LL
← All projectsLightning Labs

LND

Go implementation of a complete Lightning Network node.

BitcoinLightning NetworkNormal
Repository coverage

1399 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

142security candidates195second-pass queue1287AI analyses
86commits · 30 days
186commits · 60 days
609commits · 180 days
1247commits · 365 days
Backfill bands
Aug 5 → Feb 6405 seen5 candidatesComplete
Feb 6 → Jun 6665 seen28 candidatesComplete
Jun 6 → Jul 689 seen4 candidatesComplete
Jul 6 → Aug 569 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
322Strong · 80–100
655Adequate · 60–79
391Thin · 40–59
31Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Olaoluwa Osuntokun20942204474
Elle Mouton26832268167
ziggie44416413165
Yong28513171
LNBiG111173
Jared Tobin909171
bitromortac661153071
yyforyongyu83861068
Erick Cestari26726070
Andras Banki-Horvath11311072
Gijs van Dam33230073
ziggieXXX2026070
Analysis record

Published AI watches

Last scanned 5 minutes ago

Moderate 62 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11212 from ziggie1984/disable-legacy-channels

This change stops LND from opening new Lightning channels using the old 'legacy' commitment format. The legacy format makes it harder to recover funds if something goes wrong, because the money owed to you is tied to a secret key that chan…

Prevents opening new channels with the legacy commitment type, whose tweaked to_remote output complicates data-loss recoveryCloses a negotiation path where an empty channel_type TLV bypassed feature checks and forced a legacy channelAdds explicit RPC and wire rejection with a dedicated error code
112cb5f3by ziggieXXX+265−4716 files
Vendor flagged security relevance
Moderate 56 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11223 from gijswijs/legacy-dust-retribution-fix

This update fixes a bug in how LND handles old-style punishment transactions when a channel partner tries to cheat. Previously, tiny (dust) HTLCs were left as blank placeholder entries in the punishment data, which could cause the node to …

nil-pointer dereference risk in breach retribution pathlegacy revocation log handling inconsistency with modern formatdefensive hardening added for trimmed/dust HTLCs
500ca51fby ziggieXXX+168−146 files
No security note in commit
Moderate 62 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11190 from Roasbeef/zpay32-reject-duplicate-payment-hashes

This change tightens how LND reads Lightning invoices (BOLT 11). Previously, if an invoice contained more than one payment hash field, LND would silently keep the first one and ignore the rest. Now it rejects the invoice entirely. The rele…

Behavior change from 'use first duplicate field' to 'reject duplicate fields'New error type ErrDuplicatePaymentHash returned on duplicate payment hash fieldsMalformed/unsupported-length duplicate payment hash now treated as duplicate and rejected
86306f89by Yong+147−106 files
No security note in commit
Moderate 62 AI analysisMessage 98 · Strong
LL Lightning LabsLND BitcoinLightning Network

zpay32: reject duplicate payment hash fields

This change tightens how LND reads Lightning invoices. Previously, if an invoice contained more than one payment hash field, LND would silently keep the first valid one and ignore the rest. Now it rejects such invoices outright. This preve…

Behavioral change from silent first-field acceptance to explicit rejection of duplicate payment hash fieldsPrevents invoice parsing from depending on field ordering when multiple payment hashes are presentCovers malformed first field + valid second field, closing a potential bypass
e2f27063by Olaoluwa Osuntokun+147−106 files
Vendor flagged security relevance
Moderate 53 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11132 from yyforyongyu/task-11129-pong

This change fixes how LND answers network 'ping' messages from other Lightning nodes. Previously, LND would sometimes silently ignore valid pings to limit reply traffic, which violates the Lightning protocol (BOLT 1) and could make a peer …

Protocol compliance fix: BOLT 1 requires a Pong for every valid PingRemoved silent suppression of Pong replies that could cause peer timeout/misbehaviorUnified rate limiting now accounts for amplification bandwidth, not just ping count
d3d1f1d0by Olaoluwa Osuntokun+274−1715 files
Vendor flagged security relevance
Low 33 AI analysisMessage 90 · Strong
LL Lightning LabsLND BitcoinLightning Network

itest: stop creating legacy channels

This commit updates LND's integration tests to stop using an obsolete 'legacy' channel type and adds a test confirming that LND now rejects that legacy type. The commit message says the real fix is elsewhere in the same pull request: previ…

Deprecated commitment format (legacy) is now rejected by RPCTest added to verify legacy channel type is refusedUnused legacy node configuration flag removed
03d8b09dby ziggie+24−85 files
No security note in commit
Moderate 60 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11198 from gijswijs/amp-setlocal-reconstruction-fix

This change fixes a bug in LND's handling of AMP (Atomic Multi-Path) payments. Previously, if one partial payment set failed to reconstruct its secret preimage, the entire invoice was canceled, including unrelated partial payment sets from…

Denial-of-service against reusable static AMP invoices by causing unrelated accepted HTLC sets to be canceledIncorrect invoice state transition from set-local failure to global invoice cancellationAvailability impact on multi-payer AMP invoice scenarios
88959aecby Olaoluwa Osuntokun+155−44 files
Vendor flagged security relevance
Low 29 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11200 from ziggie1984/build-go-1.27.1

This commit updates the Go programming language version used to build LND from 1.25.13/1.26.6 to 1.26.8 (language version) and 1.27.1 (toolchain). It also regenerates many automatically generated RPC files and adjusts linter settings. The …

Go version bump may indirectly address unlisted runtime/standard-library security fixesLarge regenerated protobuf files suggest dependency/toolchain refresh rather than logic changeLinter configuration expanded to suppress new checks, consistent with a toolchain upgrade
ef4820e5by Olaoluwa Osuntokun+4932−412670 files
No security note in commit
Informational 15 AI analysisMessage 92 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: adopt focused golangci-lint v2.13 checks

This commit is a routine build-maintenance change. It updates the project's Go linter configuration to a newer version and fixes the resulting style warnings: a WebSocket header spelling and several documentation comments that didn't start…

bada7ea3by ziggie+27−1911 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnrpc: regenerate protos with Go 1.27

This commit is a housekeeping change that regenerates automatically generated RPC binding files using a newer Go compiler version. The only differences are in code comments (doc-comment formatting), not in actual program logic or API behav…

dd523108by ziggie+4501−369826 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: fix Go 1.27 compatibility

This commit is a routine build-and-test maintenance patch to make the LND codebase compile and pass tests with the upcoming Go 1.27 release. It upgrades the project's custom linter tool, refreshes many indirect tool dependencies, adjusts o…

No production code changesNo vulnerability fix or CVE reference presentDependency-only refresh in tools module (development tooling)
6b54a387by ziggie+365−3706 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: bump Go language and toolchain versions

This commit is a routine maintenance update that changes which version of the Go programming language is used to build the lnd project. It does not change any application logic, fix a bug, or address a security vulnerability. The project i…

b1f9ca66by ziggie+39−3930 files
No security note in commit
Moderate 60 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

invoices: cancel only the failing AMP set on reconstruction failure

This commit fixes a bug in LND's invoice handling for reusable AMP (Atomic Multi-Path) invoices. Previously, if one payment set failed to reconstruct its preimage, the entire invoice was canceled, even though other valid payment sets on th…

Denial-of-service-like availability impact: a malicious or buggy payer could cause a whole reusable AMP invoice to be canceled, blocking legitimate concurrent payersSet-local failure incorrectly escalated to invoice-global cancellationRegression test added for concurrent-set survival after reconstruction failure
d74ab6faby Gijs van Dam+141−42 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

bolt12: describe the lnwire dependency

This is a documentation-only change. A package comment was updated to accurately describe that the bolt12 codec library does depend on LND's lnwire package for low-level message types, while clarifying it still does not interact with the r…

5f53171dby bitromortac+3−21 file
No security note in commit
Moderate 60 AI analysisMessage 91 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: cover the amount overflow guard

This commit adds a test to ensure that when a BOLT 12 invoice is validated against a request, the multiplication of the offer amount by the requested quantity cannot overflow and wrap around to zero. Without this guard, a malicious or malf…

Integer overflow / wraparound in amount calculationMissing test coverage for security-critical branchBOLT 12 invoice amount validation
3c8e2bcbby bitromortac+47−01 file
Vendor flagged security relevance
Low 34 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11061 from bitromortac/2604-bolt12-1f

This commit adds the missing cryptographic signature layer for BOLT 12 offers in LND. It builds a Merkle tree from the message fields, signs that tree with a BIP-340 Schnorr signature, and now rejects invoice requests and invoices whose si…

Adds BIP-340 Schnorr signature verification for BOLT 12 invoice_request and invoice messagesMerkle tree commits to canonical re-encoded TLV records; non-minimal feature/amount encodings now rejected to preserve byte-exactnessSignature TLV type 240 and reserved range 240-1000 excluded from the signed Merkle root
1049d301by Yong+2076−7815 files
Vendor flagged security relevance
Low 35 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11125 from bhandras/codex/reorg-aware-output-lock-20260825

This commit adds a new optional wallet feature to LND that lets users lock UTXOs until the transaction spending them reaches a chosen confirmation depth, instead of relying on a wall-clock timeout. It is a feature addition with safety chec…

New RPC fields release_after_spend_confs and confirmed_spend_height added to LeaseOutput and FundPsbtCustom lock ID enforced as required for confirmation-controlled FundPsbt leases; all-zero and reserved internal IDs rejectedCapability check (ResolveOutputLeaser) prevents silent downgrade to time-only lease when confirmation control is requested
80dde144by Yong+1293−10021 files
No security note in commit
Informational 19 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10812 from ziggie1984/chanstate-kv-store-move

This commit is a large internal code reorganization for the LND Lightning node. It moves channel state storage logic from the `channeldb` package into a new `chanstate` package, while keeping the same database keys, serialization formats, …

Large refactoring with no change to cryptographic or consensus-critical logicCodec serialization moved verbatim to new package; wire format unchangedDatabase bucket keys and TLV record types preserved
62b0a073by Olaoluwa Osuntokun+3923−310924 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10804 from GeorgeTsagk/close-immediately-itest-lnd-7c38

This change fixes a data-handling bug in LND's channel-opening code. When opening a Lightning channel using an optional 'auxiliary funding controller' (used for custom channel types such as Taproot Assets), the funding manager was previous…

Data-correctness fix in funding handshake: negotiated channel configs now exposed to auxiliary funding controllerAuxiliary funding controller receives incomplete channel state before patch, complete state after patchNo explicit security claim, CVE, or advisory referenced in commit or supplied materials
1e127653by Olaoluwa Osuntokun+291−254 files
No security note in commit
Moderate 60 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: verify invoice_request and invoice signatures on read

This change makes LND's BOLT 12 invoice and invoice-request reader actually check that the digital signature is valid, instead of only checking that a signature field exists. Before, an attacker could craft or modify a BOLT 12 message and …

Missing cryptographic verification on parsed BOLT 12 messages replaced with BIP-340 Schnorr signature verificationReader accepted any 64-byte placeholder signature before the patchNew negative tests verify rejection of wrong-signer and tampered Merkle-root fields
aa8bd19fby bitromortac+272−723 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritysqldb/sqlc: add non-terminal payment queryby yyforyongyu · 4c163acf · Apr 7, 2026 · 5 filesMessage 78 · AdequateInformational 12Details
Commit message · yyforyongyu

sqldb/sqlc: add non-terminal payment query

FetchInFlightPayments needs a dedicated SQL query that can return
non-terminal payments without relying on the unresolved-attempt scan.
The first version of that query fixed correctness, but the follow-up
selector measurements showed a UNION-based shape was materially
faster while returning the same payment set.

Use the inflight regression tests as evidence. The tests still fail on
SQL before the Go payment store is wired up, but this commit adds the
final SQL surface the later wiring commit depends on.

Add FetchNonTerminalPayments to the SQL query set, regenerate the sqlc
bindings, add the PaymentAndIntent adapters for the new row type, and
use the UNION-based candidate selection so the final query shape lands
in one commit.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 12/100

This commit adds a new database query to the Lightning Network Daemon (LND) for finding payments that haven't finished yet. It is a performance and correctness improvement to how the node tracks in-flight payments. There is no indication it fixes a security vulnerability or introduces a new attack path.

Lower-prioritypaymentsdb: add AMP hash regression testby yyforyongyu · e8c58fc0 · Apr 7, 2026 · 1 fileMessage 90 · StrongLow 41Details
Commit message · yyforyongyu

paymentsdb: add AMP hash regression test

SQL writes store the payment identifier in payment_hash for each
attempt. That is wrong for AMP payments, because the payment
identifier is the SetID while each shard carries its own HTLC hash.

Add TestRegisterAttemptPreservesAttemptHash as evidence. It passes on
KV and fails on SQL before the fix because SQL reads the attempt hash
back as the payment identifier.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Low 41/100

This commit only adds a new regression test for the Lightning Network Daemon (LND) payments database. The test checks that for AMP (Atomic Multi-Path) payments, each individual payment attempt keeps its own unique hash rather than being overwritten by the overall payment identifier. The commit message says the test fails on the SQL database backend before a separate fix, but the actual code fix is not included in this commit. So by itself, this change does not fix anything; it only provides a test that demonstrates the bug.

Lower-prioritypaymentsdb: preserve AMP attempt hashes in sql storeby yyforyongyu · 53eea4d0 · Apr 7, 2026 · 1 fileMessage 95 · StrongLow 43Details
Commit message · yyforyongyu

paymentsdb: preserve AMP attempt hashes in sql store

Live SQL writes stored the payment identifier in payment_hash for
each attempt. That works for legacy payments, but it breaks AMP
because the payment identifier is the SetID while each shard carries
its own HTLC hash.

Use TestRegisterAttemptPreservesAttemptHash as evidence. The test now
passes on both KV and SQL.

Fix this by persisting attempt.Hash when it is present and only
falling back to the payment identifier when the attempt hash is nil.
That restores KV parity for AMP attempt reloads.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Low 43/100

This commit fixes a database bug in LND's new SQL payment store. For a special payment type called AMP (Atomic Multi-Path), each individual payment shard has its own unique hash, but the SQL store was incorrectly saving the overall payment identifier (the SetID) as the hash for every shard. This meant that when LND later reloaded AMP payment attempts from the SQL database, the per-shard hashes were wrong, which could break retry logic, correlation of HTLCs, or reporting. The fix saves the shard's own hash when available, and only falls back to the payment identifier when there is no shard hash. It is a data-integrity bug, not a direct funds-loss vulnerability, and only affects users running the experimental SQL backend.

Lower-prioritypaymentsdb: add inflight recovery regression testsby yyforyongyu · 5d9756f8 · Apr 7, 2026 · 1 fileMessage 83 · StrongLow 37Details
Commit message · yyforyongyu

paymentsdb: add inflight recovery regression tests

SQL FetchInFlightPayments only returns payments with an unresolved
attempt row. KV returns every non-terminal payment, including
retryable payments with only failed attempts and payments that have
been initialized but have not registered any HTLCs yet.

Add TestFetchInFlightPaymentsIncludesRetryablePayments and
TestFetchInFlightPaymentsIncludesInitiatedPayments as evidence. Both
tests pass on KV and fail on SQL before the fix.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Low 37/100

This commit only adds new regression tests to LND's payment database. The tests document that the SQL database backend previously failed to return certain kinds of non-finished (retryable or just-started) payments when asked for in-flight payments, while the older KV backend returned them correctly. The commit itself does not contain the actual fix; it only adds tests that would have failed before the fix. The practical risk is that recovery or routing logic relying on FetchInFlightPayments could miss payments it should retry or monitor, but no direct funds-loss vulnerability is shown in the diff.

Lower-prioritychainreg: accommodate buried taproot deployment in Bitcoin Core v31by Matthew Zipkin · f8314761 · Apr 6, 2026 · 1 fileMessage 81 · StrongLow 37Details
Commit message · Matthew Zipkin

chainreg: accommodate buried taproot deployment in Bitcoin Core v31

Removes "taproot" from deployments:
https://github.com/bitcoin/bitcoin/pull/26201

Adds "script_flags" field to RPC getdeploymentinfo:
https://github.com/bitcoin/bitcoin/pull/32998

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 37/100

This change updates LND's compatibility check so it can still recognize that Bitcoin Core supports Taproot after Bitcoin Core version 31 removed Taproot from its deployment list and added a new 'script_flags' field. Without this fix, LND might incorrectly think a fully capable Bitcoin Core backend does not support Taproot, potentially causing startup or feature-detection problems. It is a robustness fix, not a vulnerability patch.

Lower-prioritydocs: add release note for cursor-based invoice paginationby ziggie · 85c8e955 · Apr 1, 2026 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · ziggie

docs: add release note for cursor-based invoice pagination

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds a release note describing a previous performance improvement: invoice database queries were changed from slow offset-based pagination to faster cursor-based pagination. There is no code change, no bug fix, and no security relevance in the commit itself.

Lower-priorityinvoices+sqldb/sqlc: replace offset-based pagination with cursor-basedby ziggie · e02f77ec · Apr 1, 2026 · 4 filesMessage 85 · StrongLow 27Details
Commit message · ziggie

invoices+sqldb/sqlc: replace offset-based pagination with cursor-based

The invoice filter queries (FetchPendingInvoices,
FilterInvoicesBySettleIndex, FilterInvoicesByAddIndex,
FilterInvoicesForward, FilterInvoicesReverse) all used LIMIT+OFFSET for
internal pagination. This causes SQLite to build an ephemeral temp
B-tree for every page to implement the OFFSET skip, making each
successive page O(offset+limit). On nodes with large invoice histories
this compounds into a significant CPU cost — profiling showed
FilterInvoicesReverse consuming 53% of total CPU, with _sqlite3BtreeInsert
and _balance_nonroot (2.4s combined) appearing inside the SELECT due to
the temp B-tree being built and rebalanced to skip rows.

Replace the OFFSET loop (queryWithLimit) with cursor-based pagination
across all four callers in sql_store.go:

- FetchPendingInvoices: add id_cursor param, advance cursor to
last_id + 1 each page.
- InvoicesSettledSince: add id_cursor param alongside the existing
settle_index lower bound, advance cursor to last_id + 1 each page.
- InvoicesAddedSince: cursor starts at idx+1, advances to last_id+1.
- QueryInvoices: forward cursor starts at IndexOffset+1 and advances
by +1; reverse cursor starts at IndexOffset-1 (or MaxInt64) and
advances by -1. Inclusive SQL bounds (>= / <=) are preserved so
query semantics and all existing callers are unchanged.

The queryWithLimit helper is removed as it has no remaining callers.

Each page now performs a single PK seek + forward scan of exactly
page_size rows with no temp sort structure, matching the cursor-based
pattern already used by the payments filter queries.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Low 27/100

This commit is a performance optimization, not a security fix. It replaces slow database pagination that skipped rows using OFFSET with faster cursor-based pagination using primary-key ranges. On nodes with very large invoice histories this can dramatically reduce CPU usage and query time, but it does not close any vulnerability that an attacker could exploit.

Lower-prioritysqldb/v2: limit MigrationExecutor interfaceby Viktor Torstensson · 1b3bea56 · Mar 31, 2026 · 5 filesMessage 90 · StrongInformational 14Details
Commit message · Viktor Torstensson

sqldb/v2: limit MigrationExecutor interface

This commit limits the MigrationExecutor interface due to the following
reasoning:

1. SkipMigrations() and DefaultTarget() should not be on the interface
Both are only used by ApplyAllMigrations, which immediately passes the
results back into the same executor. They are internal implementation
details and should be folded into ExecuteMigrations itself.

2. SetSchemaVersion and GetSchemaVersion are test-only but on the
production interface Every caller of these in sqldb/v2 is in test files.
The SetSchemaVersion comment even says "USE WITH CAUTION" — dangerous
test utilities should not be on an interface that every real consumer
must implement. They should be accessible on the concrete types only and
used directly in tests without going through the interface.

3. ExecuteMigrations should not take a MigrationTarget parameter for the
normal path On the normal startup path, callers just do
executor.ExecuteMigrations(executor.DefaultTarget(), stream) — asking
the executor for its default and handing it straight back. The method
should run to latest by default; a version override for tests can live
on the concrete type instead.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 14/100

This commit is a routine code cleanup in LND's database migration system. It narrows a Go interface so that production code only exposes the migration method actually needed at runtime, while test-only helpers move to the concrete database types. There is no security-relevant change: no bug is fixed, no vulnerability is introduced, and no behavior of the running program changes.

Lower-prioritysqldb/v2: rename `ErrRetriesExceeded` errorby Viktor Torstensson · a726dbd0 · Mar 31, 2026 · 3 filesMessage 60 · AdequateInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: rename `ErrRetriesExceeded` error

rename the `ErrRetriesExceeded` error to `ErrTxRetriesExceeded`.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit simply renames an internal error variable from ErrRetriesExceeded to ErrTxRetriesExceeded across three files. The error message text and behavior remain unchanged. There is no security relevance.

Lower-prioritysqldb/v2: ensure SqliteConfig.MaxConnections is usedby Viktor Torstensson · 58f757a8 · Mar 31, 2026 · 1 fileMessage 50 · ThinInformational 17Details
Commit message · Viktor Torstensson

sqldb/v2: ensure SqliteConfig.MaxConnections is used

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 17/100

This commit fixes a small configuration bug in LND's SQLite database setup. Previously, the user-supplied 'MaxConnections' setting was ignored and a hardcoded default was always used. Now the configured value is respected if it is greater than zero. This is a correctness fix rather than a clear security vulnerability, though ignoring a connection limit could theoretically contribute to resource exhaustion under unusual conditions.

Lower-prioritysqldb/v2: use `defaultMaxIdleConns` in SqliteStoreby Viktor Torstensson · 0c8f5211 · Mar 31, 2026 · 1 fileMessage 73 · AdequateInformational 19Details
Commit message · Viktor Torstensson

sqldb/v2: use `defaultMaxIdleConns` in SqliteStore

The code previously used `defaultMaxOpenConns` for both the maximum
number of open connections and the maximum number of idle connections in
the `SqliteStore`.

This commit updates the code to use `defaultMaxIdleConns` for the
maximum number of idle connections.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This commit fixes a small configuration mistake in LND's SQLite database setup. Previously, the code used the same limit for both 'open' and 'idle' database connections, when it should have used separate limits. This is a code-quality and reliability fix, not a security vulnerability. It does not allow attackers to steal funds, access data, or crash the node directly.

Lower-prioritysqldb/v2: rename the `postgresErrMsgs` listby Viktor Torstensson · 4219e5ae · Mar 31, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: rename the `postgresErrMsgs` list

Rename the `postgresErrMsgs` list to `postgresRetriableErrMsgs`, in
order to clarify its usage.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a simple rename of an internal variable and its comment from `postgresErrMsgs` to `postgresRetriableErrMsgs`. No code behavior changes; it only improves readability. There is no security relevance.

Lower-prioritysqldb/v2: add MaxIdleConnections & ConnMaxLifetime sqlite optsby Viktor Torstensson · cff8836e · Mar 31, 2026 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: add MaxIdleConnections & ConnMaxLifetime sqlite opts

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds two new user-configurable knobs for SQLite connection pool management in LND: how many idle database connections to keep open, and how long a single connection may be reused before being closed. It is a routine feature/configuration improvement with no security relevance visible in the code or commit message.

Lower-prioritysqldb/v2: rename MigrationConfig to MigrationDescriptorby Viktor Torstensson · 9946d521 · Mar 31, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: rename MigrationConfig to MigrationDescriptor

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a simple code cleanup: it renames a data structure called MigrationConfig to MigrationDescriptor and updates related comments and field names. There is no change to how the program behaves, no bug fix, and no security relevance.

Lower-prioritysqldb/v2: clarify config options docsby Viktor Torstensson · 1819b986 · Mar 31, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: clarify config options docs

The documentation for the `SqliteConfig.MaxConnections`,
`PostgresConfig.MaxOpenConnections` and
`PostgresConfig.MaxIdleConnections` previously stated that an unlimited
number was used when the value was set to 0. This is not the case
however, as setting the value to 0 will result in the default values
being used.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only fixes three incorrect sentences in the user-facing documentation for database connection settings. It does not change any code behavior, defaults, or limits. There is no security issue in the commit itself.

Lower-prioritysqldb/v2: set predictable NewTestPgFixture container nameby Viktor Torstensson · 12d97cc4 · Mar 31, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: set predictable NewTestPgFixture container name

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit changes a test helper that spins up temporary PostgreSQL databases inside Docker containers during automated testing. It gives each container a predictable, test-specific name instead of letting Docker generate a random one. This only affects internal test infrastructure and does not change any production code, user-facing behavior, or network security.

Lower-prioritysqldb/v2: sync features with tapd's sqldb packageby Viktor Torstensson · 13d0cf11 · Mar 31, 2026 · 10 filesMessage 80 · StrongInformational 17Details
Commit message · Viktor Torstensson

sqldb/v2: sync features with tapd's sqldb package

In order to make it possible to replace `tapd`'s internal `sqldb`
package with the new generic `sqldb/v2` package, we need to make sure
that all features and functionality that currently exist in the `tapd`
package are also present in the new `sqldb/v2` package.

This commit adds such additional missing features to the `sqldb/v2`
package.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 17/100

This commit is a routine feature-sync between two internal database packages. It adds new configuration knobs, improves retry logic, updates a Postgres driver, and adds helper functions for SQL type conversions. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a code-maintenance and compatibility change.

Lower-prioritysqldb/v2: move Sqlite test helpers to separate fileby Viktor Torstensson · 422dd5d2 · Mar 31, 2026 · 2 filesMessage 60 · AdequateInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: move Sqlite test helpers to separate file

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit simply moves three SQLite test helper functions from one file to a new file. It is a code organization change with no functional changes to the actual Lightning Network node software. There is no security issue here.

Lower-prioritysqldb/v2: rename test db helper filesby Viktor Torstensson · afc1a675 · Mar 31, 2026 · 2 filesMessage 78 · AdequateInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: rename test db helper files

Previously, the test db helper files were suffixed with "_test", which
would indicate that the files specifically contained tests.
However, these files actually contain helper functions to be used
in tests, and are not tests themselves. To better reflect their
purpose, the files have been renamed to instead be prefixed with
"test_".

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit simply renames two test helper files from ending in '_test.go' to starting with 'test_'. The code inside the files is unchanged. It is a routine cleanup to make the file names better describe that these files contain helper utilities for tests, not actual tests. There is no security relevance.

Lower-prioritysqldb/v2: introduce sqldb/v2 `BaseDB`by Viktor Torstensson · 472deadc · Mar 31, 2026 · 7 filesMessage 68 · AdequateInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: introduce sqldb/v2 `BaseDB`

This commit updates the definition of the `BaseDB` struct to decouple
it from lnd`s `sqlc` package. We also introduce new fields to the struct
to make it possible to track the database type used at runtime.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine internal refactoring of the database helper code in LND's new sqldb/v2 package. It removes a dependency on the older sqldb/sqlc package, adds a way to track whether SQLite or Postgres is being used at runtime, and adds a flag to optionally skip database migrations. There is no indication this fixes or introduces a security vulnerability.

Lower-prioritysqldb/v2: clarify no_sqlite `SqliteStore` intentby Viktor Torstensson · 07fdd0f4 · Mar 31, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: clarify no_sqlite `SqliteStore` intent

The docs of the `SqliteStore` for no sqlite build environments
previously didn't clarify that the actual `SqliteStore` implementation
under such build tag environments, didn't actually implement a real
sqlite store. This commit clarifies that in the docs.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only adds a comment to source code explaining that a placeholder 'SqliteStore' struct exists solely to keep builds working when SQLite support is disabled. No code behavior changed, and there is no security issue.

Lower-prioritysqldb/v2: introduce `MigrationStream`by Viktor Torstensson · 1c833c5c · Mar 31, 2026 · 3 filesMessage 58 · ThinInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: introduce `MigrationStream`

This commit introduces a new struct named `MigrationStream`, which
defines a structure for migrations SQL migrations.

The `MigrationStream` struct contains the SQL migrations which will be
applied, as well as corresponding post-migration code migrations which
will be executed afterwards. The struct also contains fields which
define how the execution of the migrations are tracked.

Importantly, it is also possible to define multiple different
`MigrationStream`s which are executed, to for example define one `prod`
and one `dev` migration stream.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine code refactor that introduces a new data structure called MigrationSet (also referred to as MigrationStream in the title) for organizing database migrations. It does not fix a bug, change security logic, or alter how user data is handled. The changes are purely structural and include routine dependency updates.

Lower-prioritysqldb/v2: move all non lnd-specific v1 code to v2by Viktor Torstensson · d7a5127c · Mar 31, 2026 · 16 filesMessage 68 · AdequateInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: move all non lnd-specific v1 code to v2

This commit moves all non lnd-specific code of sqldb/v1 to the new
sqldb/v2 module.

Note however, that without additional changes, this package still needs
to reference lnd, as references to the lnd `sqlc` package is required
without further changes. Those changes will be introduced in the
upcoming commits, to fully decouple the new sqldb/v2 module from lnd.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a straightforward code reorganization: it copies existing, non-LND-specific database helper code from the sqldb/v1 module into a new sqldb/v2 module. There are no functional changes, bug fixes, or security patches visible in the diff. It is part of a larger refactoring to eventually decouple the database module from the rest of LND.

Lower-prioritysqldb/v2: Use `MigrationStream` for migrationsby Viktor Torstensson · b0c7c570 · Mar 31, 2026 · 12 filesMessage 68 · AdequateLow 32Details
Commit message · Viktor Torstensson

sqldb/v2: Use `MigrationStream` for migrations

This commit updates the `sqldb/v2` package to utilize the new
`MigrationStream` type for executing migrations, instead of passing
`[]MigrationConfig`'s directly.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 32/100

This commit refactors how LND's new sqldb/v2 package runs database migrations. It replaces a hand-rolled migration loop with a new MigrationStream abstraction, adds automatic SQLite backups before migrations, prevents accidental database downgrades, and rejects running migrations when the database is in a 'dirty' (partially failed) state. The changes are mostly defensive hardening and code cleanup rather than a fix for a known active vulnerability.

Lower-prioritysqldb/v2: add base for sqldb/v2 moduleby Viktor Torstensson · aa1725a8 · Mar 31, 2026 · 3 filesMessage 80 · StrongInformational 15Details
Commit message · Viktor Torstensson

sqldb/v2: add base for sqldb/v2 module

In the upcoming commits, we will introduce a new sqldb module, sqldb
version 2.

The intention of the new sqldb module, is to make it generalizable so
that it contains no `lnd` specific code, to ensure that it can be reused
in other projects.

This commit adds the base of the new module, but does not include any
implementation yet, as that will be done in the upcoming commits.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit creates a brand-new, empty code module called sqldb/v2. It only adds a Go module definition, dependency checksums, and a simple logging helper. There is no actual database logic, no user input handling, and no security-sensitive change.