CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17782Commits captured
17251AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17251 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/cache from 5.0.0 to 5.0.5

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions caching tool used only in a daily fuzzing workflow. There is no code change to the rust-bitcoin library itself, and nothing in the commit indicates…

a22ae9a8by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Fix some memory handling issues

This commit fixes two memory-handling bugs in the BitBox02 hardware wallet's Rust LVGL UI bindings. First, line widgets were storing point data in dynamically allocated memory attached to the LVGL object and freeing it when the object was …

Memory lifetime mismatch between Rust-owned Vec and C object lifetimePotential use-after-free / double-free in object-attached heap storageMissing terminator validation on C-style sentinel array passed to LVGL
3a7143f4by Niklas Dusenlund+84−263 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: ensure we use correct lld version in OpenBSD job

This is a minor continuous-integration (CI) build fix for Bitcoin Core's OpenBSD cross-compilation job. It changes one package name so the build system installs the matching version of the LLVM linker (lld-22) instead of accidentally insta…

22ac4ad9by fanquake+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

depends: move FreeBSD SDK handling to CI

This commit is a build-system cleanup. It moves the handling of the FreeBSD software development kit (SDK) out of the shared dependency build files and into the continuous integration (CI) configuration. The actual compiler flags and downl…

244739dbby fanquake+37−263 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: FreeBSD 15.1

This commit simply updates the FreeBSD version number used in automated testing from 15.0 to 15.1. It is a routine CI (continuous integration) maintenance change with no security relevance.

495f43f7by fanquake+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API snapshot text files to reflect a function renaming (adding '_decoder' suffix to several decode helper functions). It changes no source code, logic, or behavior. There is no security relevance.

b32abd74by Mitchell Bagot+8−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: Rename _with decoder functions

This commit is a simple renaming of internal Rust functions from names ending in '_with' to names ending in '_with_decoder'. It does not change what the code does, only what the functions are called, to avoid confusion with another functio…

12325a67by Mitchell Bagot+18−174 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: only flag major semver breaks

This commit changes an internal CI script so that only major version-number-breaking API changes are flagged, while minor API changes are ignored. It is a workflow/process tweak with no effect on the actual Bitcoin library code that users …

047761e5by jrakibi+8−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Fix lint errors in addresses

This commit only adds documentation comments and a single Clippy lint suppression to fix code-style warnings. It does not change any program logic, data validation, or behavior, so it has no security impact.

56ba9b8fby Mitchell Bagot+12−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Move address constants to addresses

This commit is a simple code reorganization. It moves four Bitcoin address-version constants (the numeric prefixes that identify mainnet/testnet and pubkey/script addresses) from the main `bitcoin` crate into a new `addresses` crate, then …

0e6b97c1by Mitchell Bagot+13−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Copy new_witness_program_unchecked into addresses

This commit is a straightforward internal code refactor: it copies a small private helper function into a new file so it can be reused locally. There is no security-relevant change to behavior, no new public API, and no fix for a vulnerabi…

3ac9d3e7by Mitchell Bagot+21−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 63 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Move ScriptPubKeyBufExt to addresses

This commit is a routine internal code reorganization in the rust-bitcoin library. It moves a helper trait (ScriptPubKeyBufExt) and its functions from one internal module to another, and re-exports it so existing users see no change. There…

ed00d91aby Mitchell Bagot+92−552 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →