LL
← All projectsLightning Labs

LND

Go implementation of a complete Lightning Network node.

BitcoinLightning NetworkNormal
Repository coverage

1407 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

142security candidates195second-pass queue1287AI analyses
94commits · 30 days
194commits · 60 days
617commits · 180 days
1248commits · 365 days
Backfill bands
Aug 5 → Feb 6405 seen5 candidatesComplete
Feb 6 → Jun 6665 seen28 candidatesComplete
Jun 6 → Jul 689 seen4 candidatesComplete
Jul 6 → Aug 569 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
324Strong · 80–100
661Adequate · 60–79
391Thin · 40–59
31Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Olaoluwa Osuntokun20942204474
Elle Mouton26832268167
ziggie45016413165
Yong28513171
LNBiG111173
Jared Tobin909171
bitromortac661153071
yyforyongyu83861068
Erick Cestari26726070
Andras Banki-Horvath11311072
Gijs van Dam33230073
ziggieXXX2226070
Analysis record

Published AI watches

Last scanned 40 minutes ago

Moderate 62 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11212 from ziggie1984/disable-legacy-channels

This change stops LND from opening new Lightning channels using the old 'legacy' commitment format. The legacy format makes it harder to recover funds if something goes wrong, because the money owed to you is tied to a secret key that chan…

Prevents opening new channels with the legacy commitment type, whose tweaked to_remote output complicates data-loss recoveryCloses a negotiation path where an empty channel_type TLV bypassed feature checks and forced a legacy channelAdds explicit RPC and wire rejection with a dedicated error code
112cb5f3by ziggieXXX+265−4716 files
Vendor flagged security relevance
Moderate 56 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11223 from gijswijs/legacy-dust-retribution-fix

This update fixes a bug in how LND handles old-style punishment transactions when a channel partner tries to cheat. Previously, tiny (dust) HTLCs were left as blank placeholder entries in the punishment data, which could cause the node to …

nil-pointer dereference risk in breach retribution pathlegacy revocation log handling inconsistency with modern formatdefensive hardening added for trimmed/dust HTLCs
500ca51fby ziggieXXX+168−146 files
No security note in commit
Moderate 62 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11190 from Roasbeef/zpay32-reject-duplicate-payment-hashes

This change tightens how LND reads Lightning invoices (BOLT 11). Previously, if an invoice contained more than one payment hash field, LND would silently keep the first one and ignore the rest. Now it rejects the invoice entirely. The rele…

Behavior change from 'use first duplicate field' to 'reject duplicate fields'New error type ErrDuplicatePaymentHash returned on duplicate payment hash fieldsMalformed/unsupported-length duplicate payment hash now treated as duplicate and rejected
86306f89by Yong+147−106 files
No security note in commit
Moderate 62 AI analysisMessage 98 · Strong
LL Lightning LabsLND BitcoinLightning Network

zpay32: reject duplicate payment hash fields

This change tightens how LND reads Lightning invoices. Previously, if an invoice contained more than one payment hash field, LND would silently keep the first valid one and ignore the rest. Now it rejects such invoices outright. This preve…

Behavioral change from silent first-field acceptance to explicit rejection of duplicate payment hash fieldsPrevents invoice parsing from depending on field ordering when multiple payment hashes are presentCovers malformed first field + valid second field, closing a potential bypass
e2f27063by Olaoluwa Osuntokun+147−106 files
Vendor flagged security relevance
Moderate 53 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11132 from yyforyongyu/task-11129-pong

This change fixes how LND answers network 'ping' messages from other Lightning nodes. Previously, LND would sometimes silently ignore valid pings to limit reply traffic, which violates the Lightning protocol (BOLT 1) and could make a peer …

Protocol compliance fix: BOLT 1 requires a Pong for every valid PingRemoved silent suppression of Pong replies that could cause peer timeout/misbehaviorUnified rate limiting now accounts for amplification bandwidth, not just ping count
d3d1f1d0by Olaoluwa Osuntokun+274−1715 files
Vendor flagged security relevance
Low 33 AI analysisMessage 90 · Strong
LL Lightning LabsLND BitcoinLightning Network

itest: stop creating legacy channels

This commit updates LND's integration tests to stop using an obsolete 'legacy' channel type and adds a test confirming that LND now rejects that legacy type. The commit message says the real fix is elsewhere in the same pull request: previ…

Deprecated commitment format (legacy) is now rejected by RPCTest added to verify legacy channel type is refusedUnused legacy node configuration flag removed
03d8b09dby ziggie+24−85 files
No security note in commit
Moderate 60 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11198 from gijswijs/amp-setlocal-reconstruction-fix

This change fixes a bug in LND's handling of AMP (Atomic Multi-Path) payments. Previously, if one partial payment set failed to reconstruct its secret preimage, the entire invoice was canceled, including unrelated partial payment sets from…

Denial-of-service against reusable static AMP invoices by causing unrelated accepted HTLC sets to be canceledIncorrect invoice state transition from set-local failure to global invoice cancellationAvailability impact on multi-payer AMP invoice scenarios
88959aecby Olaoluwa Osuntokun+155−44 files
Vendor flagged security relevance
Low 29 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11200 from ziggie1984/build-go-1.27.1

This commit updates the Go programming language version used to build LND from 1.25.13/1.26.6 to 1.26.8 (language version) and 1.27.1 (toolchain). It also regenerates many automatically generated RPC files and adjusts linter settings. The …

Go version bump may indirectly address unlisted runtime/standard-library security fixesLarge regenerated protobuf files suggest dependency/toolchain refresh rather than logic changeLinter configuration expanded to suppress new checks, consistent with a toolchain upgrade
ef4820e5by Olaoluwa Osuntokun+4932−412670 files
No security note in commit
Informational 15 AI analysisMessage 92 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: adopt focused golangci-lint v2.13 checks

This commit is a routine build-maintenance change. It updates the project's Go linter configuration to a newer version and fixes the resulting style warnings: a WebSocket header spelling and several documentation comments that didn't start…

bada7ea3by ziggie+27−1911 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnrpc: regenerate protos with Go 1.27

This commit is a housekeeping change that regenerates automatically generated RPC binding files using a newer Go compiler version. The only differences are in code comments (doc-comment formatting), not in actual program logic or API behav…

dd523108by ziggie+4501−369826 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: fix Go 1.27 compatibility

This commit is a routine build-and-test maintenance patch to make the LND codebase compile and pass tests with the upcoming Go 1.27 release. It upgrades the project's custom linter tool, refreshes many indirect tool dependencies, adjusts o…

No production code changesNo vulnerability fix or CVE reference presentDependency-only refresh in tools module (development tooling)
6b54a387by ziggie+365−3706 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: bump Go language and toolchain versions

This commit is a routine maintenance update that changes which version of the Go programming language is used to build the lnd project. It does not change any application logic, fix a bug, or address a security vulnerability. The project i…

b1f9ca66by ziggie+39−3930 files
No security note in commit
Moderate 60 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

invoices: cancel only the failing AMP set on reconstruction failure

This commit fixes a bug in LND's invoice handling for reusable AMP (Atomic Multi-Path) invoices. Previously, if one payment set failed to reconstruct its preimage, the entire invoice was canceled, even though other valid payment sets on th…

Denial-of-service-like availability impact: a malicious or buggy payer could cause a whole reusable AMP invoice to be canceled, blocking legitimate concurrent payersSet-local failure incorrectly escalated to invoice-global cancellationRegression test added for concurrent-set survival after reconstruction failure
d74ab6faby Gijs van Dam+141−42 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

bolt12: describe the lnwire dependency

This is a documentation-only change. A package comment was updated to accurately describe that the bolt12 codec library does depend on LND's lnwire package for low-level message types, while clarifying it still does not interact with the r…

5f53171dby bitromortac+3−21 file
No security note in commit
Moderate 60 AI analysisMessage 91 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: cover the amount overflow guard

This commit adds a test to ensure that when a BOLT 12 invoice is validated against a request, the multiplication of the offer amount by the requested quantity cannot overflow and wrap around to zero. Without this guard, a malicious or malf…

Integer overflow / wraparound in amount calculationMissing test coverage for security-critical branchBOLT 12 invoice amount validation
3c8e2bcbby bitromortac+47−01 file
Vendor flagged security relevance
Low 34 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11061 from bitromortac/2604-bolt12-1f

This commit adds the missing cryptographic signature layer for BOLT 12 offers in LND. It builds a Merkle tree from the message fields, signs that tree with a BIP-340 Schnorr signature, and now rejects invoice requests and invoices whose si…

Adds BIP-340 Schnorr signature verification for BOLT 12 invoice_request and invoice messagesMerkle tree commits to canonical re-encoded TLV records; non-minimal feature/amount encodings now rejected to preserve byte-exactnessSignature TLV type 240 and reserved range 240-1000 excluded from the signed Merkle root
1049d301by Yong+2076−7815 files
Vendor flagged security relevance
Low 35 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11125 from bhandras/codex/reorg-aware-output-lock-20260825

This commit adds a new optional wallet feature to LND that lets users lock UTXOs until the transaction spending them reaches a chosen confirmation depth, instead of relying on a wall-clock timeout. It is a feature addition with safety chec…

New RPC fields release_after_spend_confs and confirmed_spend_height added to LeaseOutput and FundPsbtCustom lock ID enforced as required for confirmation-controlled FundPsbt leases; all-zero and reserved internal IDs rejectedCapability check (ResolveOutputLeaser) prevents silent downgrade to time-only lease when confirmation control is requested
80dde144by Yong+1293−10021 files
No security note in commit
Informational 19 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10812 from ziggie1984/chanstate-kv-store-move

This commit is a large internal code reorganization for the LND Lightning node. It moves channel state storage logic from the `channeldb` package into a new `chanstate` package, while keeping the same database keys, serialization formats, …

Large refactoring with no change to cryptographic or consensus-critical logicCodec serialization moved verbatim to new package; wire format unchangedDatabase bucket keys and TLV record types preserved
62b0a073by Olaoluwa Osuntokun+3923−310924 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10804 from GeorgeTsagk/close-immediately-itest-lnd-7c38

This change fixes a data-handling bug in LND's channel-opening code. When opening a Lightning channel using an optional 'auxiliary funding controller' (used for custom channel types such as Taproot Assets), the funding manager was previous…

Data-correctness fix in funding handshake: negotiated channel configs now exposed to auxiliary funding controllerAuxiliary funding controller receives incomplete channel state before patch, complete state after patchNo explicit security claim, CVE, or advisory referenced in commit or supplied materials
1e127653by Olaoluwa Osuntokun+291−254 files
No security note in commit
Moderate 60 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: verify invoice_request and invoice signatures on read

This change makes LND's BOLT 12 invoice and invoice-request reader actually check that the digital signature is valid, instead of only checking that a signature field exists. Before, an attacker could craft or modify a BOLT 12 message and …

Missing cryptographic verification on parsed BOLT 12 messages replaced with BIP-340 Schnorr signature verificationReader accepted any 64-byte placeholder signature before the patchNew negative tests verify rejection of wrong-signer and tampered Merkle-root fields
aa8bd19fby bitromortac+272−723 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityitest: estimate on-chain fee with selected inputsby Slyghtning · 422aa7d1 · Jan 7, 2026 · 2 filesMessage 45 · ThinInformational 14Details
Commit message · Slyghtning

itest: estimate on-chain fee with selected inputs

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 14/100

This commit only adds new integration tests for the EstimateFee RPC. It does not change any production code, wallet logic, or RPC behavior. There is no security issue here.

Lower-prioritycmd: EstimateFee for explicit inputsby Slyghtning · 44aa5efc · Jan 7, 2026 · 1 fileMessage 45 · ThinInformational 19Details
Commit message · Slyghtning

cmd: EstimateFee for explicit inputs

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 19/100

This commit adds a new command-line option to the `lncli estimatefee` command, allowing users to specify exact UTXOs (unspent transaction outputs) to use when estimating a transaction fee. Previously, the fee estimation relied on automatic coin selection. This is a feature addition that exposes an existing backend capability in the command-line tool; it does not, on its own, appear to fix or introduce a security vulnerability.

AI review queuedcmd: make types.go accessible in lnd packageby Slyghtning · e5456d39 · Jan 7, 2026 · 5 filesMessage 45 · ThinInformational 15Details
Commit message · Slyghtning

cmd: make types.go accessible in lnd package

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply moves a set of helper types and functions used for formatting Bitcoin transaction data from one internal package to another. It does not change what the code does, only where it lives in the project. There is no user-facing change and no security impact.

Lower-priorityrpcserver: return inputs in EstimateFeeResponseby Slyghtning · 280929ba · Jan 7, 2026 · 1 fileMessage 45 · ThinInformational 19Details
Commit message · Slyghtning

rpcserver: return inputs in EstimateFeeResponse

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 19/100

This commit updates the EstimateFee RPC in LND so that callers can optionally specify which wallet inputs (UTXOs) to use for the fee estimate, and the response now lists the inputs that were actually selected. It is a feature/enhancement change. There is no direct evidence in the commit that this fixes a security vulnerability; it mainly improves transparency and control for API users.

Lower-prioritylnrpc: transaction inputs in EstimateFeeRequestby Slyghtning · 049f2c73 · Jan 7, 2026 · 3 filesMessage 45 · ThinInformational 16Details
Commit message · Slyghtning

lnrpc: transaction inputs in EstimateFeeRequest

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 16/100

This commit only changes the API definition files (protobuf, generated Go code, and swagger JSON) for LND's EstimateFee RPC. It adds an optional 'inputs' field so callers can specify which transaction inputs to use when estimating fees, and the server can echo back the selected inputs. There is no server-side logic shown in this commit, and nothing in the commit message or diff indicates a security fix or vulnerability.

Security candidateserver: remove accountability signal experiment periodby elnosh · 6f49bea5 · Jan 6, 2026 · 7 filesMessage 73 · AdequateInformational 21Details
Commit message · elnosh

server: remove accountability signal experiment period

In the previous iteration with endorsement
signaling, the recommendation was for the sender to
set it to 1 and that could have had privacy concerns
when first deploying given that the default was to
downgrade the signal to 0. In the latest proposal
the recommended default for both sending and
forwarding nodes is to set `accountable` to 0.
As a result, the dates have been removed given
that there are no privacy risks associated
with relaying the signal with zero values.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
update trust
AI analysis · Informational 21/100

This commit removes a time-limited 'experiment period' for a new Lightning network signaling feature called 'accountable' (previously 'endorsement signal'). Previously, nodes would only relay this signal until a fixed date in 2026, after which they would stop. Now, because the latest protocol proposal says the default should be to send a zero/'unaccountable' value, there is no longer a privacy risk from relaying it, so the experiment end date is removed. The signal is now relayed whenever the feature is enabled, regardless of date. This is a protocol behavior change, not a fix for an exploitable security bug.

Security candidatemulti: rename experimental endorsement signal to accountableby elnosh · 34329c68 · Jan 6, 2026 · 21 filesMessage 73 · AdequateInformational 19Details
Commit message · elnosh

multi: rename experimental endorsement signal to accountable

Renames the endorsement signal to accountable to
match the latest proposal https://github.com/lightning/blips/pull/67

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathparser or protocol path
AI analysis · Informational 19/100

This commit is a pure rename of an experimental Lightning Network feature from 'endorsement' to 'accountable/accountability' to match a community proposal update. No security vulnerability is introduced or fixed; the underlying behavior, feature bits, TLV type, and experiment end date remain unchanged. It is a terminology and identifier refactor across 21 files.

Lower-prioritymulti: make sure previous inconsitent states are fixedby ziggie · d9fb9092 · Jan 6, 2026 · 4 filesMessage 65 · AdequateLow 46Details
Commit message · ziggie

multi: make sure previous inconsitent states are fixed

We make sure that nodes previously suffering from this error will
have a consitent db view when restarting their node.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Low 46/100

This commit adds a startup repair routine for the LND Lightning node database. It fixes cases where a previous bug could delete 'link node' records even though the node still had open payment channels. On startup, LND now scans for missing link nodes and recreates them so the database stays consistent. The commit itself is a repair/cleanup patch, not an active vulnerability fix, but it addresses the after-effects of a prior race-condition bug.

Security candidatechanneldb: fix race condition in link node pruningby ziggie · 51f3c6f5 · Jan 6, 2026 · 1 fileMessage 100 · StrongModerate 68Details
Commit message · ziggie

channeldb: fix race condition in link node pruning

This commit fixes a critical race condition in MarkChanFullyClosed and
pruneLinkNode where link nodes could be incorrectly deleted despite
having pending or open channels.

The race occurred because the check for open channels and the link node
deletion happened in separate database transactions:

Thread A: TX1 checks open channels → [] (empty)
Thread A: TX1 commits
Thread B: Opens new channel with same peer
Thread A: TX2 deletes link node (using stale data)
Result: Link node deleted despite pending channel existing

This creates a TOCTOU (time-of-check to time-of-use) vulnerability where
database state changes between reading the channel count and deleting
the node.

Fix for MarkChanFullyClosed:
- Move link node deletion into the same transaction as the channel
closing check, making the check-and-delete operation atomic

Fix for pruneLinkNode:
- Add double-check within the write transaction to verify no channels
were opened since the caller's initial check
- Maintains performance by keeping early return for common case
- Prevents deletion if channels exist at delete time

This ensures the invariant: "link node exists iff channels exist"
is never violated, preventing database corruption and potential
connection issues.

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
explicit security language
AI analysis · Moderate 68/100

This commit fixes a database race condition in LND (a Bitcoin Lightning Network implementation). When a channel closed, the software could incorrectly delete stored peer information ('link node') even though a new channel with that same peer had just been opened. The fix moves the 'check for open channels' and 'delete peer info' steps into the same database transaction, so they happen atomically and cannot be interrupted by another operation.

Lower-priorityfn: fix Result[T].FlatMapby Gijs van Dam · e7b9515e · Jan 6, 2026 · 2 filesMessage 86 · StrongLow 36Details
Commit message · Gijs van Dam

fn: fix Result[T].FlatMap

For a Result[T], FlatMap should apply f when the result is Ok, and
propagate the error unchanged when it's Err. The original code returns r
on Ok and tries to use r.left when Err, which is wrong. This commit
fixes that.

Secondly, the group of FlatMap/AndThen and OrElse functions and methods
are now properly tested with new unit tests.

fixes #10401

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Low 36/100

This commit fixes a logic bug in a small helper function called FlatMap used inside the LND codebase. FlatMap is supposed to transform a successful value and pass through failures unchanged. The old code did the opposite: it left successes alone and tried to transform failures, which could cause errors to be silently mishandled or successful values to be lost. The commit also adds unit tests to prevent the bug from returning.

Lower-priorityitest: fix endorsement itestsby ziggie · 5f307977 · Jan 5, 2026 · 3 filesMessage 80 · StrongInformational 15Details
Commit message · ziggie

itest: fix endorsement itests

Due to the signaling period expiring tests had to be adopted bc
they were not taking the activation time period into account.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only updates integration tests to account for an experimental feature's activation window expiring. It does not change production code behavior or fix any security vulnerability. The new helper checks whether the endorsement experiment is still active and adjusts test expectations accordingly.

Lower-prioritydocs: add release-notesby Erick Cestari · 52300298 · Dec 29, 2025 · 1 fileMessage 40 · ThinInformational 15Details
Commit message · Erick Cestari

docs: add release-notes

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only edits the release notes document for version 0.21.0. It describes a previously merged fix that makes certain data-parsing routines stricter about record sizes, and it adds a contributor name. The commit itself changes no program code, so it cannot directly introduce or fix a security issue.

Lower-prioritymulti: enforce strict TLV length checksby Erick Cestari · 5a792500 · Dec 29, 2025 · 10 filesMessage 78 · AdequateModerate 64Details
Commit message · Erick Cestari

multi: enforce strict TLV length checks

This commit improves TLV decoding safety and consistency across multiple
packages by enforcing fixed-length requirements and adding unit tests to
prevent malformed TLV records from being accepted.

Changes include:

- lnwire:
* Enforce 8-byte length in Fee TLV decoder.
* Enforce PubNonceSize in Musig2Nonce TLV decoder.
* Enforce 8-byte length in ShortChannelID TLV decoder.
* Added roundtrip and invalid length tests for Fee, Musig2Nonce,
and ShortChannelID records.

- routing/route:
* Enforce Vertex TLV length (33 bytes).
* Added encode/decode and invalid length tests for Vertex.

- tlv:
* Enforce correct length in DBytes33 decoder (33 bytes).
* Added tests ensuring all fixed-size primitive decoders reject
incorrect TLV lengths.

By strictly validating TLV lengths, we prevent malformed or corrupted
TLV records from being silently accepted, improving protocol safety.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Moderate 64/100

This commit tightens validation for a message-encoding format (TLV) used inside the Lightning Network daemon lnd. Previously, several decoders would accept a record whose declared length did not match the fixed size they expected, which could let malformed or corrupted data be silently processed. The patch now rejects wrong-length records and adds tests to prove it. It is a defensive hardening change rather than a fix for a publicly disclosed exploit.

Lower-prioritypeer: fix log output when not applicableby ziggie · 4d1faabd · Dec 25, 2025 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · ziggie

peer: fix log output when not applicable

Before we would always log that the peer was not ready starting
up although it was not the case. We now make sure we still log
this case but only when applicable.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit fixes a minor logging issue in LND's peer connection code. Previously, the software would always print a debug message saying it was waiting for a peer to finish starting up, even when that wasn't true. The change makes the log message appear only in the actual waiting case. There is no security impact.

Lower-prioritydocs: add release noteby Abdullahi Yunus · 68f558c8 · Dec 24, 2025 · 1 fileMessage 40 · ThinInformational 15Details
Commit message · Abdullahi Yunus

docs: add release note

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds a line to the release notes describing a previous performance improvement. It does not change any code, configuration, or behavior. There is no security issue here.

Lower-prioritygraph: use UNION for isPublicNode queryby Abdullahi Yunus · ac2cec46 · Dec 23, 2025 · 2 filesMessage 68 · AdequateInformational 19Details
Commit message · Abdullahi Yunus

graph: use UNION for isPublicNode query

In this commit we updated the IsPublicV1Node query to use UNION
instead of OR, since sqlite struggles to efficiently use
multiple indexes in a single query involving OR conditions across
different columns.

We use UNION ALL since the query doesn't care about duplicates.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This commit rewrites a single database query so that it checks two possible relationships as separate sub-queries combined with UNION ALL, instead of using OR inside one JOIN condition. The goal is to make SQLite run the query faster by using its indexes better. The result returned to the application is unchanged, so this is a performance fix, not a security fix.

Lower-prioritygraphdb: add benchmark for isPublicNode queryby Abdullahi Yunus · 86cde4b9 · Dec 23, 2025 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Abdullahi Yunus

graphdb: add benchmark for isPublicNode query

In this commit we add a benchmark to test the performance of
IsPublicNode query.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a new performance benchmark test for an existing database query. It does not change any production code, fix any bug, or alter any behavior that users or attackers could interact with.

Lower-prioritylntest: make sure HTLCs are locked in when sending a paymentby ziggie · ece84690 · Dec 21, 2025 · 1 fileMessage 83 · StrongInformational 17Details
Commit message · ziggie

lntest: make sure HTLCs are locked in when sending a payment

Before this change, CompletePaymentRequestsNoWait would return as
soon as the channel's NumUpdates increased by at least one. When
sending multiple payments, this meant the function could return
while some HTLCs were still in-flight and not yet committed to the
channel state.

The problem occurred when tests captured the channel state
immediately after calling this function. Even though we read the
current NumUpdates from the channel, HTLCs could still be in the
process of being committed. This led to a race where the channel
would progress to a new state after we thought we had correctly
captured it, causing tests to see unexpected commitment heights.

Fix this by waiting for all outgoing HTLCs to appear in
PendingHtlcs before returning. We count outgoing HTLCs before
sending, then wait until exactly len(paymentRequests) new HTLCs
are present. This guarantees all payments have fully completed
their commitment exchange and are locked in on both sides.

Fixes the flaky revokedCloseRetributionRemoteHodlCase test where
backups would capture state at height N+1 instead of the expected
height N.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 17/100

This commit fixes a timing bug in LND's internal test helper. The helper previously returned too early when sending test payments, before all payment commitments were fully recorded on the channel. This caused occasional flaky test failures because tests captured channel state at the wrong moment. The fix makes the helper wait until every sent payment appears as a pending HTLC. There is no indication this affects real user funds or production code paths.

AI review queueditest: accept NO_ROUTE or TIMEOUT in testLocalClaimOutgoingHTLCby ziggie · c493f7d9 · Dec 18, 2025 · 2 filesMessage 95 · StrongInformational 15Details
Commit message · ziggie

itest: accept NO_ROUTE or TIMEOUT in testLocalClaimOutgoingHTLC

Fix flaky test due to race between channel closure propagation and
payment timeout. Both failure reasons are correct depending on timing.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit only changes an integration test to accept either of two valid failure reasons for a payment, fixing a flaky test. It does not change production code or fix a security vulnerability.

Lower-prioritydocs: add release-notes for LND 20.1by ziggie · e5b0704d · Dec 16, 2025 · 1 fileMessage 57 · ThinInformational 16Details
Commit message · ziggie

docs: add release-notes for LND 20.1

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 16/100

This commit only edits the release notes document for LND 0.20.1. It adds a description of a previously merged bug fix (PR #10449) that could cause startup failures due to timestamp comparison issues. The commit itself does not change any executable code, so it cannot directly introduce or fix a security vulnerability. It is purely documentation.

Lower-priorityserver: fix timestamp comparison in setSelfNodeby ziggie · 865e1556 · Dec 16, 2025 · 2 filesMessage 68 · AdequateLow 34Details
Commit message · ziggie

server: fix timestamp comparison in setSelfNode

Fix bug where setSelfNode compared only the seconds component of
timestamps instead of the full timestamp. This caused the node to
attempt persisting an older timestamp than what existed in the
database during restart, resulting in "sql: no rows in result set"
errors.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 34/100

This commit fixes a bug in the LND Lightning node where it compared only the seconds part of timestamps (e.g., the :30 in 12:00:30) instead of the full Unix timestamp when deciding whether to update its own network announcement. Because of this, a node could try to save an announcement with an older timestamp than what was already in its database, which the database rejected with a 'no rows in result set' error. The fix makes the comparison use the full timestamp, preventing restart failures and ensuring the node can rejoin the network properly.

AI review queuedchancloser: stabilize remote RBF coop testsby Boris Nagaev · d47d86ce · Dec 14, 2025 · 1 fileMessage 98 · StrongInformational 15Details
Commit message · Boris Nagaev

chancloser: stabilize remote RBF coop tests

CI started panicking in TestRbfChannelFlushingTransitions/early_offer /
TestRbfCloseClosingNegotiationRemote (see GitHub Actions run
https://github.com/lightningnetwork/lnd/actions/runs/19155841408/job/54756127218?pr=10352)
because the cached remote offer could fire before the test harness
registered its mock CloseSigner expectations. When that happened,
the mock complained that CreateCloseProposal was unexpected:

panic:
assert: mock: I don't know what to return because the method call was unexpected.

Fix this by having assertSingleRemoteRbfIteration take a sendEvent callback
that receives the context and initial offer, so tests can install expectations
first and then fire the event via SendEvent (or the early-offer test's custom
flush sender).

Reproduction (on master)
------------------------
1. Modify lnwallet/chancloser/rbf_coop_test.go
Add time.Sleep(10 * time.Millisecond) before the first call of
closeHarness.assertSingleRemoteRbfIteration (in function
TestRbfChannelFlushingTransitions).

2. go test ./lnwallet/chancloser -run TestRbfChannelFlushingTransitions/early_offer

3. The panic reproduces immediately.

98/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit fixes a flaky test in LND's cooperative channel-closing code. The test sometimes panicked because an event arrived before the test had finished setting up its mock objects. The change lets tests install mock expectations first and then trigger the event, making the test suite more reliable. It does not change production code or fix a security vulnerability.

Lower-priorityrouterrpc: fix comment in lsp heuristicby ziggie · 5580c40c · Dec 14, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · ziggie

routerrpc: fix comment in lsp heuristic

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes two comments in the source code. It corrects a misleading description: the code actually selects the route with the highest fee, not the cheapest route. No program logic, behavior, or security boundary is changed.

Lower-priorityci: fix some minor issues in the backport ci jobby ziggie · dbb3a9e9 · Dec 14, 2025 · 2 filesMessage 92 · StrongInformational 15Details
Commit message · ziggie

ci: fix some minor issues in the backport ci job

-Due to a newer version we need to use add_labels instead of just
labels

-The backport PR will now also copy the milestones in case the
milstones were set

92/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit is a routine maintenance fix for the project's automated GitHub workflow that creates backport pull requests. It updates a configuration option name from 'labels' to 'add_labels' to match a newer version of the workflow action, and enables copying of milestone settings from the original pull request to the backport. There is no change to the actual Lightning Network node software or anything that could affect user funds or network security.

Lower-priorityci: add automated backport workflowby ziggie · 7ecdb9b8 · Dec 12, 2025 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · ziggie

ci: add automated backport workflow

This commit introduces an automated GitHub Actions workflow to streamline
the backporting process for merged PRs from master to release branches.

Key features:
- Triggers on merged PRs with labels matching 'backport-v*' pattern
(e.g., backport-v0.20.x-branch)
- Validates that target branches exist before attempting backport
- Creates separate backport PRs for each target branch
- Automatically adds 'no-changelog' label to backport PRs
- Handles merge conflicts by creating draft PRs with conflict markers
- Supports multiple simultaneous backports via multiple labels

Workflow steps:
1. Checkout repository with full git history
2. Validate all target branches exist in the remote repository
3. For each valid backport label:
- Create a new branch (backport-<pr-num>-to-<target-branch>)
- Cherry-pick commits from the master PR
- Create a new PR targeting the release branch
- Link back to the original PR
4. If conflicts occur, create a draft PR for manual resolution

Label format:
- Valid: backport-v0.20.x-branch, backport-v0.19.x-branch
- Invalid: backport candidate, backport-candidate, backport-needed

This automation reduces manual work and ensures consistency in the
backporting process while maintaining full visibility and control
for maintainers.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
defensive validationdocumentation-only discount
AI analysis · Informational 15/100

This commit adds a GitHub Actions automation script that helps developers copy approved code changes from the main development branch to older release branches. It is purely a process improvement for maintainers and does not change any wallet, networking, or cryptographic code in the LND application itself.