We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit only adds a new test operation to an existing fuzzing target. It exercises a database compaction function (CompactFullAsync) during automated fuzz testing, with no changes to production code or user-facing behavior. There is no…
703a671fby Lőrinc+6−11 fileThis commit is a simple rename of an internal function from CompactFull() to CompactFullAsync(). It does not change what the code does, only its name, to make it clearer that the operation runs in the background rather than blocking. There…
0868c85fby Lőrinc+4−44 filesThis commit only adds a new automated test for Zcash transparent output parsing. It builds a sample pay-to-public-key-hash (p2pkh) output at runtime and checks that the parser correctly extracts the recipient address, value, and 'not chang…
612a4a94by Adam Tucker+37−01 fileThis commit simply updates the SHA256 digest of the 'blockstream/jade_builder' Docker image used for building and testing Jade in four configuration files. There is no code change, no disclosed security fix, and no evidence in the commit o…
00e7a397by Jon Griffiths+5−54 filesThis commit fixes a race condition in the Blockstream Jade hardware wallet's camera and screen rendering code. When the camera task finished, its stack memory could be freed while the GUI task was still trying to draw the last camera image…
c51f7fb9by Daniel Newton+16−03 filesThis commit is a large feature/refactor patch for Blockstream Jade's libjade (a desktop emulator of the Jade hardware wallet). It adds RPC endpoints that let a host application read the emulated device's screen, push fake button presses, r…
f7184945by Daniel Newton+1806−75832 filesThis commit fixes a user-interface navigation quirk on the M5StickC Plus 2 hardware for Blockstream Jade. When entering a PIN, the up/down button directions were not inverted to match the rest of the device's menus, making number entry con…
9de1409eby roderico+3−21 fileThis commit adds three simple file-like method declarations (readable, writable, seekable) to a Python class that communicates with a Blockstream Jade hardware wallet. The change appears to be a compatibility fix so the Jade interface obje…
9857bed9by Jon Griffiths+9−01 fileThis is a small compatibility fix for the Python Jade library so it works with both older and newer versions of the cbor2 serialization library. Newer cbor2 changed which exception it raises when data runs out, so the code now detects the …
91cc2edbby Jon Griffiths+4−21 fileThis commit simply updates the version of a Python library called cbor2 from 5.9.0 to 6.1.2 in the project's dependency list. There is no information in the commit itself saying this fixes a security problem. It is a routine dependency bum…
2c602b52by Jon Griffiths+50−451 fileThis commit fixes a small but real bug in Blockstream Jade's USB/serial message handling. A variable that decides whether a version-info message should get an immediate reply was not given a safe starting value. In C, that means it could a…
3d28dccbby Jon Griffiths+1−11 fileThis commit removes a custom bitmap-drawing function used only in the libjade build and makes that build use the same drawing path as other configurations. It is a code cleanup with no visible security relevance.
ff0789f0by Jon Griffiths+0−253 filesA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.