BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

2876 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

252security candidates603second-pass queue1022AI analyses
206commits · 30 days
491commits · 60 days
1521commits · 180 days
2876commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
915Strong · 80–100
1187Adequate · 60–79
686Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot2248170
Ava Chow15649127064
MarcoFalke40621105074
Lőrinc1772169081
fanquake2271960057
Hennadii Stepanov2081443063
rkrux57944074
Sjors Provoost89824074
Sebastian Falbesoner33717073
David Gumberg55638072
Pieter Wuille95518066
Hodlinator66520076
Analysis record

Published AI watches

Last scanned 35 minutes ago

Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

This is a code cleanup change that turns on a static-analysis rule to prevent a specific C++ coding pattern (anonymous namespaces in header files) and updates two headers to comply. It does not change how Bitcoin Core behaves at runtime an…

No security-relevant code changeNo memory safety, cryptography, consensus, or network changesTooling-only refactor (clang-tidy configuration)
c4fbd3c7by merge-script+9−123 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

This commit only adds new test cases to Bitcoin Core's functional test suite. It does not change any production wallet, node, or RPC code. The tests verify that the importdescriptors RPC reports errors in the right order, rejects bad times…

465196d0by merge-script+77−11 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35180: coins: group private cache helpers

This change is purely a code cleanup: it moves two internal helper functions of a Bitcoin Core cache class into the private section of the class and removes a duplicate 'private:' label. There is no change to what the code does, no bug fix…

c940fd75by merge-script+13−141 file
No security note in commit
Low 29 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

This Bitcoin Core change tightens how three RPC commands (scantxoutset, scanblocks, deriveaddresses) handle the value null when it is passed for optional parameters. Previously, explicitly passing null could be treated differently from sim…

RPC parameter validation changeNull value handling changeAddition of explicit error checks for missing required contextual parameters
3db96eb5by merge-script+18−75 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable misc-definitions-in-headers

This commit is a code cleanup: it turns on a clang-tidy style check called 'misc-definitions-in-headers' and suppresses that check around a large inline implementation block in a benchmark header. There is no change to Bitcoin's runtime be…

fa93132dby MarcoFalke+3−02 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable clang-tidy rule to reject anon namespace in header

This commit only changes a linting configuration file for the project's code style checker. It enables a rule that prevents anonymous namespaces from being used in header files, which is a code-quality and build-hygiene practice. There is …

No security-relevant signals in the diff or commit message.Change is purely a static-analysis/linting configuration update.
fa5ca877by MarcoFalke+2−11 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use C++20 std::identity over IntIdentity

This commit is a straightforward code cleanup: it replaces a small custom helper named IntIdentity with the standard C++20 std::identity from the <functional> header. The behavior of the ConvertBits function is unchanged; only the implemen…

fafe5042by MarcoFalke+4−111 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test the result order of a multiple import request is correct

This commit only adds a new automated test to Bitcoin Core. It checks that when a user asks the wallet to import multiple descriptors at once, the list of results comes back in the same order as the original request, including any error me…

3ac8b806by Pol Espinasa+40−01 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test invalid or missing timestamp throws importdescriptors

This commit only adds new automated tests for the Bitcoin Core wallet's importdescriptors RPC. It checks that the command correctly rejects requests with a missing or invalid timestamp. No production wallet code is changed, so this cannot …

No changes to consensus, networking, wallet logic, or cryptographyOnly functional test code is modifiedAdded assertions are for expected error handling paths
e4732bf0by Pol Espinasa+28−11 file
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Remove unused #include in common/system

This is a minor code cleanup that removes one unused header file include and swaps another for a more specific one. It does not change any program behavior or fix any security issue.

fa7304f3by MarcoFalke+1−22 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

iwyu: Fix warnings in `src/consensus` and treat them as errors

This commit is a routine code cleanup: it adjusts which C++ header files are included in several consensus-related source files and turns on a stricter compiler hygiene check (Include What You Use, or IWYU) for the src/consensus directory.…

13b53f8bby Hennadii Stepanov+42−79 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: don't connman.ReceiveMsgFrom oversized msg

This is a small fix to a Bitcoin Core fuzz test (an automated internal testing harness), not to the live network code. The fuzzer was sometimes creating fake P2P messages larger than the real protocol allows and passing them into a test he…

Test-only fuzz harness hardeningOversized message guard added before ReceiveMsgFrom() in fuzz targetNo change to production P2P message acceptance logic
bb19f1daby Greg Sanders+5−01 file
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

kernel, node: colocate dbcache bounds

This commit is a small code cleanup: it moves two constants that define the minimum and maximum size of the database cache (dbcache) into a shared kernel header so that both the node and kernel code use the same limits. There is no change …

8aa21e11by Lőrinc+7−74 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci, iwyu: Enforce warning-free `src/common`

This is a routine code cleanup commit. It adjusts which C++ header files are included in the `src/common` part of Bitcoin Core so that an automated tool called Include What You Use (IWYU) reports no warnings. It also tells the continuous i…

50145f62by Hennadii Stepanov+75−3822 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: Rework rpc fuzz target

This commit rewrites an internal fuzz-testing harness for Bitcoin Core's RPC interface. It changes how fake RPC arguments are generated so the test can feed more realistic JSON data (numbers, booleans, nested arrays/objects, raw JSON) dire…

No changes to runtime consensus, networking, wallet, or RPC server logicOnly src/test/fuzz/rpc.cpp is modifiedChange improves fuzzer fidelity by removing RPCConvertValues string-to-JSON conversion
fa895bb7by MarcoFalke+64−481 file
No security note in commit
Informational 20 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Remove meaningless bool fallback in FundTransaction

This commit removes an old backward-compatibility feature in Bitcoin Core's wallet RPC command `fundrawtransaction`. Previously, callers could pass a plain `true` or `false` as the second argument, which was silently ignored. Now, passing …

Removal of a no-op backward-compatibility code path that silently accepted arbitrary boolean valuesStricter RPC input validation: bare booleans now rejected with a JSON type errorNo memory safety, cryptographic, or consensus changes observed
fa7fe798by MarcoFalke+60−652 files
No security note in commit
Informational 15 AI analysisMessage 35 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: consolidate config flags

This commit is a housekeeping change to Bitcoin Core's Guix build scripts. It only reorders and consolidates CMake configuration flags, and adds a couple of disabled test/build options. There is no change to the actual Bitcoin software cod…

683ae4c5by fanquake+16−146 files
No security note in commit
Informational 17 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

gui: Menu action for exporting a watchonly wallet

This commit adds a new menu item in the Bitcoin Core desktop wallet that lets users export a 'watch-only' copy of their wallet. A watch-only wallet can see transactions and balances but cannot spend funds. The change only wires up an exist…

No security-relevant signals detected in the diffNew GUI feature exposing existing wallet export functionalityAction is disabled for wallets with private keys disabled
cb51f97fby Ava Chow+30−04 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityAdd helper methods to HTTPRequest to match original APIby Matthew Zipkin · f946ff5a · Jun 22, 2026 · 3 filesMessage 65 · AdequateTriage 0Details
Commit message · Matthew Zipkin

Add helper methods to HTTPRequest to match original API

These methods are called by http_request_cb() and are present in the
original http_libevent::HTTPRequest.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityrefactor: split http_request_cb into libevent callback and dispatchby Matthew Zipkin · fec6b6bc · Jun 22, 2026 · 1 fileMessage 85 · StrongTriage 0Details
Commit message · Matthew Zipkin

refactor: split http_request_cb into libevent callback and dispatch

The original function is passed to libevent as a callback when HTTP
requests are received and processed. It wrapped the libevent request
object in a http_libevent::HTTPRequest and then handed that off to
bitcoin for basic checks and finally dispatch to worker threads.

In this commit we split the function after the
http_libevent::HTTPRequest is created, and pass that object to a new
function that maintains the logic of checking and dispatching.

This will be the merge point for http_libevent and http_bitcoin,
where HTTPRequest objects from either namespace have the same
downstream lifecycle.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Lower-priorityHTTPServer: implement control methods to match legacy APIby Matthew Zipkin · e5f242ee · Jun 22, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Matthew Zipkin

HTTPServer: implement control methods to match legacy API

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityHTTPServer: disconnect after idle timeout (-rpcservertimeout)by Matthew Zipkin · cbb8d1fb · Jun 22, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Matthew Zipkin

HTTPServer: disconnect after idle timeout (-rpcservertimeout)

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityhttp: switch servers from libevent to bitcoinby Matthew Zipkin · 21c7542c · Jun 22, 2026 · 8 filesMessage 45 · ThinTriage 0Details
Commit message · Matthew Zipkin

http: switch servers from libevent to bitcoin

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityfuzz: switch http_libevent::HTTPRequest to http_bitcoin::HTTPRequestby Matthew Zipkin · e427c227 · Jun 22, 2026 · 1 fileMessage 60 · AdequateInformational 18Details
Commit message · Matthew Zipkin

fuzz: switch http_libevent::HTTPRequest to http_bitcoin::HTTPRequest

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 18/100

This commit updates a fuzz test—a special automated test that feeds random data to a piece of code to find bugs. The test previously used Bitcoin Core's old libevent-based HTTP request parser and worked around a known crash in that parser. The commit switches the test to use Bitcoin Core's newer internal HTTP request parser. This is a test-only cleanup and does not change the code that real Bitcoin nodes run to handle network traffic.

AI review queuedHTTPServer: disconnect clientsby Matthew Zipkin · a69bb9e1 · Jun 22, 2026 · 4 filesMessage 35 · OpaqueLow 43Details
Commit message · Matthew Zipkin

HTTPServer: disconnect clients

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Low 43/100

This commit finishes the Bitcoin Core HTTP server's ability to actually close client connections. Before, several error paths had 'TODO: disconnect' comments, meaning misbehaving or finished clients could stay connected longer than intended. The change adds flags and a periodic cleanup routine so the server drops clients after errors, oversized requests, malformed requests, EOF, non-keep-alive responses, and during shutdown. It is best read as a robustness/cleanup improvement rather than a single critical vulnerability fix, though leaving connections hanging can waste resources and, in some designs, be abused.

Lower-priorityAllow http workers to send data optimistically as an optimizationby Matthew Zipkin · 5ef1b80a · Jun 22, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Matthew Zipkin

Allow http workers to send data optimistically as an optimization

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityHTTPServer: use a queue to pipeline requests from each connected clientby Matthew Zipkin · 7ee7df98 · Jun 22, 2026 · 2 filesMessage 81 · StrongTriage 0Details
Commit message · Matthew Zipkin

HTTPServer: use a queue to pipeline requests from each connected client

See https://www.rfc-editor.org/rfc/rfc7230#section-6.3.2

> A server MAY process a sequence of pipelined requests in
parallel if they all have safe methods (Section 4.2.1 of [RFC7231]),
but it MUST send the corresponding responses in the same order that
the requests were received.

We choose NOT to process requests in parallel. They are executed in
the order recevied as well as responded to in the order received.
This prevents race conditions where old state may get sent in response
to requests that are very quick to process but were requested later on
in the queue.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-priorityrefactor: split HTTPBindAddresses into config parse and libevent setupby Matthew Zipkin · 2ca645c2 · Jun 22, 2026 · 1 fileMessage 85 · StrongInformational 15Details
Commit message · Matthew Zipkin

refactor: split HTTPBindAddresses into config parse and libevent setup

The original function was already naturally split into two chunks:
First, we parse and validate the users' RPC configuration for IPs and
ports. Next we bind libevent's http server to the appropriate
endpoints.

This commit splits these chunks into two separate functions, leaving
the argument parsing in the common space of the module and moving the
libevent-specific binding into the http_libevent namespace.

A future commit will implement http_bitcoin::HTTPBindAddresses to
bind the validate list of endpoints by the new HTTP server.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
defensive validation
AI analysis · Informational 15/100

This commit is a simple code cleanup: it takes one function that did two jobs—reading RPC bind settings and actually opening network sockets—and splits it into two smaller functions. The behavior, settings, and warnings shown to users are unchanged. There is no security fix or vulnerability here.

Lower-priorityHTTPserver: support "chunked" Transfer-Encodingby Matthew Zipkin · 6734bcde · Jun 22, 2026 · 3 filesMessage 45 · ThinTriage 0Details
Commit message · Matthew Zipkin

HTTPserver: support "chunked" Transfer-Encoding

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityHTTPServer: compose and send replies to connected clientsby Matthew Zipkin · cdf71998 · Jun 22, 2026 · 5 filesMessage 83 · StrongTriage 0Details
Commit message · Matthew Zipkin

HTTPServer: compose and send replies to connected clients

Sockets-touching bits copied and adapted from `CConnman::SocketSendData()`

Testing this requires adding a new feature to the SocketTestingSetup,
returning the DynSock I/O pipes from the mock socket so the received
data can be checked.

Co-authored-by: Vasil Dimov <vd@FreeBSD.org>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityHTTPServer: read requests from connected clientsby Matthew Zipkin · 80e1cfe5 · Jun 22, 2026 · 5 filesMessage 78 · AdequateTriage 0Details
Commit message · Matthew Zipkin

HTTPServer: read requests from connected clients

`SocketHandlerConnected()` adapted from CConnman

Testing this requires adding a new feature to the SocketTestingSetup,
inserting a "request" payload into the mock client that connects
to us.

This commit also moves IOErrorIsPermanent() from sock.cpp to sock.h
so it can be called from the socket handler in httpserver.cpp

Co-authored-by: Vasil Dimov <vd@FreeBSD.org>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI review queuedhttp: Introduce HTTPRemoteClient classby Matthew Zipkin · 4ef4ebdc · Jun 22, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Matthew Zipkin

http: Introduce HTTPRemoteClient class

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds a new C++ class definition to a header file. It does not change any existing behavior, fix a bug, or alter how the program handles data. There is nothing here that would allow an attacker to exploit the software.

Lower-priorityHTTPServer: generate sequential Ids for each newly accepted connectionby Matthew Zipkin · a85286c5 · Jun 22, 2026 · 2 filesMessage 65 · AdequateTriage 0Details
Commit message · Matthew Zipkin

HTTPServer: generate sequential Ids for each newly accepted connection

Co-authored-by: Vasil Dimov <vd@FreeBSD.org>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityHTTPServer: start an I/O loop in a new thread and accept connectionsby Matthew Zipkin · 3c5226ab · Jun 22, 2026 · 3 filesMessage 73 · AdequateTriage 0Details
Commit message · Matthew Zipkin

HTTPServer: start an I/O loop in a new thread and accept connections

Socket handling methods are copied from CConnMan:

`CConnman::GenerateWaitSockets()`
`CConnman::SocketHandlerListening()`
`CConnman::ThreadSocketHandler()` and `CConnman::SocketHandler()` are combined into ThreadSocketHandler()`.

Co-authored-by: Vasil Dimov <vd@FreeBSD.org>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityutil/string: use string_view in LineReaderby Matthew Zipkin · 0cdbb191 · Jun 22, 2026 · 4 filesMessage 60 · AdequateTriage 0Details
Commit message · Matthew Zipkin

util/string: use string_view in LineReader

Co-authored-by: Hodlinator <172445034+hodlinator@users.noreply.github.com>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityutil/string: LineReader should only trim \r or \r\nby Matthew Zipkin · 5aa3629b · Jun 22, 2026 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · Matthew Zipkin

util/string: LineReader should only trim \r or \r\n

The utility can not be opinionated about CR or SP on either end of a
line it reads. That decision is up to the caller and in fact in the
case of HTTP should be allowed in some places and rejected in others.

Replace TrimStringView() with more surgical operation.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityhttp: enclose libevent-dependent code in a namespaceby Matthew Zipkin · 89c54ae4 · Jun 22, 2026 · 8 filesMessage 83 · StrongTriage 0Details
Commit message · Matthew Zipkin

http: enclose libevent-dependent code in a namespace

This commit is a no-op to isolate HTTP methods and objects that
depend on libevent. Following commits will add replacement objects
and methods in a new namespace for testing and review before
switching over the server.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityhttp: Implement HTTPHeaders classby Matthew Zipkin · 68b5d289 · Jun 22, 2026 · 3 filesMessage 66 · AdequateTriage 0Details
Commit message · Matthew Zipkin

http: Implement HTTPHeaders class

see:
https://www.rfc-editor.org/rfc/rfc2616#section-4.2
https://www.rfc-editor.org/rfc/rfc7231#section-5
https://www.rfc-editor.org/rfc/rfc7231#section-7
https://httpwg.org/specs/rfc9111.html#header.field.definitions

66/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI review queuedhttp: Implement HTTPResponse classby Matthew Zipkin · ad50aa4a · Jun 22, 2026 · 4 filesMessage 66 · AdequateInformational 15Details
Commit message · Matthew Zipkin

http: Implement HTTPResponse class

HTTP Response message:
https://datatracker.ietf.org/doc/html/rfc1945#section-6

Status line (first line of response):
https://datatracker.ietf.org/doc/html/rfc1945#section-6.1

Status code definitions:
https://datatracker.ietf.org/doc/html/rfc1945#section-9

66/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds a new helper class for formatting HTTP response headers in Bitcoin Core's internal web server. It does not change any existing behavior or fix any known problem; it is purely new infrastructure code with accompanying tests.

Lower-priorityhttp: Implement HTTPRequest classby Matthew Zipkin · 9463e987 · Jun 22, 2026 · 3 filesMessage 66 · AdequateTriage 0Details
Commit message · Matthew Zipkin

http: Implement HTTPRequest class

HTTP Request message:
https://datatracker.ietf.org/doc/html/rfc1945#section-5

Request Line aka Control Line aka first line:
https://datatracker.ietf.org/doc/html/rfc1945#section-5.1

See message_read_status() in libevent http.c for how
`MORE_DATA_EXPECTED` is handled there

66/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-priorityhttp: Introduce HTTPServer class and implement binding to listening socketby Matthew Zipkin · f5bc0189 · Jun 22, 2026 · 5 filesMessage 83 · StrongTriage 0Details
Commit message · Matthew Zipkin

http: Introduce HTTPServer class and implement binding to listening socket

Introduce a new low-level socket managing class `HTTPServer`.

BindAndStartListening() was copied from CConnMan's BindListenPort()
in net.cpp and modernized.

Unit-test it with a new class `SocketTestingSetup` which mocks
`CreateSock()` and will enable mock client I/O in future commits.

Co-authored-by: Vasil Dimov <vd@FreeBSD.org>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityHTTPServer: implement and test AcceptConnection()by Matthew Zipkin · 5a3aa1af · Jun 22, 2026 · 5 filesMessage 78 · AdequateTriage 0Details
Commit message · Matthew Zipkin

HTTPServer: implement and test AcceptConnection()

AcceptConnection() is mostly copied from CConmann in net.cpp
and then modernized.

Co-authored-by: Vasil Dimov <vd@FreeBSD.org>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Security candidatetest: cover common HTTP attacks and common malformed requestsby Matthew Zipkin · 881d4b6c · Jun 22, 2026 · 1 fileMessage 72 · AdequateInformational 12Details
Commit message · Matthew Zipkin

test: cover common HTTP attacks and common malformed requests

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
explicit security language
AI analysis · Informational 12/100

This commit only adds new automated tests to Bitcoin Core. It does not change the actual server code that handles HTTP requests. The tests verify that the existing HTTP server correctly rejects or handles common web attacks such as path traversal, request smuggling, null bytes, invalid HTTP versions, and malformed authentication headers. Because no production code is modified, the commit itself does not introduce or fix a vulnerability.