Merge branch 'ElementsProject:master' into bolt-quote-update

Author: nGoline

.github/workflows/ci.yaml

@@ -28,8 +28,6 @@ jobs:
     if: |
       github.event.action != 'edited' ||
       contains(github.event.pull_request.body, 'Changelog')
-    env:
-      BOLTDIR: bolts
     strategy:
       fail-fast: true
     steps:
@@ -197,6 +195,8 @@ jobs:
     runs-on: ubuntu-24.04
     needs:
       - compile
+    env:
+      BOLTDIR: bolts
     strategy:
       matrix:
         CFG: [compile-gcc]

.version

@@ -1 +1 @@
-v26.04
+v26.04.1

CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [26.04.1] - 2026-04-24: "Negative Routing Fees II"
+
+This point release is recommended: it fixes a build failure in some environments and a gossip protocol issue.
+
+### Fixed
+
+ - **Protocol:** we now reject `channel_announcement` messages where `node_id_1` is not lexicographically less than `node_id_2` (per BOLT; see [lightning/bolts#1333](https://github.com/lightning/bolts/pull/1333)), so malformed announcements no longer stress the gossip store and other readers. ([#9082])
+ - **Build:** correct `printf` format for the splice transaction weight log line (`%zu` for `size_t`), fixing a `-Werror` / `-Wformat` failure (for example in the `linux/amd64` Docker image build). ([#9083])
+
+[#9082]: https://github.com/ElementsProject/lightning/pull/9082
+[#9083]: https://github.com/ElementsProject/lightning/pull/9083
+[26.04.1]: https://github.com/ElementsProject/lightning/releases/tag/v26.04.1
+
 ## [26.04] - 2026-04-20: Negative Routing Fees
 
 This release is named by @Chand-ra.

contrib/pyln-client/pyln/client/__init__.py

@@ -4,7 +4,7 @@
 from .gossmapstats import GossmapStats
 from .version import NodeVersion
 
-__version__ = "v26.04"
+__version__ = "v26.04.1"
 
 __all__ = [
     "LightningRpc",

contrib/pyln-client/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-client"
-version = "v26.04"
+version = "v26.04.1"
 description = "Client library and plugin library for Core Lightning"
 authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
 license = { text = "BSD-MIT" }

contrib/pyln-proto/pyln/proto/__init__.py

@@ -4,7 +4,7 @@
 from .onion import OnionPayload, TlvPayload, LegacyOnionPayload
 from .wire import LightningConnection, LightningServerSocket
 
-__version__ = "v26.04"
+__version__ = "v26.04.1"
 
 __all__ = [
     "Invoice",

contrib/pyln-proto/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-proto"
-version = "v26.04"
+version = "v26.04.1"
 description = "This package implements some of the Lightning Network protocol in pure python. It is intended for protocol testing and some minor tooling only. It is not deemed secure enough to handle any amount of real funds (you have been warned!)."
 authors = [
     {name = "Christian Decker", email = "decker.christian@gmail.com"}

contrib/pyln-testing/pyln/testing/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "v26.04"
+__version__ = "v26.04.1"
 
 __all__ = [
     "__version__",

contrib/pyln-testing/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-testing"
-version = "v26.04"
+version = "v26.04.1"
 description = "Test your Core Lightning integration, plugins or whatever you want"
 authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
 license = { text = "BSD-MIT" }

gossipd/gossmap_manage.c

@@ -648,6 +648,20 @@ const char *gossmap_manage_channel_announcement(const tal_t *ctx,
 			       tal_hex(tmpctx, announce));
 	}
 
+	/* BOLT-gossip-node-check #7:
+	 * The receiving node:
+	 *...
+	 *   - if `node_id_1` is not lexicographically less than `node_id_2`:
+	 *     - SHOULD send a `warning`.
+	 *     - MAY close the connection.
+	 *     - MUST ignore the message.
+	 */
+	if (!(node_id_cmp(&node_id_1, &node_id_2) < 0)) {
+		return tal_fmt(ctx, "node_id_1 must be the lesser node id! 1=%s, 2=%s",
+			       fmt_node_id(tmpctx, &node_id_1),
+			       fmt_node_id(tmpctx, &node_id_2));
+	}
+
 	/* If a prior txout lookup failed there is little point it trying
 	 * again. Just drop the announcement and walk away whistling.
 	 *