We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit only adds a new automated fuzz test for an existing Bitcoin Core feature called private transaction broadcast. It does not change any production code that runs on the network, so it cannot by itself introduce a security vulnera…
2ee4fafaby kevkevinpal+212−53 filesThis change adds a safety check inside Bitcoin Core's private transaction-broadcast feature. It prevents the same node from being chosen more than once to receive different transactions, because doing so could let that node figure out whic…
08b7c61fby Vasil Dimov+8−12 filesThis is a routine code cleanup in the xpay plugin. Two nearly identical functions that handle successful 'pre-approval' responses for invoice and keysend payments were merged into one shared function. There is no change in behavior, no bug…
fdb6df88by Lagrang3+6−251 fileThis change adjusts when the xpay plugin cleans up old routing data. Previously, cleanup ran on a 60-second timer, which could fail during shutdown and cause test flakiness. Now cleanup happens right before each payment is routed. The patc…
9e8f4ffdby Lagrang3+19−231 fileThis is a small fix to a developer linting tool that checks whether automated 'scripted-diff' commits actually run their embedded scripts. Previously, if the script itself failed, the check could still report success because the success/fa…
2a36d6a5by Hodlinator+1−11 fileThis commit adds a new regression test for the LSPS2 (Lightning Service Provider Specification 2) feature in rust-lightning. It checks that if a node crashes and restarts, replaying the same intercepted payment event does not cause the ser…
68e71c2fby tnull+48−01 fileThis commit adds cleanup logic for a Lightning Service Provider (LSP) feature called LSPS2 Just-In-Time (JIT) channels. When a JIT channel closes, the service now deletes leftover internal tracking entries instead of keeping them forever i…
bab66f62by tnull+146−02 filesThis commit fixes a build-configuration problem in Ledger's Bitcoin app. Two source files now explicitly include the SDK header that defines TARGET_* constants (such as TARGET_NANOX, TARGET_STAX, TARGET_FLEX), and the build adds the correc…
56299efaby Ilya Artemov+9−03 filesThis change fixes a crash and duplicate-queue bug in the Lightning Dev Kit's LSPS2 payment queue. After a restart, previously seen intercepted HTLCs can be replayed; the old code would panic (in debug builds) or add duplicates, while the n…
6997c888by tnull+25−81 fileThis commit changes the SMTP port used by a GitHub Actions workflow from 587 to 465 when sending automated emails about reproducible-build errors. Port 465 is the standard port for SMTP-over-SSL/TLS, while port 587 is typically used with S…
c779e165by daywalker90+1−11 fileThis commit fixes a bug in btcd's test-network synchronization logic. A previous change accidentally allowed light clients (such as Neutrino wallets) to be chosen as sync peers on regtest/simnet. Because light clients advertise a recent bl…
a7e980ddby Oli+55−442 filesThis commit is a routine cleanup of compiler feature checks in the secp256k1 cryptographic library. It replaces a custom version-check macro with a simpler check for whether the compiler is GCC (or claims to be GCC, like Clang). The change…
09870e9cby copilot-swe-agent[bot]+10−102 filesA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.