Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit changes how the Lightning networking code handles oversized encrypted messages. Previously, certain conditions would cause the program to crash with a panic. Now the code returns errors instead, which is a defensive improvement…
panic-to-error conversion for oversized message encryption/decryptiondenial-of-service hardening against oversized peer messagesdebug_assert retained to preserve test coverage of invariant violations
This commit simply updates the 'repository' web links in 15 package metadata files from GitHub to a self-hosted Forgejo instance. It does not change any program code, build logic, dependencies, or security behavior. There is no security is…
This commit fixes a bug in the Lightning Dev Kit where, after a disconnection, a node could fail to retransmit a 'splice_locked' message to a peer that was still waiting for transaction signatures. Without this retransmission, the two peer…
Protocol state desynchronization between channel peers after reconnectionMissing retransmission of splice_locked for 0-conf splice channelsPotential channel unusability or stuck splice negotiation
This commit fixes a small accounting bug in how the Lightning wallet estimates the size (and therefore transaction fee) of a special Bitcoin transaction that sweeps funds back to the user after a channel closes. The old code always assumed…
debug assertion failure possible in development/testing buildstransaction weight/fee estimate overestimation up to 3 WUconstant replaced with per-descriptor length computation
This commit only updates documentation comments for a Rust function called get_per_commitment_point. It removes an outdated warning that the method was non-asynchronous and that returning an error could cause a crash, and replaces it with …
Documentation-only changeRemoves outdated panic warningAdds retry/unblock guidance for signer errors
This commit changes the project's internal code-review workflow. It stops automatically assigning a human reviewer when a pull request is opened; instead, contributors must manually click a button to request a reviewer after first addressi…
This commit fixes a bug in LDK's Lightning channel reconnection logic after a splice (a way to resize a channel's on-chain funds). If one peer had already received the splice signatures but the other had not, and then they disconnected and…
Protocol-state inconsistency on reconnection after splice signature exchangePotential channel stall/force-close due to quiescence not being exited before commitment updateFuzzer-discovered edge case in Lightning splicing retransmission
This commit adds a new option for Lightning invoice creators to explicitly tell payers not to use multi-path payments (MPP) when paying an invoice. It does not change any enforcement rules; it only changes what feature bits are advertised …
New API surface for feature advertisement controlExplicit documentation that the method does not enforce single-HTLC receipt, shifting enforcement responsibility to callersNo removal or weakening of existing validation logic
This commit swaps the ID number used by an automated workflow that randomly assigns code reviewers. The old number pointed to a real person's account, so the workflow's assignments appeared to come from that person. The new number points t…
This commit adjusts the project's continuous integration (CI) test script to pin an older version of a build-time helper crate called `jobserver` when using older Rust compilers. It is a build compatibility fix, not a security patch, and d…
This commit updates a dependency used to talk to Esplora blockchain servers from version 0.12 to 0.13, switching the underlying HTTP library from reqwest to bitreq. It also removes two CI workarounds that pinned older versions of idna_adap…
Dependency version bump (esplora-client 0.12 -> 0.13)HTTP backend switch (reqwest -> bitreq) in a transitive dependencyRemoval of MSRV pins for idna_adapter and hyper-rustls
This commit only adds new test code. It exercises how a newer version of LDK exchanges saved channel data with the older LDK 0.2 release when a channel has a pending splice. There is no change to production logic, no bug fix, and no securi…
This commit removes the 'Option' wrapper from several HTLC amount fields, making them required instead of optional. It is a cleanup/refactoring change that simplifies the code by assuming the amount is always known. The commit message fram…
Removal of Option wrapper for financial amount fieldsSerialization format change from optional to required TLV fieldsLoss of backward compatibility with older serialized monitor/channel state
This commit is a code cleanup inside the project's test suite. It replaces a helper function with several hard-to-read positional arguments (like bare `false` and `None`) with a 'builder' pattern that names each option. This makes the test…
This commit is a feature addition, not a vulnerability fix. It extends rust-lightning's BOLT 12 payment support so that when a wallet pays a BOLT 12 invoice, the paid invoice is saved through retries and restarts and is later exposed in th…
New BOLT 12 payer proof feature: persists paid invoice across retries/restarts and exposes it in Event::PaymentSentPayer signing key re-derived from invoice payer metadata rather than storing extra key materialAdds end-to-end test for proof creation, verification, and bech32 round-trip
This commit is a code cleanup (refactor) in the Lightning Dev Kit library. It moves existing payer key-derivation logic into shared helper functions so that future 'payer proof' features can reuse the same code. The change does not appear …
Refactor only: moves existing key derivation/verification logic into helpers without changing algorithmsAdds new public API `Bolt12Invoice::derive_payer_signing_keys` for payer proof key recoveryNo mention of vulnerability, bug, CVE, security fix, or exploit in commit title/message
This commit changes a CI workflow for the rust-lightning project. It stops trying to push new fuzz test inputs directly to a corpus repository from automated test runs, and instead uploads them as a temporary artifact that a separate sched…
This is a routine update to the project's automated reviewer-assignment workflow. It prevents the bot from accidentally adding a second random reviewer when one is already assigned, and adds a manual trigger so maintainers can request an a…
This is a one-line fix to a Forgejo workflow that assigns reviewers. The workflow requests a temporary identity token from the CI system so it can call another service. The change adds an explicit audience parameter to that token request, …
OIDC token audience now explicitly scopedCI workflow authentication hardeningNo change to application code or cryptographic logic
This commit adds partial support in the Lightning Dev Kit node software for receiving and temporarily holding multi-part trampoline payments, then deliberately rejects them once all parts arrive because full outbound forwarding is not yet …
New trampoline forward handling path accumulates MPP parts before rejectingDebug assertion guards first-HTLC failure in MPP mergeTODO comment flags possible MPP inconsistency in next_node_id across trampoline parts
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedFormat `tx_builder::get_available_balances`by Leo Nash · 121302e1 · Feb 24, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Leo Nash
Format `tx_builder::get_available_balances`
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is purely a code formatting and documentation cleanup of one internal function in the Lightning Dev Kit. It adds explanatory comments and rewraps long lines to match the project's style guide. No logic, calculations, or security behavior were changed.
AI review queuedCreate `ChannelConstraints` to hold parameters for balance calculationsby Leo Nash · 22b056ba · Feb 24, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Leo Nash
Create `ChannelConstraints` to hold parameters for balance calculations
In an upcoming commit, we move `get_available_balances_for_scope` behind `TxBuilder::get_channel_stats`, and pass channel parameters relevant to balance calculations in `TxBuilder::get_channel_stats` via `ChannelConstraints`.
There are no functional changes in this commit.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a pure internal code reorganization. It creates a new ChannelConstraints container and copies existing channel parameters into it so a future change can pass them more easily. The values used in balance calculations are identical to before; nothing about user funds, network behavior, or security rules changes.
The following types have methods for returning contributed inputs and outputs: - FundingNegotiationContext - InteractiveTxConstructor - InteractiveTxSigningSession - ConstructedTransaction
Having iterators for these can avoid allocations, which is useful for filtering contributed input and outputs when producing DiscardFunding events.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Informational 15/100
This commit is a straightforward internal code cleanup in the Lightning Dev Kit's transaction-building code. It replaces a few methods that always built full lists of contributed inputs and outputs with new iterator methods that let callers decide when to build those lists. There is no change to security logic, no bug fix, and no externally visible behavior change.
Security candidateClean up fuzz crate: use panic=abort, add stdin_fuzz support, remove dylibby Joost Jager · 69e2d8cf · Feb 23, 2026 · 75 filesMessage 95 · StrongInformational 15Details
Commit message · Joost Jager
Clean up fuzz crate: use panic=abort, add stdin_fuzz support, remove dylib
This commit makes three related changes to the fuzz infrastructure:
1. Set panic=abort on both dev and release profiles, and remove the dylib crate type (keeping rlib and staticlib). The dylib crate type was added in e28fd78e6 (2019) for a C-callable harness that was never implemented. Removing dylib is what enables panic=abort, since Rust forces panic=unwind on dylib crates. staticlib is retained as it is compatible with panic=abort.
2. Add stdin_fuzz support: a new Stdout logger, updated target template so that stdin_fuzz calls _test() with Stdout logging, and updated README with usage instructions. This allows reproducing crashes via piped input, useful for git bisect and AI-assisted debugging.
3. Update all fuzzer frontends (AFL, honggfuzz, libfuzzer, stdin_fuzz) to call the _test() functions directly instead of going through the _run() C wrappers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 15/100
This commit is a routine cleanup of the project's fuzz-testing infrastructure. It changes how fuzz tests are compiled and run, adds a new way to feed test input via standard input, and removes an unused dynamic-library build mode. There is no indication it fixes or introduces a security vulnerability in the actual Lightning library code.
AI review queuedDelete `TxBuilder::subtract_non_htlc_outputs`by Leo Nash · 75d4a6bf · Feb 23, 2026 · 2 filesMessage 70 · AdequateInformational 12Details
Commit message · Leo Nash
Delete `TxBuilder::subtract_non_htlc_outputs`
We make temporary use of the raw `tx_builder::saturating_sub_anchor_outputs` function in `get_available_balances_for_scope`. This ok because we move most of the `get_available_balances_for_scope` function to the `TxBuilder::get_channel_stats` call in an upcoming commit.
Again, no functional change is introduced in this commit.
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100
This commit is a straightforward internal code cleanup in the Lightning Dev Kit's Rust implementation. It removes a helper method called subtract_non_htlc_outputs from a trait and replaces its uses with direct calls to a similar helper function. The commit message explicitly states there is no functional change, and the diff shows the new helper behaves identically to the removed method. There is no indication this fixes or introduces a security issue.
AI review queuedDelete `TxBuilder::commit_tx_fee_sat`by Leo Nash · a4bf94a4 · Feb 23, 2026 · 2 filesMessage 58 · ThinLow 27Details
Commit message · Leo Nash
Delete `TxBuilder::commit_tx_fee_sat`
Move calls to `TxBuilder::commit_tx_fee_sat` in `new_for_inbound_channel` and `new_for_outbound_channel` to `ChannelContext::get_next_{*}_commitment_stats`, and set the parameters such that the exact same behavior is maintained.
We also replace calls to `TxBuilder::commit_tx_fee_sat` in `get_pending_htlc_stats`, `next_local_commit_tx_fee_msat`, and `next_remote_commit_tx_fee_msat` with `chan_utils::commit_tx_fee_sat`. All three functions get deleted in an upcoming commit, so we accept this temporary use of the `chan_utils::commit_tx_fee_sat` function.
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100
This commit is a code cleanup in the Lightning Dev Kit's rust-lightning project. It removes a helper method called `commit_tx_fee_sat` from a transaction-building trait and moves the fee-checking logic into a more central place when opening channels. The goal is to keep the same behavior while simplifying the code. There is no direct evidence in the commit that this fixes a security vulnerability.
AI review queuedIntroduce `TxBuilder::get_channel_stats`by Leo Nash · 4760f868 · Feb 23, 2026 · 2 filesMessage 58 · ThinInformational 13Details
Commit message · Leo Nash
Introduce `TxBuilder::get_channel_stats`
This commit moves the previous `TxBuilder::get_next_commitment_stats` method to a private function, and then calls this function in `TxBuilder::get_channel_stats`.
Similar to the previous `TxBuilder::get_next_commitment_stats` method, `TxBuilder::get_channel_stats` fails if any party cannot afford the HTLCs outbound from said party, and the anchors if they are the funder.
Aside from the API changes on `TxBuilder`, there are no functional changes in this commit.
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 13/100
This commit is a straightforward internal code reorganization in the Lightning Dev Kit's transaction-building code. It renames and restructures a method so that a new wrapper, `get_channel_stats`, returns the same underlying commitment statistics inside a new container struct. The commit message explicitly states there are no functional changes beyond the API rename, and the diff shows only mechanical renames and field-access adjustments (e.g., `stats.nondust_htlc_count` becomes `stats.commitment_stats.nondust_htlc_count`). There is no indication of a security fix, vulnerability, or behavior change.
Security candidateInclude MPP payment amount in `RecipientOnionFields`by Matt Corallo · abf258a6 · Feb 20, 2026 · 29 filesMessage 95 · StrongLow 36Details
Commit message · Matt Corallo
Include MPP payment amount in `RecipientOnionFields`
In some uses of LDK we need the ability to send HTLCs for only a portion of some larger MPP payment. This allows payers to make single payments which spend funds from multiple wallets, which may be important for ecash wallets holding funds in multiple mints or graduated wallets which hold funds across a trusted wallet and a self-custodial wallet.
In order to allow for this, we need to separate the concept of the payment amount from the onion MPP amount. Here we start this process by adding a `total_mpp_amount_msat` field to `RecipientOnionFields` (which is the appropriate place for a field describing something in the recipient onion).
We currently always assert that it is equal to the existing fields, but will relax this in the coming commit(s).
We also start including a payment preimage on probe attempts, which appears to have been the intent of the code, but which did not work correctly.
The bulk of the test updates were done by Claude.
95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing or wallet pathboot or update path
AI analysis · Low 36/100
This commit is a preparatory refactor in LDK's payment-sending code. It adds a new `total_mpp_amount_msat` field to `RecipientOnionFields` so that, in future commits, a payer can send an HTLC that is only one part of a larger multi-part payment. For now the new field is always required and is asserted to match the existing payment amount, so behavior is unchanged. The commit also fixes a small related bug where probe payments were not including a payment preimage as intended. There is no immediate security vulnerability here; it is a feature-building change with a minor bug fix.
Security candidateValidate the `Router` is meeting MPP and max-fee limitations givenby Matt Corallo · c31a7bee · Feb 20, 2026 · 6 filesMessage 73 · AdequateLow 47Details
Commit message · Matt Corallo
Validate the `Router` is meeting MPP and max-fee limitations given
When `OutboundPayments` calls the provided `Router` to fetch a `Route` it passes a `RouteParameters` with a specific max-fee. Here we validate that the `Route` returned sticks to the limits provided, and also that it meets the MPP rules of not having any single MPP part which can be removed while still meeting the desired payment amount.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validationboot or update path
AI analysis · Low 47/100
This commit adds safety checks inside the Lightning payment code to make sure the route finder (the 'Router') actually follows the rules it was given. Before sending a payment, the code now verifies that the chosen route does not exceed the user-set maximum fee, does not contain useless empty paths, and does not include unnecessary multi-path payment (MPP) parts. If the router misbehaves, the payment is abandoned instead of being sent. It is a defensive hardening change rather than a fix for a known active attack.
Security candidateReplace `get_closing_signed_broadcast!` macro with direct function callsby elnosh · 28388c40 · Feb 19, 2026 · 5 filesMessage 65 · AdequateInformational 15Details
Commit message · elnosh
Replace `get_closing_signed_broadcast!` macro with direct function calls
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100
This commit is a straightforward code cleanup in the project's test suite. It replaces a Rust macro used only in tests with an equivalent regular function. There is no change to the actual Lightning node logic that runs in production, and no security-relevant behavior is altered.
Security candidateReplace `get_payment_preimage_hash!` macro with direct function callsby elnosh · e48478a7 · Feb 19, 2026 · 9 filesMessage 65 · AdequateInformational 15Details
Commit message · elnosh
Replace `get_payment_preimage_hash!` macro with direct function calls
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100
This commit is a straightforward code cleanup in the project's test suite. It removes a helper macro used only in tests and replaces it with direct calls to an existing function. There is no change to the actual Lightning node logic that runs in production, and nothing in the commit suggests a security fix.
Security candidateReplace `check_closed_broadcast!` macro with direct function callsby elnosh · 63f4f8f5 · Feb 19, 2026 · 13 filesMessage 65 · AdequateInformational 15Details
Commit message · elnosh
Replace `check_closed_broadcast!` macro with direct function calls
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100
This commit is a straightforward code cleanup in the project's test suite. It replaces a Rust macro called `check_closed_broadcast!` with direct calls to an equivalent function. Macros are a shorthand in Rust; replacing them with normal function calls makes the test code easier to read and maintain but does not change what the tests actually do. There is no change to the live Lightning node software that users run, so this cannot affect real funds or network security.
Security candidateTime out incomplete MPP payments in chanmon_consistencyby Wilmer Paulino · 520dcbb2 · Feb 18, 2026 · 4 filesMessage 73 · AdequateLow 27Details
Commit message · Wilmer Paulino
Time out incomplete MPP payments in chanmon_consistency
This requires calling `timer_tick_occurred`. As a result, when `timer_tick_occurred` is called, disabled/enabled updates and `WarnAndDisconnect` events may be triggered.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Low 27/100
This commit changes how a Lightning payment library runs its internal fuzz tests. It makes the test harness call the normal periodic timer function instead of a special stripped-down version, so incomplete multi-part payments time out properly during testing. The production code is mostly unchanged, but a few internal test-only helpers are now available under a new test-utilities feature flag. There is no direct evidence this fixes a real-world security bug; it appears to be a test-harness cleanup that makes fuzzing more realistic.
Security candidateDrive splices to completion in chanmon_consistencyby Wilmer Paulino · 3c09513b · Feb 18, 2026 · 1 fileMessage 85 · StrongInformational 12Details
Commit message · Wilmer Paulino
Drive splices to completion in chanmon_consistency
This commit adds support for locking splices. This required confirming transactions, which this target previously didn't consider.
It also fixes a `serial_id` collision, due to its generation using the first 4 bytes of `get_secure_random_bytes`, that was preventing splices from negotiating up to the `tx_signatures` exchange.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing boundary
AI analysis · Informational 12/100
This commit updates a fuzzing test harness (chanmon_consistency) in the Lightning Dev Kit project. It adds the ability to simulate confirming splice transactions on a fake blockchain and fixes a serial ID collision in the test's random number generator. The changes are confined to test/fuzzing code and do not alter production Lightning logic.
This commit adds new opcodes to enable/disable signer operations one by one. Note that this only covers signer operations post-funding.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 13/100
This commit only changes test and fuzzing code. It adds new test controls that let developers temporarily disable or enable individual signer operations during fuzz testing, and it removes one unused signer-operation flag. There is no change to production Lightning code, so it does not create a real-world security vulnerability or fix one.
After cad88af, a few code paths that also lead to a quiescence exit were not accounted for. This commit addresses the last remaining path where we exit quiescence when we exchange `tx_signatures` with the counterparty.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 44/100
This patch fixes a bug in the Lightning Dev Kit where, after a special quiet period called 'quiescence' used during splicing (modifying a channel's funds), some queued payment updates were not released when the quiet period ended via the 'tx_signatures' message exchange. The fix ensures those queued updates are freed and processed, preventing payment delays or stalls during splice operations.
AI review queuedRemove use of Deref with CoinSelectionSourceby Jeffrey Czyz · 2a238d76 · Feb 17, 2026 · 3 filesMessage 68 · AdequateInformational 17Details
Commit message · Jeffrey Czyz
Remove use of Deref with CoinSelectionSource
Instead of using Deref in APIs using CoinSelectionSource, implement CoinSelectionSource for any Deref with a Target that implements CoinSelectionSource.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100
This commit is a code cleanup in the Lightning Dev Kit's Rust library. It changes how a wallet interface called CoinSelectionSource is used in function signatures. Instead of requiring that a wallet type be a pointer-like wrapper (Deref) around something that implements CoinSelectionSource, the commit makes CoinSelectionSource directly implementable for any pointer-like wrapper. This simplifies the API and removes an internal wrapper struct, but it does not fix a security bug or change runtime behavior in a way that would affect funds or network safety.
AI review queuedMake ConfirmedUtxo the primary typeby Jeffrey Czyz · 9a0a2497 · Feb 17, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Jeffrey Czyz
Make ConfirmedUtxo the primary type
FundingTxInput was originally designed for channel funding but is now used more broadly for coin selection and splicing. The name ConfirmedUtxo better reflects its general-purpose nature as a confirmed UTXO with previous transaction data. Make ConfirmedUtxo the real struct in wallet_utils and alias FundingTxInput to it for backward compatibility.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a pure code reorganization: it renames the internal primary type from FundingTxInput to ConfirmedUtxo and makes FundingTxInput a backward-compatible alias. No behavior, logic, or security properties change. It is not a security fix.
AI review queuedMove sync wallet utils to util::wallet_utilsby Jeffrey Czyz · 0ce6ba40 · Feb 17, 2026 · 11 filesMessage 68 · AdequateInformational 15Details
Commit message · Jeffrey Czyz
Move sync wallet utils to util::wallet_utils
Synchronous wallet utilities were coupled to bump_transaction::sync, limiting their reusability for other features like channel funding and splicing which need synchronous wallet operations. Consolidate all wallet utilities in a single module for consistency and improved code organization.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a straightforward code reorganization. It moves synchronous wallet helper code from one module (bump_transaction::sync) into a shared utility module (util::wallet_utils) so it can be reused by channel funding and splicing features. No security-relevant behavior is changed; only import paths and module locations are adjusted.
AI review queuedMove wallet utils to dedicated moduleby Jeffrey Czyz · 45db7c88 · Feb 17, 2026 · 9 filesMessage 68 · AdequateInformational 19Details
Commit message · Jeffrey Czyz
Move wallet utils to dedicated module
Wallet-related types were tightly coupled to bump_transaction, making them less accessible for other use cases like channel funding and splicing. Extract these utilities to a dedicated module for improved code organization and reusability across the codebase.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100
This commit is a pure code reorganization: it moves wallet-related types and traits (for choosing which coins to spend in Bitcoin transactions) from one internal module to a new dedicated module. There are no functional changes, no bug fixes, and no security patches visible in the diff.
Security candidateUse CoinSelection::change_output when splicingby Jeffrey Czyz · 96b9e6af · Feb 17, 2026 · 7 filesMessage 68 · AdequateLow 32Details
Commit message · Jeffrey Czyz
Use CoinSelection::change_output when splicing
Now that CoinSelection is used to fund a splice funding transaction, use that for determining of a change output should be used. Previously, the initiator could either provide a change script upfront or let LDK generate one using SignerProvider::get_destination_script.
Since older versions may have serialized a SpliceInstruction without a change script while waiting on quiescence, LDK must still generate a change output in this case.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 32/100
This commit changes how Lightning Dev Kit handles 'change' money during Bitcoin channel splicing. Previously, the user could provide a change address or LDK would generate one itself. Now, the wallet's coin-selection logic decides whether a change output is needed and what it looks like. The commit keeps a fallback for older stored data that may not include a change script. It is a code-quality and consistency improvement rather than a clear security fix, though it reduces the chance of fee or change-output mistakes during splicing.
AI review queuedSplit splice initiation into two phasesby Jeffrey Czyz · 2fd33510 · Feb 17, 2026 · 11 filesMessage 68 · AdequateLow 28Details
Commit message · Jeffrey Czyz
Split splice initiation into two phases
Previously, splice_channel required callers to manually construct funding inputs and pass them directly, making coin selection the caller's responsibility. This made the API difficult to use and prevented reuse of the existing CoinSelectionSource trait.
Introduce a two-phase API: splice_channel now returns a FundingTemplate that callers use to build a FundingContribution via wallet-backed splice methods (e.g., splice_in_sync, splice_out_sync), which handle coin selection automatically. The completed contribution is then passed to a new funding_contributed method to begin quiescence and negotiation.
This also renames SpliceContribution to FundingContribution and moves fee estimation and input validation into the funding module, co-located with the types they operate on.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 28/100
This commit refactors how Lightning channel 'splicing' is started. Instead of requiring the user to manually pick coins and hand them to the API, it splits the process into two steps: first the library returns a 'funding template', then the user's wallet automatically selects coins through a standard trait and the result is handed back. The change is mostly an API usability improvement and moves fee-estimation/validation code into a dedicated module. There is no direct evidence in the commit that it fixes a security vulnerability; it is a design/API change.
AI review queuedMake ClaimId optional in coin selectionby Jeffrey Czyz · 4cae129b · Feb 17, 2026 · 2 filesMessage 80 · StrongLow 27Details
Commit message · Jeffrey Czyz
Make ClaimId optional in coin selection
CoinSelectionSource is used for anchor bumping where a ClaimId is passed in to avoid double spending other claims. To re-use this trait for funding a splice, the ClaimId must be optional. And, if None, then any locked UTXOs may be considered ineligible by an implementation.
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100
This commit changes how a wallet picks coins to spend when building Bitcoin transactions. Previously, every coin selection had to be tied to a specific 'claim ID' used to avoid accidentally spending the same coin twice across different claims. Now the claim ID is optional so the same code can be reused for a new feature called 'splicing.' When no claim ID is provided, the code is designed to treat the spend as unique and avoid double-spending locked coins. The change includes safety checks to skip the 'force conflicting spend' path when there is no claim ID.
AI review queuedUse FundingTxInput instead of Utxo in CoinSelectionby Jeffrey Czyz · fc3fa7ca · Feb 17, 2026 · 6 filesMessage 85 · StrongLow 27Details
Commit message · Jeffrey Czyz
Use FundingTxInput instead of Utxo in CoinSelection
In order to reuse CoinSelectionSource for splicing, the previous transaction of each UTXO is needed. Update CoinSelection to use FundingTxInput (renamed to ConfirmedUtxo) so that it is available.
This requires adding a method to WalletSource to look up a previous transaction for a UTXO. Otherwise, Wallet's implementation of CoinSelectionSource would need WalletSource to include the previous transactions when listing confirmed UTXOs to select from. But this would be inefficient since only some UTXOs are selected.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100
This commit refactors how the Lightning Dev Kit (LDK) selects coins for on-chain Bitcoin transactions. It changes the internal data structure used during coin selection so that each selected coin now carries the full previous transaction that created it, not just the coin's own details. The main stated reason is to prepare for a future feature called 'splicing.' The commit also adds a new wallet method to look up those previous transactions on demand. There is no direct evidence in the commit that this fixes an active security bug, but it does touch code that handles real money (transaction fees and UTXOs) and changes a public wallet interface, so downstream implementers need to update their code.
AI review queuedMove FundingTxInput::sequence to Utxoby Jeffrey Czyz · c80afe9e · Feb 13, 2026 · 4 filesMessage 68 · AdequateInformational 19Details
Commit message · Jeffrey Czyz
Move FundingTxInput::sequence to Utxo
A forthcoming commit will change CoinSelection to include FundingTxInput instead of Utxo, though the former will probably be renamed. This is so CoinSelectionSource can be used when funding a splice. Further updating WalletSource to use FundingTxInput is not desirable, however, as it would result in looking up each confirmed UTXOs previous transaction even if it is not selected. See Wallet's implementation of CoinSelectionSource, which delegates to WalletSource for listing all confirmed UTXOs.
This commit moves FundingTxInput::sequence to Utxo, and thus the responsibility for setting it to WalletSource implementations. Doing so will allow Wallet's CoinSelectionSource implementation to delegate looking up previous transactions to WalletSource without having to explicitly set the sequence on any FundingTxInput.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100
This commit is a straightforward internal code reorganization in the Lightning Dev Kit's Rust library. It moves the 'sequence' field (a Bitcoin transaction detail that controls things like replace-by-fee) from one internal data structure called FundingTxInput into another called Utxo. The change is preparation for future work on splicing (a way to resize a Lightning channel) and avoids unnecessary lookups of previous transactions. There is no indication this fixes a security vulnerability or introduces a new attack path.