We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit adds a new 'reset' command to the Trezor firmware's internal xtask build tool. It lets developers reset a connected Trezor device during development using OpenOCD, a hardware debugging tool. There is no indication this is a sec…
1e0f365dby tychovrahe+31−13 filesThis commit is a simple code cleanup in the Trezor firmware build tooling. It extracts repeated OpenOCD command construction into a single helper function, with no functional changes to what commands are run or how they behave.
7030c8e2by tychovrahe+11−301 fileThis commit adds a new helper script that lets developers check whether a signed Trezor firmware file truly matches its unsigned counterpart and whether its digital signature is valid. It is a defensive verification tool, not a fix for a s…
0cbc8f59by obrusvit+275−04 filesThis commit fixes a test-only plugin used during automated testing. It does not change production code, user-facing behavior, or any security-sensitive logic. The plugin now exits quickly when the underlying lightning daemon refuses connec…
fcb81c84by daywalker90+5−101 fileThis commit fixes flaky automated tests for the gRPC interface. It makes the test framework wait until the gRPC connection is fully ready before using it, preventing random timeouts. There is no security issue here—just a test reliability …
54c610a8by daywalker90+13−02 filesThis commit fixes a minor quality-of-life issue in an example plugin. The plugin now exits cleanly when it receives a shutdown message, instead of hanging until test cleanup forcibly kills it. It is not a security vulnerability and does no…
e33f9e3cby daywalker90+7−03 filesThis commit fixes a flaky testing bug in Core Lightning's Python test helpers. When running many tests in parallel, the old code could accidentally reuse the same network port for two different test nodes, causing test failures or weird no…
c43420deby daywalker90+45−242 filesThis commit removes support for a deprecated Bitcoin Core RPC field called `bip125-replaceable` from Eclair's internal mempool transaction model. Bitcoin Core stopped providing this field, so Eclair is updating its code to keep working wit…
cfe47a8cby Fabrice Drouin+2−72 filesThis commit adds a testing-only helper that lets developers write small Core Lightning plugins directly inside Python test files, instead of creating separate plugin files. It is purely a developer convenience for the test suite and does n…
5b7042f1by Rusty Russell+99−12 filesThis commit is a test-code cleanup. It removes 14 small helper plugin files from the test suite and rewrites the same plugin logic directly inside the test functions using an existing 'inline_plugin' helper. No production code, user-facing…
50bf9193by Rusty Russell+371−46219 filesThis commit only renames test variables (like changing 'node' to 'l1' or 'n' to 'l1') and replaces a few pairs of get_node() calls with a single get_nodes(2) call in test files. It does not change any production code, network protocol hand…
181a1e1fby Rusty Russell+181−1853 filesThis commit fixes a potential deadlock in how Lightning Dev Kit handles repeated lookups of the same short channel ID. When a custom UTXO lookup service returns the same in-flight future object for repeated requests, and a replacement chan…
dce31b72by Elias Rohrer+105−281 fileA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.