LDK
← All projectsLightning Dev Kit

rust-lightning

Composable Rust libraries for building Lightning wallets, nodes, and services.

BitcoinCryptographic librariesLightning NetworkNormal
Repository coverage

1665 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

252security candidates228second-pass queue1525AI analyses
81commits · 30 days
180commits · 60 days
552commits · 180 days
1254commits · 365 days
Backfill bands
Aug 5 → Feb 6819 seen18 candidatesComplete
Feb 6 → Jun 6468 seen16 candidatesComplete
Jun 6 → Jul 6128 seen8 candidatesComplete
Jul 6 → Aug 561 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
473Strong · 80–100
836Adequate · 60–79
294Thin · 40–59
62Opaque · 0–39
3security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Elias Rohrer15315153667
Matt Corallo43553371574
Jeffrey Czyz19545182169
Wilmer Paulino15945155169
Leo Nash11613116162
Valentine Wallace14511138169
Vincenzo Palazzo11311183
Joost Jager16224162069
elnosh391333058
auto-pr-bot2478087
shaavan22622069
Carla Kirk-Cohen78366068
Analysis record

Published AI watches

Last scanned 16 minutes ago

Moderate 55 AI analysisMessage 76 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Persistent `MonitorEvent`s' (#4491)

This commit makes on-chain 'MonitorEvent' notifications durable and replay-safe. Previously, if a node crashed after a ChannelMonitor persisted a block update but before the ChannelManager processed the resulting event, the event could be …

Durability/atomicity fix for async persistence: prevents lost MonitorEvents across crashesNew ack-based event lifecycle with random event IDsArchival gating on unacknowledged events to avoid losing preimage/timeout information
9a324e72by wpaulino+467−45912 files
No security note in commit
Low 47 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Fix payment attribution edge cases and simplify claiming' (#5021)

This commit refactors how LDK nodes claim incoming Lightning payments. It replaces a separate 'claim with known custom TLVs' method with an options struct passed to the normal claim call, and fixes two edge cases in payment attribution dat…

API change: claim_funds now takes ClaimFundsOptions, consolidating TLV-known behavior into one pathFailure-packet length bound added to prevent oversized onion error messagesIncoming failure packet truncated at 32 KiB before processing
ee7c61c2by Matt Corallo+256−17322 files
No security note in commit
Low 47 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'release utxos from failed splices' (#4973)

This change fixes a wallet bookkeeping problem in rust-lightning's built-in coin-selection wrappers. Previously, when a splice attempt failed or coin selection errored after picking UTXOs, those UTXOs stayed marked as 'reserved' in memory …

Resource exhaustion / denial-of-service via permanent in-memory UTXO reservationIncorrect state tracking in coin-selection wrapperNew API method required for correct lifecycle management (release_utxos)
7220a6fdby jkczyz+295−383 files
No security note in commit
Low 49 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Restore `Wallet` UTXO locks when coin selection fails afterwards

This commit fixes a bug in the wallet's coin-selection code. When the wallet picked UTXOs to spend, it locked them immediately so they couldn't be reused. But if a later step—fetching the change address or the previous transaction—failed, …

Resource lock leak on error pathUTXO lock state inconsistency between selection and confirmationDenial-of-service/funds-unavailability risk from persistent UTXO locks
81afd9caby elnosh+146−331 file
No security note in commit
Informational 19 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'tx-sync: Parallelize esplora status queries' (#4913)

This commit rewrites how a Lightning wallet talks to Esplora block-explorer servers so that many status checks happen in parallel instead of one at a time. It is a performance/refactoring change. There is no direct evidence in the commit t…

Concurrency/timing change in transaction confirmation logicNew inconsistency check preserved when a previously-confirmed tx is reported unconfirmedAdded defensive error path for missing pre-fetched block status
c303f515by Matt Corallo+140−371 file
No security note in commit
Low 30 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Skip Electrum creator transaction downloads' (#4992)

This change stops the Electrum-based transaction sync client from downloading the very transaction that created an output it is watching. Previously, the client could request that transaction from Electrum, even though a transaction can ne…

Avoids unnecessary Electrum transaction.get requests for watched outputsReduces information disclosure to Electrum server about watched outpointsAdds regression test verifying request suppression
c36e50cbby Matt Corallo+142−02 files
No security note in commit
Low 44 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Use preferred sPK of watched txn in electrum, not rand ones' (#4867)

This change improves how the Lightning Dev Kit's Electrum and Esplora transaction-sync clients track watched Bitcoin transactions. Previously, the code ignored the script pubkey (the 'address' associated with a transaction) supplied when r…

Previously ignored `script_pubkey` argument in `register_tx` for transaction watchersElectrum script-history queries previously used an arbitrary transaction output, which could be OP_RETURN and therefore unindexed by some Electrum serversNew logic prefers caller-supplied script pubkey and falls back to non-OP_RETURN outputs
bfe5ca89by tnull+52−243 files
No security note in commit
Low 33 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Serialize transient Event variants; move persist decision into ChannelManager' (#4791)

This commit changes how LDK stores pending event notifications. It adds serialization support for several event types that previously were not fully saved to disk, and introduces a helper method so the code can decide which events are wort…

Data-loss prevention: previously non-round-trippable event variants are now fully serialized, avoiding accidental event loss when users serialize Event queues themselvesState-consistency hardening: ChannelManager now explicitly skips events that describe non-surviving restart state, preventing replay of stale eventsDefensive assertion: debug builds assert that every persisted event round-trips to Some(event), catching serialization mismatches
a0d4632eby Matt Corallo+694−818 files
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Document that funding signing events can go stale' (#4960)

This commit only adds documentation comments to two source files. It explains that certain funding-signing events can become stale if the underlying negotiation fails, and that callers may see specific harmless errors as a result. No code …

26eecf2dby Matt Corallo+15−02 files
No security note in commit
Moderate 58 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add `Wallet::release_utxos` to free UTXOs from abandoned transactions

This commit fixes a design flaw in LDK's built-in wallet helper where coins selected for a splice-in (or other unclaimed funding) were permanently reserved in memory if the transaction was abandoned. Over repeated failed splices, all spend…

Denial-of-service via UTXO exhaustion from repeated failed splice negotiationsRisk of inability to broadcast fee-bumping/claim transactions due to lack of available UTXOsNew API surface (release_utxos) introduced to mitigate resource leak
52ab13fdby elnosh+148−43 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop the honggfuzz version pin from the CI fuzz job

This commit removes a fixed-version pin for the honggfuzz fuzzing tool in a continuous-integration script. The project now uses the current release of honggfuzz instead of an older pinned version. There is no change to the actual Lightning…

4a1635efby auto-pr-bot+1−51 file
No security note in commit
Informational 15 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Run the CI fuzz job on the stable toolchain

This commit changes the Rust toolchain used in the continuous integration (CI) fuzzing job from a fixed older version (1.75) to the latest stable release. It is purely a build/test infrastructure change to fix a dependency compatibility is…

21c4ed2bby auto-pr-bot+3−32 files
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Expose the dummy-hop tail constructor publicly

This commit makes a previously internal helper function public so that outside developers can build dummy-hop tails for blinded payment paths without recreating the logic themselves. It is an API usability change, not a fix for a known sec…

No security-relevant behavior change in the diffAPI visibility broadened from crate-public to publicCLTV expiry overflow check already present and unchanged
c5443353by auto-pr-bot+14−71 file
No security note in commit
Moderate 54 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fail commitment sig verification without counterparty params

This change adds a safety check in a Bitcoin Lightning Network library (LDK). Previously, if the software tried to verify a peer's commitment signature before it had learned the peer's channel parameters, it could crash with a panic. Now i…

Defensive check added on peer-driven code path to prevent panicMissing counterparty_parameters could previously cause panic during commitment transaction constructionChannel closure returned instead of panic
de7ecc2fby auto-pr-bot+24−01 file
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Clarify the commitment validation failure message

This commit only changes the wording of an error message sent to peers when a commitment transaction fails validation. It replaces the vague phrase 'Failed to validate our commitment' with the clearer 'Received commitment failed validation…

3284a006by auto-pr-bot+11−114 files
No security note in commit
Moderate 61 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Move holder commit sig checks to `InMemorySigner`' (#4885)

This commit moves the checks that validate a counterparty's signatures on the holder's commitment and HTLC transactions out of the general channel code and into the signer module (InMemorySigner). Previously, these signature checks were do…

Moved signature validation from channel state machine into signer moduleAdded new tests that corrupt signatures and verify rejectionChanged error message from 'Invalid commitment tx signature from peer' / 'Invalid funding_created signature from peer' to 'Failed to validate our commitment'
83f5ba55by Matt Corallo+626−31024 files
No security note in commit
Low 42 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Drop stale splice signature on disconnect' (#4954)

This change fixes a Lightning channel splicing bug: when two peers temporarily disconnect during a splice, any half-finished signature the other side already sent is now discarded. Before the fix, that stale signature could be reused after…

State-invalidation bug in multi-step protocol (splice negotiation)Stale cryptographic signature not cleared on disconnectPotential reuse of old commitment state after reconnect
c9a77251by Matt Corallo+22−12 files
No security note in commit
Moderate 58 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop stale splice signature on disconnect

This fix prevents a Lightning channel from being accidentally force-closed. During a splice (a way to resize a payment channel), one side's initial signature could be kept in memory after the peers disconnected. If the peers later reconnec…

State inconsistency: in-memory buffered message not cleared on disconnectDuplicate message processing after reconnectionForce-close consequence for active Lightning channel
71405b4bby Wilmer Paulino+22−12 files
Vendor flagged security relevance
Informational 20 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'offers: rename matches_invoice_signing_pubkey to key_can_sign_invoice' (#4942)

This commit is a simple rename of a public function from `matches_invoice_signing_pubkey` to `key_can_sign_invoice`, plus matching updates to its documentation, callers, tests, and changelog. No behavior changed. It is not a security fix.

a476cf92by Matt Corallo+13−133 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

offers: rename matches_invoice_signing_pubkey to key_can_sign_invoice

This commit is a simple rename of a function and its documentation from matches_invoice_signing_pubkey to key_can_sign_invoice. No logic, behavior, or security properties changed. It is a follow-up code-review naming cleanup.

388187caby Vincenzo Palazzo+13−133 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateUse a tolerance when estimating remote feesby Jeffrey Czyz · 3aa45740 · Nov 11, 2025 · 1 fileMessage 68 · AdequateLow 33Details
Commit message · Jeffrey Czyz

Use a tolerance when estimating remote fees

The interactive-tx construction protocol uses an agreed upon fee rate.
Since the bitcoind coin selection algorithm may underpay fees when no
change output is needed, providing a tolerance when checking if the
remote's fee contribution could avoid some unexpected failures. This
commit introduces a 95% tolerance similar to Eclair.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 33/100

This change relaxes a fee-checking rule during Bitcoin Lightning channel transactions. When two parties jointly build a transaction, the code now accepts a remote party's fee contribution that is up to 5% lower than the agreed rate, matching how another major implementation (Eclair) behaves. This avoids false failures caused by real-world coin-selection quirks, but it also means the local node may accept slightly less fee than strictly required.

Security candidateAccount for grind_signatures in splice funding txby Jeffrey Czyz · 46980261 · Nov 11, 2025 · 6 filesMessage 68 · AdequateLow 32Details
Commit message · Jeffrey Czyz

Account for grind_signatures in splice funding tx

When estimating the splice funding transaction fees, adjust for
grind_signatures. Since LDK supplies one of the signatures, only adjust
by 1 WU even though spending the shared input requires two signatures.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 32/100

This commit fixes a fee-estimation bug in LDK's experimental splicing code. When the optional `grind_signatures` feature is enabled, signatures are guaranteed to be one byte smaller than the normal maximum. The splice funding-transaction fee estimator was not accounting for that smaller signature, so it could slightly overestimate fees. The patch subtracts one weight unit from the relevant estimates when the feature is on, and updates tests to match. It is a correctness/efficiency fix rather than a critical vulnerability.

Security candidateRemove `get_revoke_commit_msgs` macroby elnosh · 0ef429ee · Nov 10, 2025 · 11 filesMessage 50 · ThinInformational 15Details
Commit message · elnosh

Remove `get_revoke_commit_msgs` macro

Replace calls to `get_revoke_commit_msgs` macro
to the identically-named function.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a simple internal cleanup in the project's test code. It removes a helper macro named `get_revoke_commit_msgs!` and replaces every use with an already-existing function of the same name. There is no change to how the software behaves in production, no fix for a bug, and no security-relevant change.

Security candidateUse `commitment_signed_dance_through_cp_raa` instead of macroby elnosh · 021d503d · Nov 10, 2025 · 4 filesMessage 65 · AdequateInformational 15Details
Commit message · elnosh

Use `commitment_signed_dance_through_cp_raa` instead of macro

Replace calls to `commitment_signed_dance` macro to instead
call `commitment_signed_dance_through_cp_raa`.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a small internal cleanup in the project's test code. It replaces a few uses of a test helper macro with a direct call to an equivalent helper function. There is no change to the actual Lightning node logic that runs in production, and nothing in the commit suggests a security fix or vulnerability.

Security candidateRemove `commitment_signed_dance` macroby elnosh · 1bbc6928 · Nov 10, 2025 · 5 filesMessage 50 · ThinInformational 15Details
Commit message · elnosh

Remove `commitment_signed_dance` macro

Replace last `commitment_signed_dance` calls with
`commitment_signed_dance_return_raa`.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a straightforward internal cleanup in the project's test code. It removes a helper macro used only in tests and replaces its remaining uses with an equivalent regular function. There is no change to the actual Lightning protocol logic, network-facing behavior, or production code, so it does not create or fix a security issue.

Lower-priorityRemove `do_main_commitment_signed_dance` call in macroby elnosh · b675324a · Nov 10, 2025 · 1 fileMessage 50 · ThinInformational 11Details
Commit message · elnosh

Remove `do_main_commitment_signed_dance` call in macro

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 11/100

This commit removes an unused branch of a Rust macro used only in test helper code. It is a code cleanup change with no apparent effect on production Lightning node behavior or security.

Security candidateReplace `commitment_signed_dance` for skip_last_step=trueby elnosh · c1097fdb · Nov 10, 2025 · 15 filesMessage 65 · AdequateInformational 13Details
Commit message · elnosh

Replace `commitment_signed_dance` for skip_last_step=true

Replace calls to `commitment_signed_dance` macro when
skip_last_step=true to instead call `do_commitment_signed_dance`.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 13/100

This commit is a test-only refactoring change. It replaces uses of a test helper macro (`commitment_signed_dance!`) with direct calls to an equivalent test helper function (`do_commitment_signed_dance`) in many test files. There is no change to production code, no change to behavior, and no security fix or vulnerability introduced.

Security candidateReplace `commitment_signed_dance` for skip_last_step=falseby elnosh · 80965fa6 · Nov 10, 2025 · 18 filesMessage 73 · AdequateInformational 15Details
Commit message · elnosh

Replace `commitment_signed_dance` for skip_last_step=false

Replace calls to `commitment_signed_dance` macro when
skip_last_step=false to instead call `do_commitment_signed_dance`.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a test-only refactoring change. It replaces uses of a macro called `commitment_signed_dance!` with direct calls to a helper function `do_commitment_signed_dance` in many test files. There is no change to production code, no security fix, and no vulnerability introduced.

Lower-priorityUse `honggfuzz`'s `--run-time` arg to limit per-fuzz runtime in CIby Matt Corallo · 8015c015 · Nov 10, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Matt Corallo

Use `honggfuzz`'s `--run-time` arg to limit per-fuzz runtime in CI

We have some complexity in `ci-fuzz.sh` to limit each fuzzer to a
rough runtime, but `honggfuzz` has a `--run-time` argument that we
can simply use instead, which we do here.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit is a cleanup of the project's continuous integration fuzz-testing script. It replaces a custom, per-target method of limiting how long each fuzz test runs with a built-in honggfuzz command-line option (`--run_time 30`). There is no change to the actual Lightning protocol code, cryptography, networking, or any code that end users run. It only affects how long automated fuzzing jobs run in CI.

Security candidateUse 72 WU instead of 73 WU for signature weightby Jeffrey Czyz · eb341de7 · Nov 10, 2025 · 4 filesMessage 73 · AdequateLow 36Details
Commit message · Jeffrey Czyz

Use 72 WU instead of 73 WU for signature weight

When estimating signature weight, 73 WU was used in some places while 72
WU was used in others. Consistently use 72 WU and replace hardcoded
values with constants. 73 WU signatures are non-standard and won't be
produced by LDK. Additionally, using 73 WU along with grind_signatures
adjustment is nonsensical.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 36/100

This commit fixes an internal inconsistency in how LDK estimates Bitcoin transaction fees. Some parts of the code assumed signatures could be 73 weight units (WU) long, while others used 72 WU. Since 73 WU signatures are non-standard and LDK never produces them, the 73 WU assumption caused fee estimates to be slightly too high. The patch standardizes on 72 WU and replaces magic numbers with named constants. The practical effect is slightly lower, more accurate fee estimates for Lightning channel funding and splicing transactions. It is not a direct vulnerability fix, but incorrect fee estimation could in edge cases cause transactions to be over-funded or, more importantly, could contribute to fee-related negotiation failures.

AI review queuedDrop required `Box`ing of `lightning` trait `Future`sby Matt Corallo · 3da5f583 · Nov 10, 2025 · 4 filesMessage 73 · AdequateInformational 18Details
Commit message · Matt Corallo

Drop required `Box`ing of `lightning` trait `Future`s

Now that our MSRV is 1.75, we can return `impl Trait` from trait
methods. Here we use this to clean up `lightning` crate trait
methods, dropping the `Pin<Box<dyn ...>>`/`AsyncResult` we had to
use to have trait methods return a concrete type.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a routine code cleanup in the Lightning Dev Kit Rust library. It takes advantage of a newer Rust language feature (available since Rust 1.75) to remove unnecessary 'Box' heap allocations around futures returned from certain trait methods. There is no indication this change fixes a security bug or introduces a vulnerability; it is a refactoring to simplify the code and reduce allocations.

AI review queuedTrivially replace `Box::pin` with `pin!` in a few placesby Matt Corallo · 21052847 · Nov 10, 2025 · 6 filesMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Trivially replace `Box::pin` with `pin!` in a few places

Now that our MSRV is above 1.68 we can use the `pin!` macro to
avoid having to `Box` various futures, avoiding some allocations,
especially in `lightning-net-tokio`, which happens in a tight loop.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup that swaps one Rust standard-library mechanism for pinning futures (`Box::pin`) with a newer, allocation-free equivalent (`pin!`). It removes heap allocations in a few internal loops and sync wrappers, but does not change program logic, trust boundaries, or behavior. There is no security relevance.

Lower-priorityMove `lightning-transaction-sync` back into the main workspaceby Matt Corallo · 7956af05 · Nov 10, 2025 · 4 filesMessage 65 · AdequateInformational 15Details
Commit message · Matt Corallo

Move `lightning-transaction-sync` back into the main workspace

Now that it has the same MSRV as everything else in the workspace,
it doesn't need to live on its own.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is purely a housekeeping change: it moves the `lightning-transaction-sync` crate from a separate mini-workspace back into the main project workspace because it now uses the same minimum Rust version as everything else. The only files changed are CI workflow definitions and test scripts. There is no change to application code, no bug fix, and no security patch.

Lower-priorityDrop `Box`ing of iterators during BOLT 11 invoice serializationby Matt Corallo · b1f1ee2a · Nov 10, 2025 · 2 filesMessage 85 · StrongInformational 15Details
Commit message · Matt Corallo

Drop `Box`ing of iterators during BOLT 11 invoice serialization

Now that we have an MSRV that supports returning `impl Trait` in
trait methods, we can use it to avoid the `Box<dyn ...>` we had
spewed all over our BOLT 11 invoice serialization.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is a routine code cleanup in the Lightning Dev Kit's BOLT 11 invoice serialization code. It replaces heap-allocated boxed iterators with Rust's newer 'impl Trait' return type feature, eliminating unnecessary memory allocations. There is no security-relevant change here.

Lower-priorityDrop required `Box`ing of `lightning-block-sync` `Future`sby Matt Corallo · a435228c · Nov 10, 2025 · 6 filesMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Drop required `Box`ing of `lightning-block-sync` `Future`s

Now that our MSRV is 1.75, we can return `impl Trait` from trait
methods. Here we use this to clean up `lightning-block-sync` trait
methods, dropping the `Pin<Box<dyn ...>>` we had to use to have
trait methods return a concrete type.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine code cleanup in the Lightning Dev Kit's block synchronization module. It takes advantage of a newer Rust language feature (returning 'impl Trait' from trait methods, now that the project's minimum supported Rust version is 1.75) to remove unnecessary heap-allocated boxed futures. There is no security-relevant change here; it is purely a refactoring to simplify the code and remove an old workaround.

Lower-priorityDrop required `Box`ing of `KVStore` `Future`sby Matt Corallo · 0b4e1b5c · Nov 10, 2025 · 6 filesMessage 68 · AdequateInformational 17Details
Commit message · Matt Corallo

Drop required `Box`ing of `KVStore` `Future`s

Now that our MSRV is 1.75, we can return `impl Trait` from trait
methods. Here we use this to clean up `KVStore` methods, dropping
the `Pin<Box<dyn ...>>` we had to use to have trait methods return
a concrete type. Sadly, there's two places where we can't drop a
`Box::pin` until we switch to edition 2024.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 17/100

This commit is a routine Rust code cleanup: it removes the requirement that KVStore trait methods return their futures inside a Box (a heap allocation). It takes advantage of a newer Rust compiler feature (returning 'impl Trait' from trait methods) to make the code simpler and slightly more efficient. There is no indication this fixes a security bug or introduces a vulnerability.

Lower-priorityFix unused_mut warning under --cfg=c_bindingsby Jeffrey Czyz · 2338805c · Nov 6, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Jeffrey Czyz

Fix unused_mut warning under --cfg=c_bindings

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a minor code cleanup that removes a Rust compiler warning. It changes how a macro handles the `mut` keyword so that one version of the code no longer triggers an 'unused_mut' warning when compiled with a specific configuration flag. There is no functional change and no security impact.

AI review queuedFix compiler warningby Jeffrey Czyz · 73820aec · Nov 5, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Jeffrey Czyz

Fix compiler warning

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This is a one-line change that adds a Rust compiler feature gate to silence a warning. It does not change program behavior or fix any security issue.

Lower-priorityAdd LDK Node integration testby Elias Rohrer · f50ea316 · Nov 5, 2025 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Elias Rohrer

Add LDK Node integration test

We add a simple workflow to our CI that runs `cargo check` on LDK Node to ensure
LDK didn't introduce breaking API changes.

The idea here is to catch breaking changes early, and encourage to fix
them in LDK or LDK Node `main` ASAP.

In the future we might want to extend this to run the full test suite,
once we whack-a-moled a few more of LDK Node's flaky tests.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit adds a new automated CI workflow that checks whether changes in the rust-lightning project break the public API used by a related project called LDK Node. It does not change any application code, cryptographic logic, network handling, or user-facing behavior. It is purely a testing/infrastructure addition.

Security candidateAllow counterparty tx_abort before handling initial commitment signedby Wilmer Paulino · d282a47f · Nov 3, 2025 · 3 filesMessage 85 · StrongLow 44Details
Commit message · Wilmer Paulino

Allow counterparty tx_abort before handling initial commitment signed

Upon processing the counterparty's initial `commitment_signed` for a
splice, we queue a monitor update with the new commitment transactions
spending the new funding transaction. Once handled, funding transaction
signatures can be exchanged and we must start monitoring the chain for a
possible commitment transaction broadcast spending the new funding
transaction. Aborting the splice negotiation then would therefore be
unsafe, hence why we currently force close in such cases. However, there
is no reason to force close prior to receiving their initial
`commitment_signed`, as this would imply the funding transaction
signatures have yet to be exchanged, thus making a commitment broadcast
spending said transaction impossible allowing us to abort the splice
negotiation safely.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing boundary
AI analysis · Low 44/100

This change fixes a Lightning channel splicing behavior where one side would unnecessarily force-close the channel if the counterparty tried to abort a splice before both sides had exchanged their first commitment signatures. Previously, any tx_abort during the signature-waiting phase triggered a force close. The patch makes the protocol more forgiving: aborting is allowed until the counterparty has actually sent its initial commitment_signed, because before that point no dangerous on-chain transaction has been committed to. Once commitment_signed is received, aborting remains unsafe and still triggers a force close. The change also cleans up internal state when aborting early and adds tests for the new behavior.

AI review queuedSupport capturing `tx_abort` send within channel reestablish testsby Wilmer Paulino · 0cdcf542 · Nov 3, 2025 · 2 filesMessage 60 · AdequateInformational 15Details
Commit message · Wilmer Paulino

Support capturing `tx_abort` send within channel reestablish tests

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes internal test helper code in the Lightning Dev Kit repository. It extends a test macro and a test reconnection helper so that automated tests can optionally capture and forward a `tx_abort` message during channel re-establishment scenarios. No production code is modified, and there is no indication this fixes or introduces a security issue.

AI review queuedProvide the same docs in `ChangeDestinationSource` as the sync oneby Matt Corallo · b55eec77 · Nov 3, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Matt Corallo

Provide the same docs in `ChangeDestinationSource` as the sync one

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a documentation comment to a Rust trait method. It does not change any code behavior, logic, or security properties. The added text explains that the method returns a script pubkey usable as a change destination and references another function.

AI review queuedCopy async docs from async bump transaction objects to sync onesby Matt Corallo · c3114471 · Nov 3, 2025 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Copy async docs from async bump transaction objects to sync ones

When we added the async traits and wrapper structs for the
transaction-bumping logic, we didn't bother copying the
documentation to the sync wrappers as we figured the links
sufficed. Sadly, however, this means that our bindings logic will
have no docs but a broken link to an async object that doesn't
exist.

Instead, here, we copy the docs from the async objects to the sync
ones, at least leaving behind a comment noting that both need
updating whenever one gets updated.

We also fix one bogus link in `Wallet`'s docs.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only copies documentation comments from asynchronous Rust traits and structs to their synchronous counterparts. It fixes broken documentation links and adds notes reminding developers to keep both versions in sync. No code behavior changes.

Lower-priorityCopy async docs from async KVStore to sync oneby Matt Corallo · 9516400d · Nov 3, 2025 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Matt Corallo

Copy async docs from async KVStore to sync one

When we added the async trait for `KVStore`, we didn't bother
copying the documentation to the sync wrappers as we figured the
links sufficed. Sadly, however, this means that our bindings logic
will have no docs but a broken link to an async object that doesn't
exist.

Instead, here, we copy the docs from the async objects to the sync
ones, at least leaving behind a comment noting that both need
updating whenever one gets updated.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only copies documentation comments from the asynchronous version of a key-value storage trait to its synchronous wrapper. It fixes broken documentation links for language bindings but does not change any code behavior, logic, or security properties.

Lower-priorityCopy docs from `OutputSweeper` to `OutputSweeperSync`by Matt Corallo · 4bc993cc · Nov 3, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Copy docs from `OutputSweeper` to `OutputSweeperSync`

When we added the async wrapper for `OutputSweeper`, we didn't
bother copying the documentation to the sync wrappers as we figured
the links sufficed. Sadly, however, this means that our bindings
logic will have no docs but a broken link to an async object that
doesn't exist.

Instead, here, we copy the docs from the async objects to the sync
ones, at least leaving behind a comment noting that both need
updating whenever one gets updated.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a documentation-only change. It copies the user-facing documentation from the asynchronous OutputSweeper struct to its synchronous wrapper OutputSweeperSync, and fixes a broken doc link. No code behavior changes, no security fix or vulnerability introduced.