We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit simply updates the SHA256 digest of the 'blockstream/jade_builder' Docker image used for building and testing Jade in four configuration files. There is no code change, no disclosed security fix, and no evidence in the commit o…
00e7a397by Jon Griffiths+5−54 filesThis commit fixes a race condition in the Blockstream Jade hardware wallet's camera and screen rendering code. When the camera task finished, its stack memory could be freed while the GUI task was still trying to draw the last camera image…
c51f7fb9by Daniel Newton+16−03 filesThis commit is a large feature/refactor patch for Blockstream Jade's libjade (a desktop emulator of the Jade hardware wallet). It adds RPC endpoints that let a host application read the emulated device's screen, push fake button presses, r…
f7184945by Daniel Newton+1806−75832 filesThis commit fixes a user-interface navigation quirk on the M5StickC Plus 2 hardware for Blockstream Jade. When entering a PIN, the up/down button directions were not inverted to match the rest of the device's menus, making number entry con…
9de1409eby roderico+3−21 fileThis commit adds three simple file-like method declarations (readable, writable, seekable) to a Python class that communicates with a Blockstream Jade hardware wallet. The change appears to be a compatibility fix so the Jade interface obje…
9857bed9by Jon Griffiths+9−01 fileThis is a small compatibility fix for the Python Jade library so it works with both older and newer versions of the cbor2 serialization library. Newer cbor2 changed which exception it raises when data runs out, so the code now detects the …
91cc2edbby Jon Griffiths+4−21 fileThis commit simply updates the version of a Python library called cbor2 from 5.9.0 to 6.1.2 in the project's dependency list. There is no information in the commit itself saying this fixes a security problem. It is a routine dependency bum…
2c602b52by Jon Griffiths+50−451 fileThis commit fixes a small but real bug in Blockstream Jade's USB/serial message handling. A variable that decides whether a version-info message should get an immediate reply was not given a safe starting value. In C, that means it could a…
3d28dccbby Jon Griffiths+1−11 fileThis commit removes a custom bitmap-drawing function used only in the libjade build and makes that build use the same drawing path as other configurations. It is a code cleanup with no visible security relevance.
ff0789f0by Jon Griffiths+0−253 filesThis is a small fix to a developer helper script (format.sh) used during code formatting. It prevents the script from trying to move a temporary file into place when a configuration-file check fails or never creates that temporary file. Th…
3dd9c4dbby Jon Griffiths+2−11 fileThis commit adds compiler flags and helper macros to make the build fail whenever a function's return value is ignored without explicit intent. It is a hardening change, not a fix for a specific known bug. By enforcing that programmers che…
bb2e53d6by Mike Tolkachev+21−03 filesThis commit is a preventive build-hardening change. It adds compiler annotations (WARN_UNUSED_RESULT) to many functions that return success/failure codes, so the compiler will warn if a caller ignores the result. The goal is to catch futur…
909a89aaby Mike Tolkachev+215−15225 filesA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.