CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18178Commits captured
17450AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17450 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove the second field of Builder

This commit is a straightforward internal code cleanup in the Rust Bitcoin library. It removes a redundant field from the script Builder struct and replaces it with an equivalent method call. There is no security-relevant change visible in…

6e1e545eby Mitchell Bagot+5−121 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove access to private fields of Builder

This commit is a routine internal code cleanup in the rust-bitcoin library. It changes how the Script Builder accesses its own data so that future code reorganization is easier. There is no indication this fixes a security bug or changes b…

9a644e42by Mitchell Bagot+23−181 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Move push_int_non_minimal to BuilderExtPriv

This commit is a routine internal code reorganization. It moves a helper function for building Bitcoin scripts from a public-ish location on the Builder type into a private extension trait only visible inside one module. There is no securi…

ddd1de3aby Mitchell Bagot+22−103 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Split Builder into BuilderExt

This commit is a routine internal code reorganization. It moves several helper methods off the `Builder` type into a new `BuilderExt` extension trait so that the core `Builder` can be kept clean and moved to a more basic crate. There is no…

a5db61b9by Mitchell Bagot+129−1236 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 50 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Improve phoenixd, remove support for deprecated lightning backend

This commit is a routine maintenance update for BTCPay Server. It removes support for three older/deprecated Lightning payment backends (Lightning Charge, LNDHub, and LNBank), updates the phoenixd integration, bumps a couple of library ver…

Removal of deprecated Lightning backend integrations (Lightning Charge, LNDHub, LNBank)Dependency bump: BTCPayServer.Lightning.All 1.7.0 -> 1.7.1 and BTCPayServer.Lightning.Common 1.5.3 -> 1.7.1Change to Lightning node sync validation: now skips the 'blocks behind' check when reported BlockHeight is 0
009f458eby Nicolas Dorier+68−12722 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

flake: Fix test_graceful_htlc to be flexible for notifs

This commit fixes a flaky automated test, not a security issue. The test sometimes received an extra timing-related notification when the machine was slow. The change makes the test tolerate that extra notification by tracking which notifi…

6994681aby Dusty Daemon+19−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Versions: post-release updates for v26.06

This commit is a routine post-release housekeeping update. It bumps the project's version strings from the just-released v26.06 to the upcoming v26.09, updates the pull-request template deadlines, shifts the CI downgrade test to use the v2…

72244363by Níckolas Goline+10−94 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

BOLTs: update announcement_signatures and next_funding reconnect quotes

This commit updates Core Lightning's implementation of Lightning protocol (BOLT) rules for reconnecting after a channel disruption and for sending channel announcement signatures. It adds handling for newer 'splicing' scenarios—where an ex…

Protocol state machine update for channel reconnectionAdded mismatch detection for next_funding in channel_reestablishAdded force-close requirement when next_commitment_number is zero
cad409efby Níckolas Goline+25−133 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wire/splice: rename messages and TLV fields per updated BOLTs

This commit is a routine renaming and cleanup of internal Lightning protocol message names and fields to match a newer version of the BOLTs specification. It does not fix a security bug, add a security feature, or change any security-criti…

b52d5455by Níckolas Goline+143−19120 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 91 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

dualopend: fix next_funding reconnect: error if both set it, tx_abort if only peer

This commit fixes a bug in Core Lightning's channel reconnection handshake for v2 (dual-funded) channel opens. Before the fix, the code could not tell whether it had itself sent a 'next_funding' field in its own reconnection message, so it…

Protocol-state mismatch on reconnect could previously be handled as a soft abort instead of a fatal errorBOLT #2 compliance fix: both-set mismatch now triggers error/channel failureOnly-peer-set case now correctly triggers tx_abort instead of error
7fb9a29fby Níckolas Goline+67−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Tighten getblocktxn checks in parallel cb reconstruction test.

This commit only changes a Bitcoin Core functional test file. It tightens the checks in a test that verifies how nodes request missing transactions from compact blocks. There is no change to the actual Bitcoin node software, so it cannot d…

No production code modifiedTest-only changeCommit message references a future behavior change (ignoring unsolicited CMPCTBLOCK messages) but that change is not present in this diff
25457a32by David Gumberg+33−351 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: test: Static assert_highbandwidth_states

This commit is a minor code cleanup in Bitcoin Core's test suite. It moves a small helper function from inside one test method to the class level so other tests can reuse it. There is no change to the actual Bitcoin network code, no change…

44f377a7by David Gumberg+12−111 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →