We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit is a routine version bump from 1.5.5 to 1.5.6. It only changes version numbers in build files, documentation, and package metadata. There are no code changes that affect security or functionality.
0c41f38fby Jon Griffiths+12−129 filesThis commit fixes a parsing bug in libwally-core's Bitcoin descriptor handling. Previously, if extra characters appeared after a valid nested expression inside parentheses, the parser silently ignored them. For example, 'wsh(pk(KEY)xyz)' w…
f23a1c97by odudex+17−02 filesThis commit tightens validation for Bitcoin descriptors that wrap a miniscript inside sh() (pay-to-script-hash) or wsh() (pay-to-witness-script-hash). Previously, the library accepted any miniscript fragment as the top-level child, even fr…
6f656241by odudex+33−22 filesThis is a test-only cleanup change. It removes a dedicated helper file used to simulate external programs during testing and instead makes the main test program act as that helper when a special environment variable is set. There is no cha…
63c5f9d2by rustaceanrob+48−604 filesThis commit only changes a code comment in a Zcash-related Rust file. It does not modify any actual program logic, function behavior, or memory-management code. The new comment explains more clearly that certain memory must be freed throug…
94e77e73by Adam Tucker+3−21 fileThis commit rewrites how a Zcash wallet's firmware summarizes batches of migration transactions on its screen. Previously, the code assumed the first message in a batch was an ordinary transaction and all later messages were migration-styl…
44d6d428by Adam Tucker+346−4523 filesThis commit adds a new compact review screen for batches of Zcash 'migration' transactions (moving funds from the Orchard pool to the newer Ironwood pool). It also fixes a small user-experience issue: the device will no longer auto-lock wh…
7770a70aby Adam Tucker+986−118 filesThis commit fixes a security hygiene issue in the Keystone hardware wallet's Zcash signing code. Previously, secret 'spend authorizing keys' were cached in ordinary memory and could remain there after use. The patch adds explicit memory sc…
e05af65aby Adam Tucker+251−583 filesThis commit fixes validation of Zcash shielded transaction data on a Keystone hardware wallet. Previously, the device could accept transactions where it could not verify where shielded funds were going, could not read certain encrypted out…
7459ef9dby Adam Tucker+275−1184 filesThis commit refactors how Keystone's Zcash firmware checks and parses batches of partially-created shielded transactions (PCZTs). It merges what used to be separate validation and display steps into a single pass, adds a new public functio…
c55a8572by Adam Tucker+324−23 filesThis commit only adds a new GitHub Actions CI workflow that runs automated tests for Zcash-related Rust code when relevant files change. It does not modify any firmware code, cryptographic logic, or user-facing behavior. There is no securi…
25c20357by Adam Tucker+26−01 fileThis commit is a small performance and code-clarity improvement for Zcash shielded transaction signing in a Keystone hardware wallet firmware component. It moves a repeated transaction-hash calculation out of a per-action loop so it is com…
1596d47dby Adam Tucker+33−141 fileA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.