BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

2900 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

254security candidates607second-pass queue2881AI analyses
209commits · 30 days
502commits · 60 days
1535commits · 180 days
2884commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
937Strong · 80–100
1188Adequate · 60–79
687Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot22422170
Ava Chow15750157064
MarcoFalke41021406074
Lőrinc17721177081
fanquake22719226057
Hennadii Stepanov20914208063
rkrux57957074
Sjors Provoost89889074
Sebastian Falbesoner33733073
David Gumberg55655072
Pieter Wuille95595066
Hodlinator66566076
Analysis record

Published AI watches

Last scanned 5 minutes ago

Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35928: doc: mention -DWITH_ZMQ=ON in macOS build guide

This is a one-line documentation update to the macOS build guide. It adds a note telling users to pass a specific CMake option if they want ZeroMQ notification support. There is no code change and no security impact.

8397e09eby merge-script+1−11 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35482: fuzz: exercise the transaction-handling path in process_message(s)

This commit only changes Bitcoin Core's internal fuzz testing code. It makes the fuzz tests exercise more of the transaction-handling code path by toggling Initial Block Download mode and resetting the mempool between test runs. There is n…

No production code modifiedNo consensus, validation, net_processing, or wallet logic changedOnly fuzz test harnesses and test utilities affected
f11dc617by merge-script+105−798 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35914: test, fuzz: Remove unused variables

This commit removes unused variables from Bitcoin Core's test and fuzzing code. It is a cleanup/refactoring change with no effect on the live network software or user funds. It does not fix or introduce any security vulnerability.

d36bf709by merge-script+1−138 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35896: refactor: Default uint256::operator==, add operator<=>

This commit is a routine code cleanup in Bitcoin Core. It switches the uint256 equality and comparison operators to use standard C++20 defaults, removes an old custom Compare() helper, and marks an internal assertion-failure function as ne…

ed2c59abby merge-script+99−245 files
No security note in commit
Moderate 62 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35872: rpc: avoid descriptor range counter overflow

This update fixes a counting bug in several Bitcoin Core RPC commands that scan descriptors. When a user requested a descriptor range ending at the maximum allowed value (2,147,483,647), the internal counter used a smaller integer type and…

Signed integer overflow in descriptor expansion loopCrash/undefined behavior on maximum-range descriptor scansAuthenticated RPC surface affected (scantxoutset, scanblocks, getdescriptoractivity, utxoupdatepsbt, descriptorprocesspsbt)
b388674aby Ava Chow+3−12 files
Vendor flagged security relevance
Informational 19 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35842: rpc: Properly make RPCResult::Type::ANY non-test-only

This is a small cleanup and documentation fix for Bitcoin Core's RPC help system. It removes a comment that incorrectly said a certain output type was 'for testing only' and makes the help text properly display those outputs. There is no d…

No memory safety, cryptography, consensus, or authorization changes observedChange is confined to RPC help/schema metadata generationComment-only/type-label change from 'for testing only' to general use
c36ffd87by merge-script+42−364 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

This is a code cleanup change that turns on a static-analysis rule to prevent a specific C++ coding pattern (anonymous namespaces in header files) and updates two headers to comply. It does not change how Bitcoin Core behaves at runtime an…

No security-relevant code changeNo memory safety, cryptography, consensus, or network changesTooling-only refactor (clang-tidy configuration)
c4fbd3c7by merge-script+9−123 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

This commit only adds new test cases to Bitcoin Core's functional test suite. It does not change any production wallet, node, or RPC code. The tests verify that the importdescriptors RPC reports errors in the right order, rejects bad times…

465196d0by merge-script+77−11 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35180: coins: group private cache helpers

This change is purely a code cleanup: it moves two internal helper functions of a Bitcoin Core cache class into the private section of the class and removes a duplicate 'private:' label. There is no change to what the code does, no bug fix…

c940fd75by merge-script+13−141 file
No security note in commit
Low 29 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

This Bitcoin Core change tightens how three RPC commands (scantxoutset, scanblocks, deriveaddresses) handle the value null when it is passed for optional parameters. Previously, explicitly passing null could be treated differently from sim…

RPC parameter validation changeNull value handling changeAddition of explicit error checks for missing required contextual parameters
3db96eb5by merge-script+18−75 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable misc-definitions-in-headers

This commit is a code cleanup: it turns on a clang-tidy style check called 'misc-definitions-in-headers' and suppresses that check around a large inline implementation block in a benchmark header. There is no change to Bitcoin's runtime be…

fa93132dby MarcoFalke+3−02 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable clang-tidy rule to reject anon namespace in header

This commit only changes a linting configuration file for the project's code style checker. It enables a rule that prevents anonymous namespaces from being used in header files, which is a code-quality and build-hygiene practice. There is …

No security-relevant signals in the diff or commit message.Change is purely a static-analysis/linting configuration update.
fa5ca877by MarcoFalke+2−11 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use C++20 std::identity over IntIdentity

This commit is a straightforward code cleanup: it replaces a small custom helper named IntIdentity with the standard C++20 std::identity from the <functional> header. The behavior of the ConvertBits function is unchanged; only the implemen…

fafe5042by MarcoFalke+4−111 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test the result order of a multiple import request is correct

This commit only adds a new automated test to Bitcoin Core. It checks that when a user asks the wallet to import multiple descriptors at once, the list of results comes back in the same order as the original request, including any error me…

3ac8b806by Pol Espinasa+40−01 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test invalid or missing timestamp throws importdescriptors

This commit only adds new automated tests for the Bitcoin Core wallet's importdescriptors RPC. It checks that the command correctly rejects requests with a missing or invalid timestamp. No production wallet code is changed, so this cannot …

No changes to consensus, networking, wallet logic, or cryptographyOnly functional test code is modifiedAdded assertions are for expected error handling paths
e4732bf0by Pol Espinasa+28−11 file
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Remove unused #include in common/system

This is a minor code cleanup that removes one unused header file include and swaps another for a more specific one. It does not change any program behavior or fix any security issue.

fa7304f3by MarcoFalke+1−22 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

iwyu: Fix warnings in `src/consensus` and treat them as errors

This commit is a routine code cleanup: it adjusts which C++ header files are included in several consensus-related source files and turns on a stricter compiler hygiene check (Include What You Use, or IWYU) for the src/consensus directory.…

13b53f8bby Hennadii Stepanov+42−79 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: don't connman.ReceiveMsgFrom oversized msg

This is a small fix to a Bitcoin Core fuzz test (an automated internal testing harness), not to the live network code. The fuzzer was sometimes creating fake P2P messages larger than the real protocol allows and passing them into a test he…

Test-only fuzz harness hardeningOversized message guard added before ReceiveMsgFrom() in fuzz targetNo change to production P2P message acceptance logic
bb19f1daby Greg Sanders+5−01 file
No security note in commit
Informational 15 AI analysisMessage 97 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: Temporarily remove riscv32 config from GHA matrix

This commit simply removes one failing test configuration (RISC-V 32-bit bare metal) from the project's GitHub Actions CI matrix because it was failing. It is a routine CI maintenance change with no security implications.

fa06ea42by MarcoFalke+0−61 file
No security note in commit
Low 47 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: verify cross-build SDK archives

This change adds checksum verification to the build system's downloads of Apple, FreeBSD, NetBSD, and OpenBSD software development kits (SDKs). Before this patch, those SDK archives were downloaded at build time and extracted without confi…

Adds cryptographic digest verification for downloaded SDK archivesRemoves unchecked extraction of remote SDK archives in CIHardens CI supply chain for macOS/BSD cross-builds
873550beby Lőrinc+25−126 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityci: remove TODOs from retryby fanquake · c08f0c3c · Mar 10, 2026 · 1 fileMessage 84 · StrongInformational 15Details
Commit message · fanquake

ci: remove TODOs from retry

TODOs are good targets for LLMs to generate PRs. Remove these TODOs,
which aren't needed, to prevent that.

84/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit simply deletes three TODO comments from a CI helper script. There is no code behavior change, no bug fix, and no security relevance.

Lower-priorityci: use latest versions of lint depsby fanquake · 9f3752c4 · Mar 10, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · fanquake

ci: use latest versions of lint deps

Use the latest available versions, except for LIEF, which is
changed with Guix.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit simply updates the versions of several linting tools used in Bitcoin Core's continuous integration (CI) pipeline. Linting tools check code style and catch common mistakes, but they are not part of the actual Bitcoin software that users run. There is no indication this change fixes or introduces a security vulnerability.

Lower-prioritytest: Scale feature_dbcrash.py timeout with factorby MarcoFalke · fadb7716 · Mar 10, 2026 · 1 fileMessage 95 · StrongInformational 15Details
Commit message · MarcoFalke

test: Scale feature_dbcrash.py timeout with factor

This allows to run the test under valgrind:

./bld-cmake/test/functional/feature_dbcrash.py --timeout-factor=10 --valgrind

For testing, the same test can be run multiple times in parallel:

./bld-cmake/test/functional/test_runner.py -j 10 $( printf 'feature_dbcrash.py %.0s' {1..10} ) --timeout-factor=10 --valgrind

(Running the test under valgrind may take several hours!)

I found that before this commit, 9 out of the 10 runs failed via:

```
...
TestFramework (INFO): Iteration 36, generating 2500 transactions [11, 5, 6]
TestFramework (ERROR): Unexpected exception
Traceback (most recent call last):
File "/b-c/test/functional/test_framework/test_framework.py", line 142, in main
self.run_test()
~~~~~~~~~~~~~^^
File "/b-c/bld-cmake/test/functional/feature_dbcrash.py", line 262, in run_test
self.sync_node3blocks(block_hashes)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^
File "/b-c/bld-cmake/test/functional/feature_dbcrash.py", line 151, in sync_node3blocks
nodei_utxo_hash = self.restart_node(i, block_hash)
File "/b-c/bld-cmake/test/functional/feature_dbcrash.py", line 102, in restart_node
raise AssertionError(f"Unable to successfully restart node {node_index} in allotted time")
AssertionError: Unable to successfully restart node 0 in allotted time
```

With this commit, all 10 runs passed.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This is a test-only change. It makes one functional test wait longer before giving up when running under slow tools like valgrind. It does not change Bitcoin Core's production code, network behavior, or wallet security.

Lower-prioritydepends: link to upstream qt issueby fanquake · 3a83715c · Mar 10, 2026 · 1 fileMessage 76 · AdequateInformational 15Details
Commit message · fanquake

depends: link to upstream qt issue

Follows up to:
https://github.com/bitcoin/bitcoin/pull/34650#discussion_r2837726376.

https://qt-project.atlassian.net/browse/QTBUG-144864

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit only updates a code comment in Bitcoin Core's build system. It replaces a vague remark about a Qt build option not working with a direct link to the upstream Qt bug report. No code behavior changes, no security fix, and no vulnerability is introduced or patched.

Lower-prioritytest: Add NodeClockContextby MarcoFalke · fa4fae62 · Mar 10, 2026 · 1 fileMessage 92 · StrongInformational 15Details
Commit message · MarcoFalke

test: Add NodeClockContext

This makes it easier to use mock-time in tests. Also, it resets the
global mocktime, so that no state is leaked between test cases.

92/100 · StrongMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a new test-only helper class in a header file under the test directory. It makes it easier for Bitcoin Core's own unit tests to set and reset mock time, and prevents mock-time state from leaking between test cases. There is no change to production code, no network-facing change, and no security fix or vulnerability introduced.

AI review queuedfuzz: Use NodeClockContextby MarcoFalke · eeeeb2a0 · Mar 10, 2026 · 25 filesMessage 68 · AdequateInformational 15Details
Commit message · MarcoFalke

fuzz: Use NodeClockContext

This refactor does not change any behavior.

However, it is nice to know that no global mocktime leaks from the fuzz
init step to the first fuzz input, or from one fuzz input execution to
the next.
With the clock context, the global is re-set at the end of the context.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a test-only code cleanup. It replaces direct calls to a global mock-time setter with a local clock-context object in Bitcoin Core's fuzz tests. The change does not alter how the software behaves and only affects internal testing code, not the live Bitcoin network or user wallets.

AI review queuedqt: 31.0 translations updateby Hennadii Stepanov · d21afb29 · Mar 10, 2026 · 101 filesMessage 45 · ThinInformational 15Details
Commit message · Hennadii Stepanov

qt: 31.0 translations update

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: unusually broad change
AI analysis · Informational 15/100

This commit is a routine update of translated user-interface text for the Bitcoin Core Qt wallet in preparation for version 31.0. It adds, removes, and revises translated strings across many language files and registers two new language files (Yoruba and a generic Chinese locale) in the resource list. There is no executable code change and no security relevance.

Lower-prioritytest: Remove fixed TODO in address_to_scriptpubkeyby MarcoFalke · fa0587a3 · Mar 10, 2026 · 1 fileMessage 52 · ThinInformational 15Details
Commit message · MarcoFalke

test: Remove fixed TODO in address_to_scriptpubkey

52/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body! Contains work-in-progress language
AI analysis · Informational 15/100

This is a tiny test-only code cleanup. It removes a completed TODO comment and changes an internal assertion failure into a more descriptive error message when an unsupported address type is encountered in the test framework. It does not affect live Bitcoin Core software, wallets, consensus, networking, or any user-facing behavior.

Lower-prioritydoc: update http worker thread namesby rkrux · 46189fd5 · Mar 10, 2026 · 1 fileMessage 76 · AdequateInformational 15Details
Commit message · rkrux

doc: update http worker thread names

After using `Threadpool` for HTTP server in PR 33689, the previously
documented HTTP worker thread names are outdated. This commit makes
the corresponding changes to document new names for the HTTP worker
threads. Below is the output from the `thead list` command after
attaching `lldb` to `bitcoind`.

```zsh
thread #3: tid = 0xfe551, 0x00007ff80e3536f6 libsystem_kernel.dylib`__psynch_cvwait + 10, name = 'b-http_pool_0'
thread #4: tid = 0xfe552, 0x00007ff80e3536f6 libsystem_kernel.dylib`__psynch_cvwait + 10, name = 'b-http_pool_1'
```

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates a developer documentation file to reflect new internal thread names used by the Bitcoin Core HTTP server. It changes one line in doc/developer-notes.md from 'b-httpworker.x' to 'b-http_pool_x' and updates a documentation hyperlink. There is no code change, no functional change, and no security relevance.

Lower-priorityguix: Make guix-clean less destructiveby Hodlinator · be6d24ec · Mar 9, 2026 · 1 fileMessage 68 · AdequateInformational 18Details
Commit message · Hodlinator

guix: Make guix-clean less destructive

* Show preview and ask for confirmation before git clean unless used with "--force"
* Error out when trying to pass args such as "guix-clean --help"

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit changes a Bitcoin Core build helper script so that before it deletes leftover files, it shows a preview and asks the user to confirm. It also adds a safety check so passing unexpected arguments (like --help) causes an error instead of being silently ignored. The change reduces the chance of accidentally deleting important files, but it is a usability/safety improvement rather than a fix for a software vulnerability that an attacker could exploit remotely.

Lower-priorityvalidation: do not add the snapshot block to candidates of bg chainstateby Martin Zumsande · 69baddc9 · Mar 9, 2026 · 2 filesMessage 85 · StrongInformational 23Details
Commit message · Martin Zumsande

validation: do not add the snapshot block to candidates of bg chainstate

The snapshot block needs to be added to the candidates set of the
assumed-valid chain because it will be the tip of that chainstate
right after snapshot activation.
However, adding it also to the background chainstate is not necessary
for anything. Before, the index would linger in the set without being
connectable. It will be eventually added to the set as part of the
normal block download - no extra logic is necessary here.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 23/100

This commit fixes a minor bookkeeping error in Bitcoin Core's block validation engine. During a special one-time process called assumeutxo snapshot activation, the snapshot block was being incorrectly added to the candidate set of both the new lightweight chain and the older background chain. The background chain does not need or want this block as a candidate, because it cannot connect it. The patch removes the extra entry so the candidate set matches the intended design. There is no direct evidence this causes a security exploit, but it removes a confusing inconsistency that could theoretically affect validation decisions.

AI review queuedwalletdb: hash pubkey/privkey in one shot to avoid leaking secret databy Sebastian Falbesoner · 501a3dd4 · Mar 8, 2026 · 1 fileMessage 85 · StrongLow 37Details
Commit message · Sebastian Falbesoner

walletdb: hash pubkey/privkey in one shot to avoid leaking secret data

Avoid storing the privkey in a vector, which could linger in memory
and potentially leak sensitive data. An alternative approach is to
use `secure_allocator` for the `std::vector` instances, but this
commit has the advantage of also deduplicating code at the same shot.

Thanks to @theuni for suggesting this.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 37/100

This change is a defensive cleanup in Bitcoin Core's wallet code. Previously, when saving or loading private keys, the code temporarily copied the public and private keys together into an ordinary memory buffer (a std::vector) before hashing them. That buffer could remain in memory longer than necessary, creating a small window where sensitive private-key material might be exposed through memory dumps, core dumps, or swap. The patch removes that temporary buffer and instead hashes the keys directly in one step. It does not fix an active exploit or reported breach, but it reduces a real, if narrow, information-disclosure risk.

AI review queuedrefactor: improve benchmark setup and execution for various testsby Lőrinc · 8825051e · Mar 8, 2026 · 5 filesMessage 95 · StrongInformational 15Details
Commit message · Lőrinc

refactor: improve benchmark setup and execution for various tests

Note that `make_hard_case` already clears the UTXO pool in `coin_selection.cpp`.

./build/bin/bench_bitcoin -filter='^(BnBExhaustion|AddrManAddThenGood|DeserializeBlockTest|DeserializeAndCheckBlockTest|CheckBlockTest|LoadExternalBlockFile|FindByte|WalletCreatePlain|WalletCreateEncrypted|WalletLoadingDescriptors)$'

| ns/op | op/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 15,088,500.00 | 66.28 | 0.2% | 0.17 | `AddrManAddThenGood`
| 179,208.00 | 5,580.11 | 2.0% | 0.00 | `BnBExhaustion`

| ns/block | block/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 318,166.00 | 3,143.01 | 3.5% | 0.00 | `CheckBlockTest`
| 886,750.00 | 1,127.71 | 0.8% | 0.01 | `DeserializeBlockTest`

| ns/op | op/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 42.00 | 23,809,523.81 | 2.4% | 0.00 | `FindByte`
| 5,473,208.00 | 182.71 | 0.4% | 0.06 | `LoadExternalBlockFile`
| 584,168,041.00 | 1.71 | 0.3% | 6.43 | `WalletCreateEncrypted`
| 168,040,458.00 | 5.95 | 1.1% | 1.85 | `WalletCreatePlain`
| 155,446,625.00 | 6.43 | 0.7% | 0.78 | `WalletLoadingDescriptors`

| ns/op | op/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 14,894,917.00 | 67.14 | 0.3% | 0.16 | `AddrManAddThenGood`
| 177,667.00 | 5,628.51 | 1.3% | 0.00 | `BnBExhaustion`

| ns/block | block/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 313,791.00 | 3,186.83 | 3.8% | 0.00 | `CheckBlockTest`
| 888,208.00 | 1,125.86 | 0.7% | 0.01 | `DeserializeBlockTest`

| ns/op | op/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 41.00 | 24,390,243.90 | 2.4% | 0.00 | `FindByte`
| 5,445,208.00 | 183.65 | 1.0% | 0.06 | `LoadExternalBlockFile`
| 581,800,500.00 | 1.72 | 0.4% | 6.40 | `WalletCreateEncrypted`
| 166,035,583.00 | 6.02 | 0.5% | 1.82 | `WalletCreatePlain`
| 153,574,792.00 | 6.51 | 0.1% | 0.77 | `WalletLoadingDescriptors`

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit is a code cleanup that changes how several performance benchmarks are set up and run. It does not alter the behavior of the actual Bitcoin Core software that users run, only the internal testing/benchmarking code. There is no security issue here.

AI review queuedbench: add fluent API for untimed setup steps in `nanobench`by Lőrinc · 83b8528d · Mar 8, 2026 · 1 fileMessage 95 · StrongInformational 15Details
Commit message · Lőrinc

bench: add fluent API for untimed setup steps in `nanobench`

Some benchmarks need per-epoch state reset so every measured run does the same work.
Add `Bench::setup(...).run(...)` for untimed per-epoch setup.
The existing `run()` now delegates to `runImpl()` with an empty setup lambda, keeping the old API unchanged.

This vendors the upstream change from `martinus/nanobench`.
The upstream PR also adds tests that verify setup is excluded from timing and runs once before each epoch's iterations.
Those tests are not copied here because wiring them into `src/bench/nanobench.h` outside the benchmarking setup would be awkward.

The `Default is 1ms, so we are mostly relying ...` comment update matches current upstream `nanobench` master.

-------

Running a few benchmarks (which will be migrated in the next commit to use the new setup method) several times to showcase the spread:

./build/bin/bench_bitcoin -filter='^(BnBExhaustion|AddrManAddThenGood|DeserializeBlockTest|DeserializeAndCheckBlockTest|CheckBlockTest|LoadExternalBlockFile|FindByte|WalletCreatePlain|WalletCreateEncrypted|WalletLoadingDescriptors)$'

| ns/op | op/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 26,400,542.00 | 37.88 | 0.4% | 0.29 | `AddrManAddThenGood`
| 189,075.00 | 5,288.91 | 0.4% | 0.01 | `BnBExhaustion`

| ns/block | block/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 1,237,000.00 | 808.41 | 2.4% | 0.01 | `DeserializeAndCheckBlockTest`
| 893,333.00 | 1,119.40 | 0.6% | 0.01 | `DeserializeBlockTest`

| ns/op | op/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 31.62 | 31,622,370.70 | 0.2% | 0.01 | `FindByte`
| 5,506,875.00 | 181.59 | 1.4% | 0.06 | `LoadExternalBlockFile`
| 593,480,333.00 | 1.68 | 0.4% | 6.53 | `WalletCreateEncrypted`
| 174,305,167.00 | 5.74 | 0.7% | 1.93 | `WalletCreatePlain`
| 160,833,875.00 | 6.22 | 0.2% | 0.80 | `WalletLoadingDescriptors`

| ns/op | op/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 26,005,125.00 | 38.45 | 1.3% | 0.29 | `AddrManAddThenGood`
| 181,909.67 | 5,497.23 | 0.1% | 0.01 | `BnBExhaustion`

| ns/block | block/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 1,223,000.00 | 817.66 | 2.8% | 0.01 | `DeserializeAndCheckBlockTest`
| 892,917.00 | 1,119.92 | 0.7% | 0.01 | `DeserializeBlockTest`

| ns/op | op/s | err% | total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
| 31.58 | 31,660,608.70 | 0.5% | 0.01 | `FindByte`
| 5,612,750.00 | 178.17 | 1.1% | 0.06 | `LoadExternalBlockFile`
| 594,012,250.00 | 1.68 | 0.2% | 6.53 | `WalletCreateEncrypted`
| 174,668,334.00 | 5.73 | 0.8% | 1.92 | `WalletCreatePlain`
| 158,494,375.00 | 6.31 | 0.3% | 0.79 | `WalletLoadingDescriptors`

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit is a clean, non-functional change to Bitcoin Core's internal benchmarking header. It adds a new fluent API (bench.setup(...).run(...)) so benchmark authors can run an untimed setup step before each timed epoch. The old run(...) API is preserved by delegating to a new internal runImpl(...) with an empty setup lambda. There is no change to consensus, networking, wallet logic, or any runtime node behavior.

Security candidateBugfix: GUI/Intro: Handle errors from SelectParams the same as if during InitConfigby Luke Dashjr · 55d37546 · Mar 6, 2026 · 2653 filesMessage 65 · AdequateInformational 17Details
Commit message · Luke Dashjr

Bugfix: GUI/Intro: Handle errors from SelectParams the same as if during InitConfig

Without this, invalid vbparams just silently exit with no message

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 17/100

This commit is a small bug fix in the Bitcoin Core graphical wallet (bitcoin-qt). When a user starts the GUI with an invalid custom network parameter (the -vbparams option), the program used to quit without showing any error message. The fix makes the GUI display the same helpful error message that the command-line daemon already shows, so users know what went wrong.

Lower-prioritybuild: bump to 31.99by Ava Chow · 48b952cb · Mar 6, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Ava Chow

build: bump to 31.99

50/100 · ThinMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit simply changes the displayed major version number of Bitcoin Core from 30 to 31.99 in the build configuration. It is a routine development marker with no security relevance.

Lower-prioritydocs Remove 31.0 release notes fragmentsby Ava Chow · 1b3d58f1 · Mar 6, 2026 · 18 filesMessage 45 · ThinInformational 15Details
Commit message · Ava Chow

docs Remove 31.0 release notes fragments

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only deletes documentation files—specifically, draft release-notes fragments for the upcoming 31.0 release. No program code, configuration defaults, or runtime behavior is changed. It is a routine housekeeping change and has no security relevance on its own.

Lower-prioritydocs: Update bips.mdby Ava Chow · b7cf2f87 · Mar 6, 2026 · 1 fileMessage 40 · ThinInformational 15Details
Commit message · Ava Chow

docs: Update bips.md

Add 327, 328, 373, and 390

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates a documentation file (doc/bips.md) listing which Bitcoin Improvement Proposals (BIPs) are implemented in Bitcoin Core. It adds entries for BIPs 327, 328, 373, and 390, all related to MuSig2 multi-signature support. No code, logic, or configuration was changed, so this commit has no direct security impact.

Lower-prioritydepends: delete Boost extra filesby fanquake · 0ebc6891 · Mar 6, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · fanquake

depends: delete Boost extra files

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit removes leftover documentation and example files from the Boost dependency after it is built. It is a cleanup change with no apparent security relevance.

Lower-prioritydepends: disable Qt sbom generationby fanquake · 168997e9 · Mar 6, 2026 · 1 fileMessage 45 · ThinInformational 16Details
Commit message · fanquake

depends: disable Qt sbom generation

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 16/100

This commit turns off a Qt build feature called SBOM generation in Bitcoin Core's dependency build system. SBOMs are inventory lists of software components. The change is a build-hygiene measure; there is no direct evidence in the commit that it fixes an exploitable security vulnerability.

Lower-prioritydoc: Update asmap-data repository rule for file inclusionby Fabian Jahr · 8bc62ce1 · Mar 6, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Fabian Jahr

doc: Update asmap-data repository rule for file inclusion

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates a documentation file describing how asmap-data files are accepted into a related repository. It changes the rule from needing 5+ participants with a matching majority result to needing a result hash signed by 5+ participants. There is no code change and no direct security impact on Bitcoin Core itself.

Lower-prioritytest: use static methods and clarify comment in addr_relayby stratospher · 57bfa864 · Mar 6, 2026 · 2 filesMessage 95 · StrongInformational 15Details
Commit message · stratospher

test: use static methods and clarify comment in addr_relay

we don't need to send GETADDR for initial self announcement
anymore + can construct addr_receivers using
AddrReceiver(send_getaddr=False).

however we would need to send an empty ADDR message to each
of the addr_receivers to initialise addr relay for inbound
connections. so current code is simpler and we can just
clarify the comment.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This is a minor cleanup of Bitcoin Core's own functional test code. It changes two helper methods to be static (they don't need access to test class state) and rewrites a comment to be clearer about why the test still sends an initial GETADDR message. There is no change to the actual Bitcoin node software, no security fix, and no vulnerability.

Lower-prioritytest: protect outbound connection from eviction in getaddr_testby stratospher · 7ee8c0ab · Mar 6, 2026 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · stratospher

test: protect outbound connection from eviction in getaddr_test

since we're bumping mocktime more than CHAIN_SYNC_TIMEOUT = 20 * 60,
it's possible for disconnections like this to happen in the test:

$ test/functional/p2p_addr_relay.py --randomseed=7758649581790797022
...
TestFramework (INFO): Check that we answer getaddr messages only once per connection
TestFramework.p2p (WARNING): Connection lost to 127.0.0.1:58829 due to [Errno 54] Connection reset by peer
...

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit fixes a flaky Bitcoin Core functional test. The test was sometimes failing because the node would disconnect an outbound peer after the test advanced its internal clock too far. The fix makes the test announce the latest block header to the peer, which tells the node to protect that peer from disconnection. It is purely a test change and does not affect real network behavior or user funds.

Lower-prioritytest: fix addr relay test silent pass and wrong peerinfo indexby stratospher · ecb5ce6e · Mar 6, 2026 · 1 fileMessage 99 · StrongInformational 15Details
Commit message · stratospher

test: fix addr relay test silent pass and wrong peerinfo index

the test silently passes on master because SetupAddressRelay
isn't called by default for inbound connections.

99/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit fixes bugs in a Bitcoin Core functional test script, not in the actual Bitcoin network node software. The test was checking address relay behavior using the wrong peer index and was silently passing because a setup step was missing. The fix moves an empty address message earlier and corrects which peer's statistics are checked. There is no change to production code and no security risk to running nodes.

Lower-priorityindex: document TxoSpenderIndex::FindSpenderby furszy · 15c48894 · Mar 6, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · furszy

index: document TxoSpenderIndex::FindSpender

Hard to know what a returned std::Expected(std::nullopt) mean
if it is not documented anywhere.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only adds a comment explaining what a particular function returns in different situations. No code behavior was changed, so it cannot introduce or fix a security issue.