CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17559Commits captured
17148AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17148 analyses
Highest risk·RSS
Informational 18 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

rpc: report -txsendrate and bucket info via getnetworkinfo

This commit adds new read-only information fields to Bitcoin Core's getnetworkinfo RPC command. It exposes the configured transaction send rate and internal token-bucket statistics used to pace transaction announcements to peers. There is …

New RPC output fields only; no state mutationNo authentication or authorization changesNo network protocol changes
4842903aby Anthony Towns+45−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

tests: basic functional test for tx rate limiting

This commit only adds a new automated test file and registers it in the test runner. It does not change any production code in Bitcoin Core. The test verifies that transaction relay rate limiting (a feature controlled by the -txsendrate op…

5cde6634by Anthony Towns+115−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Add release note for -txsendrate etc

This commit only adds a release note describing a previously made network change. It does not change any code, configuration defaults, or behavior. There is no security issue in this documentation patch itself.

12b0dc33by Anthony Towns+13−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net_processing: Drop unnecessary txid arg from InitiateTxBroadcastToAll

This is a small code cleanup change in Bitcoin Core's network transaction broadcasting. It removes an unused transaction ID argument from an internal function called InitiateTxBroadcastToAll, leaving only the witness transaction ID. The fu…

349c72eeby Anthony Towns+9−93 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 63 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

txmempool: Add ExtractBestByMiningScoreWithTopology

This commit adds a new internal mempool helper function that takes a list of transaction IDs, looks them up in the memory pool, removes duplicates and missing entries, and returns the best-priority ones according to Bitcoin's mining-score/…

No security-relevant signals observed in the diff or commit message.Function is additive and not invoked in the changed code.Locking annotation and iterator-lifetime warning are present and correct.
6cfc65d2by Anthony Towns+71−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net_processing: Remove per-peer rate-limiting

This Bitcoin Core change removes a per-peer speed limit on how many transaction announcements (INV messages) a node sends out at once. Previously a peer would only announce up to about 1,000 transactions per batch, with a dynamic cap. Now …

Removal of a rate-limiting control that constrained per-peer transaction announcement burstsIncrease in maximum single INV message size from ~1,000 to ~50,000 itemsCommit message explicitly references 'severe bugs in the past' caused by per-peer rate-limiting logic
026f70e0by Anthony Towns+6−151 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 65 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net_processing: bump last_inv_sequence for bip35 messages explicitly

This change makes a Bitcoin node's mempool announcement logic more explicit and reliable. When a node announces the contents of its memory pool to a peer (a BIP35 'mempool' request), it now directly records the latest mempool version. Prev…

P2P protocol state inconsistency between mempool announcement and inventory sequence trackingReliance on implicit side effect for security-relevant state updatePotential for follow-up GETDATA requests to be mishandled after BIP35 mempool response
46c8c471by Anthony Towns+4−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

wally: update wally to release 1.5.6

This commit updates a bundled dependency (libwally-core) to a newer release, but no actual diff content or release notes were provided. We cannot see what changed or whether any security issue is involved.

cfce08ceby Jon Griffiths+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 100 · Strong
BS BlockstreamBlockstream Jade BitcoinHardware wallets

power: release PMU devices before deleting the i2c bus on M5CoreS3

This commit fixes a boot failure on the M5CoreS3 hardware. A recent update to the underlying Espressif SDK (ESP-IDF v5.5) changed the rules for deleting an I2C bus: it now refuses to delete a bus that still has devices attached. The power …

fb3a009aby Gustavo Cateim+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 86 · Strong
BS BlockstreamBlockstream Jade BitcoinHardware wallets

input: release touch handles before deleting the i2c bus

This commit fixes a bug where the touchscreen driver failed to clean up internal handles when shutting down. On newer ESP-IDF firmware, this cleanup failure caused the device to panic and freeze during boot and when using the camera or QR …

Device freeze/DoS-like symptom on affected hardwareMemory leak fixedNo input validation, authentication, or cryptographic weakness visible
36776fecby Gustavo Cateim+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

update CHANGES.md for release 1.5.6

This commit only updates the project's changelog file (CHANGES.md) to document what is included in the upcoming 1.5.6 release. It does not change any source code, build scripts, tests, or documentation that affects how the software runs. T…

9947fc4eby Jon Griffiths+8−21 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

Bump version to 1.5.6

This commit is a routine version bump from 1.5.5 to 1.5.6. It only changes version numbers in build files, documentation, and package metadata. There are no code changes that affect security or functionality.

0c41f38fby Jon Griffiths+12−129 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →