LL
← All projectsLightning Labs

LND

Go implementation of a complete Lightning Network node.

BitcoinLightning NetworkNormal
Repository coverage

1400 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

142security candidates195second-pass queue1287AI analyses
87commits · 30 days
187commits · 60 days
610commits · 180 days
1241commits · 365 days
Backfill bands
Aug 5 → Feb 6405 seen5 candidatesComplete
Feb 6 → Jun 6665 seen28 candidatesComplete
Jun 6 → Jul 689 seen4 candidatesComplete
Jul 6 → Aug 569 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
322Strong · 80–100
656Adequate · 60–79
391Thin · 40–59
31Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Olaoluwa Osuntokun20942204474
Elle Mouton26832268167
ziggie44416413165
Yong28513171
LNBiG111173
Jared Tobin909171
bitromortac661153071
yyforyongyu83861068
Erick Cestari26726070
Andras Banki-Horvath11311072
Gijs van Dam33230073
ziggieXXX2126070
Analysis record

Published AI watches

Last scanned 41 minutes ago

Moderate 62 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11212 from ziggie1984/disable-legacy-channels

This change stops LND from opening new Lightning channels using the old 'legacy' commitment format. The legacy format makes it harder to recover funds if something goes wrong, because the money owed to you is tied to a secret key that chan…

Prevents opening new channels with the legacy commitment type, whose tweaked to_remote output complicates data-loss recoveryCloses a negotiation path where an empty channel_type TLV bypassed feature checks and forced a legacy channelAdds explicit RPC and wire rejection with a dedicated error code
112cb5f3by ziggieXXX+265−4716 files
Vendor flagged security relevance
Moderate 56 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11223 from gijswijs/legacy-dust-retribution-fix

This update fixes a bug in how LND handles old-style punishment transactions when a channel partner tries to cheat. Previously, tiny (dust) HTLCs were left as blank placeholder entries in the punishment data, which could cause the node to …

nil-pointer dereference risk in breach retribution pathlegacy revocation log handling inconsistency with modern formatdefensive hardening added for trimmed/dust HTLCs
500ca51fby ziggieXXX+168−146 files
No security note in commit
Moderate 62 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11190 from Roasbeef/zpay32-reject-duplicate-payment-hashes

This change tightens how LND reads Lightning invoices (BOLT 11). Previously, if an invoice contained more than one payment hash field, LND would silently keep the first one and ignore the rest. Now it rejects the invoice entirely. The rele…

Behavior change from 'use first duplicate field' to 'reject duplicate fields'New error type ErrDuplicatePaymentHash returned on duplicate payment hash fieldsMalformed/unsupported-length duplicate payment hash now treated as duplicate and rejected
86306f89by Yong+147−106 files
No security note in commit
Moderate 62 AI analysisMessage 98 · Strong
LL Lightning LabsLND BitcoinLightning Network

zpay32: reject duplicate payment hash fields

This change tightens how LND reads Lightning invoices. Previously, if an invoice contained more than one payment hash field, LND would silently keep the first valid one and ignore the rest. Now it rejects such invoices outright. This preve…

Behavioral change from silent first-field acceptance to explicit rejection of duplicate payment hash fieldsPrevents invoice parsing from depending on field ordering when multiple payment hashes are presentCovers malformed first field + valid second field, closing a potential bypass
e2f27063by Olaoluwa Osuntokun+147−106 files
Vendor flagged security relevance
Moderate 53 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11132 from yyforyongyu/task-11129-pong

This change fixes how LND answers network 'ping' messages from other Lightning nodes. Previously, LND would sometimes silently ignore valid pings to limit reply traffic, which violates the Lightning protocol (BOLT 1) and could make a peer …

Protocol compliance fix: BOLT 1 requires a Pong for every valid PingRemoved silent suppression of Pong replies that could cause peer timeout/misbehaviorUnified rate limiting now accounts for amplification bandwidth, not just ping count
d3d1f1d0by Olaoluwa Osuntokun+274−1715 files
Vendor flagged security relevance
Low 33 AI analysisMessage 90 · Strong
LL Lightning LabsLND BitcoinLightning Network

itest: stop creating legacy channels

This commit updates LND's integration tests to stop using an obsolete 'legacy' channel type and adds a test confirming that LND now rejects that legacy type. The commit message says the real fix is elsewhere in the same pull request: previ…

Deprecated commitment format (legacy) is now rejected by RPCTest added to verify legacy channel type is refusedUnused legacy node configuration flag removed
03d8b09dby ziggie+24−85 files
No security note in commit
Moderate 60 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11198 from gijswijs/amp-setlocal-reconstruction-fix

This change fixes a bug in LND's handling of AMP (Atomic Multi-Path) payments. Previously, if one partial payment set failed to reconstruct its secret preimage, the entire invoice was canceled, including unrelated partial payment sets from…

Denial-of-service against reusable static AMP invoices by causing unrelated accepted HTLC sets to be canceledIncorrect invoice state transition from set-local failure to global invoice cancellationAvailability impact on multi-payer AMP invoice scenarios
88959aecby Olaoluwa Osuntokun+155−44 files
Vendor flagged security relevance
Low 29 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11200 from ziggie1984/build-go-1.27.1

This commit updates the Go programming language version used to build LND from 1.25.13/1.26.6 to 1.26.8 (language version) and 1.27.1 (toolchain). It also regenerates many automatically generated RPC files and adjusts linter settings. The …

Go version bump may indirectly address unlisted runtime/standard-library security fixesLarge regenerated protobuf files suggest dependency/toolchain refresh rather than logic changeLinter configuration expanded to suppress new checks, consistent with a toolchain upgrade
ef4820e5by Olaoluwa Osuntokun+4932−412670 files
No security note in commit
Informational 15 AI analysisMessage 92 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: adopt focused golangci-lint v2.13 checks

This commit is a routine build-maintenance change. It updates the project's Go linter configuration to a newer version and fixes the resulting style warnings: a WebSocket header spelling and several documentation comments that didn't start…

bada7ea3by ziggie+27−1911 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnrpc: regenerate protos with Go 1.27

This commit is a housekeeping change that regenerates automatically generated RPC binding files using a newer Go compiler version. The only differences are in code comments (doc-comment formatting), not in actual program logic or API behav…

dd523108by ziggie+4501−369826 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: fix Go 1.27 compatibility

This commit is a routine build-and-test maintenance patch to make the LND codebase compile and pass tests with the upcoming Go 1.27 release. It upgrades the project's custom linter tool, refreshes many indirect tool dependencies, adjusts o…

No production code changesNo vulnerability fix or CVE reference presentDependency-only refresh in tools module (development tooling)
6b54a387by ziggie+365−3706 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: bump Go language and toolchain versions

This commit is a routine maintenance update that changes which version of the Go programming language is used to build the lnd project. It does not change any application logic, fix a bug, or address a security vulnerability. The project i…

b1f9ca66by ziggie+39−3930 files
No security note in commit
Moderate 60 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

invoices: cancel only the failing AMP set on reconstruction failure

This commit fixes a bug in LND's invoice handling for reusable AMP (Atomic Multi-Path) invoices. Previously, if one payment set failed to reconstruct its preimage, the entire invoice was canceled, even though other valid payment sets on th…

Denial-of-service-like availability impact: a malicious or buggy payer could cause a whole reusable AMP invoice to be canceled, blocking legitimate concurrent payersSet-local failure incorrectly escalated to invoice-global cancellationRegression test added for concurrent-set survival after reconstruction failure
d74ab6faby Gijs van Dam+141−42 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

bolt12: describe the lnwire dependency

This is a documentation-only change. A package comment was updated to accurately describe that the bolt12 codec library does depend on LND's lnwire package for low-level message types, while clarifying it still does not interact with the r…

5f53171dby bitromortac+3−21 file
No security note in commit
Moderate 60 AI analysisMessage 91 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: cover the amount overflow guard

This commit adds a test to ensure that when a BOLT 12 invoice is validated against a request, the multiplication of the offer amount by the requested quantity cannot overflow and wrap around to zero. Without this guard, a malicious or malf…

Integer overflow / wraparound in amount calculationMissing test coverage for security-critical branchBOLT 12 invoice amount validation
3c8e2bcbby bitromortac+47−01 file
Vendor flagged security relevance
Low 34 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11061 from bitromortac/2604-bolt12-1f

This commit adds the missing cryptographic signature layer for BOLT 12 offers in LND. It builds a Merkle tree from the message fields, signs that tree with a BIP-340 Schnorr signature, and now rejects invoice requests and invoices whose si…

Adds BIP-340 Schnorr signature verification for BOLT 12 invoice_request and invoice messagesMerkle tree commits to canonical re-encoded TLV records; non-minimal feature/amount encodings now rejected to preserve byte-exactnessSignature TLV type 240 and reserved range 240-1000 excluded from the signed Merkle root
1049d301by Yong+2076−7815 files
Vendor flagged security relevance
Low 35 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11125 from bhandras/codex/reorg-aware-output-lock-20260825

This commit adds a new optional wallet feature to LND that lets users lock UTXOs until the transaction spending them reaches a chosen confirmation depth, instead of relying on a wall-clock timeout. It is a feature addition with safety chec…

New RPC fields release_after_spend_confs and confirmed_spend_height added to LeaseOutput and FundPsbtCustom lock ID enforced as required for confirmation-controlled FundPsbt leases; all-zero and reserved internal IDs rejectedCapability check (ResolveOutputLeaser) prevents silent downgrade to time-only lease when confirmation control is requested
80dde144by Yong+1293−10021 files
No security note in commit
Informational 19 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10812 from ziggie1984/chanstate-kv-store-move

This commit is a large internal code reorganization for the LND Lightning node. It moves channel state storage logic from the `channeldb` package into a new `chanstate` package, while keeping the same database keys, serialization formats, …

Large refactoring with no change to cryptographic or consensus-critical logicCodec serialization moved verbatim to new package; wire format unchangedDatabase bucket keys and TLV record types preserved
62b0a073by Olaoluwa Osuntokun+3923−310924 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10804 from GeorgeTsagk/close-immediately-itest-lnd-7c38

This change fixes a data-handling bug in LND's channel-opening code. When opening a Lightning channel using an optional 'auxiliary funding controller' (used for custom channel types such as Taproot Assets), the funding manager was previous…

Data-correctness fix in funding handshake: negotiated channel configs now exposed to auxiliary funding controllerAuxiliary funding controller receives incomplete channel state before patch, complete state after patchNo explicit security claim, CVE, or advisory referenced in commit or supplied materials
1e127653by Olaoluwa Osuntokun+291−254 files
No security note in commit
Moderate 60 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: verify invoice_request and invoice signatures on read

This change makes LND's BOLT 12 invoice and invoice-request reader actually check that the digital signature is valid, instead of only checking that a signature field exists. Before, an attacker could craft or modify a BOLT 12 message and …

Missing cryptographic verification on parsed BOLT 12 messages replaced with BIP-340 Schnorr signature verificationReader accepted any 64-byte placeholder signature before the patchNew negative tests verify rejection of wrong-signer and tampered Merkle-root fields
aa8bd19fby bitromortac+272−723 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritygraph/db: add v2 policy fields to database layerby Elle Mouton · 0aa93c93 · Feb 13, 2026 · 3 filesMessage 68 · AdequateInformational 19Details
Commit message · Elle Mouton

graph/db: add v2 policy fields to database layer

Extend channel policy queries and structs to support v2-specific fields:

- Add BlockHeight field to track the block height for v2 policy updates.
- Add DisableFlags field for v2 channel disable messages.

Both fields are nullable (sql.NullInt64/Int16) to maintain backwards
compatibility with v1 channels. The fields are initialized as null in
updateChanEdgePolicy and threaded through all policy-related queries
(GetChannelBySCIDWithPolicies, ListChannelsByNodeID, UpsertEdgePolicy,
etc.) and the extractChannelPolicies helper.

This commit includes both the hand-written SQL query updates and the
corresponding sqlc-generated Go code.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This commit is a straightforward database schema plumbing change for the LND Lightning node. It adds two new optional fields—block height and disable flags—to the channel policy records so that a future protocol version (v2) can store extra information. The fields are always written as NULL for now, so the change does not by itself fix or introduce any security issue. It simply prepares the data layer for later feature work.

Security candidategraph/db: add version parameter to IsPublicNodeby Elle Mouton · 971c0f6e · Feb 13, 2026 · 6 filesMessage 78 · AdequateInformational 24Details
Commit message · Elle Mouton

graph/db: add version parameter to IsPublicNode

Make IsPublicNode version-aware by routing to the appropriate SQL
query based on gossip version. V1 and v2 have different criteria for
determining node publicity (v1 requires four signatures, v2 requires
one). Convert TestNodeIsPublic to versioned test for both protocols.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundary
AI analysis · Informational 24/100

This commit updates how LND decides whether a Lightning node is 'public' so that the decision respects the network's gossip protocol version. In the older v1 protocol, a node needed four signatures to be considered public; in the newer v2 protocol, one signature is enough. Previously the code always used the v1 rule, which could misclassify v2 nodes as private. The change is a correctness fix rather than an obvious remote-exploitable vulnerability, but misclassified publicity could affect routing, channel selection, or policy decisions.

Security candidatesqldb/sqlc: add IsPublicV2Node queryby Elle Mouton · a99604c7 · Feb 13, 2026 · 3 filesMessage 73 · AdequateInformational 3Details
Commit message · Elle Mouton

sqldb/sqlc: add IsPublicV2Node query

Add SQL query to determine if a node has public v2 channels. Unlike
v1 which requires all four individual signatures, v2 channels are
considered public when the single aggregated signature is present.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 3/100

This commit adds a new database query helper that checks whether a Lightning node has any 'version 2' public channels. It is purely additive and does not change any existing behavior or fix a known bug. There is no indication in the commit that this is a security patch.

Security candidatesqldb/sqlc: add AddV2ChannelProof queryby Elle Mouton · 315f5ed7 · Feb 13, 2026 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Elle Mouton

sqldb/sqlc: add AddV2ChannelProof query

Add SQL query to update the signature column for v2 channel auth proofs.
Unlike v1 which requires four separate signatures, v2 channels use a
single aggregated signature.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit adds a new database query to support v2 Lightning channel proofs. It simply updates a single signature column for v2 channels, whereas the older v1 proof format required four separate signatures. There is no security issue visible in the change itself.

Lower-prioritygraph/db: add version parameter to FetchChannelEdgesByID/Outpointby Elle Mouton · d88fa011 · Feb 13, 2026 · 4 filesMessage 73 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: add version parameter to FetchChannelEdgesByID/Outpoint

Make channel edge fetching version-aware by adding gossip version
parameter to FetchChannelEdgesByID and FetchChannelEdgesByOutpoint.
Add corresponding methods to VersionedGraph. V2 policy building is
marked as TODO.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine internal refactoring to prepare the LND channel graph database for future support of multiple gossip protocol versions. It adds a version parameter to two edge-lookup functions and makes the SQL store use that parameter instead of a hardcoded version. There is no security bug being fixed here and no behavior that would let an attacker do anything harmful.

Lower-prioritygraph/db: make TestPartialNode version-awareby Elle Mouton · dcd0b9da · Feb 13, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: make TestPartialNode version-aware

Convert TestPartialNode to a versioned test that runs for both v1 and
v2 gossip versions, ensuring shell node creation works correctly for
both channel types.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only changes a test file. It converts an existing single-version test into a versioned test that runs against both v1 and v2 gossip protocol versions. There is no change to production code, no bug fix, and no security-relevant behavior change.

Lower-prioritygraph/db: add version parameter to IsZombieEdgeby Elle Mouton · 03050a58 · Feb 13, 2026 · 5 filesMessage 78 · AdequateInformational 19Details
Commit message · Elle Mouton

graph/db: add version parameter to IsZombieEdge

Make IsZombieEdge version-aware and add corresponding method to
VersionedGraph. Convert TestEdgeInsertionDeletion to versioned test
using the createEdge helper for both v1 and v2 channel testing.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 19/100

This commit extends the channel graph database so that zombie-edge lookups know which gossip protocol version (v1 or v2) they are dealing with. Previously the code only checked v1 zombie records; now it can check the matching version. It is a correctness/refactoring change rather than a fix for an active vulnerability, but it removes a version-confusion bug class that could cause routing or channel-state mistakes in a multi-version Lightning network.

Lower-prioritygraph/db: refactor TestNodeIsPublic to use require assertionsby Elle Mouton · 86732fae · Feb 13, 2026 · 1 fileMessage 75 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: refactor TestNodeIsPublic to use require assertions

Replace verbose t.Fatal patterns with concise require assertions
following the project's testing guidelines.

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a pure test-code cleanup. It replaces verbose error-checking patterns in a single unit test with shorter, equivalent assertion helpers. There is no change to production code, no change to behavior, and no security relevance.

Security candidatemulti: update models.ChannelAuthProof with v2 fieldby Elle Mouton · 7a260ee1 · Feb 13, 2026 · 11 filesMessage 78 · AdequateLow 32Details
Commit message · Elle Mouton

multi: update models.ChannelAuthProof with v2 field

Also update it to more closely match the persisted version which has the
v1 and v2 only fields as optional.

Refactor ChannelAuthProof to support both v1 and v2 channel
announcements:

- Add Version field to distinguish v1 from v2 proofs
- Wrap v1-specific fields (NodeSig1/2, BitcoinSig1/2) in fn.Option
since v2 doesn't use them
- Add optional Signature field for v2's single schnorr signature
- Add constructor functions NewV1ChannelAuthProof and
NewV2ChannelAuthProof to enforce correct initialization
- Add getter methods (NodeSig1(), BitcoinSig1(), etc.) that safely
unwrap options, returning empty slices when not present

The IsEmpty() check is updated to handle both versions correctly.
Both stores validate v1-only for now.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarydefensive validationauthentication path
AI analysis · Low 32/100

This commit refactors how Lightning Network channel authentication proofs are represented in the lnd codebase. It adds support for a future v2 channel announcement format (using a single Schnorr signature) while keeping v1 (four ECDSA signatures) as the only currently supported version. The change is structural and preparatory; it does not appear to fix an active security bug, nor does it introduce obvious new vulnerabilities. Both database stores explicitly reject v2 proofs for now.

Lower-prioritygraph/db: add version parameter to DeleteChannelEdgesby Elle Mouton · a73189cc · Feb 13, 2026 · 5 filesMessage 73 · AdequateLow 27Details
Commit message · Elle Mouton

graph/db: add version parameter to DeleteChannelEdges

Thread the gossip version through DeleteChannelEdges to enable
version-aware channel deletion. The KVStore rejects non-v1 versions
while SQLStore properly passes the version to the underlying queries.
This prepares for v2 channel zombie handling (strict zombie pruning
for v2 is marked as TODO).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 27/100

This commit changes how LND deletes Lightning channel records from its graph database. It adds a 'version' parameter so the code can distinguish between older (v1) and newer (v2) channel announcement formats. Right now it mostly hard-codes v1 and explicitly rejects or errors on v2 in some paths, so it is a preparatory/refactoring change rather than a finished security fix. There is no evidence in the commit that this resolves an active vulnerability or that it was released as a security patch.

Lower-prioritygraph/db: add v2 channel announcement fields to ChannelEdgeInfoby Elle Mouton · 6842252b · Feb 13, 2026 · 2 filesMessage 73 · AdequateInformational 12Details
Commit message · Elle Mouton

graph/db: add v2 channel announcement fields to ChannelEdgeInfo

This commit extends ChannelEdgeInfo to support v2 (taproot) channel
announcements by adding:
- MerkleRootHash for the optional Merkle tree commitment
- ExtraSignedFields for additional signed TLV fields
- ChannelV2Fields struct to encapsulate v2-specific optional fields
- NewV2Channel constructor for creating v2 channel edges
- FundingPKScript handling for MuSig2 key aggregation with optional
taproot tweaks

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 12/100

This commit adds new data fields and code to support version 2 (Taproot) Lightning channels in LND's graph database. It does not fix a bug or close a security hole; it is a feature addition that lets the software understand and store newer channel announcement formats, including optional Merkle tree commitments and MuSig2 aggregated public keys. There is no indication in the commit or supplied references that this change addresses a security vulnerability.

Security candidategraph/db: update SQLStore to read and write v2 channelsby Elle Mouton · fa24d336 · Feb 13, 2026 · 2 filesMessage 78 · AdequateLow 30Details
Commit message · Elle Mouton

graph/db: update SQLStore to read and write v2 channels

Extends the SQL store to support v2 (taproot) channel announcements:
- Add version validation in AddChannelEdge
- Store v2-specific fields: FundingPkScript, MerkleRootHash, Signature
- Update buildEdgeInfoWithBatchData to reconstruct v2 channels from DB
with optional bitcoin keys and funding script handling
- Add WithMerkleRootHash edge modifier for ChannelV2Fields

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Low 30/100

This commit extends LND's SQL graph database to store and retrieve a newer type of Lightning channel announcement (called 'v2' or 'taproot' channels). It adds support for new fields like funding scripts, Merkle root hashes, and a single signature, and it replaces hard-coded 'v1 only' checks with version-aware logic. There is no direct evidence in the commit that this fixes an active security bug; it reads as a feature-completion change to support a new protocol version.

Security candidategraph/db: add version parameter to createEdge test helperby Elle Mouton · 6bb3bdc8 · Feb 13, 2026 · 1 fileMessage 88 · StrongInformational 15Details
Commit message · Elle Mouton

graph/db: add version parameter to createEdge test helper

Extend the createEdge test helper to accept a gossip version, enabling
creation of both v1 and v2 test channels. V2 channels include the
appropriate auth proof (single signature), merkle root hash, and
funding script fields.

88/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit only changes test code. It extends a helper function used in unit tests so it can create both old-style (v1) and new-style (v2) fake Lightning channels for testing. No production code is modified, so it cannot directly affect real users or funds.

Lower-prioritymulti: add and use V1 constructor for models.ChannelEdgeInfoby Elle Mouton · ba6222b5 · Feb 13, 2026 · 18 filesMessage 83 · StrongLow 27Details
Commit message · Elle Mouton

multi: add and use V1 constructor for models.ChannelEdgeInfo

This makes it clear what fields must/can be set for a V1 channel.

Introduce NewV1Channel constructor to create v1 channel edges with
proper initialization and validation. The constructor:

- Takes required fields (chanID, chainHash, node keys) as parameters
- Takes v1-specific fields (bitcoin keys, extra opaque data) via
ChannelV1Fields struct
- Accepts optional fields (capacity, channel point, features, proof)
via functional options (WithCapacity, WithChannelPoint, etc.)
- Validates that if an AuthProof is provided, its version matches the
channel version

This makes it clear which fields are required vs optional for v1
channels and prevents incorrectly initialized channel edges. All
tests and production code updated to use the constructor.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Low 27/100

This commit is a code-quality and safety refactor for LND's Lightning channel graph data structures. It introduces a single, controlled constructor for creating V1 channel records, replacing many places where fields were set by hand. The change makes it harder to accidentally create an invalid or inconsistent channel record, and adds a check that any attached proof matches the channel version. It is not an obvious security fix for an active vulnerability, but it reduces the risk of future bugs in how the network graph is built and validated.

Lower-prioritygraph/db: add FundingPKScript method on ChannelEdgeInfoby Elle Mouton · 06a669bc · Feb 13, 2026 · 4 filesMessage 73 · AdequateInformational 13Details
Commit message · Elle Mouton

graph/db: add FundingPKScript method on ChannelEdgeInfo

Add FundingPKScript() method that returns the funding output's
pkScript for the channel. The implementation is version-aware:

- V1: generates a 2-of-2 multisig P2WSH script from the two bitcoin
keys
- V2: will use taproot script (to be implemented)

This encapsulates the script generation logic and makes it clear
which bitcoin keys are being used. Replaces direct calls to
genMultiSigP2WSH with the cleaner method call.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 13/100

This commit is a routine code cleanup in LND's channel graph database. It moves the logic for generating a Bitcoin funding script into a dedicated method on a data structure, replacing a few direct helper function calls. There is no security fix or vulnerability here.

Lower-prioritymulti: add ToChannelAnnouncement helper on ChannelEdgeInfoby Elle Mouton · 830b9db6 · Feb 13, 2026 · 5 filesMessage 85 · StrongInformational 18Details
Commit message · Elle Mouton

multi: add ToChannelAnnouncement helper on ChannelEdgeInfo

So that we have one place that converts from our `models` struct to the
`lnwire.ChannelAnnouncement` struct.

The commit also refactors netann.CreateChanAnnouncement to only take a
ChannelEdgeInfo and get the proof from there instead of needing the
proof to be passed in separately.

Add ToChannelAnnouncement() method to ChannelEdgeInfo that converts
the model struct to a lnwire.ChannelAnnouncement1 message. This:

- Centralizes the conversion logic in one place instead of scattered
across multiple call sites
- Validates that AuthProof is present (can't create announcement
without proof)
- Currently only supports v1 channels, returning error for v2

Refactor netann.CreateChanAnnouncement to use this helper and remove
the separate chanProof parameter since proof is now accessed from
within ChannelEdgeInfo. This improves encapsulation and reduces
parameter count.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
defensive validation
AI analysis · Informational 18/100

This commit is a code cleanup: it moves the logic that builds a Lightning network channel announcement message into a single helper method on the channel data object. It also makes an existing function use that helper instead of duplicating the conversion code. There is no direct security fix here, but centralizing the logic reduces the chance of future bugs where different code paths build announcements differently. The helper also adds a small safety check that refuses to build an announcement if required proof data is missing.

Lower-prioritydocs: update release notesby Elle Mouton · 25bbb390 · Feb 13, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Elle Mouton

docs: update release notes

Update the Database section to reference both PRs that prepare the
graph DB for gossip v2 support:
- PR 10339: node handling
- PR 10379: channel handling (this PR)

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates the release notes documentation. It adds a second pull request link to an existing note about preparing the graph database for a future protocol feature (gossip v2). No code, logic, or configuration changes are present in the diff.

Lower-prioritygraph/db: make some ChannelEdgeInfo fields optionalby Elle Mouton · 44f41714 · Feb 13, 2026 · 4 filesMessage 73 · AdequateInformational 20Details
Commit message · Elle Mouton

graph/db: make some ChannelEdgeInfo fields optional

Since not all will be required for V2 channels.

Wrap BitcoinKey1Bytes and BitcoinKey2Bytes in fn.Option since these
fields are only required for v1 channel announcements. V2 channels may
or may not have bitcoin keys present in their announcement.

NewV1Channel constructor wraps the bitcoin keys with fn.Some().
All access sites updated to unwrap the options, using UnwrapOr for
non-critical paths and UnwrapOrErr where the keys must be present
(e.g., KV serialization, ToChannelAnnouncement).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 20/100

This commit changes how Lightning Network channel announcement data is stored so that two public-key fields (BitcoinKey1Bytes and BitcoinKey2Bytes) are now optional rather than always required. This is preparation for a newer channel-announcement format (V2) where those keys may not be present. The change itself is a data-model refactor, not a fix for an active bug or vulnerability. It adds explicit error handling when those keys are unexpectedly missing in places that still require them, which is a defensive improvement.

Lower-prioritygraph/db: expose version in maybeCreateShellNodeby Elle Mouton · b13b0bb9 · Feb 13, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: expose version in maybeCreateShellNode

Add a version parameter to maybeCreateShellNode to allow callers to
specify which gossip protocol version should be used when creating
shell nodes. Currently all callers pass GossipVersion1, but this
change sets up the foundation for v2 support.

Shell nodes are lightweight node entries containing only a protocol
version and public key, created before full node information is
available.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a small, straightforward code cleanup change. It adds a 'version' parameter to an internal helper function so that future code can choose between gossip protocol versions. Right now every caller still hardcodes version 1, so behavior is unchanged. There is no security issue visible in this commit.

Lower-prioritygraph/db: use route.Vertex for channel keysby Elle Mouton · 34f74c71 · Feb 13, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: use route.Vertex for channel keys

Replace [33]byte with route.Vertex for NodeKey1Bytes, NodeKey2Bytes,
BitcoinKey1Bytes, and BitcoinKey2Bytes in ChannelEdgeInfo. Since
route.Vertex is defined as [33]byte, this change is functionally
equivalent but provides better type safety and consistency with the
rest of the routing subsystem.

OtherNodeKeyBytes is also updated to return route.Vertex.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup in LND's channel graph database. It swaps one Go data type for another equivalent one (route.Vertex, which is defined as exactly the same 33-byte array) when storing public keys in channel records. There is no functional change, no bug fix, and no security-relevant behavior change.

AI review queuedmulti: add version to models.ChannelEdgeInfoby Elle Mouton · 4480352d · Feb 13, 2026 · 18 filesMessage 68 · AdequateInformational 19Details
Commit message · Elle Mouton

multi: add version to models.ChannelEdgeInfo

And set it to V1 version everywhere.

Add a Version field to ChannelEdgeInfo to distinguish between v1 and
v2 channel announcements. Set it to GossipVersion1 for all existing
channels.

Both KV and SQL stores now validate that only v1 channels are
currently supported, returning an error for v2 channels. The KV store
automatically sets version to v1 when deserializing (since all
persisted channels in KV format are v1).

This versioning is essential for handling the different field
requirements and validation logic between v1 and v2 channels.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validationsecond-pass: broader security terminology
AI analysis · Informational 19/100

This commit adds a version field to Lightning Network channel records and makes the code reject version 2 channels for now. It is a forward-looking structural change, not a fix for an active security bug. The new validation prevents the node from accidentally storing or relaying channel announcements it does not yet understand, which reduces the risk of future misbehavior but does not by itself stop any known current attack.

Lower-prioritygraph/db: add TestVersionedDBsby Elle Mouton · 7a5a5881 · Feb 13, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: add TestVersionedDBs

This will be used to run sub-tests with v2 data.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds and reorganizes test code. It introduces a new test helper that runs existing node database tests against both v1 and v2 gossip data formats, and refactors one existing test to use that helper. There is no change to production code, runtime behavior, or security-sensitive logic.

Lower-prioritygraph/db: introduce VersionedGraphby Elle Mouton · 4db51980 · Feb 13, 2026 · 9 filesMessage 50 · ThinInformational 15Details
Commit message · Elle Mouton

graph/db: introduce VersionedGraph

For now, all instances will use V1 only so as not to change behaviour
yet.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a straightforward internal refactoring in LND's channel graph code. It introduces a new VersionedGraph wrapper so that future support for multiple gossip protocol versions can be added cleanly. For now every call site is hard-coded to use the existing V1 gossip version, so observable behavior is unchanged. There is no security fix or vulnerability here.

Lower-prioritygraph/db: let node helpers take versionby Elle Mouton · d2b47cdb · Feb 13, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Elle Mouton

graph/db: let node helpers take version

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes test code. It updates helper functions in the graph database test file so they can create either version 1 or version 2 Lightning Network gossip nodes, and updates existing tests to explicitly request version 1 nodes. There is no change to production code, no bug fix, and no security-relevant behavior.

Lower-prioritygraph/db: add helper variable for testsby Elle Mouton · d8337be9 · Feb 13, 2026 · 3 filesMessage 70 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: add helper variable for tests

Add an isSQLDB variable that will let us quickly check in tests if the
backing DB is KVStore or SQLStore.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a test-only helper variable (isSQLDB) to three test setup files. It does not change any production code, network behavior, or security-sensitive logic. There is no security issue here.