CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24873Commits captured
21194AI analyses
60High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21194 analyses
Highest risk·RSS
Low 35 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

register only transaction entries held in a wallets transactions model for confirmation updates, and unregister them on removal, history clear and tab close

This commit fixes a resource-leak bug in Sparrow Wallet's transaction list. Previously, every temporary transaction object automatically subscribed to blockchain-tip updates when it was created, and many of those temporary objects were nev…

Resource leak / listener accumulation in event busPotential stale-object memory retentionRisk of incorrect UI state updates from orphaned subscribers
58856f7dby Craig Raw+216−194 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

treat an input transaction the server cannot return as unfetched in the fee, spend, outpoint and diagram views

This commit fixes a bug in the Sparrow Wallet desktop app where, if the Bitcoin server could not return a transaction referenced by a wallet input, the app would crash or show incorrect data. The change makes the app treat such transaction…

Null-pointer-dereference crash avoided in transaction fee calculationMissing input transaction data no longer causes IllegalStateException or incorrect UI outputFee and total value labels now display 'Unknown' instead of potentially wrong computed values
d66d38dfby Craig Raw+29−85 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

show alert buttons carrying their own text in the terminal rather than failing to map them

This commit fixes a user-interface bug in Sparrow Wallet's terminal (command-line) mode. Previously, alert buttons with custom labels like 'Refresh Wallet' could not be shown correctly and were either mislabeled or failed to map. The chang…

UI misrepresentation in terminal alertsCustom action buttons previously mapped to misleading standard labelsPotential for user confusion or accidental confirmation/cancellation
fb864314by Craig Raw+58−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

release the node refresh subscription when a wallet is closed, and on a settings form that can never receive one

This change fixes a resource leak in the Sparrow Wallet desktop app. When a wallet tab was closed, a background subscription that refreshes wallet data from the connected server was not being stopped, so it could keep running and potential…

Resource leak / memory retention from undisposed RxJava subscriptionBackground subscription continues after wallet UI is closedPotential for stale wallet state or unexpected background activity after tab close
d9648404by Craig Raw+11−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

disable the terminal add account button when no accounts remain to add

This commit simply disables the 'Add Account' button in the terminal version of Sparrow Wallet when there are no accounts left to add. It is a minor user-interface improvement to prevent a user from clicking a button that would have no eff…

ba438591by Craig Raw+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 60 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

use forward slashes for the linked table test csv marker path so h2 does not strip windows separators, and assert the fixture wrote the marker before checking it was not rewritten on load

This commit fixes a unit test that was failing on Windows. The test uses an embedded H2 database feature, and Windows file paths use backslashes. H2 interprets backslashes in its connection URL as escape characters, so the test path was be…

9da43fa7by Craig Raw+3−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

name the bitcoin unit in the value, balance and fee column headings of the transactions, utxos and search results csv exports

This commit only changes the column headings in CSV export files so they include the name of the bitcoin unit being used (for example, 'Value (BTC)' or 'Value (sats)'). It is a user-experience improvement, not a security fix.

eacc62d2by Craig Raw+5−53 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

switch wallet tables and charts to btc when an open wallet on the auto unit receives 1 btc or more

This commit changes how Sparrow Wallet displays bitcoin amounts in tables and charts. When a wallet using the 'auto' unit setting receives 1 BTC or more, the app now switches the display from satoshis to BTC. This is a user-interface conve…

48034ab1by Craig Raw+8−45 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

refresh the cached bitcoin core descriptor ranges when a wallet wants a range beyond them, so a range bitcoin core has already extended is not imported again or refused

This change fixes a bookkeeping issue between the Sparrow Wallet app and Bitcoin Core. When Bitcoin Core automatically expands the set of addresses it watches for a wallet, Sparrow could get out of sync and either try to re-import descript…

Stale cache leading to incorrect descriptor import decisionsPotential address-range gap or missed transactions if descriptor extension is mishandledNo cryptographic or remote-code-execution signal in the diff
b366c7ffby Craig Raw+4−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

include unconfirmed wallet descendant fees when increasing a transaction fee, advise the replaced fees plus relay cost on rejection, and allow a cpfp child to be replaced

This commit fixes how Sparrow Wallet calculates fees when you speed up or replace a Bitcoin transaction. Previously, if your wallet had unconfirmed follow-up transactions (like a CPFP child) that depended on the transaction being replaced,…

RBF fee-bumping calculation omitted unconfirmed descendant fees, risking insufficient-fee rejectionUser-facing error message previously could understate the fee required to successfully replace a transactionCPFP child output to change address was not treated as consolidation, potentially affecting input selection during fee bump
b6c68694by Craig Raw+33−42 files
No security note in commit
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

cormorant: purge a bitcoin core wallet transaction with only mempool conflicts once it leaves the mempool

This commit tightens how Sparrow's Cormorant integration decides when a Bitcoin Core wallet transaction has been replaced or dropped from the mempool. It now also considers new 'mempool conflicts' reported by Bitcoin Core 28+, waits until …

Incorrect transaction state handling could lead to premature purge of unconfirmed transactionsDefensive fix for Bitcoin Core v28+ mempool conflict reporting behaviorRace condition addressed between listSinceBlock polling and mempool/block state changes
392c398eby Craig Raw+15−73 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6881: build(deps): bump cargo-bins/cargo-binstall from 1.20.1 to 1.21.0

This is a routine automated update by Dependabot that changes one line in a GitHub Actions workflow. It bumps the version of cargo-binstall, a helper tool used only during CI checks for semantic versioning. There is no indication this fixe…

12a14bdfby Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →