CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17548Commits captured
17139AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17139 analyses
Highest risk·RSS
Informational 18 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: emit a single dataChanged when updating blockchain height

This change is a performance cleanup in Electrum's mobile/QML user interface. When the wallet learns that the Bitcoin blockchain has grown taller, it now refreshes the transaction list with a single 'everything changed' signal instead of s…

No security-relevant logic changePerformance/efficiency optimization onlyNo input validation, parsing, cryptography, or network changes
fbe9e2d8by f321x+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 85 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

qml: don't compute notification balance delta for large tx batches

This commit is a performance fix, not a security patch. It stops the Electrum mobile/QML wallet from calculating the total balance change when more than 20 new transactions arrive at once, because that calculation could freeze the user int…

No security-relevant signal present in the diff or commit messagePerformance/DoS mitigation against accidental UI freezing from large transaction batches
7b4759c5by f321x+5−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: change event callback logs to debug

This commit simply changes two logging messages from 'info' level to 'debug' level in the mobile/QML wallet interface. It reduces routine log output when many transactions occur. There is no security-relevant change.

a6cc4e08by f321x+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: don't force-build address model from tx event handlers

This is a performance and responsiveness fix for the Electrum mobile/QML wallet. It stops the app from doing heavy work (building the address coin list) every time a new transaction arrives, which was causing the user interface to freeze. …

35fc4a13by f321x+4−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: skip per-tx balance updates during sync

This commit is a performance optimization for Electrum's mobile/QML user interface. It prevents the wallet balance from being recalculated and redrawn on every incoming transaction during synchronization, because the balance isn't shown du…

54cccd4fby f321x+4−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 68 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: QETransactionListModel: add txid->row index

This commit is a performance improvement for the Electrum mobile/QML wallet. It replaces repeated scanning of the transaction history list with a simple dictionary lookup (txid -> row index). There is no security-relevant change visible in…

997e8a2dby f321x+19−161 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/github-script from 8.0.0 to 9.0.0

This is a routine update by Dependabot that bumps the version of a GitHub Actions helper called actions/github-script from version 8.0.0 to 9.0.0 in two workflow files. The workflows only manage issue/label automation after CI runs and do …

Dependency version bump of a third-party GitHub ActionWorkflows use GITHUB_TOKEN with repository write scopes for issue/label managementNo vendor disclosure of security relevance
5d64b04fby dependabot[bot]+3−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump cargo-bins/cargo-binstall from 1.15.10 to 1.19.1

This is a routine automated dependency update by Dependabot. It changes the version of a GitHub Action used to install a Rust tool during automated semver compatibility checks. There is no indication in the commit that this fixes or introd…

784f797eby dependabot[bot]+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions helper used to save build artifacts in three CI workflow files. There is no indication of a security issue in the project code itself, and the chan…

9f63707fby dependabot[bot]+3−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/labeler from 6.0.1 to 6.1.0

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions workflow helper (actions/labeler) used to automatically label pull requests. There is no indication of a security issue in the change itself, and n…

d858acd1by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1

This is a routine Dependabot update that bumps a GitHub Actions helper used by automated weekly maintenance workflows to create pull requests. The change only affects internal tooling, not the Rust Bitcoin library code that users rely on. …

Third-party GitHub Action version bump in CI/CD workflowsWorkflows use a repository secret (APOELSTRA_CREATE_PR_TOKEN) when creating pull requestsNo vendor security advisory or CVE referenced in commit or supplied materials
21337179by dependabot[bot]+5−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Preserve master software version

This commit only changes the firmware version numbers in a header file (from 12.4.9 beta 2 to 12.5.0 beta 1). It does not modify any executable code, fix any bug, or change any security behavior. There is no security relevance visible in t…

177a1177by Adam Tucker+3−31 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →