AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

xpay: add developer option dev_maxparts

Public commit record

What the developer wrote

Authored by Lagrang3

68/100 · Adequate
xpay: add developer option dev_maxparts

dev_maxparts limits the number of pending routes allowed at any given
time.

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a developer-only tuning knob called dev_maxparts to the xpay plugin in Core Lightning. It lets advanced users limit how many simultaneous payment routes the plugin tries at once. The change is defensive: it caps resource usage and prevents unbounded route exploration, but it is not described by the project as fixing a known security bug.

Recommended action

Treat as a routine hardening/resource-governance change. No urgent action required. Operators using xpay may review whether the default dev_maxparts=100 suits their node capacity. If backporting, note it is a developer option and may not be enabled in release builds.

Security signals we found

01

Adds a bounded resource limit (maxparts) for pending payment routes

02

Prevents zero-value maxparts via JSON-RPC parameter validation

03

Developer-only option, reducing accidental production exposure

04

No mention of vulnerability, CVE, or security fix in commit message

Risk score

Why this scored 19/100

Our methodology →
Potential impact 2/30
Exploitability 2/25
Stealth signal 2/15
Affected reach 3/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.