LND

This commit removes a redundant flag called HaveNodeAnnouncement from LND's internal node records and replaces it with a simple rule: if a node has a stored signature, it has an announcement. It is a code-quality/refactoring change that eliminates two conflicting ways of answering the same question. There is no direct evidence in the commit that this fixes an active security vulnerability, but inconsistent state can historically lead to subtle bugs in how node information is stored, forwarded, or validated.

This commit is a straightforward code organization change. It adds a GossipVersion() method to several existing Lightning network gossip message types and updates their interfaces to require it. There is no bug fix, behavior change, or security patch visible in the diff.

This commit updates an OpenPGP public key file stored in the repository. The underlying cryptographic key material did not change; only the key's metadata (specifically its self-signatures and expiry dates) was refreshed to extend the key's validity period. There is no code change and no direct security vulnerability in the commit itself.

This change makes LND more forgiving when reading old payment failure records that contain slightly corrupted extra data fields. Previously, such records could cause the database read to fail entirely; now the code logs a warning and continues, leaving the failure message empty but preserving the rest of the record. It is a robustness fix rather than an active vulnerability patch.

This commit simply refreshes an expired PGP public key file used to verify software releases. The same cryptographic key is kept, but its expiration date is extended. There is no code change and no security vulnerability.

This commit is a routine build-maintenance change. It updates the version of the Go programming language used by the project's automated tests, release builds, Docker images, and documentation from Go 1.25.2 to Go 1.25.3 (and the minimum required Go version from 1.24.8 to 1.24.9). There are no code logic changes, no bug fixes, and no security patches in the project itself.

This commit is a routine build-maintenance change. It updates the Go compiler version used in CI, release pipelines, Docker images, and documentation from Go 1.24.6 to Go 1.25.2, and bumps the minimum Go version declared in go.mod files from 1.24.6 to 1.24.8. There are no code logic changes and no security fix or vulnerability patch is visible in the diff.

This commit adds a new optional 'inbound fee' field to an experimental Lightning Network message type called ChannelUpdate2. The commit message explicitly states this message type is not used in production, and the field uses a temporary placeholder type number (55555) with a TODO to pick the correct one later. There is no security issue visible in the change itself.

This commit refactors an internal LND gossip method to return a lazy iterator instead of a fully built list of network messages. The goal is to reduce memory use when syncing large amounts of routing gossip. It is a code-quality/performance change, not a fix for an active security bug. There is no evidence in the commit or supplied references that it addresses a disclosed vulnerability.

This commit fixes three places in the LND (Lightning Network Daemon) code where a map was being reset by assigning it to nil. The fix uses Go's `clear()` function instead, which empties the map while keeping the underlying map object. This is a code-correctness fix that prevents potential runtime panics if the same map variable is later used after a reset callback runs, but it is not a clear-cut exploitable security vulnerability based on the diff alone.

This commit is a massive repository import or initial commit adding the entire LND codebase plus CI, docs, and tooling. The PR title mentions relaxing a feature-bit check for peer features, but the supplied diff does not show any code changes related to that title—it only shows newly added files. There is no visible security patch or vulnerability fix in the provided materials.

This commit refactors how a Lightning network message (ChannelUpdate2) is encoded and decoded. Previously, the digital signature was a separate fixed field; now it is treated as just another TLV (Type-Length-Value) record inside the message. The change also preserves unknown fields that fall within the signed portion of the message so that signatures can still be validated correctly. There is no direct evidence in the commit that this fixes an active security bug, but it is a protocol-correctness change that could prevent signature-validation failures or message-malleability issues when future unknown fields are present.

This commit refactors how a new Lightning network message type (ChannelAnnouncement2) is encoded and decoded. Previously the message had a fixed signature field followed by a block of TLV data. Now the signature itself is placed inside the TLV stream, and the code distinguishes between fields that are covered by the signature and those that are not. The change is a protocol-structure update rather than a clear-cut bug fix, but it touches signature coverage and message parsing, which are security-sensitive areas.

This commit adds a new internal framework called PureTLVMessage to the Lightning Network wire protocol code. It is purely a code addition (no existing behavior is changed) and is designed to make future message formats more forward-compatible. There is no indication this commit fixes a security bug or introduces a vulnerability.

This commit adds a new documentation file explaining how SQL database schema updates should be written in LND. It contains no code changes, no configuration changes, and no fixes. It is purely a developer guide.

This commit swaps out one PGP public key for another in LND's release verification script. The old key belonged to the same person (ffranr/Robyn Ffrancon) and is no longer used; the new key is the current release signing key. There is no code vulnerability here—it's a routine key rotation. However, if someone could silently replace the key with an attacker's key, they could trick users into trusting fake LND releases. The commit itself appears legitimate and matches the stated purpose.