CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18285Commits captured
17497AI analyses
106High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17497 analyses
Highest risk·RSS
Informational 17 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Remove bad include directive with CFLAGS

This commit removes a leftover debugging include from the build and adds a missing standard header to one source file. It is a cleanup/fix for build hygiene, not a security patch for an exploitable vulnerability. There is no evidence in th…

No security-relevant signal in diffBuild hygiene cleanup onlyMissing standard header fixed
704b361aby Charles-Edouard de la Vergne+2−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
ER electrselectrs BitcoinIndexing infrastructureSoftware wallets

Bump serde_json from 1.0.149 to 1.0.150

This is an automated dependency update by Dependabot that bumps the serde_json library from version 1.0.149 to 1.0.150. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication …

ca254cb5by dependabot[bot]+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
ER electrselectrs BitcoinIndexing infrastructureSoftware wallets

Bump bytes from 1.11.0 to 1.11.1

This is a routine automated dependency update by Dependabot, bumping the Rust 'bytes' library from version 1.11.0 to 1.11.1. Only the Cargo.lock file changed. There is no indication in the commit of any security fix, bug fix, or behavior c…

d889624fby dependabot[bot]+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 88 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

Update outdated BOLT quotes common/bolt11.c: Some BOLT quotes had changed slightly. run-bolt11.c: A test was updated to reflect nomenclature changes (from `signature recovery` to `public-key recovery`).

This commit only changes wording: it renames an internal error message from 'signature recovery failed' to 'public-key recovery failed' to match updated BOLT specification terminology. No program logic, cryptography, or behavior changes.

b0e72857by Níckolas Goline+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

Update outdated BOLT quotes bolt12.c: - quote update on `bolt12_chains_match`; - add a new condition to `offer_decode` to check if the amount is greater than 0;

This commit only changes test files and BOLT specification comment quotes. It updates test expectations and comment text to match a newer version of the BOLT #12 standard, but does not change any production code that validates offer amount…

1a58dd3cby Níckolas Goline+6−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Update outdated BOLT quotes in several files. update BOLT quotes that drifted from the current spec without changing the meaning or expected functionality.

This commit only fixes formatting and wording in code comments that quote the BOLT specification. No actual program logic, behavior, or security checks were changed. It is not a security fix.

35d6dd6bby Níckolas Goline+5−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

gossmap_manage.c: update BOLT quote and logic to wait for 72 blocks instead of 12 blocks before forgetting a channel.

This commit only adjusts a test file to match an already-implemented change in how long Core Lightning waits before forgetting a closed channel (72 blocks instead of 12). The actual logic change happened elsewhere; this is a test-only fix …

80f2ac64by Níckolas Goline+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Update BOLT quotes for channel open flow. The TLV `channel_type` is now mandatory. The code was correct but the quote was not.

This commit only fixes whitespace formatting in a comment that quotes the BOLT protocol specification. No actual code behavior changed. The surrounding C code that sets the channel_type value was already correct and is untouched.

b9dc9919by Níckolas Goline+6−61 file
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

Fix tests for bolt12-decode. new cases added by autogenerated mocks after updating the default BOLT spec version.

This commit fixes two validation checks in Core Lightning's code for handling BOLT12 offers and Bech32-encoded data. One fix prevents an offer from claiming it supports zero blockchains, which could confuse or misroute payments. The other …

Input validation hardening for BOLT12 offer parsingBech32 padding-bit validation added to charset decoderRejection of zero-length `offer_chains` TLV
d218756eby Níckolas Goline+34−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

Update tests after changing deadline from `blockheight + 12` to `blockheight + 72` blocks.

This commit only updates test numbers to match a previously made code change that extended a timeout/deadline from 12 blocks to 72 blocks. It does not change any production code, so it cannot directly affect real users or introduce a secur…

4a0538a1by Níckolas Goline+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

Update BOLT quote for `channel_ready` re-transmission guards.

This commit tightens the rules for when a Core Lightning node resends a 'channel_ready' message after a peer reconnects during a splice (a way to resize a Lightning channel). Previously, the node would retransmit channel_ready whenever bot…

Protocol conformance fix for BOLT #2 channel_ready retransmissionSplice-related state machine guard added to peer reconnect pathTest assertion added to prevent regression of retransmission during splice
878ecdb2by Níckolas Goline+17−52 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

channeld.c: update logic for retransmitting channel_ready Extracted logic from if clause to variable for readability, and add extra checks to make sure a splice is active

This change adjusts when Core Lightning re-sends a 'channel_ready' message after a peer reconnects. It adds an extra check to avoid retransmitting the message if a splice (a way to resize a Lightning channel) is active. The commit is frame…

Logic change around retransmission of channel_ready during peer reconnectionNew condition checks received TLV funding_locked txid against current funding txidSplice-related state now gates channel_ready retransmission
204240c2by Níckolas Goline+12−41 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →