rust-lightning

This commit fixes a privacy leak in Lightning onion messages. When building a blinded path with fake 'dummy' hops, the program previously did not always hide the size of the data carried at each hop. That made the dummy hops easy to spot, defeating their purpose. The patch adds a new padding mode so that every non-final hop is padded to the same length, keeping dummy hops indistinguishable from real ones. It also lets compact paths use this same minimal padding instead of skipping padding entirely.

This commit refactors how the Lightning Dev Kit tracks whether a BOLT12 invoice is tied to a Refund versus a regular InvoiceRequest. Previously, one shared context type was used for both, which could lead to ambiguous handling. The change splits that shared context into two distinct variants and adds checks so that Refund-only contexts are only accepted for Refund invoices and InvoiceRequest contexts only for Offer invoices. It is a hardening/correctness change rather than a clear-cut security fix, but it removes ambiguity that could in principle be abused to trick the code into accepting an invoice in the wrong context.

This commit only adds a pending changelog note. It documents that outbound payments waiting for a BOLT 12 invoice response will fail to complete after upgrading to version 0.3. There is no code change, no vulnerability, and no security fix in this commit itself.

This commit only adds a three-line documentation comment explaining when developers might want to use a specific message-routing helper. It does not change any code behavior, fix a bug, or alter security logic.

This commit changes how Lightning Dev Kit builds private 'blinded paths' used to route messages without revealing the recipient's exact location. It makes the default router choose shorter, more compact paths when the message is part of a BOLT 12 offer that might be encoded in a QR code, and longer, padded paths otherwise. The goal is to balance privacy with fitting data into QR codes and payment onions. The change itself is a privacy-tuning improvement, not a direct security bug fix, though it touches code that affects how easily a recipient can be identified.

This commit adds a small convenience helper that converts an LSPS5 webhook notification into a JSON string. It is purely a developer-experience improvement and does not change any security behavior.

This is a routine code cleanup that changes how a BOLT 11 invoice exposes its payment hash. Previously the function returned a raw SHA-256 hash object; now it returns a typed PaymentHash wrapper. All callers are updated to use the new type. There is no security bug being fixed here and no behavior change to the Lightning protocol logic.

This commit refactors how Lightning Dev Kit handles background verification of gossip data (the routing information nodes share). Previously, the gossip verifier, the gossip sync component, and the peer manager held circular references to each other, which could prevent memory from being freed when LDK was unloaded. The change replaces those circular references with a notification mechanism: the background processor now waits directly for a 'validation completed' signal. This is primarily a memory-leak and architectural cleanup, not a direct exploit fix, but it removes a design that could keep resources alive unexpectedly.

This commit refactors how Lightning Dev Kit handles asynchronous checks of Bitcoin transaction outputs (UTXOs) used to validate gossip messages about the network graph. Previously, resolving these checks required direct circular references between components, which could cause memory leaks when LDK was unloaded. The new design uses a notification/polling pattern instead, making the code cleaner and avoiding leaked objects. It is a defensive architectural fix rather than a patch for an active exploit.

This commit is a routine internal cleanup in the Lightning Dev Kit's gossip message handling code. It removes a method that let users set a UTXO (unspent transaction output) lookup provider after the object was created, because the codebase no longer needs that late-setup workaround. The change only affects how the code is structured and how tests are set up; it does not fix a security bug or introduce a known vulnerability.

This commit is a small internal cleanup in the Lightning Dev Kit Rust library. It changes how background tasks are notified when an asynchronous UTXO (unspent transaction output) lookup finishes, so that circular references between gossip-sync objects can eventually be removed. There is no direct security vulnerability being fixed here; it is a design refactor that may help prevent memory leaks in the future.

This commit is a straightforward internal code cleanup in the Lightning Dev Kit Rust library. It replaces several hand-written helper functions for waiting on 2, 3, or 4 background tasks with a single helper that accepts any number of tasks using Rust's standard iterator features. There is no indication this fixes a security bug or changes user-facing behavior.

This change turns on automatic cleanup of old, resolved Lightning channel monitoring data by default in LDK's background processor. Previously this cleanup existed but was not enabled by default because archiving a monitor too early could risk losing funds. After broader real-world use, the developers now enable it automatically on a timer, which helps prevent denial-of-service/resource-exhaustion issues caused by keeping stale monitors around forever. The commit itself is a defensive hardening change, not an active vulnerability fix.

This commit is a small internal cleanup in the Lightning Dev Kit's channel manager. It replaces calls to a more general force-close helper with a more specific helper meant for channels that have not yet been funded. The change removes duplicated parameters and makes the code clearer, but there is no direct evidence in the commit or supplied references that it fixes an active security vulnerability or changes externally observable behavior.

This commit is a minor code cleanup that changes how two error messages are formatted in Rust. It uses a newer, more concise syntax for embedding variables inside strings. There is no functional change and no security relevance.

This commit only renames several internal helper methods in the Lightning channel manager to make their purpose clearer (for example, 'convert_channel_err' becomes 'locked_handle_force_close'). No behavior changes, security fixes, or bug fixes are present in the diff.

This is a routine fix to an internal GitHub Actions CI workflow. The change ensures that when testing pull requests against the LDK Node project, the local copy of rust-lightning is patched in correctly even when LDK Node depends on it via a Git URL rather than crates.io. It has no effect on shipped code or user-facing security.

This commit simply moves a group of channel-closing helper methods to a different location within the same file. No code behavior was changed, so it has no security impact on its own.

This commit is a simple code cleanup: it turns an internal macro (a reusable code snippet) into a regular Rust method. The actual behavior of the program does not change. There is no security fix or vulnerability here.

This commit only adds one line to a shell script used in continuous integration. It tells the Clippy code-analysis tool to ignore a newly introduced lint about assertions on constant values. The change does not modify any actual Rust source code, runtime behavior, or security-sensitive logic.

This commit is purely a code-formatting cleanup. It uses rustfmt to rewrap long function signatures, break up long macro invocations, and adjust indentation in a single Rust source file. No logic, behavior, or security properties of the code were changed.

This commit is a straightforward internal code cleanup: it turns a Rust macro named convert_channel_err into a regular method on the ChannelManager struct. The logic inside the conversion stays the same, and all call sites are updated to use the new method. There is no change to user-facing behavior, network protocol handling, or security-sensitive checks.

This commit simply removes formatting-suppression annotations from several Rust methods. It does not change any executable code, logic, or security behavior. It is a code-style cleanup with no security relevance.

This commit is a straightforward code cleanup: it turns a small Rust macro used only for funded-channel error handling into a regular method. The behavior appears unchanged; the same internal function is called with the same arguments. There is no indication this fixes or introduces a security issue.

This is a small internal code cleanup in the Lightning Dev Kit's Rust implementation. It removes a rarely-used macro branch and replaces two calls with direct function calls. There is no visible security change: the same function runs, with the same arguments, in the same order. The commit message and diff give no indication of a bug fix or security issue.