This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.
41278b4eby jaonoctus+2−02 filesThis is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…
498e5086by daywalker90+2−01 fileThis commit fixes a cache-key collision bug in Elements' range-proof and surjection-proof validation caches. Previously, the cache key was built by simply concatenating raw bytes, so two different sets of inputs could accidentally produce …
301acc64by merge-script+270−335 filesThis commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…
d1b6963bby daywalker90+204−1224 filesThis commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …
c09c4520by Erick Cestari+1−01 fileThis commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…
5685c9a3by cdecker+12−211 fileThis commit adds a new command-line option `-norangeproofcache` that lets node operators turn off an internal performance cache used when validating confidential transaction range proofs. It is a debug/test option, not a security fix. Ther…
53167b1fby Byron Hambly+13−52 filesThis commit fixes a cache-key collision bug in Elements' proof verification caches. Previously, the cache key for range proofs and surjection proofs was built by simply concatenating raw bytes, so two different sets of inputs could acciden…
b0a27528by Byron Hambly+92−282 filesThis commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…
ddbd2963by daywalker90+1786−173950 filesThis is a routine automated update by Dependabot that bumps the version of a JavaScript build tool called browserslist, used only in the WebAssembly packaging part of the project. The change only updates version numbers and metadata in a l…
834987a8by dependabot[bot]+65−511 fileThis is a routine automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.5 to 3.1.7 inside the WebAssembly packaging directory. The commit itself only changes a package-lock.json file and does not…
05843a61by dependabot[bot]+8−71 fileThis commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …
a34b9758by Peter Neuroth+30−86 filesThis commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…
8e495707by Peter Neuroth+5−21 fileThis commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…
2dee8699by Peter Neuroth+9−62 filesThis update fixes several ways that malformed transaction data could crash Elements nodes or trick wallet users into signing bad transactions. The main changes turn internal 'assert' crashes into proper error returns when creating confiden…
4ddaefc8by merge-script+221−4515 filesThis merge commit fixes several security and robustness bugs in Elements' confidential-transaction blinding code and in its dynamic-federated (dynafed) header handling. The most user-visible issues are in 'blindpsbt': malformed PSET inputs…
31e8f27fby merge-script+86−189 filesThis commit only updates test scripts to fix flaky automated tests. It changes how test code calculates expected pegin subsidy values and how test nodes bind to network ports when using Bitcoin Core as a parent chain. No production node co…
bad8ca42by merge-script+154−382 filesThis commit hardens how Elements handles 'peg-in' transactions—transfers of assets from a parent blockchain into a sidechain. It adds size checks for witness data fields and wraps decoding in error handling so malformed inputs are rejected…
ffd91c05by Tom Trevethan+57−332 filesThis commit fixes a security bug in how the Elements wallet signs partially-signed Bitcoin transactions (PSBTs) for confidential (blinded) payments. Previously, a malicious counterparty could remove the plain-text amount and asset fields f…
3a8dec12by Tom Trevethan+18−73 filesThis commit fixes a crash bug in the Elements blockchain wallet software. When creating a confidential (blinded) transaction, the code could hit an internal 'assert' and abort the program if it tried to generate a rangeproof for a zero-amo…
4e5ca94fby Tom Trevethan+99−54 files