Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This update fixes a way that people with limited access to a Bitcoin node could make fake log entries appear real. Normally, the node cleans up special characters in log messages but was leaving newlines alone. A clever user could slip a n…
Log injection / log forgery via embedded newlines in untrusted inputInput from restricted RPC users reaching log output without newline escapingControl-character escaping bypass due to explicit newline exception
This commit fixes a one-word typo in a comment inside a test file. The comment incorrectly referred to 'walletcreatepsbt' when the surrounding test code actually calls 'walletcreatefundedpsbt'. No code behavior changes, and there is no sec…
This commit fixes a typo in a comment within a test file. The comment incorrectly referred to 'walletcreatepsbt' when the surrounding test code actually exercises 'walletcreatefundedpsbt'. No code behavior changes, and there is no security…
This commit is a documentation-only update. It adds a single line to Bitcoin Core's list of implemented BIPs, noting that BIP 461 (a technique for making ECDSA signatures smaller and deterministic) has been implemented since version 0.17.0…
This patch fixes a bug in Bitcoin Core's `sendall` wallet command. If a user typed a bech32 address in uppercase letters, the command would fail with a confusing 'below dust threshold' error instead of sending the funds. The fix compares d…
Functional bug in RPC command causing unexpected transaction failureCase-sensitivity mismatch between user input and canonical address encodingNo memory safety, cryptographic, or authorization issue evident
This commit fixes a flaky automated test in Bitcoin Core. The test was checking the maximum transaction fee rate by creating a transaction at the exact boundary, which sometimes failed because the real transaction size could be slightly sm…
No production code changedTest-only changeNo memory safety, cryptography, consensus, or authorization changes
This is a build-system maintenance update for Bitcoin Core's reproducible build environment (Guix). It updates the Guix time-machine commit and several dependency versions, and temporarily disables some test suites that fail when building …
No direct security-relevant code change in Bitcoin Core consensus, wallet, or P2P layers.Dependency version bumps (git-minimal, linux-headers, python-lief, python-minimal) are routine build-environment updates.Disabling third-party package test suites reduces build-time test coverage but does not alter Bitcoin Core's own test or release binaries.
This change makes three Bitcoin command-line tools (bitcoin-tx, bitcoin-util, and bitcoin-wallet) automatically pick the fastest SHA-256 hashing implementation available on the computer, such as hardware-accelerated versions on modern CPUs…
This is a one-line fix in Bitcoin Core's network code. It changes how the size of a list of block headers is converted to a signed integer inside a loop. Previously, if the list was empty, the conversion could trigger undefined-behavior wa…
UndefinedBehaviorSanitizer integer sanitizer warning addressedImplicit signed/unsigned conversion in loop counterUnsigned integer wraparound on empty vector size
This change fixes a Bitcoin Core wallet bug where the `importprunedfunds` RPC command could only re-import transactions that sent money to the wallet, not transactions that spent money from it. After this fix, both incoming and outgoing tr…
Logic bug in wallet transaction import scopeIncorrect balance possible after removing and re-importing spending transactionFix routes import through existing involvement check (IsMine + IsFromMe)
This commit adds a new Bitcoin Core wallet startup option called -maxfeerate. It lets users set a maximum fee rate (fee per unit of transaction size) that the wallet will allow when creating or broadcasting transactions. Previously, the wa…
New wallet startup option -maxfeerate to cap transaction fee rateNew transaction error type MAX_FEE_RATE_EXCEEDEDBroadcastTransaction now checks both max absolute fee and max fee rate
This Bitcoin Core update fixes a wallet-signing quirk. When a user chose the SIGHASH_SINGLE signature mode, an input that had no matching output index would sign essentially nothing meaningful. That signature could then stay valid even if …
Funds-redirection footgun from SIGHASH_SINGLE signatures with no committed outputInconsistent guard between SignTransaction and SignPSBTInput pathsFix centralizes the guard in the low-level signature creator to cover future signing paths
This change updates Bitcoin Core's I2P (Invisible Internet Project) privacy network settings to use newer, stronger encryption for the published 'leaseset' that describes how other peers can contact a node. The old setting included ElGamal…
Cryptographic algorithm update (ElGamal to MLKEM-768)Use of I2P 'legacy' encryption type removedConfiguration-only change in network privacy layer
This change fixes a labeling bug in Bitcoin Core's first-run disk-space warning. The estimate was stored in GiB (binary gigabytes, 1024-based) but displayed as GB (decimal gigabytes, 1000-based), and for pruned nodes it showed the full-cha…
This is a wallet bug, not a theft or remote-code bug. When a Bitcoin Core user turns on the optional 'avoidpartialspends' or 'avoid_reuse' setting, an output group rejected during coin selection could be counted twice as 'discarded.' That …
Logic error causing double-counting of discarded UTXO groupsCan trigger false 'insufficient funds' failure in coin selectionAffects avoidpartialspends / avoid_reuse wallets only
This is a documentation-only fix in a tutorial file. It changes two shell examples from using '>>' (append to file) to '>' (overwrite file). If a user followed the old instructions and ran the same command twice, the file would contain two…
No security signal: change is limited to documentationNo code changes to Bitcoin Core binaries, RPC, wallet, or consensus logicNo cryptographic, network, or privilege-boundary implications
This is a large internal code reorganization (refactor) in Bitcoin Core. It creates a new BlockTemplateManager class that takes over block-template creation, block submission, and tip-waiting helpers that were previously spread across seve…
Large refactor touching mining, RPC, interfaces, and test shutdown pathsNew object lifetime dependency: BlockTemplateManager holds references to mempool, chainman, and notifications; explicit reset ordering added in Shutdown/InitAndLoadChainstate/test setupsRemoval of early-init node.mining interface; BlockTemplateManager is now created after chainstate load, with a comment that it must exist before setChainstateLoaded(true) unblocks IPC waiters
This commit adds the first implementation of BIP352 (Silent Payments) to Bitcoin Core. Silent Payments are a new type of privacy-preserving Bitcoin address that lets someone receive payments without publicly revealing a fixed address. The …
New cryptographic feature implementation (BIP352 Silent Payments)Extensive use of secp256k1 silentpayments moduleInput public key extraction from P2PKH, P2WPKH, P2SH-P2WPKH, and P2TR inputs
This update fixes a wallet database loading bug where a damaged or tampered Bitcoin wallet file could cause the program to read past the end of a stored extended public key (xpub). The patch makes the loader check the stored xpub length be…
Out-of-bounds read in wallet descriptor cache deserializationASan container-overflow triggered by malformed on-disk recordMissing length validation between record size prefix and fixed-size decoder
This commit adds a new wallet RPC called listrawtransactions to Bitcoin Core. It is a feature addition that lets users list every transaction their wallet knows about, including internal transfers and consolidations that the existing listt…
No security-relevant bug fix or vulnerability patch is present in the diff.New RPC exposes additional wallet transaction metadata, but only to callers already authorized for wallet RPCs.Code is a refactor of existing gettransaction logic into shared helpers; no new cryptographic, network, or consensus code.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100
This commit only deletes documentation files—specifically, draft release-notes fragments for the upcoming 31.0 release. No program code, configuration defaults, or runtime behavior is changed. It is a routine housekeeping change and has no security relevance on its own.
Lower-prioritydocs: Update bips.mdby Ava Chow · b7cf2f87 · Mar 6, 2026 · 1 fileMessage 40 · ThinInformational 15Details
Commit message · Ava Chow
docs: Update bips.md
Add 327, 328, 373, and 390
40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100
This commit only updates a documentation file (doc/bips.md) listing which Bitcoin Improvement Proposals (BIPs) are implemented in Bitcoin Core. It adds entries for BIPs 327, 328, 373, and 390, all related to MuSig2 multi-signature support. No code, logic, or configuration was changed, so this commit has no direct security impact.
Lower-prioritydepends: delete Boost extra filesby fanquake · 0ebc6891 · Mar 6, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · fanquake
depends: delete Boost extra files
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit removes leftover documentation and example files from the Boost dependency after it is built. It is a cleanup change with no apparent security relevance.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 16/100
This commit turns off a Qt build feature called SBOM generation in Bitcoin Core's dependency build system. SBOMs are inventory lists of software components. The change is a build-hygiene measure; there is no direct evidence in the commit that it fixes an exploitable security vulnerability.
Lower-prioritydoc: Update asmap-data repository rule for file inclusionby Fabian Jahr · 8bc62ce1 · Mar 6, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Fabian Jahr
doc: Update asmap-data repository rule for file inclusion
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100
This commit only updates a documentation file describing how asmap-data files are accepted into a related repository. It changes the rule from needing 5+ participants with a matching majority result to needing a result hash signed by 5+ participants. There is no code change and no direct security impact on Bitcoin Core itself.
Lower-prioritytest: use static methods and clarify comment in addr_relayby stratospher · 57bfa864 · Mar 6, 2026 · 2 filesMessage 95 · StrongInformational 15Details
Commit message · stratospher
test: use static methods and clarify comment in addr_relay
we don't need to send GETADDR for initial self announcement anymore + can construct addr_receivers using AddrReceiver(send_getaddr=False).
however we would need to send an empty ADDR message to each of the addr_receivers to initialise addr relay for inbound connections. so current code is simpler and we can just clarify the comment.
95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100
This is a minor cleanup of Bitcoin Core's own functional test code. It changes two helper methods to be static (they don't need access to test class state) and rewrites a comment to be clearer about why the test still sends an initial GETADDR message. There is no change to the actual Bitcoin node software, no security fix, and no vulnerability.
Lower-prioritytest: protect outbound connection from eviction in getaddr_testby stratospher · 7ee8c0ab · Mar 6, 2026 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · stratospher
test: protect outbound connection from eviction in getaddr_test
since we're bumping mocktime more than CHAIN_SYNC_TIMEOUT = 20 * 60, it's possible for disconnections like this to happen in the test:
$ test/functional/p2p_addr_relay.py --randomseed=7758649581790797022 ... TestFramework (INFO): Check that we answer getaddr messages only once per connection TestFramework.p2p (WARNING): Connection lost to 127.0.0.1:58829 due to [Errno 54] Connection reset by peer ...
100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100
This commit fixes a flaky Bitcoin Core functional test. The test was sometimes failing because the node would disconnect an outbound peer after the test advanced its internal clock too far. The fix makes the test announce the latest block header to the peer, which tells the node to protect that peer from disconnection. It is purely a test change and does not affect real network behavior or user funds.
Lower-prioritytest: fix addr relay test silent pass and wrong peerinfo indexby stratospher · ecb5ce6e · Mar 6, 2026 · 1 fileMessage 99 · StrongInformational 15Details
Commit message · stratospher
test: fix addr relay test silent pass and wrong peerinfo index
the test silently passes on master because SetupAddressRelay isn't called by default for inbound connections.
99/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100
This commit fixes bugs in a Bitcoin Core functional test script, not in the actual Bitcoin network node software. The test was checking address relay behavior using the wrong peer index and was silently passing because a setup step was missing. The fix moves an empty address message earlier and corrects which peer's statistics are checked. There is no change to production code and no security risk to running nodes.
Hard to know what a returned std::Expected(std::nullopt) mean if it is not documented anywhere.
50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100
This commit only adds a comment explaining what a particular function returns in different situations. No code behavior was changed, so it cannot introduce or fix a security issue.
Lower-prioritytest: Add missing txospenderindex coverage in feature_initby Fabian Jahr · f8b9595a · Mar 5, 2026 · 1 fileMessage 95 · StrongInformational 15Details
Commit message · Fabian Jahr
test: Add missing txospenderindex coverage in feature_init
Also refactors the list of all index args into a constant that can be reused across tests.
Co-authored-by: sedited <seb.kung@gmail.com>
95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100
This is a routine test-only change for Bitcoin Core. It adds the new '-txospenderindex' option to an existing initialization test and refactors the list of index arguments into a shared constant. There is no change to production code, no security fix, and no vulnerability.
Lower-prioritytest: sock: Enable socket pair tests on Windowsby David Gumberg · 9316d962 · Mar 5, 2026 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · David Gumberg
test: sock: Enable socket pair tests on Windows
Adds a helper struct `socket_pair` for constructing and connecting TCP sockets, this replaces socketpair() which is not available on Windows. Making the socket pair TCP sockets instead of Unix sockets, and separating socket creation from socket connection also enables more detailed tests to be added in the future.
90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100
This commit only changes test code. It replaces Unix-only socketpair() with a cross-platform TCP loopback socket helper so the same socket tests can run on Windows. There is no change to production Bitcoin Core networking code, consensus logic, or wallet handling, so it does not affect live node security.
Lower-prioritytest: Wait for txospender index to be synced in rpc_gettxspendingprevoutby Ava Chow · cbdb891d · Mar 5, 2026 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · Ava Chow
test: Wait for txospender index to be synced in rpc_gettxspendingprevout
Each node's txospender index needs to catch up with the existing chain before the tests will work.
87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100
This is a test-only change. It adds two lines to a single functional test file to wait for an internal index to finish syncing before continuing the test. There is no change to production Bitcoin Core code, no wallet or consensus logic is touched, and no security vulnerability is present in the commit.
Lower-prioritytest: Sync mempools after tx creation in rpc_gettxspendingprevoutby Ava Chow · 2db5c049 · Mar 5, 2026 · 1 fileMessage 95 · StrongInformational 15Details
Commit message · Ava Chow
test: Sync mempools after tx creation in rpc_gettxspendingprevout
The test will query information from the other nodes about mempool txs, ensure that the txs are in their mempools beforehand.
95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100
This is a one-line change to a Bitcoin Core functional test. It adds a mempool synchronization step before the test checks that transactions are visible across nodes. It does not change production code, consensus rules, networking, or wallet behavior, and it does not fix a security issue in the Bitcoin software itself.
Lower-prioritycontrib: Add bash completion for new bitcoin commandby CaesarCoder · 39668f1e · Mar 5, 2026 · 1 fileMessage 73 · AdequateInformational 16Details
Commit message · CaesarCoder
contrib: Add bash completion for new bitcoin command
Adds a bash completion script for the new bitcoin command-line tool, which unifies the main Bitcoin Core executables under a single interface. This feature improves usability, reduces errors, and makes the command-line tools more easily discoverable for users working in a Linux bash environment.
The completion script dynamically lists available commands and options by parsing `bitcoin --help` and `bitcoin help`. It also incorporates the existing bash completions for `bitcoind`, `bitcoin-cli`, and `bitcoin-tx`, depending on the argument provided (node, rpc, or tx). This ensures that all relevant completions are available seamlessly through a single interface without modifying core functionality.
No functional changes to core code are introduced; this is an optional enhancement placed under `contrib/` for easy installation and use.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 16/100
This commit adds a new bash tab-completion helper script for a new 'bitcoin' command-line wrapper tool. It only lives in the contrib/ directory (optional add-on files) and does not change any Bitcoin Core wallet, networking, or consensus code. There is no security issue visible in the change.
Security candidatefuzz: set whitelist permissions on connman targetby Bruno Garcia · 32debfa1 · Mar 5, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · Bruno Garcia
fuzz: set whitelist permissions on connman target
55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidencecredential or privilege state
AI analysis · Informational 15/100
This commit adds fuzz-testing coverage for whitelist permission settings inside a test harness. It does not change production network code, user-facing behavior, or fix a live vulnerability. It is a test-quality improvement that helps automated fuzzers explore more code paths in CConnman initialization.
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100
This commit contains only cosmetic formatting fixes: removing a blank line at the top of a header file, deleting an accidental backslash at the end of a C++ source line, and adding a trailing comma in a Python test dictionary. None of these changes affect program behavior or security.
Lower-priorityhelp: enrich help text for `-loadblock`by Hao Xu · 2e041b49 · Mar 5, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Hao Xu
help: enrich help text for `-loadblock`
`-loadblock` doesn't support obfuscated blocks, mention it in its help text to avoid troubles for users.
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode
AI analysis · Informational 15/100
This commit only changes the user-facing help text for the `-loadblock` command-line option. It adds a note that the option cannot read obfuscated (scrambled) block files. There is no code behavior change, no bug fix, and no security-relevant change.
Replace ConnectTrace with a plain std::vector<ConnectedBlock>, and rename PerBlockConnectTrace to ConnectedBlock and connectTrace to connected_blocks.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100
This commit is a simple internal code cleanup in Bitcoin Core. It removes a small wrapper class called ConnectTrace and replaces it with a plain list (std::vector) of connected blocks, renaming some variables for clarity. There is no change to network rules, transaction validation, wallet behavior, or any user-facing feature. It does not fix a bug or introduce a known security issue.
Lower-priorityExtend functional test for setBlockIndexCandidates UBby marcofleon · 20ae9b98 · Mar 4, 2026 · 1 fileMessage 83 · StrongLow 33Details
Commit message · marcofleon
Extend functional test for setBlockIndexCandidates UB
Fix the from-disk subtest to use a separate node so it builds on a clean genesis block, rather than the leftover chain from the in-memory subtest.
Change from a two-way to a three-way block race. The UB in the old LoadChainTip (mutating nSequenceId, a sort key, while the block is in setBlockIndexCandidates) corrupts the internal tree structure, resulting in a failed erase that leaves stale blocks in the set alongside the tip. With only two competing blocks, this is caught by libstdc++ but not by libc++. A three-way split triggers the bug on both implementations.
To trigger CheckBlockIndex (where the crashing assertion is), replace the restart loop with sending a new block after a single restart.
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Low 33/100
This commit only changes a test file. It improves an existing functional test that exercises a known undefined-behavior bug in Bitcoin Core's block index handling. The test now uses a separate node, creates a three-way block race instead of a two-way race, and triggers the bug more reliably across different C++ standard library implementations. It does not change production code, so it does not fix or introduce a vulnerability by itself.
Lower-priorityvalidation: fix UB in LoadChainTipby marcofleon · 854a6d5a · Mar 4, 2026 · 5 filesMessage 68 · AdequateModerate 57Details
Commit message · marcofleon
validation: fix UB in LoadChainTip
The removal of the chain tip from setBlockIndexCandidates was happening after nSequenceId was modified. Since the set uses nSequenceId as a sort key, modifying it while the element is in the set is undefined behavior, which can cause the erase to fail.
With assumeutxo, a second form of UB exists: two chainstates each have their own candidate set, but share the same CBlockIndex objects. Calling LoadChainTip on one chainstate mutates nSequenceIds that are also in the other chainstate's set.
Fix by populating setBlockIndexCandidates after all changes to nSequenceId.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Moderate 57/100
This commit fixes a low-level memory-handling bug in Bitcoin Core's startup code. When loading the chain tip, the program was changing a value (nSequenceId) that is also used to sort a set of candidate blocks, while the block was still in that set. In C++, changing a sort key while an item is in a sorted set is 'undefined behavior'—the program may crash, corrupt data, or behave unpredictably. The fix moves the population of the candidate set to after all such changes are complete. A second, related problem existed with the experimental assumeutxo feature, where two separate chain states share the same block objects and could interfere with each other's candidate sets. The patch addresses both by clearing and repopulating candidate sets at safe points.
test: Fix shutdown vptr race in BlockFilterIndexSync bench
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 18/100
This commit fixes a test-only race condition during shutdown of benchmark and unit tests that use Bitcoin Core's index objects. It adds a missing Stop() call in one benchmark and removes unnecessary synchronization comments/calls in several tests. The issue is not exploitable by users or network attackers; it only affects internal test code and could cause flaky or incorrect test results, including a potential virtual-pointer (vptr) race during benchmark teardown.
Lower-priorityvalidation: remove LoadChainTip call from ActivateSnapshotby marcofleon · 9249e608 · Mar 4, 2026 · 1 fileMessage 73 · AdequateInformational 13Details
Commit message · marcofleon
validation: remove LoadChainTip call from ActivateSnapshot
This call is a no-op. PopulateAndValidateSnapshot already sets both the chain tip and the coins cache best block to the snapshot block, so LoadChainTip always hits the early return when it finds that the two match (tip->GetBlockHash() == coins_cache.GetBestBlock()).
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validation
AI analysis · Informational 13/100
This commit removes a redundant function call and its assertion from the snapshot activation code in Bitcoin Core. The commit message explains the call was doing nothing useful because an earlier step already set the same state. There is no security-relevant change visible in the diff or commit message.
Security candidatefuzz: make sure PSBT serialization roundtripsby Antoine Poinsot · d76ec4de · Mar 4, 2026 · 1 fileMessage 70 · AdequateLow 29Details
Commit message · Antoine Poinsot
fuzz: make sure PSBT serialization roundtrips
This will prevent us from creating a serialization we do not accept going forward.
70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundaryfuzzing or regression evidencesigning or wallet path
AI analysis · Low 29/100
This commit adds a new fuzz test to Bitcoin Core that checks whether PSBT (Partially Signed Bitcoin Transaction) data can be serialized and then deserialized back to the exact same bytes. It is a defensive test meant to catch future bugs where the software might write a PSBT format it cannot later read. The commit itself does not fix any active vulnerability; it adds a regression test.
AI review queuedtest: Fix intermittent issue in wallet_assumeutxo.pyby MarcoFalke · faa68ed4 · Mar 4, 2026 · 2 filesMessage 72 · AdequateInformational 15Details
Commit message · MarcoFalke
test: Fix intermittent issue in wallet_assumeutxo.py
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit fixes a flaky automated test in Bitcoin Core. It replaces a complicated node restart/sync dance with a simpler helper that manually copies blocks between test nodes via RPC. There is no change to production code, no security fix, and no vulnerability.
Lower-prioritysubprocess: replace __USING_WINDOWS__ with WIN32by kevkevinpal · bff8a7a8 · Mar 4, 2026 · 1 fileMessage 45 · ThinInformational 18Details
Commit message · kevkevinpal
subprocess: replace __USING_WINDOWS__ with WIN32
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 18/100
This commit swaps the internal macro used to detect Windows builds in a third-party subprocess helper header. Previously the code checked for Microsoft Visual C++ or MinGW compilers to decide 'this is Windows'; now it uses the standard WIN32 macro. There is no change to actual program logic, only to the condition that selects Windows-specific versus Unix-specific code paths. It is a portability/build cleanup, not a security fix.