What the developer wrote
Authored by Sangbida Chaudhuri
v26.04.1
What changed, and why it matters
This is a version-bump point release (v26.04.1) for Core Lightning. The changelog says it fixes two issues: a build failure caused by a wrong printf format, and a Lightning gossip protocol problem where malformed channel announcements could stress the gossip store. The actual code changes for those fixes are not present in this commit; it only updates version strings and the changelog. So this commit itself is mostly administrative, but it signals that security-relevant fixes were released.
Treat this as a release marker. Review the actual fix commits in PRs #9082 and #9083 before deploying v26.04.1, especially if your node accepts public gossip or you build with -Werror. Apply the point release if the gossip-store stress issue or build failure affects your environment.
Security signals we found
Changelog describes a gossip protocol hardening fix (#9082) that rejects non-BOLT-compliant channel_announcement ordering
Changelog describes a build fix (#9083) for a printf format mismatch on size_t
Point release is labeled 'recommended' by the vendor
No actual protocol or C code changes are visible in this commit
Evidence from the diff
The commit is a release-tag bump: it changes .version, package version strings, pyproject.toml versions, uv.lock entries, and the CHANGELOG. The changelog describes two fixes from pull requests #9082 and #9083: (1) rejecting channel_announcement messages where node_id_1 is not lexicographically less than node_id_2, per BOLT 7, preventing malformed announcements from stressing the gossip store and other readers; (2) correcting a printf format specifier for size_t in a splice transaction weight log line, resolving a -Werror/-Wformat build failure. The diff does not contain the implementation of either fix, only the release metadata.
Changed components
Core Lightning gossip protocol handling (channel_announcement validation)Core Lightning splice transaction weight logging / build systemPython packaging metadata (pyln-client, pyln-proto, pyln-testing, reckless)Inspect captured patch +24 / −11
diff --git a/.version b/.version
index a3a51d38..44926a13 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-v26.04
+v26.04.1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dad3d657..6fede1da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+## [26.04.1] - 2026-04-24: "Negative Routing Fees II"
+
+This point release is recommended: it fixes a build failure in some environments and a gossip protocol issue.
+
+### Fixed
+
+ - **Protocol:** we now reject `channel_announcement` messages where `node_id_1` is not lexicographically less than `node_id_2` (per BOLT; see [lightning/bolts#1333](https://github.com/lightning/bolts/pull/1333)), so malformed announcements no longer stress the gossip store and other readers. ([#9082])
+ - **Build:** correct `printf` format for the splice transaction weight log line (`%zu` for `size_t`), fixing a `-Werror` / `-Wformat` failure (for example in the `linux/amd64` Docker image build). ([#9083])
+
+[#9082]: https://github.com/ElementsProject/lightning/pull/9082
+[#9083]: https://github.com/ElementsProject/lightning/pull/9083
+[26.04.1]: https://github.com/ElementsProject/lightning/releases/tag/v26.04.1
+
## [26.04] - 2026-04-20: Negative Routing Fees
This release is named by @Chand-ra.
diff --git a/contrib/pyln-client/pyln/client/__init__.py b/contrib/pyln-client/pyln/client/__init__.py
index bfc305a0..ad8c1783 100644
--- a/contrib/pyln-client/pyln/client/__init__.py
+++ b/contrib/pyln-client/pyln/client/__init__.py
@@ -4,7 +4,7 @@ from .gossmap import Gossmap, GossmapNode, GossmapChannel, GossmapHalfchannel, G
from .gossmapstats import GossmapStats
from .version import NodeVersion
-__version__ = "v26.04"
+__version__ = "v26.04.1"
__all__ = [
"LightningRpc",
diff --git a/contrib/pyln-client/pyproject.toml b/contrib/pyln-client/pyproject.toml
index d54d8383..1ebd0d5b 100644
--- a/contrib/pyln-client/pyproject.toml
+++ b/contrib/pyln-client/pyproject.toml
@@ -1,6 +1,6 @@
[project]
name = "pyln-client"
-version = "v26.04"
+version = "v26.04.1"
description = "Client library and plugin library for Core Lightning"
authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
license = { text = "BSD-MIT" }
diff --git a/contrib/pyln-proto/pyln/proto/__init__.py b/contrib/pyln-proto/pyln/proto/__init__.py
index 0352121f..7faaea88 100644
--- a/contrib/pyln-proto/pyln/proto/__init__.py
+++ b/contrib/pyln-proto/pyln/proto/__init__.py
@@ -4,7 +4,7 @@ from .invoice import Invoice
from .onion import OnionPayload, TlvPayload, LegacyOnionPayload
from .wire import LightningConnection, LightningServerSocket
-__version__ = "v26.04"
+__version__ = "v26.04.1"
__all__ = [
"Invoice",
diff --git a/contrib/pyln-proto/pyproject.toml b/contrib/pyln-proto/pyproject.toml
index 5b0e9679..3edf9fcd 100644
--- a/contrib/pyln-proto/pyproject.toml
+++ b/contrib/pyln-proto/pyproject.toml
@@ -1,6 +1,6 @@
[project]
name = "pyln-proto"
-version = "v26.04"
+version = "v26.04.1"
description = "This package implements some of the Lightning Network protocol in pure python. It is intended for protocol testing and some minor tooling only. It is not deemed secure enough to handle any amount of real funds (you have been warned!)."
authors = [
{name = "Christian Decker", email = "decker.christian@gmail.com"}
diff --git a/contrib/pyln-testing/pyln/testing/__init__.py b/contrib/pyln-testing/pyln/testing/__init__.py
index 74187fc4..460b2a05 100644
--- a/contrib/pyln-testing/pyln/testing/__init__.py
+++ b/contrib/pyln-testing/pyln/testing/__init__.py
@@ -1,4 +1,4 @@
-__version__ = "v26.04"
+__version__ = "v26.04.1"
__all__ = [
"__version__",
diff --git a/contrib/pyln-testing/pyproject.toml b/contrib/pyln-testing/pyproject.toml
index 7fa72fee..b2cabca5 100644
--- a/contrib/pyln-testing/pyproject.toml
+++ b/contrib/pyln-testing/pyproject.toml
@@ -1,6 +1,6 @@
[project]
name = "pyln-testing"
-version = "v26.04"
+version = "v26.04.1"
description = "Test your Core Lightning integration, plugins or whatever you want"
authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
license = { text = "BSD-MIT" }
diff --git a/tools/reckless b/tools/reckless
index 0d9ea8d0..8154ef66 100755
--- a/tools/reckless
+++ b/tools/reckless
@@ -21,7 +21,7 @@ from urllib.error import HTTPError
import venv
-__VERSION__ = 'v26.04'
+__VERSION__ = 'v26.04.1'
logging.basicConfig(
level=logging.INFO,
diff --git a/uv.lock b/uv.lock
index 1ea376a6..8d015975 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1392,7 +1392,7 @@ dev = [{ name = "pyln-proto", editable = "contrib/pyln-proto" }]
[[package]]
name = "pyln-client"
-version = "26.4"
+version = "26.4.1"
source = { editable = "contrib/pyln-client" }
dependencies = [
{ name = "pyln-bolt7" },
@@ -1450,7 +1450,7 @@ dev = [
[[package]]
name = "pyln-proto"
-version = "26.4"
+version = "26.4.1"
source = { editable = "contrib/pyln-proto" }
dependencies = [
{ name = "base58" },
@@ -1479,7 +1479,7 @@ dev = [{ name = "pytest", specifier = ">=8.0.0" }]
[[package]]
name = "pyln-testing"
-version = "26.4"
+version = "26.4.1"
source = { editable = "contrib/pyln-testing" }
dependencies = [
{ name = "cheroot" },
Why this scored 39/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.