AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 26 Bitcoin

libplugin: correctly wrap notifications we send in the notification name.

Public commit record

What the developer wrote

Authored by Rusty Russell

73/100 · Adequate
libplugin: correctly wrap notifications we send in the notification name.

All the core notifications changed over to wrapping the notification
fields in an object with the name of the notification, but notifications
from plugins were missed.

Changelog-Added: Plugins: `channel_hint_update`, `pay_failure` and `pay_success` notifications now have objects of the same name containing the expected fields.
Changelog-Deprecated: Plugins: `channel_hint_update`, `pay_failure` and `pay_success` notification fields outside the same-named object.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a notification formatting inconsistency in Core Lightning's plugin system. Plugin-generated notifications (channel_hint_update, pay_failure, pay_success) now wrap their data inside an object named after the notification, matching how core notifications already work. The old unwrapped format is kept as a deprecated option for backward compatibility. This is primarily an API consistency and compatibility fix, not a security vulnerability fix.

Recommended action

No immediate security action required. Operators and plugin authors should update their notification handlers to expect the new wrapped format and prepare for removal of the deprecated raw fields in v26.09.

Security signals we found

01

API consistency fix for JSON-RPC notification format

02

Backward-compatible deprecation of old notification field layout

03

No memory corruption, authentication bypass, or cryptographic weakness evident

04

No explicit security relevance stated by vendor

Risk score

Why this scored 26/100

Our methodology →
Potential impact 4/30
Exploitability 2/25
Stealth signal 3/15
Affected reach 5/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.