We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit removes the libevent dependency from Bitcoin Core's vcpkg package manager configuration. It is a build-system cleanup change, not a security fix. The removed override was previously pinning an older libevent version to avoid a …
96d7f55fby fanquake+2−101 fileThis commit is a code cleanup (refactor) that splits one combined error type into two separate error types for parsing BIP32 derivation paths. It does not change the actual parsing rules or fix any security bug. It only changes how error m…
22a4cbc6by Trevor Arjeski+68−291 fileThis commit simply adds a new on-screen tutorial entry for a cryptocurrency wallet integration called 'Vizor'. It is a UI content addition with no security-relevant code changes.
9a423f33by soralit+11−02 filesThis commit is a code cleanup in the rust-bitcoin library. It splits one general BIP32 derivation error type into several more specific error types and renames the old one. It does not change how keys are actually derived or add any new se…
f83c5dd2by Trevor Arjeski+93−331 fileThis commit adds a type check to ensure a transaction fee value coming from an external server is either a valid whole number or absent. Without the check, an unexpected type (such as a string or special object) could later cause errors or…
671c08b6by ThomasV+1−01 fileThis commit adds hardware support for a new microcontroller variant (STM32U58x) in Trezor's secure monitor feature. It is a feature addition, not a security fix. There is no indication in the commit that it addresses any vulnerability or s…
ca256f17by tychovrahe+165−26 filesThis commit updates a bootloader linker script for a new STM32U58-based Trezor variant to support an alternative 'PQ' (post-quantum) bootloader header format. It adds a code-size symbol, a small padding section, and changes how the bootloa…
e25721d3by tychovrahe+13−51 fileThis commit changes how a build reporting tool calculates memory usage for the Trezor bootloader. Previously, the tool counted the zero padding that fills the bootloader image up to its maximum size as 'used' memory, making the bootloader …
1f7cbfdeby tychovrahe+87−43 filesThis commit removes one unused header file include from a production-test source file. It is a routine code cleanup with no functional change and no security relevance.
03b35af3by tychovrahe+0−11 fileThis commit fixes a bug in an internal build tool that reports how much flash memory a Trezor firmware image uses. The tool was incorrectly counting reserved RAM-only sections (like the stack) as if they lived in flash, which could make th…
96a2bddfby tychovrahe+54−11 fileThis commit simply bumps the version of a Java library called Lanterna from 3.1.3 to 3.1.5 in the project's build file. There is no information in the commit itself saying this fixes a security problem, and no independent references were p…
3dc50682by Craig Raw+1−11 fileThis commit simply removes two obsolete comment lines from the top of a source file: a Python 2 shebang and an Emacs editor mode hint. It does not change any executable code, behavior, or security properties of the Electrum wallet.
920840a8by ThomasV+0−31 fileA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.