LND

This commit only updates API documentation comments for the EstimateRouteFee feature. It clarifies that leaving the timeout field unset or setting it to zero causes a 60-second default to be used. No code behavior was changed.

This change strengthens the release process for LND by requiring timestamp proofs for final releases. It adds a GitHub Actions check that verifies certain OpenTimestamps files and signatures are present before a release is accepted. It is a defensive hardening improvement, not a fix for an active security flaw.

This commit updates the PostgreSQL database driver (pgx) and a few related Go libraries in a sub-module of the LND project. It is a routine dependency bump with no code changes. The commit message does not say it fixes a security issue, and no security advisory was provided. Dependency updates can sometimes fix hidden bugs or security flaws, but this patch alone does not prove a vulnerability exists or was being fixed.

This commit simply updates a database helper library (pgx) used by LND's key-value database module from version 5.7.4 to 5.9.2. Only version numbers in dependency files changed; no actual code was modified. There is no information in the commit itself saying this fixes a security problem, and no verified references were supplied.

This commit updates the PostgreSQL database driver (pgx) and several related Go libraries in a sub-module of the Lightning Network Daemon (LND). Dependency bumps like this are often done to pick up bug fixes, performance improvements, or security patches in upstream libraries. However, the commit message does not say it fixes a security issue, and no verified security advisory was provided. The change itself only modifies version numbers in package-management files, so we cannot confirm a specific vulnerability from the diff alone.

This commit simply updates the version of a third-party PostgreSQL database driver library (pgx) used by LND from version 5.7.4 to 5.9.2. The change only affects dependency files (go.mod and go.sum). There is no direct code change shown, and the commit message does not say why the update was made or whether it fixes any security issue. It could be a routine maintenance update, or it could be pulling in bug or security fixes from the upstream library, but that is not stated in the materials provided.

This commit updates the Prometheus monitoring library and related dependencies inside a developer tools module. It is a routine maintenance change with no direct security fix or code change to the main LND application. The update removes some old, unused dependency entries and refreshes checksums, which is normal housekeeping.

This commit removes a temporary security workaround in a Go module file. The workaround forced the use of a newer, fixed version of a compression library (xz) to avoid a known historical vulnerability. The commit message says the library is no longer used by this part of the project, so the workaround is no longer needed. By itself, removing the workaround does not introduce a vulnerability, but it means the project now relies on the normal dependency resolution to pick a safe version elsewhere.

This commit removes a now-unnecessary dependency override in a Go module file. The override was forcing the use of a newer, fixed version of the gogo/protobuf library, but the project's dependency graph now naturally selects that same fixed version, so the override is redundant. There is no functional code change and no security regression.

This commit is a routine dependency update. It bumps the project's custom protobuf (protocol buffer) code generator fork from version 1.33.0 to 1.36.11 of the upstream Google library, while keeping a Lightning Labs-specific tweak that displays raw bytes as hexadecimal in CLI JSON output. The only code changes are regenerated version strings in generated files; no application logic was modified.

This commit updates the Prometheus metrics library and several related Go module dependencies to newer versions. It is a routine dependency maintenance change, not a code-level security fix. The commit message does not describe any specific vulnerability being patched, and the diff only changes dependency version pins in go.mod and go.sum. While newer dependency versions can indirectly improve security by removing old, potentially vulnerable transitive packages, there is no direct evidence in the commit that this fixes a known security issue.

This commit updates the Prometheus monitoring library used inside the kvdb sub-module of LND. It is a routine dependency refresh that removes an old transitive dependency on an outdated version of gogo/protobuf. There is no direct code change, no disclosed vulnerability being fixed, and no indication this patch itself introduces a security problem.

This commit removes an old workaround in LND's dependency file (go.mod) that pinned a safe version of the 'xz' compression library. The workaround was originally added because another dependency once pulled in a vulnerable version of xz. The commit message says that dependency is no longer in LND's build graph, so the pin no longer does anything. There is no code change that introduces a vulnerability; it is cleanup of a stale configuration line.

This commit removes a now-unnecessary override in the project's dependency file. The override was originally added to force the use of a fixed version of the gogo/protobuf library, but the project already directly requires that fixed version, so the override had no practical effect. The effective dependency version remains unchanged, and no security-relevant behavior changes.

This commit simply updates the Go compiler and toolchain versions used to build LND from 1.25.10/1.26.3 to 1.25.11/1.26.4 across many configuration files, Docker images, and documentation. It contains no direct code changes. Such patch-level Go bumps are typically routine maintenance that may include upstream security fixes in the Go runtime, but the commit itself does not describe any specific vulnerability or attack.

This commit updates several Go module dependencies, most notably bumping the container runtime library 'runc' from version 1.1.14 to 1.2.8 (and 1.2.0 to 1.2.8 in one submodule). It also updates related indirect dependencies like urfave/cli, coreos/go-systemd, sirupsen/logrus, BurntSushi/toml, moby/sys/user, and golang.org/x/net. The commit message only says 'build: bump runc to v1.2.8' and does not mention any security issue. runc has had serious container escape vulnerabilities in the past, but this diff only shows routine dependency version bumps in module files—no actual code changes or explanation of what vulnerability is being fixed. So this looks like a normal maintenance update rather than a confirmed emergency security patch.

This is a tiny developer-tooling fix in a release helper script. It makes the script recognize GitHub remotes even when the repository owner name uses uppercase letters (e.g., 'LightningNetwork/lnd' instead of 'lightningnetwork/lnd'). It does not change any code that handles money, network messages, cryptography, or user data, and it does not create a security vulnerability.

This commit only changes a single version number in the source code, bumping the minor version from 0.20 to 0.21 and setting the patch to 99. It is a routine development housekeeping change with no security relevance.

This commit only cleans up test files by removing unused variable assignments and adding one missing error check. It does not change any production code that runs on real Lightning nodes, so it cannot directly affect live funds, network behavior, or security.

This commit simply turns on a code-quality linter called 'wastedassign' in the project's linting configuration. It does not change any application code, fix a bug, or alter runtime behavior. There is no security relevance.

This commit only changes the project's linting configuration file. It enables three Go code-quality linters (bodyclose, rowserrcheck, sqlclosecheck) that detect common resource-leak patterns, and reorganizes comments explaining why other linters remain disabled. It does not change any application code, fix any bug, or alter runtime behavior.

This commit removes unused variable assignments that were flagged by a Go linter. In two command-line handlers, it stops advancing an argument list that is never read again. In a Lightning channel function, it simplifies a swap to only assign the value that is actually used. There is no visible security relevance: no behavior changes, no bug fixes, and no disclosed vulnerability.

This commit is a routine code cleanup: it removes 53 lines of the form `x := x` inside Go loops and enables a linter to prevent them in the future. Since Go 1.22, loop variables are already scoped per-iteration, so these copies were unnecessary. The change does not alter program behavior or fix any security bug.

This commit is a cleanup-only change that removes unnecessary loop-variable copies in Go test files. Since Go 1.22, loop variables are already scoped per-iteration, so the old `x := x` workarounds are redundant. The change affects only test code, not the running LND node software, and does not alter any behavior or fix a security bug.

This commit adds a new test file that benchmarks a database operation (FetchInFlightPayments) using Postgres. It is purely a performance test/benchmark and does not change any production code, fix bugs, or alter security behavior.