LDK
← All projectsLightning Dev Kit

rust-lightning

Composable Rust libraries for building Lightning wallets, nodes, and services.

BitcoinCryptographic librariesLightning NetworkNormal
Repository coverage

1665 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

252security candidates228second-pass queue1525AI analyses
81commits · 30 days
180commits · 60 days
553commits · 180 days
1254commits · 365 days
Backfill bands
Aug 5 → Feb 6819 seen18 candidatesComplete
Feb 6 → Jun 6468 seen16 candidatesComplete
Jun 6 → Jul 6128 seen8 candidatesComplete
Jul 6 → Aug 561 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
473Strong · 80–100
836Adequate · 60–79
294Thin · 40–59
62Opaque · 0–39
3security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Elias Rohrer15315153667
Matt Corallo43553371574
Jeffrey Czyz19545182169
Wilmer Paulino15945155169
Leo Nash11613116162
Valentine Wallace14511138169
Vincenzo Palazzo11311183
Joost Jager16224162069
elnosh391333058
auto-pr-bot2478087
shaavan22622069
Carla Kirk-Cohen78366068
Analysis record

Published AI watches

Last scanned 0 minutes ago

Moderate 55 AI analysisMessage 76 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Persistent `MonitorEvent`s' (#4491)

This commit makes on-chain 'MonitorEvent' notifications durable and replay-safe. Previously, if a node crashed after a ChannelMonitor persisted a block update but before the ChannelManager processed the resulting event, the event could be …

Durability/atomicity fix for async persistence: prevents lost MonitorEvents across crashesNew ack-based event lifecycle with random event IDsArchival gating on unacknowledged events to avoid losing preimage/timeout information
9a324e72by wpaulino+467−45912 files
No security note in commit
Low 47 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Fix payment attribution edge cases and simplify claiming' (#5021)

This commit refactors how LDK nodes claim incoming Lightning payments. It replaces a separate 'claim with known custom TLVs' method with an options struct passed to the normal claim call, and fixes two edge cases in payment attribution dat…

API change: claim_funds now takes ClaimFundsOptions, consolidating TLV-known behavior into one pathFailure-packet length bound added to prevent oversized onion error messagesIncoming failure packet truncated at 32 KiB before processing
ee7c61c2by Matt Corallo+256−17322 files
No security note in commit
Low 47 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'release utxos from failed splices' (#4973)

This change fixes a wallet bookkeeping problem in rust-lightning's built-in coin-selection wrappers. Previously, when a splice attempt failed or coin selection errored after picking UTXOs, those UTXOs stayed marked as 'reserved' in memory …

Resource exhaustion / denial-of-service via permanent in-memory UTXO reservationIncorrect state tracking in coin-selection wrapperNew API method required for correct lifecycle management (release_utxos)
7220a6fdby jkczyz+295−383 files
No security note in commit
Low 49 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Restore `Wallet` UTXO locks when coin selection fails afterwards

This commit fixes a bug in the wallet's coin-selection code. When the wallet picked UTXOs to spend, it locked them immediately so they couldn't be reused. But if a later step—fetching the change address or the previous transaction—failed, …

Resource lock leak on error pathUTXO lock state inconsistency between selection and confirmationDenial-of-service/funds-unavailability risk from persistent UTXO locks
81afd9caby elnosh+146−331 file
No security note in commit
Informational 19 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'tx-sync: Parallelize esplora status queries' (#4913)

This commit rewrites how a Lightning wallet talks to Esplora block-explorer servers so that many status checks happen in parallel instead of one at a time. It is a performance/refactoring change. There is no direct evidence in the commit t…

Concurrency/timing change in transaction confirmation logicNew inconsistency check preserved when a previously-confirmed tx is reported unconfirmedAdded defensive error path for missing pre-fetched block status
c303f515by Matt Corallo+140−371 file
No security note in commit
Low 30 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Skip Electrum creator transaction downloads' (#4992)

This change stops the Electrum-based transaction sync client from downloading the very transaction that created an output it is watching. Previously, the client could request that transaction from Electrum, even though a transaction can ne…

Avoids unnecessary Electrum transaction.get requests for watched outputsReduces information disclosure to Electrum server about watched outpointsAdds regression test verifying request suppression
c36e50cbby Matt Corallo+142−02 files
No security note in commit
Low 44 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Use preferred sPK of watched txn in electrum, not rand ones' (#4867)

This change improves how the Lightning Dev Kit's Electrum and Esplora transaction-sync clients track watched Bitcoin transactions. Previously, the code ignored the script pubkey (the 'address' associated with a transaction) supplied when r…

Previously ignored `script_pubkey` argument in `register_tx` for transaction watchersElectrum script-history queries previously used an arbitrary transaction output, which could be OP_RETURN and therefore unindexed by some Electrum serversNew logic prefers caller-supplied script pubkey and falls back to non-OP_RETURN outputs
bfe5ca89by tnull+52−243 files
No security note in commit
Low 33 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Serialize transient Event variants; move persist decision into ChannelManager' (#4791)

This commit changes how LDK stores pending event notifications. It adds serialization support for several event types that previously were not fully saved to disk, and introduces a helper method so the code can decide which events are wort…

Data-loss prevention: previously non-round-trippable event variants are now fully serialized, avoiding accidental event loss when users serialize Event queues themselvesState-consistency hardening: ChannelManager now explicitly skips events that describe non-surviving restart state, preventing replay of stale eventsDefensive assertion: debug builds assert that every persisted event round-trips to Some(event), catching serialization mismatches
a0d4632eby Matt Corallo+694−818 files
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Document that funding signing events can go stale' (#4960)

This commit only adds documentation comments to two source files. It explains that certain funding-signing events can become stale if the underlying negotiation fails, and that callers may see specific harmless errors as a result. No code …

26eecf2dby Matt Corallo+15−02 files
No security note in commit
Moderate 58 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add `Wallet::release_utxos` to free UTXOs from abandoned transactions

This commit fixes a design flaw in LDK's built-in wallet helper where coins selected for a splice-in (or other unclaimed funding) were permanently reserved in memory if the transaction was abandoned. Over repeated failed splices, all spend…

Denial-of-service via UTXO exhaustion from repeated failed splice negotiationsRisk of inability to broadcast fee-bumping/claim transactions due to lack of available UTXOsNew API surface (release_utxos) introduced to mitigate resource leak
52ab13fdby elnosh+148−43 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop the honggfuzz version pin from the CI fuzz job

This commit removes a fixed-version pin for the honggfuzz fuzzing tool in a continuous-integration script. The project now uses the current release of honggfuzz instead of an older pinned version. There is no change to the actual Lightning…

4a1635efby auto-pr-bot+1−51 file
No security note in commit
Informational 15 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Run the CI fuzz job on the stable toolchain

This commit changes the Rust toolchain used in the continuous integration (CI) fuzzing job from a fixed older version (1.75) to the latest stable release. It is purely a build/test infrastructure change to fix a dependency compatibility is…

21c4ed2bby auto-pr-bot+3−32 files
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Expose the dummy-hop tail constructor publicly

This commit makes a previously internal helper function public so that outside developers can build dummy-hop tails for blinded payment paths without recreating the logic themselves. It is an API usability change, not a fix for a known sec…

No security-relevant behavior change in the diffAPI visibility broadened from crate-public to publicCLTV expiry overflow check already present and unchanged
c5443353by auto-pr-bot+14−71 file
No security note in commit
Moderate 54 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fail commitment sig verification without counterparty params

This change adds a safety check in a Bitcoin Lightning Network library (LDK). Previously, if the software tried to verify a peer's commitment signature before it had learned the peer's channel parameters, it could crash with a panic. Now i…

Defensive check added on peer-driven code path to prevent panicMissing counterparty_parameters could previously cause panic during commitment transaction constructionChannel closure returned instead of panic
de7ecc2fby auto-pr-bot+24−01 file
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Clarify the commitment validation failure message

This commit only changes the wording of an error message sent to peers when a commitment transaction fails validation. It replaces the vague phrase 'Failed to validate our commitment' with the clearer 'Received commitment failed validation…

3284a006by auto-pr-bot+11−114 files
No security note in commit
Moderate 61 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Move holder commit sig checks to `InMemorySigner`' (#4885)

This commit moves the checks that validate a counterparty's signatures on the holder's commitment and HTLC transactions out of the general channel code and into the signer module (InMemorySigner). Previously, these signature checks were do…

Moved signature validation from channel state machine into signer moduleAdded new tests that corrupt signatures and verify rejectionChanged error message from 'Invalid commitment tx signature from peer' / 'Invalid funding_created signature from peer' to 'Failed to validate our commitment'
83f5ba55by Matt Corallo+626−31024 files
No security note in commit
Low 42 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Drop stale splice signature on disconnect' (#4954)

This change fixes a Lightning channel splicing bug: when two peers temporarily disconnect during a splice, any half-finished signature the other side already sent is now discarded. Before the fix, that stale signature could be reused after…

State-invalidation bug in multi-step protocol (splice negotiation)Stale cryptographic signature not cleared on disconnectPotential reuse of old commitment state after reconnect
c9a77251by Matt Corallo+22−12 files
No security note in commit
Moderate 58 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop stale splice signature on disconnect

This fix prevents a Lightning channel from being accidentally force-closed. During a splice (a way to resize a payment channel), one side's initial signature could be kept in memory after the peers disconnected. If the peers later reconnec…

State inconsistency: in-memory buffered message not cleared on disconnectDuplicate message processing after reconnectionForce-close consequence for active Lightning channel
71405b4bby Wilmer Paulino+22−12 files
Vendor flagged security relevance
Informational 20 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'offers: rename matches_invoice_signing_pubkey to key_can_sign_invoice' (#4942)

This commit is a simple rename of a public function from `matches_invoice_signing_pubkey` to `key_can_sign_invoice`, plus matching updates to its documentation, callers, tests, and changelog. No behavior changed. It is not a security fix.

a476cf92by Matt Corallo+13−133 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

offers: rename matches_invoice_signing_pubkey to key_can_sign_invoice

This commit is a simple rename of a function and its documentation from matches_invoice_signing_pubkey to key_can_sign_invoice. No logic, behavior, or security properties changed. It is a follow-up code-review naming cleanup.

388187caby Vincenzo Palazzo+13−133 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityOnly log if we actually persisted `LiquidityManager` databy Elias Rohrer · 369ea980 · Nov 27, 2025 · 5 filesMessage 73 · AdequateInformational 15Details
Commit message · Elias Rohrer

Only log if we actually persisted `LiquidityManager` data

Previously, we logged "Persisting LiquidityManager..." on each
background processor wakeup, which can be very spammy, even on TRACE
level.

Here, we opt to only log if something actually needed to be repersisted
and we did so (in case of failure we're logging that anyways, too).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a minor logging and API cleanup change. It changes the LiquidityManager persistence methods to return a boolean indicating whether any data was actually written, and only logs a 'Persisted' message when something was actually saved. Previously, the background processor logged 'Persisting LiquidityManager...' on every wakeup even when there was nothing to save, which could produce excessive log output. There is no security issue here.

AI review queuedRustfmt channel methodsby Joost Jager · 8116e0b8 · Nov 26, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Rustfmt channel methods

Clean up changes in previous commits.

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code formatting cleanup. It removes manual rustfmt skip annotations and lets rustfmt reformat several match statements and function signatures in the Lightning channel code. There are no logic changes, no security fixes, and no behavior differences.

Lower-priorityConvert OutboundHTLCOutcome::Success fields to structby Joost Jager · 9b3a7fe0 · Nov 26, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Joost Jager

Convert OutboundHTLCOutcome::Success fields to struct

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup: it changes a Rust enum variant from storing two unnamed fields to storing two named fields. It does not alter what data is stored, how payments are validated, or any network-visible behavior. There is no security fix or vulnerability here.

Lower-priorityConvert InboundHTLCRemovalReason fields to structby Joost Jager · fb1fd4c5 · Nov 26, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Joost Jager

Convert InboundHTLCRemovalReason fields to struct

Preparation for serializing the enum. The serialization macros do not
support multiple unnamed fields.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup in the Lightning Dev Kit's channel handling code. It changes how data is packaged inside an internal enum (InboundHTLCRemovalReason) from unnamed tuples to named struct fields, so that future serialization code can handle it more easily. There is no change to security logic, no bug fix, and no externally visible behavior change.

Lower-priorityln: enforce trampoline onion recipient constraintsby Carla Kirk-Cohen · 785c7813 · Nov 25, 2025 · 2 filesMessage 83 · StrongModerate 61Details
Commit message · Carla Kirk-Cohen

ln: enforce trampoline onion recipient constraints

Tests are added to cover validation of blinded and unblinded trampoline
payloads against their outer onion. These are consolidated with our
existing coverage for successful receives.

Co-authored-by: Arik Sosman <git@arik.io>
Co-authored-by: Maurice Poirrier <mpch@hey.com>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Moderate 61/100

This commit adds safety checks in the Lightning Dev Kit (LDK) to ensure that the inner 'trampoline' payment instructions match the outer onion packet's amounts and deadlines. Without these checks, a malicious or buggy sender could craft a trampoline payment where the outer layer promises one amount or deadline while the inner layer demands a higher one, potentially allowing a node to be tricked into accepting or relaying an inconsistent payment. The patch enforces that the outer onion's amount and CLTV expiry are at least as large as the trampoline onion's, and adds tests for underpayment and deadline mismatch cases.

Lower-priorityAdd millisatoshi truncation 0FC test vectors from the specby Leo Nash · fd122059 · Nov 20, 2025 · 1 fileMessage 75 · AdequateInformational 12Details
Commit message · Leo Nash

Add millisatoshi truncation 0FC test vectors from the spec

Millisatoshi truncation also contributes to the value of the anchor
output on a zero-fee commitment transaction.

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 12/100

This commit only adds new test cases to the project's test suite. It does not change any production code. The tests verify that the software correctly handles tiny fractions of Bitcoin (millisatoshis) when building special zero-fee Lightning commitment transactions, including cases where dust amounts add up. There is no indication of a security fix or vulnerability being patched here.

Lower-priorityAdd funding redeem script to `SplicePending' eventby benthecarman · e3ebe7a8 · Nov 20, 2025 · 3 filesMessage 50 · ThinInformational 19Details
Commit message · benthecarman

Add funding redeem script to `SplicePending' event

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 19/100

This commit adds the funding redeem script (the cryptographic lock script for a Lightning channel's funding output) to the SplicePending event that LDK emits when a splice is being negotiated. It is an API/data-visibility change, not a logic fix. There is no direct evidence in the commit that this resolves a security vulnerability; it appears to give downstream wallet software the information it needs to recognize and spend the new funding output after a splice.

Lower-priorityAdd funding redeem script to `ChannelDetails` and `ChannelPending` eventby benthecarman · add202ea · Nov 20, 2025 · 6 filesMessage 93 · StrongInformational 19Details
Commit message · benthecarman

Add funding redeem script to `ChannelDetails` and `ChannelPending` event

Original context and motivation comes from here: https://github.com/lightningdevkit/ldk-node/pull/677#discussion_r2505405974

When splicing-in, the default case is our channel utxo + our wallet utxos
being combined. This works great however, it can give our wallet issues
calculating fees after the fact because our wallet needs to know about
our channel's utxo. We currently have it's outpoint and satoshi value
available, but not its output script so we are unable to construct the
TxOut for the channel. This adds the redeem script to the
`ChannelDetails` and `ChannelPending` event which gives us enough
information to be able to construct it.

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 19/100

This commit adds a new piece of public information—the funding redeem script—to two existing data structures that describe Lightning channels. It does not change how funds are secured, how transactions are signed, or how peers communicate. It simply lets downstream wallet software reconstruct the channel's funding transaction output so it can calculate fees more accurately when splicing funds into a channel. There is no indication this fixes a vulnerability or introduces a new attack path.

Lower-priorityln: add trampoline LocalHTLCFailureReason variants per specby Maurice · 269eb6b5 · Nov 20, 2025 · 1 fileMessage 73 · AdequateInformational 19Details
Commit message · Maurice

ln: add trampoline LocalHTLCFailureReason variants per spec

This commit adds three new local htlc failure error reasons:
`TemporaryTrampolineFailure`, `TrampolineFeeOrExpiryInsufficient`,
and `UnknownNextTrampoline` for trampoline payment forwarding failures.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This commit adds three new error-code labels used when a Lightning payment fails while being forwarded through a special routing feature called Trampoline payments. It is essentially a standards-compliance update that maps new internal reasons to the correct numeric failure codes and serialization IDs. There is no direct evidence this fixes an active security bug or vulnerability.

Lower-priorityln/fmt: clean up ugly formatting of do_test_trampoline_unblinded_receiveby Carla Kirk-Cohen · 26a2222c · Nov 20, 2025 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · Carla Kirk-Cohen

ln/fmt: clean up ugly formatting of do_test_trampoline_unblinded_receive

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is purely a code cleanup: it tidies up formatting in a test function and extracts a small helper to reduce repetition. There is no change to production behavior, no bug fix, and no security relevance.

Lower-priorityln/fmt: remove rustfmt::skip from do_test_trampoline_unblinded_receiveby Carla Kirk-Cohen · 8c9e01e2 · Nov 20, 2025 · 1 fileMessage 77 · AdequateInformational 15Details
Commit message · Carla Kirk-Cohen

ln/fmt: remove rustfmt::skip from do_test_trampoline_unblinded_receive

Remove skip without fixing up any of the ugly formatting, so that the
diff is a bit more readable in review.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup in a test file. It removes a directive that told the Rust formatter to ignore a particular test function, then re-wraps long lines so the code follows normal style rules. No program behavior, logic, or security-sensitive code is changed.

Lower-priorityln/fmt: move rustfmt_skip to per-function in blinded_payment_testsby Carla Kirk-Cohen · e11b30c2 · Nov 20, 2025 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Carla Kirk-Cohen

ln/fmt: move rustfmt_skip to per-function in blinded_payment_tests

To allow formatting on new code, move to per-function skips.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a code-style cleanup in a test file. It removes a file-wide directive that told the Rust formatter to ignore the file, and instead marks individual helper functions to skip formatting. The actual test logic and program behavior are unchanged.

AI review queuedSupport async fetching of commitment point during channel reestablishby Wilmer Paulino · 1f7b2490 · Nov 18, 2025 · 3 filesMessage 73 · AdequateLow 42Details
Commit message · Wilmer Paulino

Support async fetching of commitment point during channel reestablish

`HolderCommitmentPoint` currently tracks the current and next point used
on counterparty commitments, which are unrevoked. When we reestablish a
channel, the counterparty sends us the commitment height, along with the
corresponding secret, for the state they believe to be the latest. We
compare said secret to the derived point we fetch from the signer to
know if the peer is being honest.

Since the protocol does not allow peers (assuming no data loss) to be
behind the current state by more than one update, we can cache the two
latest revoked commitment points alongside `HolderCommitmentPoint`, such
that we no longer need to reach the signer asynchronously when handling
`channel_reestablish` messages throughout the happy path. By doing so,
we avoid complexity in needing to pause the state machine (which may
also result in needing to stash any update messages from the
counterparty) while the signer response is pending.

The only remaining case left to handle is when the counterparty presents
a `channel_reestablish` with a state later than what we know. This can
only result in two terminal cases: either they provided a valid
commitment secret proving we are behind and we need to panic, or they
lied and we force close the channel. This is the only case we choose to
handle asynchronously as it's relatively trivial to handle.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Low 42/100

This commit improves how the Lightning node handles reconnections after a network interruption. Previously, when re-establishing a channel, the node sometimes had to ask an external signer for a cryptographic proof point and could not proceed until the signer responded. The change keeps the two most recent revoked proof points cached locally so the common case no longer needs to wait for the signer. It only defers to the signer asynchronously in the rare 'stale state' case, where the peer claims our node is behind. That stale case either proves data loss (causing a protective panic) or proves the peer is lying (causing a force-close). The commit is a defensive hardening/feature change, not a fix for an active exploit.

AI review queuedRustfmt modified fnsby Joost Jager · a6812c8e · Nov 18, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Rustfmt modified fns

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup. It removes `#[rustfmt::skip]` annotations from a few functions in the Lightning channel manager and lets rustfmt reformat the code. No logic, behavior, or security properties of the program change.

Lower-priorityDeduplicate node id and payment hash loggingby Joost Jager · 2f6b1976 · Nov 18, 2025 · 3 filesMessage 80 · StrongInformational 15Details
Commit message · Joost Jager

Deduplicate node id and payment hash logging

Now that the default Display implementation of Record also outputs
structured log fields, that data can be removed from the log messages.
This declutters the log output and also helps with verticality in the
code.

Note that deduplication is only carried out for log statements that are
always called in a log context. For some statements this isn't the case
because not every caller sets up the context. Those are left unchanged.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is a code cleanup change. It removes repeated node IDs and payment hashes from individual log messages because the logging framework now automatically includes those details as structured fields. No security vulnerability is fixed or introduced; it only makes log output less cluttered.

Lower-priorityln/test: add new test vector for v3 duplicate dustby Carla Kirk-Cohen · 19946610 · Nov 18, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Carla Kirk-Cohen

ln/test: add new test vector for v3 duplicate dust

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit only adds a new unit test to the Lightning Dev Kit codebase. It does not change any production code, fix a bug, or alter behavior. The test exercises a specific scenario involving small ('dust') HTLCs in a v3 commitment transaction. There is no security-relevant change in the diff itself.

Lower-priorityAdd support for `Testnet4`by Elias Rohrer · 743f43fc · Nov 18, 2025 · 4 filesMessage 58 · ThinInformational 20Details
Commit message · Elias Rohrer

Add support for `Testnet4`

We simply add support for `bitcoin::Network::Testnet4`, which was added
with release v0.32.4, which we hence deem the new minimal requirement
for `lightning` and `lightning-invoice`.

As other Lightning implementations seem to simply map `Testnet4` coins
to be `Testnet` (also reusing the `tb` prefix), we here follow their
lead and choose not to introduce a separate `Currecy` variant, even
though that could lead to checks failing if someone validated the
returned `fallback_addresses` for the given `Network`.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
defensive validation
AI analysis · Informational 20/100

This commit adds support for Bitcoin's new Testnet4 network in the rust-lightning library. It mainly bumps a dependency version and maps Testnet4 invoices to use the existing Testnet currency type. The change is a routine compatibility update, not a security fix, though it removes a fallback that previously treated unknown networks as regtest.

AI review queuedInline error variableby Joost Jager · f63066ef · Nov 18, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Inline error variable

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This is a trivial code cleanup: a developer removed a temporary variable that held an error message and instead put the message text directly into the logging call. The program's behavior, error messages, and security posture are unchanged.

Lower-priorityMove `ChannelError`-handling logic down in `channelmanager.rs`by Matt Corallo · 2a650256 · Nov 17, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Move `ChannelError`-handling logic down in `channelmanager.rs`

In the next commit we'll functionize some of the
`ChannelError`-handling logic, requiring it have access to
`handle_new_monitor_update_locked_actions_handled_by_caller!` which
thus needs to be defined above it.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a pure code reorganization: it moves several large blocks of macro definitions lower in the same file so that a later commit can reuse them more easily. No behavior, logic, or security properties of the code change.

Lower-priorityFunctionize the UNFUNDED case in `convert_channel_err`by Matt Corallo · 0b0b56ba · Nov 17, 2025 · 1 fileMessage 73 · AdequateInformational 14Details
Commit message · Matt Corallo

Functionize the UNFUNDED case in `convert_channel_err`

`convert_channel_err` is used extensively in `channelmanager.rs`
(often indirectly via `try_channel_entry`) and generates nontrivial
code (especially once you include `locked_close_channel`). Here we
take the `UNFUNDED` case of it and move them to an internal
function reducing the generated code size.

On the same machine as described three commits ago, this further
reduces build times from the previous commit by about another
second.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 14/100

This commit is a pure code cleanup: it extracts the handling of unfunded channels from a large macro into a small internal function. There is no change to user-visible behavior, no bug fix, and no security relevance.

Lower-priorityFunctionize the FUNDED cases in `convert_channel_err`by Matt Corallo · 252a75a5 · Nov 17, 2025 · 1 fileMessage 73 · AdequateInformational 13Details
Commit message · Matt Corallo

Functionize the FUNDED cases in `convert_channel_err`

`convert_channel_err` is used extensively in `channelmanager.rs`
(often indirectly via `try_channel_entry`) and generates nontrivial
code (especially once you include `locked_close_channel`). Here we
take the `FUNDED` cases of it and move them to an internal function
reducing the generated code size.

On the same machine as described two commits ago, this further
reduces build times by about another second.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 13/100

This commit is a code cleanup that moves some repeated logic into a new helper function. It does not change what the program does; it only reorganizes how the code is structured to make builds slightly faster. There is no indication of a security fix.

Lower-priorityFormat `convert_*_channel_err` code moved out of macroby Matt Corallo · 7cea2e93 · Nov 17, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Matt Corallo

Format `convert_*_channel_err` code moved out of macro

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is purely a code formatting and minor refactoring change. It splits a few long single-line expressions into multiple shorter lines and introduces temporary variables for readability. There is no functional change, no bug fix, and no security relevance.

Lower-priorityInline `locked_close_channel` in the new `convert_*_channel_err`by Matt Corallo · b6974a02 · Nov 17, 2025 · 1 fileMessage 73 · AdequateInformational 14Details
Commit message · Matt Corallo

Inline `locked_close_channel` in the new `convert_*_channel_err`

Now that `convert_channel_err` is primarily in two functions,
`locked_close_channel` is just a dumb macro that has two forms,
each only called once. Instead, drop it and inline its contents
into `convert_*_channel_err`.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 14/100

This commit is a straightforward code cleanup: it removes a small internal macro and copies its contents directly into the two functions that used it. There is no change in behavior, no bug fix, and no security-relevant change. It is purely a refactoring to make the code easier to read and maintain.

Lower-priorityFormat the code moved in the previous commitby Matt Corallo · 4e4e34e3 · Nov 17, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Matt Corallo

Format the code moved in the previous commit

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup of a macro and a few nearby functions in the Lightning channel manager. It renames local variables for brevity, wraps long argument lists, and shortens a couple of log/debug strings. There is no functional change and no security relevance.

Lower-priorityMove unlocked part of `handle_monitor_update_completion` into an fnby Matt Corallo · 639e2bae · Nov 17, 2025 · 1 fileMessage 83 · StrongInformational 14Details
Commit message · Matt Corallo

Move unlocked part of `handle_monitor_update_completion` into an fn

The `handle_monitor_update_completion` macro is called from a
number of places in `channelmanager.rs` and dumps quite a bit of
code into each callsite. Here we take the unlocked half of
`handle_monitor_update_completion` and move it into a function in
`ChannelManager`.

As a result, building the `lightning` crate tests after a
single-line `println` change in `channelmanager.rs` was reduced by
around a full second (out of ~28.5 originally) on my machine using
rustc 1.85.0. Memory usage of the `expand_crate` step went from
+554MB to +548MB in the same test.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 14/100

This commit is a straightforward code cleanup: it takes a large block of code that was duplicated inside a macro and moves it into a regular function. The behavior is unchanged; the change only reduces compile time and memory usage slightly. There is no security fix or vulnerability here.