CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: fix flaky test_simple_close_delay_broadcast mempool race

This commit fixes a flaky automated test in Core Lightning. The test was sometimes failing because it mined a Bitcoin block immediately after seeing a log message that said a transaction was being broadcast. That log appears when Core Ligh…

5ae0705fby Níckolas Goline+7−41 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 52 AI analysisMessage 93 · Strong
AQ ACINQEclair BitcoinLightning Network

Reject incoming HTLCs with a high `cltv_expiry` (#3323)

This change tightens a safety limit on the Bitcoin Lightning Network node Eclair. Previously, Eclair already refused to send outgoing payments whose refund deadline (the 'cltv_expiry') was more than about two weeks in the future, because t…

Adds upper-bound validation for cltv_expiry on incoming HTLCsPrevents long fund lock-up in case of peer force-closeMitigates slow jamming by capping maximum expiry delta
7fb94601by Bastien Teinturier+52−94 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

release notes: bump 4.8.0 date for second attempt

This commit only changes a release date in the RELEASE-NOTES file from July 2, 2026 to July 8, 2026. It is a documentation-only update explaining that the previous release attempt did not achieve full reproducible-build quorum, particularl…

8c0adcdaby SomberNight+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): rename checked PCZT check helpers

This commit is a pure code cleanup: it renames Zcash PCZT (Partially Created Zcash Transaction) helper functions from 'preflight' wording to 'check' wording and merges two nearly identical wrapper functions. The actual transaction validati…

No functional change to PCZT validation or normalization logicNo change to cryptographic checks, key derivation, or transaction signingNo new unsafe code, FFI boundary changes, or input handling changes
e2072c1bby Adam Tucker+51−803 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

replace openpnp-capture-java dependency with ffm-based implementation

This commit swaps out the library Sparrow Wallet uses to talk to webcams. The old library used JNA (a common Java-to-native bridge), while the new one uses Java's newer Foreign Function & Memory (FFM) API. The change also adds a manual ste…

Dependency swap from JNA-based to FFM-based native bindings for webcam captureNew manual System.load of openpnp-capture native library from java.home/libNew --enable-native-access flag for io.github.doblon8.openpnp.capture
5ae36a54by doblon8+54−536 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 53 · Thin
AQ ACINQEclair BitcoinLightning Network

Use bitcoin-lib 0.48 (#3316)

This commit updates Eclair's underlying Bitcoin library from version 0.47 to 0.48 and makes small code adjustments to match the new library's API. The changes touch how private keys are derived and how test data is converted. There is no d…

Dependency version bump of cryptographic Bitcoin libraryPrivate key derivation code modifiedTaproot/MuSig2 test vector code adjusted
743dcdd1by Fabrice Drouin+8−44 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API listing files (text snapshots of public functions/types). It adds lines describing two new public methods on script types. There is no source code change, no bug fix, and no security relevance visible…

77cf6dc5by Mitchell Bagot+8−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): avoid restarting MicroPython event loop for faster tests

This is a small test/UX optimization for the Trezor hardware wallet firmware. It changes when the device briefly resets its internal message-processing loop. Previously this only happened on one device model (Eckhart); now it also applies …

Behavioral change in message dispatch pathRemoval of model-specific guard for event-loop restart behaviorNo changelog entry (marked [no changelog])
4406f0baby Roman Zeyde+3−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): avoid rehashing the screenshots

This is a small internal CI script cleanup. It removes an unused import and switches from manually re-computing a file hash to using a hash that was already computed and stored in the test result object. There is no user-facing change and …

17640ca1by Roman Zeyde+2−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Move script_hash and wscript_hash to primitives

This commit is a routine internal code reorganization. It moves two helper methods, `script_hash` and `wscript_hash`, from one Rust module to another within the same project. The methods still do exactly the same thing—compute the same Bit…

9c15fd0cby Mitchell Bagot+31−214 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add backlight_pwm driver

This commit adds a new hardware driver that controls the screen backlight brightness on some Trezor devices using a PWM (pulse-width modulation) timer. It is purely a feature addition for driving backlight LEDs and does not change any secu…

5cb268f3by tychovrahe+268−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): make frame buffer count board-configurable

This is a small, safe code organization change for the Trezor hardware wallet's display code. It allows different Trezor device models to configure how many screen frame buffers they use, defaulting to two. There is no security bug or fix …

1e046812by tychovrahe+8−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →