CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24806Commits captured
21167AI analyses
62High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21167 analyses
Highest risk·RSS
Low 45 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/bootloader): keep the full block length for block-0 retries

This commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the …

Firmware update reliability bug in bootloaderBlock-0 retry path truncated data before hash verificationHash mismatch caused by buffer offset/size mismatch, not by attacker
dc937ba2by tychovrahe+81−711 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/bootloader): separate image upload and image checks

This commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c,…

Refactor only: logic moved, not changed in security-relevant waysSame signature/version/model/downgrade checks remain in firmware-specific handlerSame flash erase/write sequence preserved in generic engine
caab7d9eby tychovrahe+772−4834 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnrpc: regenerate protos with Go 1.27

This commit is a housekeeping change that regenerates automatically generated RPC binding files using a newer Go compiler version. The only differences are in code comments (doc-comment formatting), not in actual program logic or API behav…

dd523108by ziggie+4501−369826 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 100 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: fix Go 1.27 compatibility

This commit is a routine build-and-test maintenance patch to make the LND codebase compile and pass tests with the upcoming Go 1.27 release. It upgrades the project's custom linter tool, refreshes many indirect tool dependencies, adjusts o…

No production code changesNo vulnerability fix or CVE reference presentDependency-only refresh in tools module (development tooling)
6b54a387by ziggie+365−3706 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/eckhart): remove flow_request_number

This is a user-interface code cleanup for the Trezor hardware wallet. It removes a custom multi-page flow for entering a number and replaces it with a simpler, shared number-input screen that uses the device's standard external menu for 'm…

No security-relevant signals detected in the diff.Change is a pure UI refactor with no cryptographic, parsing, or authorization logic changes.Atomic variable `NUM_DISPLAYED` used for cross-page state is removed, reducing shared-mutable-state surface area.
aa91d840by obrusvit+121−3369 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Bump ledger_bitcoin_client version to 0.7.0

This commit only updates a version number from 0.6.2 to 0.7.0 in two Rust package files. It is a routine bookkeeping change because the public interface of the PSBT module changed, requiring a minor version bump under semantic versioning r…

cfb530b9by Salvatore Ingala+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove unused trezor_lib/ui feature

This commit removes an unused Rust Cargo feature flag called 'ui' from the Trezor firmware build configuration. It is a cleanup change: the feature was always enabled in practice, so the code now compiles unconditionally. There is no secur…

1436fbc6by cepetr+2−158 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): enable Tropic FW update

This commit adds the ability for the Trezor T3W1 hardware wallet to automatically update the firmware of its Tropic secure chip during normal use. The update is triggered after the user unlocks the device with their PIN, which is intended …

New privileged firmware update path added to production boot flowMaintenance bit enablement gated by PIN unlock (`storage_is_unlocked`)Update state machine distinguishes UNFINISHED/OUTDATED/UP_TO_DATE/ERROR
54e2bfe9by Martin Pastyřík+1533−23339 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

js tests: drop a bogus required height locktime of 0 from test PSBTs

This commit only changes hardcoded test data used in JavaScript unit tests. It removes an invalid zero-value locktime field from two PSBT (Partially Signed Bitcoin Transaction) test fixtures so they conform to the BIP-370 standard. No prod…

ec992074by Salvatore Ingala+6−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add `alloc` support for Miniscript

This commit adds a new memory allocator for the Miniscript feature in Trezor firmware. It routes Rust memory allocations through MicroPython's existing 'tracked allocator' so memory can be freed explicitly instead of waiting for garbage co…

Memory allocator change in security-critical hardware wallet firmwareOOM path explicitly panics (RSOD) rather than failing gracefullyAlignment requirement is not guaranteed by underlying allocator; checked with ensure! in debug builds only
6ab39e95by Roman Zeyde+76−111 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 36 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

fix confirm (#7570)

This commit adds a missing safety check in the API key authorization flow. Previously, if a user clicked a 'confirm' action for an API key that no longer existed, the code would try to use a null (non-existent) key object, which could caus…

Null dereference / NullReferenceException preventedMissing validation of repository return valueUser-facing authorization flow hardening
bd7f91e2by monasco+9−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →