CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17784Commits captured
17252AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17252 analyses
Highest risk·RSS
Informational 20 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

listsendpays: discriminate ongoing payment by groupid

This commit fixes a bug in how the xpay plugin reports payment status. Previously, when listing ongoing payments, it only checked the payment hash, which could incorrectly mark unrelated payment attempts as 'pending' instead of 'failed'. N…

Status-reporting bug in payment pluginSame payment_hash used to incorrectly classify distinct payment attemptsFixes flaky test assertion mismatch between pending/failed statuses
aaefc60fby Lagrang3+8−43 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

updates for Tahoe

This commit only updates build instructions and a Makefile for compiling the COLDCARD simulator on macOS. It removes a hardcoded PKG_CONFIG_PATH workaround and updates the README to tell users to install pkgconf and libffi themselves. Ther…

02e054c8by Peter D. Gray+5−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Drop the consensus module from bitcoin

This commit removes the old `bitcoin::consensus` module from the rust-bitcoin library because its functionality has already been replaced by a newer `consensus_encoding` module. It is a cleanup change that deletes unused code; no security …

f4733c7eby Mitchell Bagot+0−20626 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 48 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove impl_consensus_encoding

This commit simply deletes an unused internal Rust macro called impl_consensus_encoding. The macro was only used to implement old Bitcoin consensus serialization traits, which are also being removed. There is no security issue here—this is…

4f5289cfby Mitchell Bagot+0−391 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove unused const values

This commit simply deletes two unused internal constant definitions (SEGWIT_MARKER and SEGWIT_FLAG) from one source file because identical copies already exist elsewhere in the project. It is a routine code cleanup with no functional or se…

606d1124by Mitchell Bagot+0−61 file
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

private broadcast: limit outstanding txs to count of 10,000

This commit adds a hard cap of 10,000 transactions to Bitcoin Core's private-broadcast queue. Before the change, that queue could grow without bound, potentially consuming large amounts of memory and CPU if many transactions were submitted…

Unbounded memory growth in private broadcast queue is boundedNew error path returns TransactionError::PRIVATE_BROADCAST_FULLRPC error mapping added: RPC_OUT_OF_MEMORY
5aea3d03by Gregory Sanders+229−2313 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Release cs_main between individual private tx re-attempts

This commit changes how Bitcoin Core holds an internal lock (cs_main) when retrying private transaction broadcasts. Previously, the lock was held for the entire batch of stale transactions; now it is released and re-acquired between each i…

Lock scope reduction (cs_main) in network processing codePerformance/liveness improvement for large rebroadcast queuesNo explicit security claim in commit message or diff
cbf8c107by Greg Sanders+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

private broadcast: add release note for limited cap

This commit only adds a release note describing a previously implemented limit on a transaction queue. It does not change any code behavior, so it has no direct security impact on its own. The note tells users that a privacy-related transa…

4e29de71by Gregory Sanders+8−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove Encodable and Decodable impls for crate types

This commit removes old serialization/deserialization trait implementations (called Encodable and Decodable) from many Bitcoin data types in the rust-bitcoin library. It is described by the project as a cleanup step toward replacing the ol…

Large deletion of serialization code (535 lines removed)Removal of consensus encoding traits from core Bitcoin typesRemoval of transaction deserialization tests including extreme-size witness/scriptSig tests
6f136cdfby Mitchell Bagot+8−53512 files
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnwallet+walletrpc: add SubmitPackage for v3 CPFP package relay

This commit adds a new RPC called SubmitPackage to LND's WalletKit. It lets users submit a group of related Bitcoin transactions together so a zero-fee parent can be accepted because a later child transaction pays its fee. This is a featur…

New RPC endpoint gated by onchain:write macaroon permissionPackage size bounded to 25 transactions to limit deserialization workFee-rate ceiling passed through to backend; explicit 0 disables limit
f55c0565by Elle Mouton+1019−21517 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lncli: add wallet submitpackage command

This commit adds a new command-line tool called `lncli wallet submitpackage` that lets users hand one or more raw Bitcoin transactions to LND's wallet service so they can be submitted to the network as a group (a "package"). The change onl…

No security-relevant signals present in the diff or commit message.New CLI command is a thin wrapper around an existing RPC.No changes to validation, authentication, authorization, or network handling.
ea88a268by Elle Mouton+72−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →