LDK
← All projectsLightning Dev Kit

rust-lightning

Composable Rust libraries for building Lightning wallets, nodes, and services.

BitcoinCryptographic librariesLightning NetworkNormal
Repository coverage

1497 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

225security candidates209second-pass queue1479AI analyses
74commits · 30 days
208commits · 60 days
663commits · 180 days
1491commits · 365 days
Backfill bands
Aug 5 → Feb 6819 seen18 candidatesComplete
Feb 6 → Jun 6468 seen16 candidatesComplete
Jun 6 → Jul 6128 seen8 candidatesComplete
Jul 6 → Aug 561 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

69/100 average clarity
359Strong · 80–100
790Adequate · 60–79
288Thin · 40–59
60Opaque · 0–39
3security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Elias Rohrer15315153667
Matt Corallo35847356473
Jeffrey Czyz17741177168
Wilmer Paulino14939149169
Leo Nash11613116162
Valentine Wallace13710135169
Vincenzo Palazzo10210184
Joost Jager16224162069
elnosh301330056
shaavan22622069
Carla Kirk-Cohen78366068
benthecarman18318071
Analysis record

Published AI watches

Last scanned 42 minutes ago

Low 32 AI analysisMessage 91 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Only fetch TXIDs instead of entire block during gossip verification' (#4846)

This commit changes how the Lightning Dev Kit's block-sync module verifies Lightning network gossip announcements. Instead of downloading entire Bitcoin blocks (which can be large), it now downloads only the list of transaction IDs for a b…

API surface change in UtxoSource traitReduced data exposure: no longer fetches full blocks for gossip verificationNew JSON parsing for txid lists and TxOut values
ebe7a447by Matt Corallo+275−1025 files
No security note in commit
Low 35 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Allow filtered block rescans at the current tip' (#4847)

This commit changes how the Lightning Dev Kit (LDK) node software handles receiving the same block twice through its filtered-block interface. Previously, calling filtered_block_connected with the current tip again would trigger an asserti…

Assertion relaxation in block connection pathPotential denial-of-service vector removed: previously a malicious or buggy filter provider could crash the node by replaying the current tipNew test coverage for same-block filtered rescan
54ddbd0bby Matt Corallo+177−486 files
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add test framework coverage of `Listen` block connection replays

This commit only adds a new test mode to the project's internal testing framework. It lets developers simulate a specific way blocks are delivered to the Lightning node (a 'replay' through the Listen interface) so that behavior is covered …

bf6ad23eby Matt Corallo+18−32 files
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Update functional test block connection to detect block replays

This commit changes only internal test helper code in the Lightning Dev Kit repository. It makes the functional test framework smarter about 'block replays'—situations where the same block is fed to a test node more than once—so the fake b…

No production code modifiedNo cryptographic, consensus, or networking changesCommit message frames change as test-framework correctness, not security
477facb4by Matt Corallo+41−333 files
No security note in commit
Moderate 66 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct HTLC confusion on unrevoked counterparty commitment txs

This patch fixes a bug in the Lightning Dev Kit where the software could confuse HTLCs (payment contracts) on live, unrevoked counterparty commitment transactions with ones from old, revoked transactions. Previously, it relied only on whet…

Incorrect revocation state detection for counterparty commitment transactionsHTLC direction not previously checked when matching against pending HTLCsPromotion of debug assertions to full assertions for HTLC claim path consistency
f06a08a6by Matt Corallo+26−192 files
Vendor flagged security relevance
Low 47 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Return `Err`s` instead of panicking on oversized messages

This commit changes how the Lightning networking code handles oversized encrypted messages. Previously, certain conditions would cause the program to crash with a panic. Now the code returns errors instead, which is a defensive improvement…

panic-to-error conversion for oversized message encryption/decryptiondenial-of-service hardening against oversized peer messagesdebug_assert retained to preserve test coverage of invariant violations
08f12bc7by Matt Corallo+68−313 files
Vendor flagged security relevance
Moderate 62 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid panicking when attempting to send an oversized message

This commit fixes a crash bug in the Lightning Dev Kit's peer message handling. Previously, if a message grew too large to be sent over the encrypted peer connection, the code would panic (abruptly terminate the whole program). The patch m…

Replaces a `.expect()` panic path with a fallible `Result` in peer message encryptionAdds graceful peer disconnection when a critical message cannot be sentIncludes a regression test for oversized-message handling
c5fdc3bfby Matt Corallo+148−901 file
Vendor flagged security relevance
High 74 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid oversized relayed failure messages

This patch fixes a crash bug in the Lightning Dev Kit's handling of HTLC failure messages. A downstream peer could send a maximally-sized failure message without attribution data. When the node added its own attribution data while relaying…

Denial-of-service via remote-triggered panic in message encryptionOversized message exceeding Noise/Lightning wire framing limitMissing length validation before adding attribution data during relay
6b1dfb1aby Matt Corallo+64−191 file
Vendor flagged security relevance
Moderate 64 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Reject attempts to advance one-hop blinded forward paths

This commit fixes a denial-of-service bug in rust-lightning where a maliciously crafted one-hop blinded reply path could cause the node to panic when it tried to respond. The fix rejects paths with too few hops before advancing them, and a…

Denial-of-service vector via malformed blinded pathPanic in onion construction due to zero-hop pathUntrusted reply path input validation gap
969a40cfby Matt Corallo+49−14 files
Vendor flagged security relevance
High 72 AI analysisMessage 96 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

lightning-types: replace Zl/Zp separators in `PrintableString`

This commit fixes a log-forgery risk in a Rust Lightning library helper called PrintableString. That helper is meant to make untrusted text safe to print by replacing dangerous characters with a placeholder. It already caught most control …

log injection / log forgery via U+2028/U+2029 line separatorsincomplete input sanitisation in PrintableStringpeer-controlled strings (node alias, BOLT 12 description/issuer/payer_note, peer_msg) as attack surface
75defa9cby Vincenzo Palazzo+63−83 files
Vendor flagged security relevance
Moderate 69 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Apply the unfunded channel peer limit to all unaccepted channels

This commit fixes a rate-limiting bug in the Lightning Dev Kit (LDK) that let a single peer bypass the cap on how many different peers can have unfunded (not-yet-funded) channels open. Previously, if a peer sent multiple channel requests q…

Denial-of-service resource exhaustion via rapid inbound channel open requestsLogic error in rate-limiting conditionRegression test added for the bypass scenario
56a4ee43by Matt Corallo+87−62 files
Vendor flagged security relevance
Moderate 60 AI analysisMessage 88 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Allow filtered block rescans at the current tip

This commit fixes a bug where replaying the current blockchain block through a normal listener callback could crash two core Lightning components (ChannelManager and OutputSweeper) with a panic. The fix recognizes a same-block replay as a …

panic in chain listener callbacksame-block replay/rescan mishandlingassertion failure on valid chain input
686f9860by Elias Rohrer+118−123 files
Vendor flagged security relevance
Moderate 57 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid panic when reorged claims cannot merge

This commit fixes a crash bug in the Lightning Dev Kit's on-chain transaction handler. During a deep blockchain reorganization, a previously settled HTLC claim could be 'resurrected' at a block height where it could no longer be combined w…

Assertion/panic in reorg handling pathDeep blockchain reorg as trigger conditionHTLC claim resurrection after reorg
f1dc8487by Matt Corallo+219−52 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 45 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Update crate repository links to forgejo

This commit simply updates the 'repository' web links in 15 package metadata files from GitHub to a self-hosted Forgejo instance. It does not change any program code, build logic, dependencies, or security behavior. There is no security is…

eb77676dby benthecarman+15−1515 files
No security note in commit
Low 45 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Account for message type prefix len in prevtx length enforcement

This commit fixes a small but real accounting bug in how rust-lightning checks whether a previous transaction (prevtx) attached to a funding input will make the resulting Lightning wire message too large. The code previously compared the m…

Off-by-constant length check in protocol message size enforcementPotential acceptance of a prevtx that produces an oversized Lightning wire messageDenial-of-service / protocol-interop risk from peer message rejection
d29e1415by Wilmer Paulino+21−41 file
No security note in commit
Moderate 54 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Retransmit splice_locked for 0-conf channels missing tx_signatures

This commit fixes a bug in the Lightning Dev Kit where, after a disconnection, a node could fail to retransmit a 'splice_locked' message to a peer that was still waiting for transaction signatures. Without this retransmission, the two peer…

Protocol state desynchronization between channel peers after reconnectionMissing retransmission of splice_locked for 0-conf splice channelsPotential channel unusability or stuck splice negotiation
5434015bby Wilmer Paulino+266−12 files
No security note in commit
Low 37 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

bolt12: add pay_for_bolt12_invoice for externally-sourced invoices

This commit adds a new API, pay_for_bolt12_invoice, that lets users pay a BOLT 12 invoice even if LDK did not originally request it. It is intended for advanced use cases like multi-sender payments and replaces an older, more restrictive A…

New API removes internal invoice-origin verification, shifting trust boundary to callerDocumentation explicitly warns caller to verify invoice via Bolt12Invoice::verify_using_metadata and to ensure unique payment_id to avoid duplicate paymentsInput validation added for zero amount, overpay, and partial-amount-without-MPP
5b80fe9cby Alkamal01+550−156 files
No security note in commit
Low 26 AI analysisMessage 90 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Include to_self_delay size in DelayedPaymentOutput weight calculation

This commit fixes a small accounting bug in how the Lightning wallet estimates the size (and therefore transaction fee) of a special Bitcoin transaction that sweeps funds back to the user after a channel closes. The old code always assumed…

debug assertion failure possible in development/testing buildstransaction weight/fee estimate overestimation up to 3 WUconstant replaced with per-descriptor length computation
e6652237by Matt Morehouse+97−83 files
No security note in commit
Informational 18 AI analysisMessage 65 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct docs on `ChannelSigner::get_per_commitment_point`

This commit only updates documentation comments for a Rust function called get_per_commitment_point. It removes an outdated warning that the method was non-asynchronous and that returning an error could cause a crash, and replaces it with …

Documentation-only changeRemoves outdated panic warningAdds retry/unblock guidance for signer errors
5057809bby Matt Corallo+6−31 file
No security note in commit
Informational 16 AI analysisMessage 35 · Opaque
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ln/refactor: remove BlindedTrampolineEntrypoint

This commit is a small internal code cleanup in the Lightning Dev Kit's Trampoline routing code. It removes a separate 'BlindedTrampolineEntrypoint' payload variant and folds an optional blinding point into the existing 'Forward' variant. …

Refactor-only change with no added bounds checks or validationNo mention of vulnerability, CVE, security fix, or bug in commit messageTLV field changed from required to optional, but only for a newly unified variant used in internal construction
3e0c2697by Carla Kirk-Cohen+8−263 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityAdd LDK Node integration testby Elias Rohrer · f50ea316 · Nov 5, 2025 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Elias Rohrer

Add LDK Node integration test

We add a simple workflow to our CI that runs `cargo check` on LDK Node to ensure
LDK didn't introduce breaking API changes.

The idea here is to catch breaking changes early, and encourage to fix
them in LDK or LDK Node `main` ASAP.

In the future we might want to extend this to run the full test suite,
once we whack-a-moled a few more of LDK Node's flaky tests.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit adds a new automated CI workflow that checks whether changes in the rust-lightning project break the public API used by a related project called LDK Node. It does not change any application code, cryptographic logic, network handling, or user-facing behavior. It is purely a testing/infrastructure addition.

Security candidateAllow counterparty tx_abort before handling initial commitment signedby Wilmer Paulino · d282a47f · Nov 3, 2025 · 3 filesMessage 85 · StrongLow 44Details
Commit message · Wilmer Paulino

Allow counterparty tx_abort before handling initial commitment signed

Upon processing the counterparty's initial `commitment_signed` for a
splice, we queue a monitor update with the new commitment transactions
spending the new funding transaction. Once handled, funding transaction
signatures can be exchanged and we must start monitoring the chain for a
possible commitment transaction broadcast spending the new funding
transaction. Aborting the splice negotiation then would therefore be
unsafe, hence why we currently force close in such cases. However, there
is no reason to force close prior to receiving their initial
`commitment_signed`, as this would imply the funding transaction
signatures have yet to be exchanged, thus making a commitment broadcast
spending said transaction impossible allowing us to abort the splice
negotiation safely.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing boundary
AI analysis · Low 44/100

This change fixes a Lightning channel splicing behavior where one side would unnecessarily force-close the channel if the counterparty tried to abort a splice before both sides had exchanged their first commitment signatures. Previously, any tx_abort during the signature-waiting phase triggered a force close. The patch makes the protocol more forgiving: aborting is allowed until the counterparty has actually sent its initial commitment_signed, because before that point no dangerous on-chain transaction has been committed to. Once commitment_signed is received, aborting remains unsafe and still triggers a force close. The change also cleans up internal state when aborting early and adds tests for the new behavior.

AI review queuedSupport capturing `tx_abort` send within channel reestablish testsby Wilmer Paulino · 0cdcf542 · Nov 3, 2025 · 2 filesMessage 60 · AdequateInformational 15Details
Commit message · Wilmer Paulino

Support capturing `tx_abort` send within channel reestablish tests

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes internal test helper code in the Lightning Dev Kit repository. It extends a test macro and a test reconnection helper so that automated tests can optionally capture and forward a `tx_abort` message during channel re-establishment scenarios. No production code is modified, and there is no indication this fixes or introduces a security issue.

AI review queuedProvide the same docs in `ChangeDestinationSource` as the sync oneby Matt Corallo · b55eec77 · Nov 3, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Matt Corallo

Provide the same docs in `ChangeDestinationSource` as the sync one

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a documentation comment to a Rust trait method. It does not change any code behavior, logic, or security properties. The added text explains that the method returns a script pubkey usable as a change destination and references another function.

AI review queuedCopy async docs from async bump transaction objects to sync onesby Matt Corallo · c3114471 · Nov 3, 2025 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Copy async docs from async bump transaction objects to sync ones

When we added the async traits and wrapper structs for the
transaction-bumping logic, we didn't bother copying the
documentation to the sync wrappers as we figured the links
sufficed. Sadly, however, this means that our bindings logic will
have no docs but a broken link to an async object that doesn't
exist.

Instead, here, we copy the docs from the async objects to the sync
ones, at least leaving behind a comment noting that both need
updating whenever one gets updated.

We also fix one bogus link in `Wallet`'s docs.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only copies documentation comments from asynchronous Rust traits and structs to their synchronous counterparts. It fixes broken documentation links and adds notes reminding developers to keep both versions in sync. No code behavior changes.

Lower-priorityCopy docs from `OutputSweeper` to `OutputSweeperSync`by Matt Corallo · 4bc993cc · Nov 3, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Copy docs from `OutputSweeper` to `OutputSweeperSync`

When we added the async wrapper for `OutputSweeper`, we didn't
bother copying the documentation to the sync wrappers as we figured
the links sufficed. Sadly, however, this means that our bindings
logic will have no docs but a broken link to an async object that
doesn't exist.

Instead, here, we copy the docs from the async objects to the sync
ones, at least leaving behind a comment noting that both need
updating whenever one gets updated.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a documentation-only change. It copies the user-facing documentation from the asynchronous OutputSweeper struct to its synchronous wrapper OutputSweeperSync, and fixes a broken doc link. No code behavior changes, no security fix or vulnerability introduced.

Lower-priorityCopy async docs from async KVStore to sync oneby Matt Corallo · 9516400d · Nov 3, 2025 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Matt Corallo

Copy async docs from async KVStore to sync one

When we added the async trait for `KVStore`, we didn't bother
copying the documentation to the sync wrappers as we figured the
links sufficed. Sadly, however, this means that our bindings logic
will have no docs but a broken link to an async object that doesn't
exist.

Instead, here, we copy the docs from the async objects to the sync
ones, at least leaving behind a comment noting that both need
updating whenever one gets updated.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only copies documentation comments from the asynchronous version of a key-value storage trait to its synchronous wrapper. It fixes broken documentation links for language bindings but does not change any code behavior, logic, or security properties.

Lower-priority`use` `Vec` from `alloc` rather than the crate preludeby Matt Corallo · 126ac509 · Nov 3, 2025 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Matt Corallo

`use` `Vec` from `alloc` rather than the crate prelude

This avoids confusing the bindings generator.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a tiny code cleanup change. It swaps one way of importing the same standard `Vec` type for another, purely to help an automated bindings generator understand the code. There is no security issue here.

Lower-priorityCopy no-export tags to new serialization traitsby Matt Corallo · 8eabcc12 · Nov 3, 2025 · 1 fileMessage 68 · AdequateInformational 18Details
Commit message · Matt Corallo

Copy no-export tags to new serialization traits

In 0.2 we added new `LengthLimitedRead` and `LengthReadable`
traits, but forgot to copy the no-export tags from the existing
`Read` and `Readable` traits. Here we add the missing tags.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit adds documentation comments (no-export tags) to two new Rust traits so that automated binding generators know not to expose them to users of language bindings. It is a build/tooling metadata fix, not a code behavior change. There is no direct security impact, but missing tags could previously have caused generated bindings to expose low-level streaming-read APIs that are not intended for bindings users.

Security candidateImport `ChannelTransactionParameters` from its real pathby Matt Corallo · b07111e3 · Nov 3, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Import `ChannelTransactionParameters` from its real path

Rather than importing `ChannelTransactionParameters` via the `use`
in `lightning::sign`, import it via its real path in
`lightning::sign::ecdsa`. This makes reading the code (incredibly
marginally) simpler, but also makes the bindings generator happy.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a pure code cleanup: it changes where one internal type, ChannelTransactionParameters, is imported from. There is no functional change, no bug fix, and no security relevance visible in the diff or commit message.

AI review queuedMark async traits and structs no-exportby Matt Corallo · 3f82fd61 · Nov 3, 2025 · 7 filesMessage 60 · AdequateInformational 19Details
Commit message · Matt Corallo

Mark async traits and structs no-export

We do not currently support async traits or methods in our
home-grown bindings logic, so here mark them no-export.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit only adds documentation comments to Rust structs, traits, and type aliases explaining that they are not exported to language bindings because async support is not available outside Rust. There are no code behavior changes, no bug fixes, and no security patches. It is a documentation-only change for bindings generation tooling.

Security candidateRequire the high-level sign traits instead of `SignFn` in bindingsby Matt Corallo · 2bf737ce · Nov 3, 2025 · 1 fileMessage 85 · StrongInformational 15Details
Commit message · Matt Corallo

Require the high-level sign traits instead of `SignFn` in bindings

Methods like `StaticInvoice::sign` have their own signing-function
traits, so there's no actual need to use `SignFn` directly, its
just a useful generic wrapper. Sadly, because it uses `AsRef`
bounds, which aren't really practical to map in bindings, we can't
really expose it directly in bindings. Because there's an
alternative and its tricky to expose, we simply mark it no-export
here.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit is a documentation-only change in the Rust Lightning library. It adds a comment explaining that a generic signing helper trait called SignFn is intentionally not exposed to language bindings (for users of other programming languages), because each specific signing method already has its own trait and the generic wrapper is awkward to map across languages. No code behavior changed, and there is no security fix or vulnerability here.

Lower-priorityMark `CheckedHrpstringError` instances as no-exportby Matt Corallo · 16aabce7 · Nov 3, 2025 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Mark `CheckedHrpstringError` instances as no-export

The details of these errors aren't particularly relevant, and its
not worth the effort of exporting them, so we just mark them
no-export here.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only adds documentation comments to two Rust error types explaining that an internal error detail is intentionally not exposed to language bindings users. There are no code behavior changes, no bug fixes, and no security implications.

Lower-priorityMark BOLT 12 builders no-export in the new `OffersMessageFlow`by Matt Corallo · 7fb0f2a4 · Nov 3, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Mark BOLT 12 builders no-export in the new `OffersMessageFlow`

As move semantics do not map to bindings, the BOLT 12 object
builders are marked no-export. In the new `OffersMesageFlow`, here,
we also mark the methods which return these builders as no-export.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only adds documentation comments to several Rust functions, explaining that they are not exposed to language bindings (such as Java, Swift, or Python wrappers) because the builder-pattern code relies on Rust-specific move semantics. There are no code behavior changes, no bug fixes, and no security-relevant modifications.

Lower-priorityDon't prune `pending_requests` in `persist`by Elias Rohrer · 5f8c54a6 · Nov 3, 2025 · 1 fileMessage 68 · AdequateLow 44Details
Commit message · Elias Rohrer

Don't prune `pending_requests` in `persist`

Previously, we would also prune any pending `GetInfo` or expired `Buy`
requests before we `persist`. This could have lead to races where we
drop a pending request and even remove the peer when calling `persist`.

Here, we simply split the pruning logic for the `pending_requests` and
expired JIT channel state, and only prune the latter before persisting.
This generally makes sense, as `pending_requests` isn't currently
persisted, so there is no need to prune before repersisting.

Both are however still pruned on peer disconnection.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 44/100

This change fixes a race condition in a Lightning service's save-to-disk routine. Previously, the code would clean up certain in-flight peer requests right before saving state, which could accidentally drop a valid request and even disconnect a peer. Now, cleanup of those in-flight requests is done only when a peer disconnects, while saving only cleans up truly expired channel state. The fix reduces the chance of legitimate requests being lost or peers being wrongly removed.

Lower-priority`notify` `ChainMonitor`'s `EventNotifier` on async write completionby Matt Corallo · 092a50ae · Nov 1, 2025 · 2 filesMessage 85 · StrongModerate 57Details
Commit message · Matt Corallo

`notify` `ChainMonitor`'s `EventNotifier` on async write completion

In c08476753f296319cd74c8394ff8cb6bb5a0e7b5 we a
`ChainMonitor::new_async_beta` and a corresponding
`MonitorUpdatingPersisterAsync` struct. To avoid circular
references, the `ChainMonitor` owns the
`MonitorUpdatingPersisterAsync` which uses a `FutureSpawner` to let
async writes happen in the background after it returns control flow
ownership to the `ChainMonitor`. This is great, except that because
`MonitorUpdatingPersisterAsync` thus doesn't have a reference to
the `ChainMonitor`, we have to poll for completion of the futures.

We do so in the new `Persist::get_and_clear_completed_updates` that
was added in the above-referenced commit. But on async monitor
write completion we're supposed to call `ChainMonitor`'s
`event_notifier.notify()` (ultimately waking up the background
processor which `await`s the corresponding update future). This
didn't happen in the new async flow.

Here we move `ChainMonitor`'s `event_notifier` into an `Arc` and
pass a reference to it through to the
`MonitorUpdatingPersisterAsync` which can then directly `notify()`
it and wake the background processor.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Moderate 57/100

This commit fixes a bug in rust-lightning's new async channel-monitor persistence code. When a background write finished, the program failed to ring a bell (notify a 'Notifier') that wakes up the background processor. That could leave the node temporarily unaware that a critical disk write completed, potentially delaying channel-state processing or, in edge cases, affecting safety guarantees. The fix moves the Notifier into a shared Arc so the async persister can ring it directly when writes finish.

Lower-priorityPersist fuzz corpus between CI runsby Anyitechs · 58078522 · Oct 31, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Anyitechs

Persist fuzz corpus between CI runs

Implements a persistent, global fuzz corpus cache.

PRs perform a "read-only" restore from the `main` cache
to seed fuzzer runs. The `main` branch performs a
"read-write" to save new findings and grow the corpus.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencedocumentation-only discount
AI analysis · Informational 15/100

This commit changes the project's GitHub Actions CI workflow to save and reuse fuzz testing data between runs. It is a build/test infrastructure improvement with no direct security vulnerability or code change to the Lightning library itself.

Lower-priorityUpload CI generated fuzz corpus coverage to codecovby Anyitechs · b06f6c55 · Oct 31, 2025 · 2 filesMessage 95 · StrongInformational 15Details
Commit message · Anyitechs

Upload CI generated fuzz corpus coverage to codecov

Because each CI job runs on a fresh runner and can't share data
between jobs. We rely on Github Actions upload-artifact and
download-artifact to share the CI generated fuzz corpus, then
replay them in the `contrib/generate_fuzz_coverage.sh` script
to generate the coverage report.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit changes the project's automated testing pipeline so that fuzz-testing data generated in one CI job is saved and reused in a later coverage-reporting job. It does not change the actual Lightning protocol code, wallet logic, or any code that end users run. There is no indication this introduces a security vulnerability.

Security candidateAdd draft release notes for 0.2by Matt Corallo · a94f9f8a · Oct 30, 2025 · 12 filesMessage 45 · ThinInformational 15Details
Commit message · Matt Corallo

Add draft release notes for 0.2

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
authentication pathdocumentation-only discount
AI analysis · Informational 15/100

This commit is purely a documentation update: it drafts the release notes for rust-lightning version 0.2 and removes the corresponding pending changelog snippets. No source code, logic, or configuration changes are made, so it cannot introduce or fix a security vulnerability on its own.

Security candidateAdd missing documentation for sigs-ready event to `splice_channel`by Matt Corallo · 00e06a06 · Oct 30, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Add missing documentation for sigs-ready event to `splice_channel`

`ChannelManager::splice_channel` initiates a splice which
ultimately generates a series of events. The most important of
which, `FundingTransactionReadyForSigning` (which must always be
handled, unlike the others), was not documented.

Here we mention the event generation.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit only adds a missing documentation comment to the splice_channel function. It explains that a FundingTransactionReadyForSigning event will be generated after signatures are exchanged, and that funding_transaction_signed should then be called. There is no code change, bug fix, or security patch.

Lower-priorityAdd note in `OnionMessageIntercepted` to handle the connected eventby Matt Corallo · 683d03c2 · Oct 30, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Add note in `OnionMessageIntercepted` to handle the connected event

Users implementing the "onion message mailbox" feature and handling
`OnionMessageIntercepted` events need to also handle
`Event::OnionMessagePeerConnected` events.

Here we update the event docs for both to add additional references
and be more explicit about what implementors need to do.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only updates documentation comments for two existing events in the Lightning Dev Kit Rust library. It adds guidance telling developers that if they store an intercepted onion message when a peer is offline, they should also handle the peer-connected event to forward the stored message. There are no code changes, no behavior changes, and no security fix or vulnerability.

Security candidateDrop useless `vec!` macro callsby Matt Corallo · 3c1159cd · Oct 30, 2025 · 6 filesMessage 60 · AdequateInformational 15Details
Commit message · Matt Corallo

Drop useless `vec!` macro calls

`clippy` now complains about more instances of useless `vec!`s, so
we drop them here.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup. It replaces unnecessary `vec!` macro calls with plain array literals in test code and internal test modules. There is no functional change, no bug fix, and no security relevance.

Lower-priorityReplace `StateMachine::default` use with `core::mem::replace`by Matt Corallo · a8b990ad · Oct 30, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Replace `StateMachine::default` use with `core::mem::replace`

`clippy` now complains that `Default` for the interactive tx
constructor `StateMachine` can be auto-derived, but its a bit weird
to have a `Default` that loads an invalid ("indeterminate") state.
Instead, we replace the one line that actually cares about the
`Default` (which uses `core::mem::take`) with `core::mem::replace`,
making it more explict.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a small code cleanup change. It removes a manually-written 'default' value for an internal state-machine type and replaces one use of a standard-library helper (core::mem::take) with a slightly more explicit one (core::mem::swap). The behavior is functionally identical: the state machine is still briefly put into a placeholder 'Indeterminate' state while a transition runs. There is no security fix here.

AI review queuedAdd `readme` fields to most crates' `Cargo.toml`sby Matt Corallo · 1605291b · Oct 30, 2025 · 9 filesMessage 80 · StrongInformational 15Details
Commit message · Matt Corallo

Add `readme` fields to most crates' `Cargo.toml`s

`crates.io` will show any README/README.md which apears in the
crate which is uploaded, but it doesn't consider the README from
the workspace, only if its in the crate itself.

Instead, add the `readme` field so that the workspace README also
gets uploaded.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds README file references to the packaging metadata for several Rust crates. It is a documentation/packaging improvement with no effect on program behavior or security.

Lower-priorityInclude monitor name in error when failing to load a monitorby Matt Corallo · a4f46639 · Oct 30, 2025 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · Matt Corallo

Include monitor name in error when failing to load a monitor

If we fail to load a `ChannelMonitor` due to the new limits in LDK
0.2, its useful to communicate which monitor failed, which we do
here.

Requested at
https://github.com/lightningdevkit/rust-lightning/pull/4146#discussion_r2418136988

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit only improves an error message by adding the name of a ChannelMonitor that failed to load. It is a diagnostic/logging improvement, not a security fix.