LDK
← All projectsLightning Dev Kit

rust-lightning

Composable Rust libraries for building Lightning wallets, nodes, and services.

BitcoinCryptographic librariesLightning NetworkNormal
Repository coverage

1665 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

252security candidates228second-pass queue1525AI analyses
81commits · 30 days
180commits · 60 days
552commits · 180 days
1254commits · 365 days
Backfill bands
Aug 5 → Feb 6819 seen18 candidatesComplete
Feb 6 → Jun 6468 seen16 candidatesComplete
Jun 6 → Jul 6128 seen8 candidatesComplete
Jul 6 → Aug 561 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
473Strong · 80–100
836Adequate · 60–79
294Thin · 40–59
62Opaque · 0–39
3security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Elias Rohrer15315153667
Matt Corallo43553371574
Jeffrey Czyz19545182169
Wilmer Paulino15945155169
Leo Nash11613116162
Valentine Wallace14511138169
Vincenzo Palazzo11311183
Joost Jager16224162069
elnosh391333058
auto-pr-bot2478087
shaavan22622069
Carla Kirk-Cohen78366068
Analysis record

Published AI watches

Last scanned 36 minutes ago

Moderate 55 AI analysisMessage 76 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Persistent `MonitorEvent`s' (#4491)

This commit makes on-chain 'MonitorEvent' notifications durable and replay-safe. Previously, if a node crashed after a ChannelMonitor persisted a block update but before the ChannelManager processed the resulting event, the event could be …

Durability/atomicity fix for async persistence: prevents lost MonitorEvents across crashesNew ack-based event lifecycle with random event IDsArchival gating on unacknowledged events to avoid losing preimage/timeout information
9a324e72by wpaulino+467−45912 files
No security note in commit
Low 47 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Fix payment attribution edge cases and simplify claiming' (#5021)

This commit refactors how LDK nodes claim incoming Lightning payments. It replaces a separate 'claim with known custom TLVs' method with an options struct passed to the normal claim call, and fixes two edge cases in payment attribution dat…

API change: claim_funds now takes ClaimFundsOptions, consolidating TLV-known behavior into one pathFailure-packet length bound added to prevent oversized onion error messagesIncoming failure packet truncated at 32 KiB before processing
ee7c61c2by Matt Corallo+256−17322 files
No security note in commit
Low 47 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'release utxos from failed splices' (#4973)

This change fixes a wallet bookkeeping problem in rust-lightning's built-in coin-selection wrappers. Previously, when a splice attempt failed or coin selection errored after picking UTXOs, those UTXOs stayed marked as 'reserved' in memory …

Resource exhaustion / denial-of-service via permanent in-memory UTXO reservationIncorrect state tracking in coin-selection wrapperNew API method required for correct lifecycle management (release_utxos)
7220a6fdby jkczyz+295−383 files
No security note in commit
Low 49 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Restore `Wallet` UTXO locks when coin selection fails afterwards

This commit fixes a bug in the wallet's coin-selection code. When the wallet picked UTXOs to spend, it locked them immediately so they couldn't be reused. But if a later step—fetching the change address or the previous transaction—failed, …

Resource lock leak on error pathUTXO lock state inconsistency between selection and confirmationDenial-of-service/funds-unavailability risk from persistent UTXO locks
81afd9caby elnosh+146−331 file
No security note in commit
Informational 19 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'tx-sync: Parallelize esplora status queries' (#4913)

This commit rewrites how a Lightning wallet talks to Esplora block-explorer servers so that many status checks happen in parallel instead of one at a time. It is a performance/refactoring change. There is no direct evidence in the commit t…

Concurrency/timing change in transaction confirmation logicNew inconsistency check preserved when a previously-confirmed tx is reported unconfirmedAdded defensive error path for missing pre-fetched block status
c303f515by Matt Corallo+140−371 file
No security note in commit
Low 30 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Skip Electrum creator transaction downloads' (#4992)

This change stops the Electrum-based transaction sync client from downloading the very transaction that created an output it is watching. Previously, the client could request that transaction from Electrum, even though a transaction can ne…

Avoids unnecessary Electrum transaction.get requests for watched outputsReduces information disclosure to Electrum server about watched outpointsAdds regression test verifying request suppression
c36e50cbby Matt Corallo+142−02 files
No security note in commit
Low 44 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Use preferred sPK of watched txn in electrum, not rand ones' (#4867)

This change improves how the Lightning Dev Kit's Electrum and Esplora transaction-sync clients track watched Bitcoin transactions. Previously, the code ignored the script pubkey (the 'address' associated with a transaction) supplied when r…

Previously ignored `script_pubkey` argument in `register_tx` for transaction watchersElectrum script-history queries previously used an arbitrary transaction output, which could be OP_RETURN and therefore unindexed by some Electrum serversNew logic prefers caller-supplied script pubkey and falls back to non-OP_RETURN outputs
bfe5ca89by tnull+52−243 files
No security note in commit
Low 33 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Serialize transient Event variants; move persist decision into ChannelManager' (#4791)

This commit changes how LDK stores pending event notifications. It adds serialization support for several event types that previously were not fully saved to disk, and introduces a helper method so the code can decide which events are wort…

Data-loss prevention: previously non-round-trippable event variants are now fully serialized, avoiding accidental event loss when users serialize Event queues themselvesState-consistency hardening: ChannelManager now explicitly skips events that describe non-surviving restart state, preventing replay of stale eventsDefensive assertion: debug builds assert that every persisted event round-trips to Some(event), catching serialization mismatches
a0d4632eby Matt Corallo+694−818 files
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Document that funding signing events can go stale' (#4960)

This commit only adds documentation comments to two source files. It explains that certain funding-signing events can become stale if the underlying negotiation fails, and that callers may see specific harmless errors as a result. No code …

26eecf2dby Matt Corallo+15−02 files
No security note in commit
Moderate 58 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add `Wallet::release_utxos` to free UTXOs from abandoned transactions

This commit fixes a design flaw in LDK's built-in wallet helper where coins selected for a splice-in (or other unclaimed funding) were permanently reserved in memory if the transaction was abandoned. Over repeated failed splices, all spend…

Denial-of-service via UTXO exhaustion from repeated failed splice negotiationsRisk of inability to broadcast fee-bumping/claim transactions due to lack of available UTXOsNew API surface (release_utxos) introduced to mitigate resource leak
52ab13fdby elnosh+148−43 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop the honggfuzz version pin from the CI fuzz job

This commit removes a fixed-version pin for the honggfuzz fuzzing tool in a continuous-integration script. The project now uses the current release of honggfuzz instead of an older pinned version. There is no change to the actual Lightning…

4a1635efby auto-pr-bot+1−51 file
No security note in commit
Informational 15 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Run the CI fuzz job on the stable toolchain

This commit changes the Rust toolchain used in the continuous integration (CI) fuzzing job from a fixed older version (1.75) to the latest stable release. It is purely a build/test infrastructure change to fix a dependency compatibility is…

21c4ed2bby auto-pr-bot+3−32 files
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Expose the dummy-hop tail constructor publicly

This commit makes a previously internal helper function public so that outside developers can build dummy-hop tails for blinded payment paths without recreating the logic themselves. It is an API usability change, not a fix for a known sec…

No security-relevant behavior change in the diffAPI visibility broadened from crate-public to publicCLTV expiry overflow check already present and unchanged
c5443353by auto-pr-bot+14−71 file
No security note in commit
Moderate 54 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fail commitment sig verification without counterparty params

This change adds a safety check in a Bitcoin Lightning Network library (LDK). Previously, if the software tried to verify a peer's commitment signature before it had learned the peer's channel parameters, it could crash with a panic. Now i…

Defensive check added on peer-driven code path to prevent panicMissing counterparty_parameters could previously cause panic during commitment transaction constructionChannel closure returned instead of panic
de7ecc2fby auto-pr-bot+24−01 file
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Clarify the commitment validation failure message

This commit only changes the wording of an error message sent to peers when a commitment transaction fails validation. It replaces the vague phrase 'Failed to validate our commitment' with the clearer 'Received commitment failed validation…

3284a006by auto-pr-bot+11−114 files
No security note in commit
Moderate 61 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Move holder commit sig checks to `InMemorySigner`' (#4885)

This commit moves the checks that validate a counterparty's signatures on the holder's commitment and HTLC transactions out of the general channel code and into the signer module (InMemorySigner). Previously, these signature checks were do…

Moved signature validation from channel state machine into signer moduleAdded new tests that corrupt signatures and verify rejectionChanged error message from 'Invalid commitment tx signature from peer' / 'Invalid funding_created signature from peer' to 'Failed to validate our commitment'
83f5ba55by Matt Corallo+626−31024 files
No security note in commit
Low 42 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Drop stale splice signature on disconnect' (#4954)

This change fixes a Lightning channel splicing bug: when two peers temporarily disconnect during a splice, any half-finished signature the other side already sent is now discarded. Before the fix, that stale signature could be reused after…

State-invalidation bug in multi-step protocol (splice negotiation)Stale cryptographic signature not cleared on disconnectPotential reuse of old commitment state after reconnect
c9a77251by Matt Corallo+22−12 files
No security note in commit
Moderate 58 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop stale splice signature on disconnect

This fix prevents a Lightning channel from being accidentally force-closed. During a splice (a way to resize a payment channel), one side's initial signature could be kept in memory after the peers disconnected. If the peers later reconnec…

State inconsistency: in-memory buffered message not cleared on disconnectDuplicate message processing after reconnectionForce-close consequence for active Lightning channel
71405b4bby Wilmer Paulino+22−12 files
Vendor flagged security relevance
Informational 20 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'offers: rename matches_invoice_signing_pubkey to key_can_sign_invoice' (#4942)

This commit is a simple rename of a public function from `matches_invoice_signing_pubkey` to `key_can_sign_invoice`, plus matching updates to its documentation, callers, tests, and changelog. No behavior changed. It is not a security fix.

a476cf92by Matt Corallo+13−133 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

offers: rename matches_invoice_signing_pubkey to key_can_sign_invoice

This commit is a simple rename of a function and its documentation from matches_invoice_signing_pubkey to key_can_sign_invoice. No logic, behavior, or security properties changed. It is a follow-up code-review naming cleanup.

388187caby Vincenzo Palazzo+13−133 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityConvert macro to convert_channel_err methodby Joost Jager · ee426703 · Dec 11, 2025 · 1 fileMessage 45 · ThinInformational 12Details
Commit message · Joost Jager

Convert macro to convert_channel_err method

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100

This commit is a straightforward internal code cleanup: it turns a Rust macro named convert_channel_err into a regular method on the ChannelManager struct. The logic inside the conversion stays the same, and all call sites are updated to use the new method. There is no change to user-facing behavior, network protocol handling, or security-sensitive checks.

Lower-priorityConvert macro to convert_channel_err_funded methodby Joost Jager · 36cfb13a · Dec 11, 2025 · 1 fileMessage 50 · ThinInformational 12Details
Commit message · Joost Jager

Convert macro to convert_channel_err_funded method

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100

This commit is a straightforward code cleanup: it turns a small Rust macro used only for funded-channel error handling into a regular method. The behavior appears unchanged; the same internal function is called with the same arguments. There is no indication this fixes or introduces a security issue.

Lower-priorityReplace macro with direct call to convert_unfunded_channel_err_internalby Joost Jager · ec112c47 · Dec 11, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Joost Jager

Replace macro with direct call to convert_unfunded_channel_err_internal

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is a small internal code cleanup in the Lightning Dev Kit's Rust implementation. It removes a rarely-used macro branch and replaces two calls with direct function calls. There is no visible security change: the same function runs, with the same arguments, in the same order. The commit message and diff give no indication of a bug fix or security issue.

Lower-priorityConvert macro to convert_channel_err_coop methodby Joost Jager · 87e01ffd · Dec 11, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Joost Jager

Convert macro to convert_channel_err_coop method

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a straightforward code cleanup: it turns a small macro used only for cooperative channel closures into a regular Rust method. No behavior changes, no security fixes, and no bug fixes are visible in the diff.

Lower-priorityConvert convert_funded_channel_err fns to methodsby Joost Jager · 004ceef4 · Dec 11, 2025 · 1 fileMessage 45 · ThinInformational 14Details
Commit message · Joost Jager

Convert convert_funded_channel_err fns to methods

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 14/100

This commit is a simple code cleanup: it turns two standalone helper functions into methods attached to the ChannelManager struct. The actual logic inside the functions is copied almost verbatim, with only mechanical changes like replacing `cm.get_cm()` and `cm.logger` with `self.logger`, and `cm.short_to_chan_info` with `self.short_to_chan_info`. There is no change to behavior, no bug fix, and no security improvement or regression visible in the diff.

Lower-priorityTest 0.2 -> 0.3 reload with with forward htlcs presentby Valentine Wallace · a24dcffa · Dec 10, 2025 · 2 filesMessage 95 · StrongInformational 12Details
Commit message · Valentine Wallace

Test 0.2 -> 0.3 reload with with forward htlcs present

We have an overarching goal of (mostly) getting rid of ChannelManager
persistence and rebuilding the ChannelManager's state from existing
ChannelMonitors, due to issues when the two structs are out-of-sync on restart.
The main issue that can arise is channel force closure.

In the previous commit we started this process by rebuilding
ChannelManager::decode_update_add_htlcs, forward_htlcs, and
pending_intercepted_htlcs from the Channel data, which will soon be included in the
ChannelMonitors as part of a different series of PRs.

Here we test that HTLC forwards that were originally received on 0.2 can still
be successfully forwarded using the new reload + legacy handling code that will
be merged for 0.3.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 12/100

This commit adds new automated tests to make sure that payment forwarding state created by an older version (0.2) of the Lightning Dev Kit library still works correctly after upgrading to the upcoming 0.3 version. It does not change production code and is not a security fix or vulnerability.

Lower-priorityGather to-decode HTLC fwds from channels on manager readby Valentine Wallace · 64de9891 · Dec 10, 2025 · 2 filesMessage 85 · StrongInformational 23Details
Commit message · Valentine Wallace

Gather to-decode HTLC fwds from channels on manager read

We have an overarching goal of (mostly) getting rid of ChannelManager
persistence and rebuilding the ChannelManager's state from existing
ChannelMonitors, due to issues when the two structs are out-of-sync on restart.
The main issue that can arise is channel force closure.

Here we start this process by rebuilding
ChannelManager::decode_update_add_htlcs from the Channels, which will soon be
included in the ChannelMonitors as part of a different series of PRs.

The newly built map is not yet used but will be in the next commit.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 23/100

This commit is a preparatory internal refactoring in the Lightning Dev Kit's rust-lightning code. It changes how the ChannelManager reconstructs a list of pending forwarded payments when it is loaded from disk, gathering the data from individual channels instead of relying on a previously stored map. The new reconstructed map is created but not yet used in this commit; a follow-up commit will start using it. There is no direct security vulnerability introduced here, but the change is part of a larger effort to avoid dangerous inconsistencies between two key data structures (ChannelManager and ChannelMonitor) that could lead to forced channel closures if they get out of sync.

Lower-priorityRebuild manager forwarded htlcs maps from Channelsby Valentine Wallace · cb398f6b · Dec 10, 2025 · 3 filesMessage 95 · StrongLow 42Details
Commit message · Valentine Wallace

Rebuild manager forwarded htlcs maps from Channels

We have an overarching goal of (mostly) getting rid of ChannelManager
persistence and rebuilding the ChannelManager's state from existing
ChannelMonitors, due to issues when the two structs are out-of-sync on restart.
The main issue that can arise is channel force closure.

Here we start this process by rebuilding
ChannelManager::decode_update_add_htlcs, forward_htlcs, and
pending_intercepted_htlcs from Channel data, which will soon be included in the
ChannelMonitors as part of a different series of PRs.

We also fix the reload_node test util to use the node's pre-reload config after
restart. The previous behavior was a bit surprising and led to one of this
commit's tests failing.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Low 42/100

This commit changes how a Lightning node rebuilds its internal list of in-flight forwarded payments when it restarts. The goal is to eventually stop requiring a separate snapshot of the ChannelManager, instead reconstructing state from the more-reliable ChannelMonitor. The patch adds logic to avoid duplicate HTLC entries when both old and new reconstruction sources are present, and fixes a test helper so reload tests use the node's actual configuration. It is a forward-looking infrastructure change with safety implications if the deduplication logic is wrong, but it does not appear to introduce a remotely exploitable vulnerability.

Lower-priorityStore inbound committed update_adds in Channelby Valentine Wallace · 4f055aca · Dec 10, 2025 · 1 fileMessage 80 · StrongLow 31Details
Commit message · Valentine Wallace

Store inbound committed update_adds in Channel

We have an overarching goal of (mostly) getting rid of ChannelManager
persistence and rebuilding the ChannelManager's state from existing
ChannelMonitors, due to issues when the two structs are out-of-sync on restart.
The main issue that can arise is channel force closure.

As part of this, we plan to store at least parts of Channels in
ChannelMonitors, and that Channel data will be used in rebuilding the manager.

Once we store update_adds in Channels, we can use them on restart when
reconstructing ChannelManager maps such as forward_htlcs and
pending_intercepted_htlcs. Upcoming commits will start doing this
reconstruction.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Low 31/100

This commit changes how the Lightning Dev Kit stores information about incoming payment commitments inside a channel. It keeps a copy of the original 'update_add' message alongside committed inbound HTLCs so that, after a restart, the node can rebuild its internal payment-forwarding maps from Channel and ChannelMonitor data rather than relying on the separate ChannelManager persistence. The change is framed by the authors as a reliability improvement to avoid force-closure when ChannelManager and ChannelMonitor get out of sync on restart. It is not a direct security patch and does not appear to fix an active exploit, but it touches consensus-adjacent state and serialization, so mistakes here could affect funds safety.

Lower-priorityExtract util for HTLCIntercepted event creationby Valentine Wallace · c27093de · Dec 10, 2025 · 1 fileMessage 80 · StrongInformational 12Details
Commit message · Valentine Wallace

Extract util for HTLCIntercepted event creation

We have an overarching goal of (mostly) getting rid of ChannelManager
persistence and rebuilding the ChannelManager's state from existing
ChannelMonitors, due to issues when the two structs are out-of-sync on restart.
The main issue that can arise is channel force closure.

As part of rebuilding ChannelManager forward HTLCs maps, we will also add
a fix that will regenerate HTLCIntercepted events for HTLC intercepts that
are present but have no corresponding event in the queue. That fix will use
this new method.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 12/100

This commit is a small internal code cleanup in the Lightning Dev Kit's channel manager. It pulls out duplicated code for creating an 'HTLC intercepted' event into a shared helper function. The change does not fix a security bug and does not alter user-facing behavior; it is preparation for a future reliability improvement around restarting the channel manager without losing track of intercepted payments.

Lower-priorityTweak pending_htlc_intercepts ser on manager readby Valentine Wallace · 7c4d0214 · Dec 10, 2025 · 1 fileMessage 45 · ThinInformational 12Details
Commit message · Valentine Wallace

Tweak pending_htlc_intercepts ser on manager read

Makes an upcoming commit cleaner

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100

This is a small internal code cleanup in the Lightning Dev Kit's channel manager. It changes how an in-memory data structure (tracking intercepted HTLCs) is initialized when reading persisted state, so that a future commit can be simpler. There is no indication this fixes a security bug or changes externally observable behavior.

Lower-priorityRename manager HTLC forward maps to _legacyby Valentine Wallace · 005da38e · Dec 10, 2025 · 1 fileMessage 80 · StrongInformational 14Details
Commit message · Valentine Wallace

Rename manager HTLC forward maps to _legacy

We have an overarching goal of (mostly) getting rid of ChannelManager
persistence and rebuilding the ChannelManager's state from existing
ChannelMonitors, due to issues when the two structs are out-of-sync on restart.
The main issue that can arise is channel force closure.

Soon we'll be reconstructing these now-legacy maps from Channel data (that will
also be included in ChannelMonitors in future work), so rename them as part of
moving towards not needing to persist them in ChannelManager.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 14/100

This commit is a simple internal renaming of several data structures in the Lightning node's channel manager. It changes variable names like `forward_htlcs` to `forward_htlcs_legacy` and adds comments explaining that these maps are being kept for backward compatibility while the project moves toward rebuilding this state from channel monitors instead. There is no functional behavior change, no bug fix, and no security patch in the diff.

Lower-priorityExtract method to dedup pre-decode update_addby Valentine Wallace · 26992e1d · Dec 10, 2025 · 1 fileMessage 80 · StrongInformational 14Details
Commit message · Valentine Wallace

Extract method to dedup pre-decode update_add

We have an overarching goal of (mostly) getting rid of ChannelManager
persistence and rebuilding the ChannelManager's state from existing
ChannelMonitors, due to issues when the two structs are out-of-sync on restart.
The main issue that can arise is channel force closure.

We'll use this new util when reconstructing the
ChannelManager::decode_update_add_htlcs map from Channel data in upcoming
commits. While the Channel data is not included in the monitors yet, it will be
in future work.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 14/100

This commit is a simple internal code cleanup: it pulls out a small block of duplicate logic into a helper function. The behavior of the program is unchanged; no security issue is introduced or fixed.

Lower-priorityConvert channelmanager handle_error macro to fnby Joost Jager · 040ce2ab · Dec 10, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Joost Jager

Convert channelmanager handle_error macro to fn

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup: it replaces a Rust macro named `handle_error!` with an equivalent method `handle_error()` on the `ChannelManager` struct. The logic inside the function is identical to the macro, and all call sites are updated to use the new method syntax. There is no change to behavior, no bug fix, and no security relevance.

Lower-prioritySimplify channelmanager handle_error via map_errby Joost Jager · deac317f · Dec 10, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Joost Jager

Simplify channelmanager handle_error via map_err

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a straightforward code cleanup in the Lightning Dev Kit's channel manager. It rewrites an error-handling function to use Rust's `map_err` helper instead of an explicit `match` on `Ok`/`Err`. The behavior is unchanged: the same channel-closing logic, logging, and peer-message generation runs. No security issue is present.

Security candidateRemove `check_added_monitors` macroby elnosh · 8423ffad · Dec 9, 2025 · 23 filesMessage 50 · ThinInformational 15Details
Commit message · elnosh

Remove `check_added_monitors` macro

Replace calls to `check_added_monitors` macro
to the identically-named function.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100

This commit is a pure internal refactoring of the project's test code. It removes a Rust macro named `check_added_monitors!` and replaces every call with an identically-named regular function `check_added_monitors(...)`. There is no change to production code, user-facing behavior, or security logic. It only affects how tests are written.

AI review queuedAdd docs to `commitment_signed_dance_return_raa`by elnosh · e5528ead · Dec 9, 2025 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · elnosh

Add docs to `commitment_signed_dance_return_raa`

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds explanatory documentation comments to an existing internal test helper function. No code behavior was changed, so it cannot introduce or fix a security issue on its own.

Lower-priorityClean up handle_monitor_update_completion_actions after rustfmtby Joost Jager · 9b2d57ca · Dec 9, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Joost Jager

Clean up handle_monitor_update_completion_actions after rustfmt

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a pure code cleanup and formatting follow-up after rustfmt was run. It renames a local variable from counterparty_node_id to cp_node_id and flattens deeply nested if-let blocks into a more readable match/early-return style. There is no functional change to the program's behavior.

Lower-priorityBump `lightning-block-sync` version number to fix SemVer CIby Elias Rohrer · 926523d8 · Dec 9, 2025 · 1 fileMessage 81 · StrongInformational 15Details
Commit message · Elias Rohrer

Bump `lightning-block-sync` version number to fix SemVer CI

PR #4175 made the first breaking API change in `lightning-block-sync`
since v0.2 without bumping the version number. Here we bump the version
number, allowing our SemVer CI check to be happy again.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit only changes a package version number in a configuration file (from 0.2.0+git to 0.3.0+git) to satisfy an automated SemVer compatibility check. It does not change any code, fix any bug, or alter any behavior.

AI review queuedMake `AttributionData` actually pub since its used in the public APIby Matt Corallo · bd578235 · Dec 9, 2025 · 5 filesMessage 85 · StrongInformational 19Details
Commit message · Matt Corallo

Make `AttributionData` actually pub since its used in the public API

`AttributionData` is a part of the public `UpdateFulfillHTLC` and
`UpdateFailHTLC` messages, but its not actually `pub`. Yet again
re-exports bite us and leave us with a broken public API - we
ended up accidentally sealing `AttributionData`.

Instead, here, we just make `onion_utils` `pub` so that we avoid
making the same mistake in the future.

Note that this still leaves us with arather useless public
`AttributionData` API - it can't be created, updated, or decoded,
it can only be serialized and deserialized, but at least it exists.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 19/100

This commit fixes a Rust library API visibility problem. A data type called AttributionData was supposed to be publicly usable because it appears in public Lightning protocol messages, but it was accidentally kept internal due to how Rust re-exports work. The change makes the containing module public so users can actually reference the type. It is a usability/API completeness fix, not a security vulnerability fix.

Security candidateConsistently use `wire::Message` for encoding network messagesby Elias Rohrer · 4289db5c · Dec 8, 2025 · 5 filesMessage 73 · AdequateInformational 19Details
Commit message · Elias Rohrer

Consistently use `wire::Message` for encoding network messages

Previously, `enqueue_message` took an `M: Type + Writeable` reference,
which didn't make use of our `wire::Message` type, which turned out to
be rather confusing. Here, we use `Message` consistently in
`PeerManager`'s `enqueue_message`, but also in `encrypt_message`, etc.

While at it we also switch to move semantics, which is a nice cleanup.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 19/100

This commit is a code cleanup in the Lightning Dev Kit's peer message handling. It changes internal functions so they consistently use a single `wire::Message` wrapper type when preparing messages to send, instead of accepting many different message types directly. It also switches from borrowing messages to moving them. There is no obvious security bug being fixed; it is primarily a maintainability and type-safety improvement.

Security candidateDrop `wire::write` and replace `encode_msg!` macroby Elias Rohrer · dfa12d88 · Dec 8, 2025 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Elias Rohrer

Drop `wire::write` and replace `encode_msg!` macro

Now that we consistently use `wire::Message` everywhere, it's easier to
simply use `Message::write`/`Type::write` instead of heaving yet another
`wire::write` around. Here we drop `wire::write`, replace the
`encode_msg` macro with a method that takes `wire::Message`, and convert
a bunch of additional places to move semantics.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This is a routine internal code cleanup in the Lightning Dev Kit's message serialization layer. It removes an old helper function (`wire::write`) and a macro (`encode_msg!`), replacing them with direct calls to `Message::write`/`Type::write`. The change does not alter the wire format or add any new behavior; it is purely a refactoring to simplify the code.

Lower-priorityAvoid force-closing 0-conf channels when funding is reorg'dby Matt Corallo · 173481f6 · Dec 6, 2025 · 4 filesMessage 93 · StrongModerate 55Details
Commit message · Matt Corallo

Avoid force-closing 0-conf channels when funding is reorg'd

When we see a funding transaction for one of our chanels reorg'd
out, we worry that its possible we've been double-spent and
immediately force-close the channel to avoid accepting any more
HTLCs on it. This isn't ideal, but is mostly fine as most nodes
require 6 confirmations and 6 block reorgs are exceedingly rare.

However, this isn't so okay for 0-conf channels - in that case we
elected to trust the funder anyway, so reorgs shouldn't worry us.
Still, to handle this correctly we needed to track the old SCID and
ensure our logic is safe across an SCID change. Luckily, we did
that work for splices, and can now take advantage of it here.

Fixes #3836.

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Moderate 55/100

This commit fixes a bug in rust-lightning where zero-confirmation (0-conf) Lightning channels were unnecessarily force-closed when their funding transaction was temporarily reorged out of the blockchain. For 0-conf channels, users already trust the funder, so a reorg should not trigger a force close. The fix tracks the old channel ID as a historical ID so payments can still flow, and only force-closes channels that required at least one confirmation. Regular 1+ confirmation channels still force-close on reorg, as before, to protect against double-spend risk.

Lower-priorityAssert peer supports splicing before splicing channelby Leo Nash · cdba25fa · Dec 5, 2025 · 2 filesMessage 50 · ThinLow 34Details
Commit message · Leo Nash

Assert peer supports splicing before splicing channel

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 34/100

This commit adds a missing safety check in the Lightning Dev Kit's channel manager. Before allowing a user to initiate a channel splice, it now verifies that the connected peer has advertised support for splicing and for quiescence (a required prerequisite). Without this check, a node could try to start a splice with a peer that doesn't understand the protocol, likely causing the operation to fail or the channel to close unexpectedly. The fix is defensive and prevents API misuse rather than fixing an active remote exploit.

Lower-priorityBias `Selector` to first poll the sleeper futureby Elias Rohrer · 9c0ca26e · Dec 5, 2025 · 1 fileMessage 68 · AdequateLow 46Details
Commit message · Elias Rohrer

Bias `Selector` to first poll the sleeper future

Previously, `lightning-background-processor`'s `Selector` would poll all
other futures *before* finally polling the sleeper and returning the
`exit` flag if it's ready. This could lead to scenarios where we
infinitely keep processing background events and never respect the
`exit` flag, as long as any of other futures keep being ready.

Here, we instead bias the `Selector` to always *first* poll the sleeper
future, and hence have us act on the `exit` flag immediately if is set.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 46/100

This commit fixes a scheduling bug in a background task runner used by the Lightning Dev Kit. Previously, the runner could keep handling other background work forever and ignore a request to shut down, as long as other work kept appearing. Now it checks the shutdown timer first, so it stops promptly when asked. This is a reliability/availability fix rather than a direct theft-of-funds bug, but in a payment system, failing to shut down on time can contribute to operational problems or resource exhaustion.