Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit changes how the Lightning networking code handles oversized encrypted messages. Previously, certain conditions would cause the program to crash with a panic. Now the code returns errors instead, which is a defensive improvement…
panic-to-error conversion for oversized message encryption/decryptiondenial-of-service hardening against oversized peer messagesdebug_assert retained to preserve test coverage of invariant violations
This commit simply updates the 'repository' web links in 15 package metadata files from GitHub to a self-hosted Forgejo instance. It does not change any program code, build logic, dependencies, or security behavior. There is no security is…
This commit fixes a bug in the Lightning Dev Kit where, after a disconnection, a node could fail to retransmit a 'splice_locked' message to a peer that was still waiting for transaction signatures. Without this retransmission, the two peer…
Protocol state desynchronization between channel peers after reconnectionMissing retransmission of splice_locked for 0-conf splice channelsPotential channel unusability or stuck splice negotiation
This commit fixes a small accounting bug in how the Lightning wallet estimates the size (and therefore transaction fee) of a special Bitcoin transaction that sweeps funds back to the user after a channel closes. The old code always assumed…
debug assertion failure possible in development/testing buildstransaction weight/fee estimate overestimation up to 3 WUconstant replaced with per-descriptor length computation
This commit only updates documentation comments for a Rust function called get_per_commitment_point. It removes an outdated warning that the method was non-asynchronous and that returning an error could cause a crash, and replaces it with …
Documentation-only changeRemoves outdated panic warningAdds retry/unblock guidance for signer errors
This commit changes the project's internal code-review workflow. It stops automatically assigning a human reviewer when a pull request is opened; instead, contributors must manually click a button to request a reviewer after first addressi…
This commit fixes a bug in LDK's Lightning channel reconnection logic after a splice (a way to resize a channel's on-chain funds). If one peer had already received the splice signatures but the other had not, and then they disconnected and…
Protocol-state inconsistency on reconnection after splice signature exchangePotential channel stall/force-close due to quiescence not being exited before commitment updateFuzzer-discovered edge case in Lightning splicing retransmission
This commit adds a new option for Lightning invoice creators to explicitly tell payers not to use multi-path payments (MPP) when paying an invoice. It does not change any enforcement rules; it only changes what feature bits are advertised …
New API surface for feature advertisement controlExplicit documentation that the method does not enforce single-HTLC receipt, shifting enforcement responsibility to callersNo removal or weakening of existing validation logic
This commit swaps the ID number used by an automated workflow that randomly assigns code reviewers. The old number pointed to a real person's account, so the workflow's assignments appeared to come from that person. The new number points t…
This commit adjusts the project's continuous integration (CI) test script to pin an older version of a build-time helper crate called `jobserver` when using older Rust compilers. It is a build compatibility fix, not a security patch, and d…
This commit updates a dependency used to talk to Esplora blockchain servers from version 0.12 to 0.13, switching the underlying HTTP library from reqwest to bitreq. It also removes two CI workarounds that pinned older versions of idna_adap…
Dependency version bump (esplora-client 0.12 -> 0.13)HTTP backend switch (reqwest -> bitreq) in a transitive dependencyRemoval of MSRV pins for idna_adapter and hyper-rustls
This commit only adds new test code. It exercises how a newer version of LDK exchanges saved channel data with the older LDK 0.2 release when a channel has a pending splice. There is no change to production logic, no bug fix, and no securi…
This commit removes the 'Option' wrapper from several HTLC amount fields, making them required instead of optional. It is a cleanup/refactoring change that simplifies the code by assuming the amount is always known. The commit message fram…
Removal of Option wrapper for financial amount fieldsSerialization format change from optional to required TLV fieldsLoss of backward compatibility with older serialized monitor/channel state
This commit is a code cleanup inside the project's test suite. It replaces a helper function with several hard-to-read positional arguments (like bare `false` and `None`) with a 'builder' pattern that names each option. This makes the test…
This commit is a feature addition, not a vulnerability fix. It extends rust-lightning's BOLT 12 payment support so that when a wallet pays a BOLT 12 invoice, the paid invoice is saved through retries and restarts and is later exposed in th…
New BOLT 12 payer proof feature: persists paid invoice across retries/restarts and exposes it in Event::PaymentSentPayer signing key re-derived from invoice payer metadata rather than storing extra key materialAdds end-to-end test for proof creation, verification, and bech32 round-trip
This commit is a code cleanup (refactor) in the Lightning Dev Kit library. It moves existing payer key-derivation logic into shared helper functions so that future 'payer proof' features can reuse the same code. The change does not appear …
Refactor only: moves existing key derivation/verification logic into helpers without changing algorithmsAdds new public API `Bolt12Invoice::derive_payer_signing_keys` for payer proof key recoveryNo mention of vulnerability, bug, CVE, security fix, or exploit in commit title/message
This commit changes a CI workflow for the rust-lightning project. It stops trying to push new fuzz test inputs directly to a corpus repository from automated test runs, and instead uploads them as a temporary artifact that a separate sched…
This is a routine update to the project's automated reviewer-assignment workflow. It prevents the bot from accidentally adding a second random reviewer when one is already assigned, and adds a manual trigger so maintainers can request an a…
This is a one-line fix to a Forgejo workflow that assigns reviewers. The workflow requests a temporary identity token from the CI system so it can call another service. The change adds an explicit audience parameter to that token request, …
OIDC token audience now explicitly scopedCI workflow authentication hardeningNo change to application code or cryptographic logic
This commit adds partial support in the Lightning Dev Kit node software for receiving and temporarily holding multi-part trampoline payments, then deliberately rejects them once all parts arrive because full outbound forwarding is not yet …
New trampoline forward handling path accumulates MPP parts before rejectingDebug assertion guards first-HTLC failure in MPP mergeTODO comment flags possible MPP inconsistency in next_node_id across trampoline parts
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedMiscellanous CI fixesby Leo Nash · 2ce8e647 · Sep 16, 2025 · 6 filesMessage 28 · OpaqueTriage 0Details
Commit message · Leo Nash
Miscellanous CI fixes
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedUpdate handling of `BumpTransactionEvent::ChannelClose` for 0FC channelsby Leo Nash · 953e939b · Sep 15, 2025 · 2 filesMessage 85 · StrongTriage 12Details
Commit message · Leo Nash
Update handling of `BumpTransactionEvent::ChannelClose` for 0FC channels
Set an empty witness to spend the P2A anchor, and set the version of the anchor transaction to 3.
We still check whether the commitment transaction has enough fees to be broadcast on its own, as these transactions may be non-zero fee due to trimmed / rounded outputs.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSet `AnchorDescriptor` output value to CSV and P2A anchor amountsby Leo Nash · b2b2dfb4 · Sep 15, 2025 · 4 filesMessage 65 · AdequateTriage 12Details
Commit message · Leo Nash
Set `AnchorDescriptor` output value to CSV and P2A anchor amounts
Co-authored-by: Matt Corallo <git@bluematt.me>
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Previously it would generate a new nonce for this context instead of using the offer nonce. This would make it so that verification would fail later when receiving a invoice request.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
We previously had a lock order dependency where the forward_htlcs lock had to be taken before the intercepted_htlcs lock. Here we remove this dependency, which also prepares for a cleaner commit once we start also intercepting HTLCs for often-offline recipients.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedRemove stale TODO for quiescence check on incoming splice_initby Wilmer Paulino · 5c6b6370 · Sep 8, 2025 · 1 fileMessage 30 · OpaqueTriage 0Details
Commit message · Wilmer Paulino
Remove stale TODO for quiescence check on incoming splice_init
30/100 · OpaqueMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body! Contains work-in-progress language
Why it was queued
second-pass: opaque commit message
AI review queuedRename `CommitmentTransaction.feerate_per_kw()`by Leo Nash · e921bf6c · Sep 6, 2025 · 6 filesMessage 58 · ThinTriage 12Details
Commit message · Leo Nash
Rename `CommitmentTransaction.feerate_per_kw()`
Use `negotiated_feerate_per_kw()` to underscore that this is the feerate we negotiated with our peer, not the actual feerate of the commitment transaction. The feerate of the actual commitment transaction may be higher.
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSerialization for Vec<BlindedMessagePath>by Joost Jager · 8db88139 · Sep 5, 2025 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Joost Jager
Serialization for Vec<BlindedMessagePath>
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedAdd a method to avoid re-persisting monitors during startupby Matt Corallo · d3779580 · Sep 3, 2025 · 5 filesMessage 85 · StrongTriage 0Details
Commit message · Matt Corallo
Add a method to avoid re-persisting monitors during startup
Prior to LDK 0.1, in rare cases we could replay payment claims to `ChannelMonitor`s on startup, which we then expected to be persisted prior to normal node operation. This required re-persisting `ChannelMonitor`s after deserializing the `ChannelManager`, delaying startup in some cases substantially.
In 0.1 we fixed this, moving claim replays to the background to run after the `ChannelManager` starts operating (and only updating/persisting changes to the `ChannelMonitor`s which need it). However, we didn't actually enable this meaningfully in our API - nearly all users use our `ChainMonitor` and the only way to get a chanel into `ChainMonitor` is through the normal flow which expects to persist.
Here we add a simple method to load `ChannelMonitor`s into the `ChainMonitor` without persisting them.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
second-pass: broader security terminology
AI review queuedCheck v2 reserves after `funding_contribution_satoshis` is appliedby Leo Nash · 85a02cac · Sep 2, 2025 · 2 filesMessage 73 · AdequateTriage 12Details
Commit message · Leo Nash
Check v2 reserves after `funding_contribution_satoshis` is applied
We check this when validating `splice_init`, `splice_ack` messages, and also when validating user-specified contributions.
From BOLT 2: ``` - If `funding_contribution_satoshis` is negative and its absolute value is greater than the sending node's current channel balance: - MUST send a `warning` and close the connection or send an `error` and fail the channel. ```
and further down: ``` If a side does not meet the reserve requirements, that's OK: but if they take funds out of the channel, they must ensure that they do meet them. If your peer adds a massive amount to the channel, then you only have to add more reserve if you want to contribute to the splice (and you can use `tx_remove_output` and/or `tx_remove_input` part-way through if this happens). ```
Therefore, we check the v2 reserve anytime `funding_contribution_satoshis` is not equal to zero.
We allow parties to draw from their previous reserve, as long as they satisfy their v2 reserve.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedMake `for_splice` infallibleby Leo Nash · bfa0f95c · Sep 2, 2025 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Leo Nash
Make `for_splice` infallible
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedAdd `NextCommitmentStats::get_balances_including_fee`by Leo Nash · 13ccaa35 · Sep 2, 2025 · 1 fileMessage 63 · AdequateTriage 12Details
`NextCommitmentStats` provides the commitment transaction fee as a separate value to assist with applying a multiplier on it in `can_accept_incoming_htlc`.
Nonetheless in most cases, we want the balances to include the commitment transaction fee, so here we add a helper that gives us these balances.
Also make the style of `tx_builder::subtract_addl_outputs` consistent with `get_balances_including_fee`.
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedPush splice initiation through the quiescent pipelineby Matt Corallo · 92f19617 · Aug 28, 2025 · 6 filesMessage 73 · AdequateTriage 12Details
Commit message · Matt Corallo
Push splice initiation through the quiescent pipeline
Now that we have a `QuiescentAction` to track what we intend to do once we reach quiescence, we need to use it to initiate splices.
Here we do so, adding a new `SpliceInstructions` to track the arguments that are currently passed to `splice_channel`. While these may not be exactly the right arguments to track in the end, a lot of the splice logic is still in flight, so we can worry about it later.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedAdd a quick TODO about merging cp- and locally-initiated splicesby Matt Corallo · 9200308e · Aug 28, 2025 · 1 fileMessage 30 · OpaqueTriage 0Details
Commit message · Matt Corallo
Add a quick TODO about merging cp- and locally-initiated splices
30/100 · OpaqueMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body! Contains work-in-progress language
Why it was queued
second-pass: opaque commit message
AI review queuedRun fmt on `validate_update_fee`by Leo Nash · f67143a0 · Aug 26, 2025 · 1 fileMessage 35 · OpaqueTriage 8Details
Commit message · Leo Nash
Run fmt on `validate_update_fee`
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
AI review queuedRun fmt on `get_next_commitment_htlcs`by Leo Nash · 59ae9e2a · Aug 26, 2025 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Leo Nash
Run fmt on `get_next_commitment_htlcs`
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedRemove all `rustfmt::skip` in `tx_builder`by Leo Nash · 3f53f3ac · Aug 26, 2025 · 1 fileMessage 45 · ThinTriage 12Details
Commit message · Leo Nash
Remove all `rustfmt::skip` in `tx_builder`
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedAdd `TxBuilder::get_next_commitment_stats`by Leo Nash · 0a75f927 · Aug 21, 2025 · 2 filesMessage 58 · ThinTriage 12Details
Commit message · Leo Nash
Add `TxBuilder::get_next_commitment_stats`
Given a snapshot of the lightning state machine, `TxBuilder::get_next_commitment_stats` calculates the transaction fees, the dust exposure, and the holder and counterparty balances (the balances themselves do *not* account for the transaction fee).