We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit is a routine dependency update for the project's fuzz testing setup. It bumps the version of the 'bitcoin' crate used in fuzz tests from 0.32.101 to 0.32.102 and updates the corresponding lock files. There are no code changes t…
d75c8544by yancy+8−233 filesThis commit only adds a new unit test. It does not change any production code, so it cannot by itself introduce or fix a security vulnerability. The test verifies that an invalid 'sendcmpct' network message (with a mode byte other than 0 o…
e99b8e4fby Abeeujah+16−01 fileThis change fixes a serialization bug in how the rust-bitcoin library handles a Bitcoin peer-to-peer message called `sendcmpct`. Previously, if a malformed or unusual message arrived with a mode value other than 0 or 1, the library would s…
b7c35effby yancy+44−81 fileThis is a one-line bug fix for a NullPointerException (NPE) that occurs when comparing an unresolved silent payment output. A silent payment is a newer Bitcoin privacy feature that lets someone receive payments without publicly revealing t…
d8e7b54cby Craig Raw+1−11 fileThis commit tightens how Sparrow Wallet checks that a scanned QR code or loaded file matches the transaction the user is currently working on. Previously, the app only compared the new transaction/PSBT against the single currently open tab…
078af174by Craig Raw+66−234 filesThis commit adds a test that checks whether Core Lightning stops trying to replace (RBF) a penalty transaction once a replacement version has already been confirmed on the blockchain. The test documents a bug where the node would keep firi…
3e0f48e1by enaples+71−01 fileThis fix resolves a bug where Core Lightning would keep trying to replace a transaction with a higher-fee version forever, even after the replacement had already been confirmed on the Bitcoin blockchain. The loop happened because the code …
15a66cbcby enaples+7−21 fileThis commit fixes a bug in the Keystone 3 hardware wallet's Zcash support: when a user changed their login password, the encrypted Zcash 'unified full viewing key' (UFVK) was not re-encrypted with the new password. That meant the stored UF…
6d8e2d9dby aaron+137−464 filesThis is a code cleanup (refactor) in Trezor's Ethereum transaction signing. It merges two internal steps into one so that transaction data is streamed, hashed, and shown to the user in a single pass instead of two. The commit message says …
ca9c3cafby Roman Zeyde+266−2564 filesThis commit adds a safety check in the Sparrow Wallet desktop app to make sure a transaction loaded from a file or scanned from a QR code actually matches the PSBT (a partially-signed Bitcoin transaction) that was already open. Before this…
4b8a4594by Craig Raw+64−284 filesThis commit updates Trezor's Bluetooth firmware build system so it can compile against two different Nordic SDK versions (an older 2.9 and a newer 3.3). It adds version checks, pins the correct compiler toolchain, and renames a few Bluetoo…
253c4f87by tychovrahe+248−2210 filesThis commit is a code cleanup that changes the way some Python test helper functions are written so that a linting tool (Ruff) can enforce a style rule. It does not change what the software does, only how the test code is formatted. There …
6eca1117by will+56−3010 filesA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.