CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

pyln-proto: update coincurve to commit 7829b29c08ebb1cc80386a1cdaf8c2243c4ef5c5

EP381c086e View source ↗
Public commit record

What the developer wrote

Authored by daywalker90

85/100 · Strong
pyln-proto: update coincurve to commit 7829b29c08ebb1cc80386a1cdaf8c2243c4ef5c5

```
DEBUG: DEBUG ERROR: Use build.verbose instead of cmake.verbose for scikit-build-core >= 0.10
DEBUG: × Failed to build `coincurve==20.0.0`
DEBUG: ├─▶ The build backend returned an error
DEBUG: ╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 7)
DEBUG:
DEBUG: [stderr]
DEBUG: ERROR: Use build.verbose instead of cmake.verbose for scikit-build-core
DEBUG: >= 0.10
DEBUG:
DEBUG:
DEBUG: hint: `coincurve` (v20.0.0) was included because `testpluguv` (v0.1.0) depends on `pyln-client` (v26.6.2) which depends on `pyln-proto` (v26.6.2) which depends on `coincurve`
```

This error is caused because coincurve v20 depends on scikit-build-core>=0.9.0 and they did a new release where
using cmake.verbose is no longer a warning but an error. coincurve v21 is using the correct build.verbose but is not
working with python 3.14. So we update coincurve to current master until the next release.

Changelog-None
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This change swaps a Python cryptography helper library (coincurve) from a pinned released version to a specific unreleased commit on GitHub. The stated reason is a build failure caused by a newer release of the build tool scikit-build-core, not a security bug. It is a build-compatibility fix, but it introduces a small risk because the project now depends on an unreleased snapshot of code instead of a stable, audited release.

Recommended action

Treat this as a supply-chain hygiene issue rather than an active vulnerability. Monitor coincurve for an official release, pin to that release as soon as it supports Python 3.14, and verify the chosen commit hash against upstream tags or signed releases. Review the diff of the chosen coincurve commit for unexpected changes before relying on it in production builds.

Security signals we found

01

Dependency source changed from PyPI release to arbitrary Git commit

02

Build-time failure in upstream dependency triggered the change

03

No CVE, advisory, or security-related changelog entry present

04

No code-level security fix visible in the diff

Risk score

Why this scored 19/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Core Lightning

Related watches

Moderate 59 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

ci: bind docker/pypi workflow inputs via env before shell

This commit hardens three GitHub Actions workflow files by moving user-controlled inputs into environment variables before they are used in shell scripts. Previously, values like platform lists, Docker Hub owner names, and PyPI distributio…

GitHub Actions script-injection hardeningWorkflow inputs moved from inline expression interpolation to env variablesDefensive CI/CD security fix
a0598a2dby SashaMIT+22−93 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗