LND

This commit updates the Prometheus metrics library and several related Go module dependencies to newer versions. It is a routine dependency maintenance change, not a code-level security fix. The commit message does not describe any specific vulnerability being patched, and the diff only changes dependency version pins in go.mod and go.sum. While newer dependency versions can indirectly improve security by removing old, potentially vulnerable transitive packages, there is no direct evidence in the commit that this fixes a known security issue.

This commit updates the Prometheus monitoring library used inside the kvdb sub-module of LND. It is a routine dependency refresh that removes an old transitive dependency on an outdated version of gogo/protobuf. There is no direct code change, no disclosed vulnerability being fixed, and no indication this patch itself introduces a security problem.

This commit is a routine dependency update. It bumps the project's custom protobuf (protocol buffer) code generator fork from version 1.33.0 to 1.36.11 of the upstream Google library, while keeping a Lightning Labs-specific tweak that displays raw bytes as hexadecimal in CLI JSON output. The only code changes are regenerated version strings in generated files; no application logic was modified.

This commit removes a now-unnecessary override in the project's dependency file. The override was originally added to force the use of a fixed version of the gogo/protobuf library, but the project already directly requires that fixed version, so the override had no practical effect. The effective dependency version remains unchanged, and no security-relevant behavior changes.

This commit simply updates the Go compiler and toolchain versions used to build LND from 1.25.10/1.26.3 to 1.25.11/1.26.4 across many configuration files, Docker images, and documentation. It contains no direct code changes. Such patch-level Go bumps are typically routine maintenance that may include upstream security fixes in the Go runtime, but the commit itself does not describe any specific vulnerability or attack.

This commit only cleans up test files by removing unused variable assignments and adding one missing error check. It does not change any production code that runs on real Lightning nodes, so it cannot directly affect live funds, network behavior, or security.

This commit simply turns on a code-quality linter called 'wastedassign' in the project's linting configuration. It does not change any application code, fix a bug, or alter runtime behavior. There is no security relevance.

This commit removes unused variable assignments that were flagged by a Go linter. In two command-line handlers, it stops advancing an argument list that is never read again. In a Lightning channel function, it simplifies a swap to only assign the value that is actually used. There is no visible security relevance: no behavior changes, no bug fixes, and no disclosed vulnerability.

This commit is a routine code cleanup: it removes 53 lines of the form `x := x` inside Go loops and enables a linter to prevent them in the future. Since Go 1.22, loop variables are already scoped per-iteration, so these copies were unnecessary. The change does not alter program behavior or fix any security bug.

This commit only adds new benchmark test files for measuring how fast the code can list currently unfinished Lightning payments from the database. It does not change any production code, user-facing behavior, or security-sensitive logic. There is nothing here that could be exploited or that weakens security.

This commit adds input validation to BOLT 12 offers in the LND Lightning node. BOLT 12 offers are payment requests that one node can present to another. Before this change, LND could accept or re-encode malformed offers that violated the protocol rules, such as offers with no usable payment path, expired offers, invalid currency codes, or hidden unknown required fields. The new code rejects these on both reading and writing, which helps prevent nodes from acting on bad offers or producing invalid ones.

This commit adds new code for encoding and decoding BOLT 12 'offers' in the LND Lightning node. It is a feature-introduction commit with no bug fix or security patch. There is no direct evidence in the commit or supplied references that this change fixes a vulnerability or introduces one.

This commit updates the Go compiler/toolchain version used to build the LND Lightning node from Go 1.25.5 to Go 1.26.3, and bumps the minimum Go language version declared in module files from 1.25.5 to 1.25.10. It also swaps one Windows release target from 32-bit ARM to 64-bit ARM. There is no code change to LND itself. The main security relevance is that newer Go patch releases typically fix bugs and security vulnerabilities in the Go runtime and standard library, so staying current is good defensive hygiene. However, the commit message does not say this is a security fix, and no specific vulnerability is named.

This commit is a follow-up test and release-note patch for a previously fixed LND bug. The underlying issue was that subscribers listening for channel close events would not receive the 'CLOSED_CHANNEL' notification until a cooperative close transaction had been buried several blocks deep, instead of being told immediately when the close first appeared on-chain. The commit itself only adds unit tests and an integration test that prove the fix works, plus a release-note entry describing the restored behavior. It does not change production code, so it cannot introduce a new exploitable vulnerability on its own.

This commit removes an unused data field called FreshFlush from the cooperative channel-closing logic. The field was always set to true and never actually checked by any code, so deleting it is a cleanup change with no security effect.

This commit only changes a test file. It adds a safety check to make sure a function called during cooperative channel closes is always given a real transaction, not a blank one. The test now records every call and fails if any call has a nil transaction. It does not change the actual production code that users run, so it cannot by itself fix or introduce a live bug.

This commit cleans up how LND records that a Lightning channel is being closed cooperatively. Previously, the code would mark a channel as 'cooperatively closed' before an actual closing transaction existed, storing a placeholder 'nil' transaction. That created a confusing in-between state in the database. The change removes those premature marks and now requires a real, non-nil closing transaction before the status is set. It also updates restart logic so the node can still recover an unfinished close from other stored information. The commit is defensive hardening rather than a fix for an active exploit.

This is a routine dependency cleanup. The project was using a standalone PostgreSQL connection helper package (pgconn) that has been merged into the main pgx database driver package in version 5. The change updates two source files to import pgconn from its new location and removes the old standalone package from the module files. There is no functional code change and no security fix or vulnerability introduced.

This is a routine dependency cleanup. The project switched from a standalone PostgreSQL connection package to the version bundled inside the newer pgx v5 library. Only import paths and the dependency list changed; no program logic was modified. There is no indication this fixes or introduces a security vulnerability.

This commit only updates a dependency version number in LND's package list (go.mod and go.sum). It bumps the 'neutrino' library from version 0.16.2 to a newer pre-release snapshot. The commit itself contains no code changes, no description of why the update is needed, and no mention of security issues. Without seeing what actually changed inside the neutrino library, we cannot tell whether this is a routine maintenance update or a security fix.

This is a small internal refactoring change. It swaps out a specific database type for a narrower interface in a few RPC configuration structs. There is no user-facing behavior change, no bug fix, and no security-relevant change visible in the diff.

This is a small internal code cleanup change in LND's contract court. It swaps a broad database dependency for a narrower interface that only exposes what the breach arbitrator actually needs: reading closed channels and marking a channel fully closed. There is no direct security fix, new feature, or behavior change visible in the diff. It reduces the code's attack surface by limiting what the breach arbitrator can access, but the change alone does not close any known vulnerability.

This commit is a straightforward internal code cleanup: it swaps a specific database type for a narrower interface in one part of the Lightning Network Daemon (LND). It does not change user-facing behavior, fix a bug, or alter security logic. There is no indication this is a security patch.

This is a small internal code cleanup in LND's funding manager. It replaces a direct dependency on a specific database type with a narrower interface (chanstate.Store). There is no functional change visible in the diff, no bug fix, and no security-relevant behavior change.

This commit tightens validation in LND when another node asks to open a Lightning channel. It now rejects requests where the proposed 'push' payment is larger than the entire channel funding, as the Lightning protocol (BOLT-02) already requires. Before this change, such oversized pushes were only caught later in the process, after extra setup work. The change is a defensive hardening fix, not an active exploit patch, and the commit message frames it as spec compliance rather than a security vulnerability.