CommitWatch RSS
LL
← All projectsLightning Labs

LND

Go implementation of a complete Lightning Network node.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1229 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

115security candidates164second-pass queue55AI analyses
70commits · 30 days
159commits · 60 days
824commits · 180 days
1229commits · 365 days
Backfill bands
Aug 5 → Feb 6405 seen5 candidatesComplete
Feb 6 → Jun 6665 seen28 candidatesComplete
Jun 6 → Jul 689 seen4 candidatesComplete
Jul 6 → Aug 569 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
277Strong · 80–100
555Adequate · 60–79
366Thin · 40–59
31Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Olaoluwa Osuntokun1943926274
Elle Mouton2673110067
ziggie408155064
Erick Cestari2677070
bitromortac4652067
yyforyongyu5531065
saubyk1520070
Oli722057
Suheb320075
elnosh320071
George Tsagkarelis3211066
Gijs van Dam2610071
Analysis record

Published AI watches

Last scanned 43 minutes ago

Low 36 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

bolt12: validate Invoice messages

This commit adds validation checks for BOLT 12 invoices in the LND Lightning node software. It ensures invoices contain required fields (creation time, amount, payment hash, node ID, payment paths), match their originating invoice requests…

New validation gate added to Invoice.Encode() to reject malformed invoices before serializationReader rejects unknown even invoice TLV types and unknown even feature bitsReader enforces chain compatibility against activeChain
e0f04f17by bitromortac+1642−74 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
LL Lightning LabsLND BitcoinLightning Network

ci: split PR severity workflow into classify and apply jobs

This commit is a hardening and cleanup of a GitHub Actions workflow that automatically labels pull requests by severity. It does not change any LND node code, wallet logic, or network protocol. Instead, it splits the workflow into two jobs…

Principle of least privilege: write token moved out of the model-bearing jobUntrusted input (model-generated comment) sanitized before privileged API useExternal action pinned to immutable commit SHA instead of mutable tag
05c62527by Olaoluwa Osuntokun+424−593 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnwallet+walletrpc: add SubmitPackage for v3 CPFP package relay

This commit adds a new RPC called SubmitPackage to LND's WalletKit. It lets users submit a group of related Bitcoin transactions together so a zero-fee parent can be accepted because a later child transaction pays its fee. This is a featur…

New RPC endpoint gated by onchain:write macaroon permissionPackage size bounded to 25 transactions to limit deserialization workFee-rate ceiling passed through to backend; explicit 0 disables limit
f55c0565by Elle Mouton+1019−21517 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: validate InvoiceRequest per BOLT 12 reader/writer requirements

This commit adds validation checks for BOLT 12 invoice requests in the LND Lightning node. It ensures that invoice requests follow protocol rules when being created (written) and received (read), rejecting malformed or non-compliant reques…

New input validation functions added for protocol messagesValidation now runs before encoding, preventing malformed outbound messagesOverflow guard added for amount*quantity calculation
8b4587b0by bitromortac+1703−53 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

multi: upgrade to btcd v2 modules

This is a large dependency upgrade for the LND Lightning node software. It moves LND from older btcd Bitcoin library packages to new 'v2' packages and updates related wallet and network libraries. The commit is almost entirely mechanical i…

Large dependency upgrade touching core Bitcoin primitives (wire, txscript, chainhash, btcutil, psbt, address)Migration to new v2 module layout with API changes in address handlingPins new upstream releases (btcd 0.26.0, btcwallet 0.17.0, neutrino 0.18.0, lightning-onion 1.4.0) that may include undisclosed fixes
8047149cby Oli+1733−1789605 files
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 85 · Strong
LL Lightning LabsLND BitcoinLightning Network

discovery: fix panic in DNS fallback SRV lookup

This commit fixes a bug in LND's DNS seed bootstrap code that could crash the node. The code assumed every record in a DNS response was an SRV record, so a non-SRV record (like a normal A or CNAME record) would cause a panic. The fix safel…

Unconditional type assertion panic in DNS fallback pathMissing bounds check on LookupHost result before array indexingMissing network deadline on manually dialed DNS TCP connection
2a3642c6by Erick Cestari+252−52 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

kvdb: remove stale xz replace

This commit removes a temporary security workaround in a Go module file. The workaround forced the use of a newer, fixed version of a compression library (xz) to avoid a known historical vulnerability. The commit message says the library i…

Removal of a dependency-level vulnerability workaroundReference to historical advisory GHSA-25xm-hr59-7c27 in deleted commentNo code changes; only go.mod cleanup
80f98a5eby ziggie+0−31 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

mod: remove stale xz replace

This commit removes an old workaround in LND's dependency file (go.mod) that pinned a safe version of the 'xz' compression library. The workaround was originally added because another dependency once pulled in a vulnerable version of xz. T…

Removal of a dependency override that was a security mitigation for CVE-2021-29482Commit explicitly references the original GHSA advisory (GHSA-25xm-hr59-7c27)No actual downgrade or re-introduction of the vulnerable module is visible in the diff
eeaa717eby ziggie+0−31 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

lint: remove redundant loop var copies in test files

This commit is a cleanup-only change that removes unnecessary loop-variable copies in Go test files. Since Go 1.22, loop variables are already scoped per-iteration, so the old `x := x` workarounds are redundant. The change affects only tes…

aca27e27by Erick Cestari+0−271137 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 66 · Adequate
LL Lightning LabsLND BitcoinLightning Network

mod: bump kvdb to v1.5.1

This commit updates a dependency version in LND's build files. It bumps the internal 'kvdb' submodule from version 1.5.0 to 1.5.1 so that downstream projects importing kvdb directly do not pull in an older, vulnerable telemetry library (Op…

Dependency bump explicitly motivated by a known vulnerability identifier (GO-2026-4394)No source code changes in LND itself; only module metadata updatedVendor describes the root build as already unaffected, limiting direct security impact on LND
12686ac3by yyforyongyu+3−32 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

multi: drop tor v2 onion production, keep wire codec faithful

This commit removes support for obsolete Tor v2 onion addresses from the Lightning Network Daemon (lnd). Tor v2 services were shut down by the Tor network in October 2021, so lnd will no longer create, accept, or dial v2 onion addresses. H…

Removal of deprecated network protocol (Tor v2) reduces attack surface and prevents futile/unsafe dials to unreachable services.Input validation added at operator boundaries (ParseAddressString, parseAddr) to reject v2 .onion addresses with a clear error.On-disk legacy key fallback now validates decrypted key type and rejects non-v3 (RSA1024) keys before passing them to Tor.
2ae1db83by Erick Cestari+780−32931 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 85 · Strong
LL Lightning LabsLND BitcoinLightning Network

lnwallet/rpcwallet: accept zero-value WitnessUtxo entries in remote-sign prep

This commit fixes a bug in LND's remote-signing setup where zero-value previous transaction outputs were wrongly ignored when preparing a PSBT for a remote signer. The most concrete affected use case is BIP-322 message attestation, where t…

Functional denial-of-service in remote-signer BIP-322 workflows due to PSBT rejectionIncorrect zero-value UTXO validation caused legitimate outputs to be droppedFix removes Value check while preserving non-empty PkScript sanity check
9f31668bby Olaoluwa Osuntokun+69−361 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

lnwallet/rpcwallet: add unit tests for WitnessUtxo population helper

This commit only adds new unit tests for an existing helper function in LND's RPC wallet code. It does not change any production logic, so it cannot introduce a security vulnerability or directly fix one in the code being committed. The te…

6bb2c6f5by Olaoluwa Osuntokun+231−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnrpc: remove deprecated Send* RPC server implementations

This commit removes old, unused code paths for sending Lightning payments through the main RPC server. These RPCs (SendPayment, SendPaymentSync, SendToRoute, SendToRouteSync) were already deleted from the service definition in a prior chan…

Removal of deprecated RPC handlers and macaroon permissionsDeletion of dead payment-dispatch helper codeNo new input parsing, network exposure, or privilege changes introduced
3ff87913by Erick Cestari+0−7891 file
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

routerrpc: remove deprecated SendPayment, SendToRoute, TrackPayment impls

This commit removes three old, deprecated payment RPC methods (SendPayment, SendToRoute, and TrackPayment) from the LND Lightning node's router service. These methods were already replaced by newer V2 versions and were only thin wrappers a…

Removal of deprecated RPC surface reduces attack surfaceMacaroon permission entries for removed methods are deletedNo new code paths or logic added
c7dd0a99by Erick Cestari+0−1262 files
No security note in commit
Open full analysis →Source commit ↗
High 76 AI analysisMessage 95 · Strong
LL Lightning LabsLND BitcoinLightning Network

peer: gate onion message ingress on having an open channel

This change closes a denial-of-service weakness in LND's onion-message forwarding. Previously, an attacker could create unlimited free peer identities and burn through the global byte-budget reserved for onion messages, starving real peers…

Adds a Sybil-resistance gate requiring funded, non-pending channels for onion message ingressChannel gate runs before per-peer and global rate limiters, preventing no-channel peers from consuming any token budgetIntroduces atomic shadow counter for O(1) hot-path checks on every incoming onion packet
c0827e8eby Olaoluwa Osuntokun+336−539 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

lnwallet: regenerate taproot test vectors with secret nonces

This commit only updates test data in a JSON file used for automated tests of Lightning's new taproot channel features. It adds secret nonce values and corrects public nonce values so the test vectors match the expected commitment transact…

No production code modifiedTest-only JSON fixture updateNonce values are part of test vectors, not live secrets
50981dfcby Olaoluwa Osuntokun+9−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

multi: add custom nonce rand support to MuSig2 sessions

This change adds a hidden switch that lets developers plug in a custom random source when creating MuSig2 signing nonces, mainly so tests can produce exactly the same signatures every time. In normal operation the switch is left empty, so …

New optional custom random source for MuSig2 nonce generationDefault call sites explicitly pass empty option, preserving CSPRNG behaviorCode comments state the option is intended only for reproducible test vectors
08c42b19by Olaoluwa Osuntokun+44−193 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

lnwallet: add taproot channel test vector generator

This commit only adds new test code and a JSON file of expected test outputs for Taproot Lightning channels. It does not change any production logic, network behavior, or wallet handling. There is no security issue in the commit itself.

38c415a9by Olaoluwa Osuntokun+1570−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

lnwallet: add 3rd-party signature verification for taproot test vectors

This commit only adds a new test to the project's test suite. It does not change any production code, user-facing behavior, or network protocol. The new test cryptographically checks that example transactions in the project's test data car…

Adds independent cryptographic signature verification for test vectorsUses txscript.NewEngine with StandardVerifyFlags to mirror on-chain validationVerifies both the commitment transaction and each HTLC resolution transaction
77da917cby Olaoluwa Osuntokun+99−01 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedlnwallet: use channel state open channelby ziggie · fa31c564 · Jul 7, 2026 · 9 filesMessage 78 · AdequateTriage 12Details
Commit message · ziggie

lnwallet: use channel state open channel

Update lnwallet channel, reservation, wallet, and test helpers to use
chanstate.OpenChannel directly.

The wallet package still imports channeldb for database APIs and other
channel-state aliases, but the OpenChannel type boundary now points at
the package that owns the type.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedhtlcswitch: use channel state open channelby ziggie · a4bec71b · Jul 7, 2026 · 1 fileMessage 78 · AdequateTriage 0Details
Commit message · ziggie

htlcswitch: use channel state open channel

Update htlcswitch test utilities to construct and pass
chanstate.OpenChannel values directly.

This removes another test-only dependency on the channeldb OpenChannel
alias while leaving the test database helpers unchanged.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedserver: use channel state open channelby ziggie · 8e709678 · Jul 7, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · ziggie

server: use channel state open channel

Update server callback wiring to use chanstate.OpenChannel at the
funding manager boundary.

This follows the funding package change and removes another
consumer-facing dependency on the channeldb OpenChannel alias.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedchanstate: use channel type in wallet rpcby ziggie · 8a215d9e · Jul 7, 2026 · 1 fileMessage 68 · AdequateTriage 12Details
Commit message · ziggie

chanstate: use channel type in wallet rpc

Move the waiting-close channel helper to chanstate.OpenChannel.

The helper consumes channel state returned by the store interface, so
it should not spell the channeldb compatibility alias. Other database
errors and APIs in the wallet RPC server remain on channeldb.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedchanstate: remove store genericsby ziggie · 68ad283d · Jul 6, 2026 · 15 filesMessage 58 · ThinTriage 12Details
Commit message · ziggie

chanstate: remove store generics

Drop the temporary channel type parameter from the channel-state store
interfaces now that OpenChannel lives in chanstate.

The domain store subinterfaces now refer to *OpenChannel directly while
retaining the same backend-independent shape. Update callers and
compatibility aliases to use the concrete Store and ChannelShell types.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedchanstate: move taproot channel helpersby ziggie · c065aa91 · Jul 6, 2026 · 2 filesMessage 78 · AdequateTriage 8Details
Commit message · ziggie

chanstate: move taproot channel helpers

Move the backend-neutral taproot shachain and verification nonce
helpers into chanstate with the thaw-height threshold they support.

Leave channeldb aliases for existing callers while OpenChannel and its
receiver methods are moved across the package boundary.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validationsecond-pass: broader security terminology
AI review queuedchanneldb: derive channel packagersby ziggie · 0229e0ad · Jul 6, 2026 · 9 filesMessage 58 · ThinTriage 12Details
Commit message · ziggie

channeldb: derive channel packagers

Remove the KV forwarding packager from OpenChannel and derive a
ChannelPackager inside the channeldb store methods that need one.

This keeps the backend-specific kvdb transaction helper in channeldb,
so the OpenChannel type no longer carries that dependency toward
chanstate.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI review queuedchanstate: add remote commit chain storeby ziggie · 06308e1d · Jul 6, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · ziggie

chanstate: add remote commit chain store

Add the remote commitment-chain append method to the chanstate
commitment store subinterface.

Move the existing KV transaction body onto ChannelStateDB and have the
OpenChannel receiver call through the store. This removes another
direct backend dependency from OpenChannel while keeping KV persistence
code in channeldb.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedchanstate: make store channel types genericby ziggie · f53d615c · Jul 6, 2026 · 18 filesMessage 68 · AdequateTriage 12Details
Commit message · ziggie

chanstate: make store channel types generic

Move the small value types referenced by chanstate.Store out of
channeldb. This includes ChannelConfig, ChannelStatus,
ChannelCloseSummary, ChannelShell, ChanCount, and FinalHtlcInfo. Leave
aliases in channeldb so existing callers keep compiling while the
backend still lives there.

Parameterize the Store subinterfaces over the channel type and instantiate
current callers with *channeldb.OpenChannel. This removes the chanstate
-> channeldb import edge without moving OpenChannel yet, keeping the
first step reviewable and backend-neutral.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedlncli: add wallet submitpackage commandby Elle Mouton · ea88a268 · Jun 30, 2026 · 1 fileMessage 68 · AdequateTriage 12Details
Commit message · Elle Mouton

lncli: add wallet submitpackage command

Add a `wallet submitpackage` command that takes one or more hex-encoded
raw transactions (topologically sorted, parents first and the child
last) and an optional --max_fee_rate, and submits them as a package via
the WalletKit.SubmitPackage RPC.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queueditest: add SubmitPackage integration testby Elle Mouton · 47661cea · Jun 30, 2026 · 3 filesMessage 78 · AdequateTriage 12Details
Commit message · Elle Mouton

itest: add SubmitPackage integration test

Add an integration test that exercises WalletKit.SubmitPackage: it builds
a zero-fee v3 (TRUC) parent that a standalone broadcast would reject,
pairs it with a fee-paying v3 CPFP child, and asserts the package is
accepted. A zero-fee transaction can only enter the mempool via package
evaluation, so this proves the CPFP package path end to end.

submitpackage is a bitcoind RPC, so the test skips on the btcd and
neutrino backends. Also adds the SubmitPackage wrapper to the
integration-test RPC harness.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queueddocs: add release note for DNS fallback SRV lookup panic fix 0.21.1by Erick Cestari · 1ab34c4e · Jun 24, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Erick Cestari

docs: add release note for DNS fallback SRV lookup panic fix 0.21.1

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI review queueddocs: remove release note for DNS fallback panic of 0.22.0by Erick Cestari · 48ba0edf · Jun 24, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Erick Cestari

docs: remove release note for DNS fallback panic of 0.22.0

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI review queuedmulti: fix lint findings from btcd v2 migrationby Elle Mouton · 39124289 · Jun 24, 2026 · 4 filesMessage 78 · AdequateTriage 7Details
Commit message · Elle Mouton

multi: fix lint findings from btcd v2 migration

The btcd v2 module migration re-touched several lines that the line-length
linter then flagged, and left one error return unchecked. Wrap the
over-length lines in input/test_utils.go and zpay32 (the address-decode
helpers and test fixtures whose btcutil->address rename lengthened them),
and check the LoadTxFilter error return in routing/chainview/btcd.go.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queueddocs: add release note for DNS fallback SRV lookup panic fixby Erick Cestari · 2ee49698 · Jun 23, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Erick Cestari

docs: add release note for DNS fallback SRV lookup panic fix

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI review queuedtor: use latest btcdby Oli · bdba8e0d · Jun 12, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Oli

tor: use latest btcd

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedkvdb: bump pgx to v5.9.2by ziggie · 079b1610 · Jun 9, 2026 · 2 filesMessage 38 · OpaqueTriage 0Details
Commit message · ziggie

kvdb: bump pgx to v5.9.2

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedlnd: bump pgx to v5.9.2by ziggie · d4bcd902 · Jun 9, 2026 · 2 filesMessage 38 · OpaqueTriage 0Details
Commit message · ziggie

lnd: bump pgx to v5.9.2

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedtools: bump prometheus client dependencyby ziggie · 6837d1aa · Jun 9, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · ziggie

tools: bump prometheus client dependency

Bump the nested tools module's Prometheus client dependency to v1.23.2
and let MVS select the newer common, procfs, and client_model versions
required by that release.

This removes the old Prometheus common v0.4.1 graph edge and drops the
stale github.com/gogo/protobuf v1.1.1 go.mod checksum from tools/go.sum.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedkvdb: remove redundant gogo protobuf replaceby ziggie · 261372bc · Jun 9, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · ziggie

kvdb: remove redundant gogo protobuf replace

Remove the nested kvdb module's self-replace for
github.com/gogo/protobuf now that the module graph selects v1.3.2
directly.

The Prometheus dependency graph was already updated in the previous
commit, so go mod tidy does not retain the old github.com/gogo/protobuf
v1.1.1 go.mod checksum.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedmod: bump prometheus client dependencyby ziggie · 8b7ededa · Jun 9, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · ziggie

mod: bump prometheus client dependency

Bump the direct Prometheus client_golang dependency to v1.23.2 and let
MVS select the newer common, procfs, and client_model modules required
by that release.

The newer Prometheus graph no longer references
github.com/prometheus/common v0.4.1, which was the remaining path that
caused go mod tidy to retain the github.com/gogo/protobuf v1.1.1 go.mod
checksum after removing the redundant gogo/protobuf replace.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedkvdb: bump prometheus client dependencyby ziggie · 316a2dfa · Jun 9, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · ziggie

kvdb: bump prometheus client dependency

Bump the nested kvdb module's Prometheus client dependency to v1.23.2
and let MVS select the newer common, procfs, and client_model versions
required by that release.

This removes the old Prometheus common v0.4.1 graph edge that referenced
github.com/gogo/protobuf v1.1.1, matching the root module cleanup.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedmod: bump protobuf hex display forkby ziggie · 3f3718ca · Jun 9, 2026 · 19 filesMessage 68 · AdequateTriage 12Details
Commit message · ziggie

mod: bump protobuf hex display fork

Update google.golang.org/protobuf to v1.36.11 and point the replace
directive at the matching lightninglabs/protobuf-go-hex-display
v1.36.11-hex-display tag.

This keeps the fork aligned with the latest upstream protobuf-go release
while preserving the UseHexForBytes option used by the CLI JSON marshal
and unmarshal paths.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedmod: remove redundant gogo protobuf replaceby ziggie · ee7c48d2 · Jun 9, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · ziggie

mod: remove redundant gogo protobuf replace

The main module already requires github.com/gogo/protobuf v1.3.2, which
is the fixed and latest tagged version. Go's MVS continues to select
v1.3.2 without the self-replace, so the replace no longer changes the
effective dependency version.

Running go mod tidy records an older transitive go.mod checksum, but go
list still resolves github.com/gogo/protobuf to v1.3.2.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedbuild: bump Go versionsby ziggie · 92e29a42 · Jun 8, 2026 · 30 filesMessage 40 · ThinTriage 0Details
Commit message · ziggie

build: bump Go versions

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: unusually broad change