CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18178Commits captured
17450AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17450 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

flake: test_no_delay: reduce expected_saving threshold to fix probe variance

This commit only adjusts a threshold inside a single automated test. It makes a timing assertion more lenient so that random network-measurement noise does not cause false test failures. There is no change to production code, no user-facin…

31741645by Níckolas Goline+4−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 67 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: announce field must be 0 or 1 in sendcmpct

This commit adds a new test to Bitcoin Core's functional test suite. The test verifies that if a peer sends a 'sendcmpct' message with an invalid 'announce' value (anything other than 0 or 1), the node logs an error and disconnects that pe…

Tests protocol-mandated rejection of malformed P2P message fieldVerifies peer disconnection on invalid boolean-like field valueReferences BIP152 specification requirement
abc33ff0by brunoerg+13−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Add missing test case for getdata requests from blocks-only peers

This commit only adds a new test case to Bitcoin Core's test suite. It verifies that a block-relay-only peer cannot request transaction data via getdata messages. There is no change to production code, no bug fix, and no security patch.

278710a8by Roqqit+11−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Remove now-redundant PaymentParameters params

This is a routine internal code cleanup in the Lightning Dev Kit's payment-sending logic. It removes a now-unnecessary duplicate argument from a few private functions because the same information is already stored inside the Route object. …

d5d502a9by Valentine Wallace+11−121 file
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 58 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Require Route::route_params

This commit makes a piece of routing data called route_params mandatory in the Lightning Dev Kit library. Previously it was optional, and the code would silently invent a dummy value if it was missing. Now it must always be provided, and o…

API hardening: removes silent fallback to dummy RouteParametersBackwards-compatibility break for pre-0.0.117 serialized Route objectsNo new bounds checks, cryptographic operations, or network parsing changes
41f0809aby Valentine Wallace+229−25213 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Rustfmt send_payment_with_route

This commit is purely a formatting cleanup: it removes a 'skip rustfmt' marker and re-indents a function so the code is easier to read. No behavior, logic, or security properties of the payment-sending code were changed.

e90ab9d2by Valentine Wallace+33−121 file
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net_processing: fix BIP152 first integer interpretation

This change tightens how Bitcoin Core handles a compact-blocks handshake message. The old code read a small number from the network and treated any non-zero value as 'true'; the new code rejects values other than 0 or 1. This prevents a pe…

Protocol field validation gap closedBIP152 specification non-compliance in deserializerPotential state inconsistency between bool interpretation and explicit 0/1 expectation
2d0dce0aby brunoerg+8−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

argsman: allow duplicate registration between HIDDEN and other categories

This commit fixes a bug where Bitcoin Core's graphical wallet (bitcoin-qt) would crash immediately on startup. The crash was caused by an overly strict internal safety check that treated a normal, intentional code pattern as a duplicate-se…

Fixes a regression causing a denial-of-service-like startup crash in bitcoin-qtChange is a relaxation of an internal assertion, not a memory-safety or cryptographic fixNo input-dependent behavior change; crash was deterministic on affected builds
f963f2b6by Pablo Martin+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BT btcsuitebtcd BitcoinNode implementations

rpcclient: add typed SubmitPackage method

This commit adds a new client-side method called SubmitPackage to btcd's RPC client. It does not change any server-side code, mempool logic, or consensus rules. It simply lets programs ask a Bitcoin Core node (version 24+) to submit a grou…

No server-side handler added; only RPC client wrapperInput validation limits transaction count to 1-25Backend version gating prevents calls to unsupported backends
de3d460eby Elle Mouton+122−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 80 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fix invalid dummy pubkey in send_to_route

This commit fixes a programming bug in rust-lightning's send_to_route function. When a user supplied a payment route with no paths or an empty first path, the code tried to create a fallback 'dummy' public key using 32 bytes of data, but p…

panic due to invalid public-key byte lengthdenial-of-service via malformed route inputunwrap on fallible public-key parsing
54cdd85fby Valentine Wallace+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core,secmon): release version bump to 2.12.2 and 1.0.12

This commit is a routine version bump for a Trezor firmware release. It only changes version numbers in header files and translation metadata, plus updates the signed translation package reference. There are no code changes that affect sec…

d621b2e1by PrisionMike+11−119 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/xtask): add `"ui_debug_overlay"` feature on debug builds

This commit fixes a build configuration issue so that debug builds of Trezor firmware, bootloader, and production-test firmware automatically enable a visual 'ui_debug_overlay' feature. That feature displays a small red square marker in th…

No security-relevant code changedChange is purely a debug UI indicatorNo changelog entry requested by vendor
dcb779afby Roman Zeyde+4−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →