CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

bump minimum python to 3.9.2 and downgrade coincurve

EP8a0e473e View source ↗
Public commit record

What the developer wrote

Authored by Alex Myers

91/100 · Strong
bump minimum python to 3.9.2 and downgrade coincurve

This allows compatibility with python 3.14.0 which coincurve 21.0.0 did
not support. The next coincurve release should restore compatibility.

Fixes: #8591

Changelog-changed: pyln-testing requires python>=3.9.2
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit adjusts Python package versions so the project's testing tools install correctly on the newly released Python 3.14. It lowers the required 'coincurve' library from version 21.0.0 to 20.0.0 and raises the minimum Python version from 3.9 to 3.9.2. The change is framed by the developer as a compatibility fix, not a security fix. There is no direct evidence in the commit that it repairs a vulnerability.

Recommended action

Treat this as a routine dependency compatibility update. Monitor coincurve 20.0.0 and its transitive dependencies (asn1crypto, cffi) for known vulnerabilities, and plan to move back to a Python 3.14-compatible newer coincurve release once available. No urgent security action is required based on this commit alone.

Security signals we found

01

Dependency downgrade (coincurve 21.0.0 -> 20.0.0)

02

Minimum Python version raised to 3.9.2

03

No mention of CVE, vulnerability, or security fix in commit message

04

No code-level security fix present in the diff

Risk score

Why this scored 19/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Core Lightning

Related watches

Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

add a test for downgrading askrene datastore

This commit adds a regression test for Core Lightning's database downgrade path. It ensures that when a user downgrades from an upcoming v26.09 release to an older version (v26.06), the new 'impressions' data added by the askrene routing s…

Database downgrade path for new askrene schema (impressions table)Regression test only; no production code changeNo input validation, cryptography, network, or authorization changes
1818553eby Lagrang3+156−13 files
No security note in commit
Open full analysis →Source commit ↗