CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16911Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

tests: check exhaustive ecmult success

This is a one-line change to a test file in the secp256k1 cryptographic library. It makes an existing exhaustive test stricter by requiring a function to report success before checking its output. It does not change any production code and…

Test-only change (src/tests_exhaustive.c)Hardens assertion to require success return code before consuming cryptographic outputPrevents accidental false pass if ecmult_multi_var fails and returns point at infinity
658c7edcby Lőrinc+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): WETH wrap and deposit

This commit adds user-friendly on-screen labels for wrapping and unwrapping Ether using the popular WETH token contract on several Ethereum-like networks. It does not change transaction security rules; it only makes the device show clearer…

No security-relevant code paths modifiedNo vulnerability or bug fix described in commit message or changelogAdditive UX improvement only: clear-signing definitions and known-address labels
fdbfc031by obrusvit+192−46 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 45 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

plugins: defer spenderp awaiting-channel recovery

This change moves a startup recovery task in the 'spenderp' plugin so it runs 180 seconds after startup instead of immediately during plugin initialization. The recovery task signs unsigned PSBTs for channels that are waiting to lock in. T…

Startup blocking by a plugin could affect node availabilityDeferred recovery reduces risk of init-time denial-of-service-like stallsNo input validation, memory safety, or cryptographic changes visible
b2d3fd84by bittylicious+16−41 file
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 45 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

plugins: recover awaiting channels after init

This commit removes a 180-second startup delay before the 'spender' plugin checks for Lightning channels that were stuck waiting for a signature after a crash. The change makes recovery happen immediately at startup instead of waiting thre…

Change removes a startup-delay workaround for slow wallet signing operationsRecovery logic for unsigned PSBTs in AWAITING_LOCKIN now runs immediately at plugin initPotential denial-of-service or startup-delay side effect if many large PSBTs must be signed synchronously during init
83529491by bittylicious+1−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

2026-07-26 automated rustfmt nightly

This is an automated code-formatting commit from rustfmt. It only changes whitespace, reorders imports, and breaks a long line. There are no functional changes and no security implications.

e4dc1996by Fmt Bot+8−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 93 · Strong
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

build(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in /src/wasm_package

This is an automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.2 to 3.1.4 inside the WebAssembly packaging directory. It only changes a package-lock.json file and is marked as a development dep…

Dependency version bump of fast-uri (indirect devDependency)No changes to libwally-core native/WASM cryptographic codeNo vendor security advisory or CVE referenced in commit message
c25fc5fdby dependabot[bot]+6−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Automated update to Github CI to cargo-semver-checks version-0.49.0

This commit simply bumps the version number of a third-party CI linting tool (cargo-semver-checks) used in GitHub Actions from 0.48.0 to 0.49.0. It changes one line in a workflow configuration file and has no effect on the actual Bitcoin l…

ac2a1b1dby Update cargo-semver-checks Bot+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BT btcsuitebtcd BitcoinNode implementations

Merge pull request #2580 from Roasbeef/version-bump-v0.26.2

This commit only changes the software version number from v0.26.1-beta.rc1 to v0.26.2-beta. It does not modify any security-related code, network behavior, or user-facing functionality. There is no security issue here.

05585e03by Olaoluwa Osuntokun+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 48 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

f names in test lookups

This is a tiny code cleanup inside a test file. It renames a local variable from `pending` to `pending_resolves` and introduces a helper variable `pending_queries_for_name` to avoid repeating the same lookup expression. There is no change …

081a8e10by Matt Corallo+9−41 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Expose DNS query failure on invalid proofs or bad BIP 353 records

This commit changes how a Lightning node handles DNS proof responses for human-readable names (like BIP 353 addresses). Previously, if a DNS proof was invalid, expired, or didn't contain a usable Bitcoin offer, the code silently returned n…

Change from silent None to explicit Err failure reporting for invalid/expired DNSSEC proofsPending resolution state is now cleaned up and failed requests are surfaced when all query contexts are exhaustedValid proof with no usable BIP 353 record or BOLT 12 Offer now returns failure instead of hanging
204134c0by Matt Corallo+102−571 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

f note that only one resolution will fail at a time

This commit only adds two explanatory comments to the code. It does not change any program behavior, fix any bug, or alter any logic. The comments clarify that although the code is written to handle multiple failed DNS resolutions at once,…

a2fe23f5by Matt Corallo+6−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →