Strong
LL Lightning LabsLND BitcoinLightning Network

htlcswitch: forward node-ID blinded hops via non-strict forwarding

This commit fixes a bug in LND's payment forwarding for 'blinded routes'—a privacy feature in the Lightning Network. Previously, if the next hop was identified by node ID rather than a specific channel ID, the payment could not be forwarde…

Fixes a functional forwarding failure for blinded-route payments using node-ID next hops (issue #10937).Prevents private channel SCID leakage in failure messages for node-ID blinded hops by returning FailUnknownNextPeer instead of a channel_update.Adds circular-route filtering for node-ID next hops before non-strict forwarding selection.
dbc57040by bitromortac+334−416 files
No security note in commit
Informational 19 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch+lnrpc: report node-ID next hop to the off-chain HTLC interceptor

This change improves how the Lightning Network Daemon (LND) reports forwarding details to external plugins that inspect HTLCs (payment packets). For a new type of blinded route where the next hop is identified by node ID rather than a spec…

Information-correctness fix for HTLC interceptor APIPrevents misclassification of node-ID forwards as exit hopsAdds explicit sentinel to disambiguate zero SCID semantics
32373b76by bitromortac+29−13 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch: classify a node-ID forward as a forward event

This commit fixes a bookkeeping bug in LND's HTLC event stream. When a payment is forwarded to a 'blinded' next hop identified only by a node public key (not a channel ID), and it fails before the switch picks an outgoing channel, the even…

Event misclassification in HTLC event stream (forward reported as receive)Blinded/node-ID forwarding path introduced prior to this fixFailure and resolution packets dropped next-hop metadata before fix
a4844ef5by bitromortac+149−04 files
No security note in commit
Low 29 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch/hop: decode next_node_id blinded hops

This commit adds support in LND for a different way of identifying the next hop in a private ('blinded') Lightning payment route. Previously LND expected the next hop to be identified by a channel ID; now it also accepts the next node's pu…

New validation enforces BOLT 4 mutual exclusivity of short_channel_id and next_node_id in blinded route dataPreviously ambiguous or unhandled next_node_id forwarding case now explicitly decodedNo memory-safety, cryptographic, or authorization changes observed
4fd4289aby bitromortac+471−86 files
No security note in commit
Moderate 60 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnwire: cap decoded short channel IDs

This commit tightens a safety limit in LND's Lightning wire protocol parser. Previously, a compressed network message could decompress into an unbounded number of short channel IDs, potentially consuming far more memory than the wire messa…

Resource-limit bypass: compressed-input bound did not bound decoded outputMemory-exhaustion risk from zlib decompression of peer-supplied dataTruncated/corrupt zlib streams previously accepted as valid partial results
d1622919by Olaoluwa Osuntokun+271−502 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritychainntnfs: notify BlockHeight in Updates eventby Nishant Bansal · 7bc63314 · Sep 11, 2025 · 3 filesMessage 68 · AdequateInformational 18Details
Commit message · Nishant Bansal

chainntnfs: notify BlockHeight in Updates event

Enhance the ConfirmationEvent's Updates channel by including the
BlockHeight alongside NumConfsLeft.

Signed-off-by: Nishant Bansal <nishant.bansal.282003@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit is a small API enhancement for LND's internal transaction notification system. It changes the 'Updates' progress channel so that, instead of only reporting how many confirmations are still needed, it also reports the block height where the transaction was included. There is no indication this fixes a security bug; it appears to be a feature improvement to give callers more information.

Lower-prioritychainntnfs: signal reorg notification before required confirmationsby Nishant Bansal · aa9c3272 · Sep 11, 2025 · 2 filesMessage 73 · AdequateLow 32Details
Commit message · Nishant Bansal

chainntnfs: signal reorg notification before required confirmations

In this commit, we send the reorg notification even when the
transaction has not yet reached the required confirmations, in
case the caller is interested in knowing about it.

Signed-off-by: Nishant Bansal <nishant.bansal.282003@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 32/100

This change fixes a notification bug in LND's transaction confirmation tracker. Previously, if a transaction had been seen in a block but had not yet reached the required number of confirmations, and then that block was reorged (removed from the chain), subscribers were not told about the reorg. Now they are notified earlier, so downstream logic can react to the lost confirmation instead of waiting for a confirmation that may never come.

Security candidateMerge pull request #9884 from ellemouton/relaxFeatureBitCheckby Yong · d1d3a820 · Sep 10, 2025 · 1944 filesMessage 73 · AdequateInformational 15Details
Commit message · Yong

Merge pull request #9884 from ellemouton/relaxFeatureBitCheck

multi: use relaxed feature bit `Set` method for peer features

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol pathmerge-commit duplicate discount
AI analysis · Informational 15/100

This commit is a massive repository import or initial commit adding the entire LND codebase plus CI, docs, and tooling. The PR title mentions relaxing a feature-bit check for peer features, but the supplied diff does not show any code changes related to that title—it only shows newly added files. There is no visible security patch or vulnerability fix in the provided materials.

Lower-prioritynetann: update ChanAnn2 validation to work for P2WSH channelsby Elle Mouton · d68d1fb3 · Sep 1, 2025 · 5 filesMessage 65 · AdequateLow 46Details
Commit message · Elle Mouton

netann: update ChanAnn2 validation to work for P2WSH channels

This commit expands the ChannelAnnouncement2 validation for the case
where it is announcing a P2WSH channel.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Low 46/100

This commit updates how LND validates a new style of Lightning channel announcement (ChannelAnnouncement2) so it correctly handles both older P2WSH-style channels and newer P2TR (Taproot) channels. Before this change, the validation logic appears to have assumed P2TR channels, which could have caused LND to reject valid announcements for older P2WSH channels or, in the worst case, accept invalid ones. The change also switches the gossiper from using a raw chain hash to carrying full chain parameters, which is needed to interpret on-chain scripts correctly.

Security candidatelnwire+netann: update ChannelUpdate2by Elle Mouton · b6b764da · Sep 1, 2025 · 4 filesMessage 55 · ThinLow 28Details
Commit message · Elle Mouton

lnwire+netann: update ChannelUpdate2

such that all fields are now TLV including the signature.

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryboot or update path
AI analysis · Low 28/100

This commit refactors how a Lightning network message (ChannelUpdate2) is encoded and decoded. Previously, the digital signature was a separate fixed field; now it is treated as just another TLV (Type-Length-Value) record inside the message. The change also preserves unknown fields that fall within the signed portion of the message so that signatures can still be validated correctly. There is no direct evidence in the commit that this fixes an active security bug, but it is a protocol-correctness change that could prevent signature-validation failures or message-malleability issues when future unknown fields are present.

AI review queuedmulti: let FetchPkScript take SCID by valueby Elle Mouton · 06bf0c28 · Sep 1, 2025 · 4 filesMessage 45 · ThinInformational 15Details
Commit message · Elle Mouton

multi: let FetchPkScript take SCID by value

Instead of a pointer.

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a small internal code cleanup in the LND lightning node software. It changes several functions so they receive a short channel identifier (SCID) directly by value instead of by pointer. There is no user-facing behavior change, no bug fix, and no security-relevant change visible in the diff.

AI review queuedlnwire: update AnnounceSigs2 to use pure TLVby Elle Mouton · b77b698b · Sep 1, 2025 · 3 filesMessage 45 · ThinLow 27Details
Commit message · Elle Mouton

lnwire: update AnnounceSigs2 to use pure TLV

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100

This commit refactors how one Lightning network message type (AnnounceSignatures2) is encoded and decoded, switching it from a fixed-field format to a more flexible Type-Length-Value (TLV) format. The change is primarily a code modernization and protocol-alignment refactor. There is no direct evidence in the commit or supplied references that this fixes an active security vulnerability.

Security candidatelnwire+netann: update ChannelAnnouncement2 structureby Elle Mouton · 1f71f145 · Sep 1, 2025 · 6 filesMessage 70 · AdequateLow 27Details
Commit message · Elle Mouton

lnwire+netann: update ChannelAnnouncement2 structure

Such that all fields are now TLV (including the signature).

70/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Low 27/100

This commit refactors how a new Lightning network message type (ChannelAnnouncement2) is encoded and decoded. Previously the message had a fixed signature field followed by a block of TLV data. Now the signature itself is placed inside the TLV stream, and the code distinguishes between fields that are covered by the signature and those that are not. The change is a protocol-structure update rather than a clear-cut bug fix, but it touches signature coverage and message parsing, which are security-sensitive areas.

Lower-prioritylnwire: let ChannelID implement RecordProducerby Elle Mouton · 5e7ca548 · Sep 1, 2025 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Elle Mouton

lnwire: let ChannelID implement RecordProducer

So that we can use it as a TLV record type.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit adds a small plumbing feature that lets a ChannelID be packaged as a TLV record. It is a straightforward, additive code change with no visible security relevance on its own.

Security candidatelnwire: introduce PureTLVMessageby Elle Mouton · 4addfd1d · Sep 1, 2025 · 2 filesMessage 73 · AdequateInformational 12Details
Commit message · Elle Mouton

lnwire: introduce PureTLVMessage

PureTLVMessage describes an LN message that is a pure TLV stream. If the
message includes a signature, it will sign all the TLV records in the
inclusive ranges: 0 to 159 and 1000000000 to 2999999999.

A comprehensive test is added that shows how two versions of the same
message remain forward compatible.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 12/100

This commit adds a new internal framework called PureTLVMessage to the Lightning Network wire protocol code. It is purely a code addition (no existing behavior is changed) and is designed to make future message formats more forward-compatible. There is no indication this commit fixes a security bug or introduces a vulnerability.

Lower-prioritygraph/db: let the rapid migration test also tests idempotencyby Elle Mouton · ce1df9da · Sep 1, 2025 · 1 fileMessage 60 · AdequateInformational 12Details
Commit message · Elle Mouton

graph/db: let the rapid migration test also tests idempotency

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 12/100

This commit only adds a second run of an existing database migration inside a test, to verify the migration can be safely repeated without changing results. It is a test-only change and does not alter production code.

Lower-prioritygraph/db+sqldb: improve performance of chan update sql migrationby Elle Mouton · f2ed5564 · Sep 1, 2025 · 5 filesMessage 73 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db+sqldb: improve performance of chan update sql migration

This commit simplifies insertChanEdgePolicyMig. Much of the logic can be
removed given that this method is only used in the context of the graph
SQL migration.

This should improve the performance of the migration quite a lot since
it removes the extra GetChannelAndNodesBySCID call.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a performance optimization for a database migration in the Lightning Network Daemon (LND). It removes an unnecessary database lookup during the migration of channel policies and changes an 'insert-only' operation into an 'upsert' (insert-or-update) for extra policy data. There is no security-relevant change here; it only makes the migration faster and more retry-safe.

Lower-prioritygraph/db+sqldb: make policy migration idempotentby Elle Mouton · 22bf88e9 · Sep 1, 2025 · 6 filesMessage 68 · AdequateLow 26Details
Commit message · Elle Mouton

graph/db+sqldb: make policy migration idempotent

Finally, we make the channel-policy part of the SQL migration idempotent
by adding a migration-only policy insert query which will not error out
if the policy already exists and does not have a timestamp that is newer
than the existing records timestamp. To keep the commit simple, a
insertChanEdgePolicyMig function is added which is basically identical
to the updateChanEdgePolicy function except for the fact that it uses
the newly added query. In the next commit, it will be simplified even
more.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 26/100

This commit fixes a database migration in LND so that if the migration is interrupted and run again, it won't fail when it sees channel policies that were already copied over. It replaces a strict 'only update if newer' insert with an 'insert or update regardless of timestamp' version used only during migration. This is a reliability improvement, not a security fix, and it does not introduce a new vulnerability.

Lower-prioritygraph/db+sqldb: make channel SQL mig retry-safeby Elle Mouton · 8736fcaf · Sep 1, 2025 · 6 filesMessage 68 · AdequateLow 31Details
Commit message · Elle Mouton

graph/db+sqldb: make channel SQL mig retry-safe

In this commit, we make the channel part of the graph SQL migration
idempotent (retry-safe!). We do this by adding a migration-only channel
insert query that will not error out if a the query is called and a
chanenl with the given scid&version already exists. We also ensure that
errors are not thrown if existing channel features & extra types are
re-added.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 31/100

This commit fixes a database migration bug in LND's move to a SQL-backed channel graph. Previously, if the migration was interrupted and retried, re-inserting a channel that had already been migrated would cause a duplicate-key error and abort the upgrade. The patch makes the channel-insert step idempotent: re-inserting the same channel now updates the existing row instead of failing, and re-adding features or extra TLV fields is also handled gracefully. It is a robustness fix for a one-time upgrade path, not a remotely exploitable vulnerability.

Lower-prioritygraph/db+sqldb: improve efficiency of node migrationby Elle Mouton · a291d6f1 · Sep 1, 2025 · 5 filesMessage 73 · AdequateInformational 17Details
Commit message · Elle Mouton

graph/db+sqldb: improve efficiency of node migration

There is no need to use the "collect-then-update" pattern for node
insertion during the SQL migration since if we do have any previously
persisted data for the node and happen to re-run the insertion for that
node, the data will be exactly the same. So we can make use of "On
conflict, no nothing" here too.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 17/100

This commit is a performance and reliability cleanup for a database migration in the Lightning Network Daemon (LND). It changes how node information is copied into a new SQL database format so that if the migration is interrupted and restarted, it can safely skip re-inserting data that is already present. There is no indication this fixes an active security vulnerability or introduces a new attack path.

Lower-prioritygraph/db+sqldb: make node migration idempotentby Elle Mouton · ddea6d59 · Sep 1, 2025 · 6 filesMessage 80 · StrongLow 31Details
Commit message · Elle Mouton

graph/db+sqldb: make node migration idempotent

In this commit, the graph SQL migration is updated so that the node
migration step is retry-safe. This is done by using migration specific
logic & queries that do not use the same node-update-constraint as the
normal node upsert logic. For normal "run-time" logic, we always expect
a node update to have a newer timestamp than any previously stored one.
But for the migration, we will only ever be dealing with a single
announcement for a given node & to make things retry-safe, we dont want
the query to error if we re-insert the exact same node.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Low 31/100

This commit fixes a reliability bug in LND's database migration process. When LND upgrades and moves old node data into a new SQL database, the migration could fail if it had to be restarted part-way through and tried to re-insert a node it had already inserted. The normal database logic rejects re-inserting the same node unless the timestamp is newer, but migration data doesn't always meet that rule. The fix adds a migration-only insert that safely ignores exact duplicates and resets progress counters so the migration can be retried cleanly. It is a robustness improvement, not a remote attack vector.

Lower-prioritygraph/db: thread through `reset` call-backsby Elle Mouton · 2c8ac0c9 · Sep 1, 2025 · 2 filesMessage 80 · StrongInformational 22Details
Commit message · Elle Mouton

graph/db: thread through `reset` call-backs

In preparation for handling retries on the source DB side, we thread
through the `reset` call-backs properly so that we can reset appropriate
variables.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 22/100

This change is a code cleanup in LND's database migration logic. It threads 'reset' callbacks through helper functions that iterate over old-style database entries, so that batch-processing variables can be properly reset on retries. The commit message frames it as preparation for future retry handling on the source database side. There is no direct security fix here; it is defensive maintenance that could prevent data-integrity issues during migrations if retries occur.

Lower-prioritygraph/db: let migration test test retry safetyby Elle Mouton · 68e4970f · Sep 1, 2025 · 1 fileMessage 78 · AdequateInformational 24Details
Commit message · Elle Mouton

graph/db: let migration test test retry safety

Currently, the graph SQL migration is not retry safe. Meaning that if
the source DB exeutes a retry under the hood, this could result in the
migration failing. In preparation for fixing this, we adust the
migration test accordingly.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 24/100

This commit only changes a test file. It updates the graph database migration test to check whether running the migration twice (a retry) succeeds or fails. The commit message says the actual migration code is not yet retry-safe, and this test change is preparation for a future fix. No production code is changed, so this is not a fix for a live vulnerability by itself.

Lower-prioritygraph/db: migration test for channels with no policiesby Elle Mouton · aefc9118 · Sep 1, 2025 · 1 fileMessage 95 · StrongInformational 13Details
Commit message · Elle Mouton

graph/db: migration test for channels with no policies

In preparation for making the channel & policy migration logic
idempotent in a step-by-step manner, we add a test here that only tests
the migration of channels _without_ policies so that we can first focus
on just making the channel migration idempotent.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 13/100

This commit only adds a new test case to an existing database migration test file. It does not change any production code, fix a bug, or alter behavior. The test verifies that migrating channels without routing policies works correctly. There is no security issue visible in this change.

Lower-prioritygraph/db: let test policy have some extra opaque databy Elle Mouton · 9019bcad · Sep 1, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Elle Mouton

graph/db: let test policy have some extra opaque data

This will help us test idempotency later on, but it also ensures that
TestMigrateGraphToSQL is properly testing writes to the
graph_channel_policy_extra_types table.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This is a small test-only change that adds a field to a helper function used in database migration tests. It does not change any production code, network behavior, or user-facing functionality. There is no security issue here.

Lower-prioritychore(ci): upgrade checkout to v5by hexcow · f1c807d4 · Aug 25, 2025 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · hexcow

chore(ci): upgrade checkout to v5

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit is a routine maintenance update to the project's automated build and test system. It upgrades the version of a commonly used GitHub-provided action (actions/checkout) from version 4 to version 5 in the project's CI workflow file. There is no indication of a security fix or vulnerability being addressed in the code itself.

Lower-prioritymulti: move DBMPPayment to paymentsdb packageby ziggie · b16782ca · Aug 20, 2025 · 4 filesMessage 45 · ThinInformational 15Details
Commit message · ziggie

multi: move DBMPPayment to paymentsdb package

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a straightforward code cleanup: it moves an existing interface definition (DBMPPayment) from the routing package to the payments/db package and updates all references. There is no functional change to how the software behaves, and no security issue is introduced or fixed.

Lower-priorityrouting: Add comment to DeleteFailedAttempts func callby ziggie · bf6131ba · Aug 20, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ziggie

routing: Add comment to DeleteFailedAttempts func call

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds a clarifying comment to existing code. It does not change any program logic, behavior, or security properties. The comment explains that deleting failed payment attempts may be a no-op depending on database options.

Lower-priorityrouting: add more comments to the ControlTower interfaceby ziggie · 039b5994 · Aug 20, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ziggie

routing: add more comments to the ControlTower interface

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds documentation comments to a Go interface describing payment routing behavior. No code logic, function signatures, or security controls were changed.

AI review queuedpaymentsdb: fix linterby ziggie · 9ac93e75 · Aug 20, 2025 · 2 filesMessage 28 · OpaqueInformational 15Details
Commit message · ziggie

paymentsdb: fix linter

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only fixes code style issues flagged by a linter. It adds punctuation to comments and reformats a test function call to fit line-length rules. There are no changes to program logic, security behavior, or how payments are processed.