CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16866Commits captured
15462AI analyses
79High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

15461 analyses
Highest risk·RSS
Informational 20 AI analysisMessage 98 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: turn linux/win linker warnings into errors

This commit changes Bitcoin Core's build scripts so that linker warnings are treated as fatal errors during Linux and Windows release builds. It is a hardening of the build process, not a fix for a user-facing security bug. The change make…

Build hardening: linker warnings promoted to errorsExclusion for riscv64-linux-gnu references upstream Boost issueNo runtime, consensus, or cryptographic code changed
b12a70f3by fanquake+8−23 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: consolidate LLVM toolchain setup

This commit is a straightforward cleanup of Bitcoin Core's macOS build scripts. It moves repeated LLVM/clang toolchain setup code from two separate scripts into a single shared function, with no change to the actual commands or build behav…

cc9b0f22by fanquake+20−303 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: consolidate mingw-w64 toolchain setup

This commit is a straightforward cleanup of Bitcoin Core's Windows build scripts. It moves duplicated toolchain setup code into a shared helper function, with no functional changes visible in the diff. There is no indication this affects r…

288f76edby fanquake+35−523 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: consolidate gcc toolchain setup

This commit is a routine cleanup of the Bitcoin Core build scripts used for Guix (a reproducible build system). It moves duplicated GCC toolchain setup code from two separate files into a single shared function in setup.sh, with no functio…

665f11d0by fanquake+35−523 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: consolidate config flags

This commit is a housekeeping change to Bitcoin Core's Guix build scripts. It only reorders and consolidates CMake configuration flags, and adds a couple of disabled test/build options. There is no change to the actual Bitcoin software cod…

683ae4c5by fanquake+16−146 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 53 · Thin
AQ ACINQEclair BitcoinLightning Network

Eclair v0.14.1 release (#3338)

This commit is the packaging of Eclair v0.14.1. It mostly changes version numbers and release notes, plus two operational tweaks: it turns off Maven's trusted-checksum post-processor and removes a startup guard that previously refused to r…

Release notes explicitly warn that custom Bolt12 offer-handler plugins setting feeOverride_opt put the node 'at risk' (#3332).Startup safety guard removed: Boot.scala no longer requires eclair.allow-unsafe-startup=true to run.Maven trusted-checksum post-processor disabled (Daether.artifactResolver.postProcessor.trustedChecksums=false).
d769db07by Bastien Teinturier+85−869 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 71 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

Remove deprecated `secp256k1_context_no_precomp` pointer

This commit removes an old, renamed pointer called secp256k1_context_no_precomp from the secp256k1 cryptographic library. It had been marked as deprecated for over three years and was only an alias for the newer secp256k1_context_static. T…

Removal of a deprecated public API symbolNo change to cryptographic logic, memory handling, or context semanticsPotential downstream build breakage for consumers still using the deprecated alias
bf435856by Sebastian Falbesoner+1−84 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/bootloader): correct "Change FW vendor" title

This commit changes a single on-screen label in the Trezor bootloader from lowercase 'Change fw vendor' to uppercase 'Change FW vendor'. It is purely a cosmetic wording fix with no security relevance.

5f756282by Roman Zeyde+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 3 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(vendor): restore vendor/ts-tvl to version 2.5

This commit simply bumps a local vendor package called 'ts-tvl' from version 2.4 to 2.5 in a Python lock file. There is no code change shown, no description of any security issue, and no supplied references indicating this is a security fi…

a54e2783by Martin Milata+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): calldata array support

This commit adds support in Trezor's Ethereum clear-signing feature for transactions that contain multiple embedded subcalls (like a multicall). Previously, only a single embedded call could be clearly displayed. The change lets the device…

New input validation added: callee array length must match subcall array lengthType validation enforced: each subcall blob must be bytes, each callee must be a 20-byte addressGraceful degradation preserved: unparseable subcalls fall back to raw hex display rather than failing the whole transaction
0feb0b96by PrisionMike+186−162 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(clear signing): multiple calldata

This commit only adds new automated tests for Trezor's Ethereum 'clear signing' feature. It includes a test case for an Aave multi-call transaction, a matching test data blob, and expected screen snapshots for different device models and l…

0de94b8aby PrisionMike+46−64 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): sync Crowdin translations

This commit only updates translated text strings in five language files and refreshes the translation signature metadata. There are no code, logic, or security-related changes.

c6040ab4by Michal Kazda+274−1346 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →