CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24879Commits captured
21196AI analyses
59High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21196 analyses
Highest risk·RSS
Informational 18 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

hide the gap limit and request a birth date for a silent payments wallet in the terminal

This commit tweaks the terminal (command-line) version of Sparrow Wallet. For a new type of wallet called a 'silent payments' wallet, it hides the 'gap limit' setting (which doesn't apply) and asks the user for the wallet's creation date w…

b43f24f9by Craig Raw+52−152 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

hide account discovery on a silent payments wallet

This commit simply hides the 'Discover' button when adding an account to a Silent Payments wallet. It is a UI change, not a fix for a vulnerability. There is no evidence of a security bug being patched.

No security signals present in the diffUI-only change hiding a button for a specific wallet policy type
4ee9a4a7by Craig Raw+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

explicitly reject a psbt signed over silent payment outputs that have not been computed

This commit updates a submodule called 'drongo' inside the Sparrow Wallet project. The title says it now explicitly rejects a partially-signed Bitcoin transaction (PSBT) if it has been signed over silent payment outputs that were not actua…

Silent payment output validation bypassPSBT signature over uncomputed outputsSubmodule-only change obscures full patch
6fcdc88bby Craig Raw+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#34914: contrib: replace deprecated --deep codesign flag, fix accidental --verify skip on ci

This change fixes how Bitcoin Core's macOS app bundle is digitally signed during automated builds. It replaces an outdated 'deep' signing method with explicit signing of each framework, plugin, and the main app bundle. It also fixes a CI s…

Fixes accidental skip of macOS code-signature verification in CIReplaces deprecated codesign --deep with explicit per-component signingAdds --strict to CI signature verification
8c64ff02by merge-script+18−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36196: contrib, kernel: fixed seeds, chainparams, headerssync params, and assumeutxo updates pre-32.0

This is a routine Bitcoin Core release-maintenance commit. It refreshes the list of network seed nodes, updates the built-in checkpoints that tell the software how much blockchain history to trust by default, adds newer 'assumeutxo' snapsh…

Hard-coded network seeds changed (expected release-process refresh)minimumChainWork/defaultAssumeValid checkpoints advanced (expected release-process refresh)New assumeutxo snapshots added (expected release-process refresh)
501ba4caby merge-script+3955−38748 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36213: Release: 32.0 translations update

This commit is a routine update of translated user-interface text for the Bitcoin Core Qt (graphical) wallet in preparation for the 32.0 release. It adds, removes, and reorders translated strings in many language files, and registers one n…

92986c73by merge-script+151596−159371103 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Harden PSBTv2 parsing

This commit tightens how COLDCARD reads PSBTv2 (Partially Signed Bitcoin Transaction version 2) files. It now rejects several malformed or ambiguous encodings that could previously be accepted: extra key data attached to fields that should…

PSBT parser hardeningrejection of non-canonical compact-size encodingsenforcement of singleton key-data emptiness
5e0dbd0eby scgbckbone+90−113 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(solana): confirm space when creating accounts

This commit adds an on-screen confirmation step for the 'space' (data size) parameter when creating new Solana accounts on a Trezor device. Previously, this parameter was hidden from the user during Create Account instructions, even though…

UI confirmation of previously hidden transaction parameterParameter 'space' controls rent-exempt deposit and storage allocationChangelog describes change as confirming non-zero space allocation
04ed8330by Jakub Janků+25−24 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

hold silent payment notifications arriving before the subscribe response is recorded, discarding those of a replaced subscription

This commit fixes a race condition in Sparrow Wallet's silent-payments scanning. When the wallet subscribes to a server to scan for silent payments, the server's first notification can arrive before the wallet has finished recording the su…

Race condition between subscribe RPC response and asynchronous silent-payment notificationsPossible indefinite wait / scan hang from dropped completion notificationPossible application of stale/replaced-subscription history leading to incorrect wallet state
7ae8ee95by Craig Raw+412−295 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

docs: document missing and fix erroneous JSON-RPC error codes

This commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…

Documentation-only change with no executable code modificationsCorrects RPC schema error-code metadata to match actual handler behaviorNo change to input parsing, authorization, cryptography, or network behavior
d1b6963bby daywalker90+204−1224 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

Merge bitcoin-core/secp256k1#1918: refactor: split `ge_parse` into explicit variants (compressed, uncompressed, uncompressed+hybrid)

This commit is a code cleanup (refactor) that splits one internal public-key parsing helper into three clearly named versions. It does not change what keys the public API accepts or rejects, and it adds more tests. There is no security vul…

Refactor only: no change to accepted public-key formats or validation rulesPublic API behavior preserved: 33-byte compressed and 65-byte uncompressed/hybrid still acceptedInternal fixed-size callers now use size-specific parser, reducing risk of accidental hybrid acceptance in future code
46db7871by merge-script+117−346 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 35 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Fix rust toolchain extraction

This is a one-line shell script fix that changes how the build script reads the required Rust compiler version from a configuration file. The old method could fail to extract the version correctly in some cases, potentially causing a build…

Build script robustness fixToolchain version extraction reliabilityReproducible build script change
0e83d894by Keeqler+1−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →