CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16920Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: fix flaky test_sql blockheight race

This commit fixes a flaky test, not a security vulnerability. The test sometimes failed because one node was slower to process newly mined blocks than the others, causing payment route expiry values to be rejected. The fix simply waits for…

4323207cby Ken Sedgwick+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Rename taproot-primitives package directory to taproot_primitives

This commit simply renames a folder from taproot-primitives to taproot_primitives to match Rust naming conventions. It does not change any code behavior, fix a bug, or address a security issue. All references to the folder path in workspac…

c59e2710by Nick Johnson+545−5458 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 50 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

extrakeys: check invariant that x-only pubkeys have even Y

This commit adds a debug-only safety check inside a Bitcoin cryptography library. It verifies that when an x-only public key (a compressed public key format that omits the Y coordinate) is saved, the internal representation has an even Y v…

Defensive invariant assertion added under VERIFY macroX-only public key parity invariant enforcedNo functional code path change in non-VERIFY builds
89a54b5aby Sebastian Falbesoner+7−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: fix flaky listchannels doc example by waiting for l3 to disable its l4 channel

This commit fixes a flaky automated test that generates documentation examples. It adds a wait so that a channel disabled by one node is consistently reflected before taking a snapshot. There is no security vulnerability or user-facing bug…

fc82dc25by Ken Sedgwick+6−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

qt: Fix `-Wsfinae-incomplete` warnings when building with GCC 16.x

This is a build-system cleanup for the Bitcoin Core graphical wallet. It silences new compiler warnings that appear with GCC 16.x by changing how Qt's meta-object compiler output is included, and it hides some wallet-only user-interface fi…

51d36dfdby Hennadii Stepanov+17−35 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.62.45 to 2.79.3

This is a routine Dependabot update that bumps a GitHub Actions helper (taiki-e/install-action) used in automated testing workflows to a newer minor version. It does not change the project's actual Bitcoin library code, its dependencies, o…

99e1381bby dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions helper used to download build artifacts in a daily fuzzing workflow. There is no code change to the rust-bitcoin library itself, and no security is…

5099d280by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that bumps the version of a GitHub-provided action used to upload security scan results. It changes only a pinned commit hash in a workflow file and does not alter the project's actual Bitco…

4460fb54by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 68 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Expose sources for pending outbound HTLCs

This commit adds extra bookkeeping information to Lightning payment records so users can tell which incoming payment caused each outgoing payment. It is a feature/enhancement change, not a fix for an active security bug. The new data is ex…

No memory-safety issues, input validation changes, or cryptographic modifications observed.New public fields expose existing internal identifiers; this is an informational API change.Serialization is backward/forward-compatible via optional upgradable TLV.
feb838daby Joost Jager+160−54 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 30 · Opaque
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

use owner only temp directory for wallet import and export

This commit changes how Sparrow Wallet handles temporary files when importing or exporting wallets. Previously, temporary wallet files were created in the system's shared temporary directory, where other users or processes on the same comp…

Creation of owner-only temporary directory for sensitive wallet import/export operationsReplacement of shared system temp file creation with isolated temp directoryUse of secureDelete for wiping temporary wallet files
d7c72678by Craig Raw+30−182 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API snapshot text files to remove a constant named GENESIS_PREVIOUS_BLOCK_HASH from the public API listing. It does not change any actual Rust source code, so it cannot introduce or fix a security vulnera…

32d0a893by Mitchell Bagot+0−123 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →