BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

3194 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

325security candidates672second-pass queue3017AI analyses
156commits · 30 days
322commits · 60 days
1288commits · 180 days
2834commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

71/100 average clarity
1198Strong · 80–100
1206Adequate · 60–79
702Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
merge-script2105094389
Antoine Poinsot22422170
Ava Chow20669195070
MarcoFalke41421408074
fanquake23321228058
Lőrinc18121177081
Hennadii Stepanov22816211065
rkrux57957074
Sjors Provoost89889074
Sebastian Falbesoner33733073
David Gumberg55655072
Pieter Wuille95595066
Analysis record

Published AI watches

Last scanned 21 minutes ago

Low 38 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36299: cli: Improve empty-response and fix -rpcclienttimeout regression

This update fixes two bugs in bitcoin-cli, the command-line tool used to talk to a Bitcoin node. First, when a server replied with an empty body but said it was intentionally empty (Content-Length: 0), the client would keep waiting instead…

Client-side hang on empty HTTP body (denial-of-service against bitcoin-cli user)Timeout regression could abort legitimate slow RPC responsesFix distinguishes Content-Length: 0 from absent Content-Length
dd809d2cby Ava Chow+41−232 files
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36052: ci: Doc: Move all config comments right next to the option they explain

This commit is a documentation and code-style cleanup for Bitcoin Core's continuous integration (CI) scripts. It changes how build configuration strings are formatted in shell scripts so comments can sit next to the options they describe, …

9f059527by merge-script+100−9826 files
No security note in commit
Moderate 60 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35833: log: prevent user input from injecting fake log lines

This update fixes a way that people with limited access to a Bitcoin node could make fake log entries appear real. Normally, the node cleans up special characters in log messages but was leaving newlines alone. A clever user could slip a n…

Log injection / log forgery via embedded newlines in untrusted inputInput from restricted RPC users reaching log output without newline escapingControl-character escaping bypass due to explicit newline exception
d4b0e1e4by Ava Chow+48−114 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36391: test: fix typo in rpc_psbt

This commit fixes a one-word typo in a comment inside a test file. The comment incorrectly referred to 'walletcreatepsbt' when the surrounding test code actually calls 'walletcreatefundedpsbt'. No code behavior changes, and there is no sec…

4b612c6bby merge-script+1−11 file
No security note in commit
Informational 15 AI analysisMessage 82 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: fix typo in rpc_psbt

This commit fixes a typo in a comment within a test file. The comment incorrectly referred to 'walletcreatepsbt' when the surrounding test code actually exercises 'walletcreatefundedpsbt'. No code behavior changes, and there is no security…

0a8ffe90by Bruno Garcia+1−11 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36377: doc: add 461 (Deterministic ECDSA signatures with low-R grinding) to bips.md

This commit is a documentation-only update. It adds a single line to Bitcoin Core's list of implemented BIPs, noting that BIP 461 (a technique for making ECDSA signatures smaller and deterministic) has been implemented since version 0.17.0…

e0f16ef9by merge-script+1−01 file
No security note in commit
Low 27 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36375: wallet: accept uppercase addresses without amount in sendall

This patch fixes a bug in Bitcoin Core's `sendall` wallet command. If a user typed a bech32 address in uppercase letters, the command would fail with a confusing 'below dust threshold' error instead of sending the funds. The fix compares d…

Functional bug in RPC command causing unexpected transaction failureCase-sensitivity mismatch between user input and canonical address encodingNo memory safety, cryptographic, or authorization issue evident
e7aef7e8by Ava Chow+22−52 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36381: test: avoid testing at the exact `-maxfeerate` boundary

This commit fixes a flaky automated test in Bitcoin Core. The test was checking the maximum transaction fee rate by creating a transaction at the exact boundary, which sometimes failed because the real transaction size could be slightly sm…

No production code changedTest-only changeNo memory safety, cryptography, consensus, or authorization changes
ba8fdb97by Ava Chow+1−11 file
No security note in commit
Informational 20 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36233: guix: Update time-machine to `60f6956aeffa7f30285745bd0ea615e9acfc74f8`

This is a build-system maintenance update for Bitcoin Core's reproducible build environment (Guix). It updates the Guix time-machine commit and several dependency versions, and temporarily disables some test suites that fail when building …

No direct security-relevant code change in Bitcoin Core consensus, wallet, or P2P layers.Dependency version bumps (git-minimal, linux-headers, python-lief, python-minimal) are routine build-environment updates.Disabling third-party package test suites reduces build-time test coverage but does not alter Bitcoin Core's own test or release binaries.
619185d5by merge-script+32−73 files
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36364: tools: Call SHA256AutoDetect in bitcoin-util, bitcoin-tx and bitcoin-wallet

This change makes three Bitcoin command-line tools (bitcoin-tx, bitcoin-util, and bitcoin-wallet) automatically pick the fastest SHA-256 hashing implementation available on the computer, such as hardware-accelerated versions on modern CPUs…

dc2a9987by merge-script+6−03 files
No security note in commit
Informational 23 AI analysisMessage 98 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36321: net: cast vector size to avoid overflow, truncation, sign change

This is a one-line fix in Bitcoin Core's network code. It changes how the size of a list of block headers is converted to a signed integer inside a loop. Previously, if the list was empty, the conversion could trigger undefined-behavior wa…

UndefinedBehaviorSanitizer integer sanitizer warning addressedImplicit signed/unsigned conversion in loop counterUnsigned integer wraparound on empty vector size
ced4c6e6by merge-script+1−11 file
No security note in commit
Low 32 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#34371: wallet: allow importprunedfunds for spending transactions

This change fixes a Bitcoin Core wallet bug where the `importprunedfunds` RPC command could only re-import transactions that sent money to the wallet, not transactions that spent money from it. After this fix, both incoming and outgoing tr…

Logic bug in wallet transaction import scopeIncorrect balance possible after removing and re-importing spending transactionFix routes import through existing involvement check (IsMine + IsFromMe)
ed7dd7cfby Ava Chow+36−203 files
No security note in commit
Low 28 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#29278: Wallet: Add `maxfeerate` wallet startup option

This commit adds a new Bitcoin Core wallet startup option called -maxfeerate. It lets users set a maximum fee rate (fee per unit of transaction size) that the wallet will allow when creating or broadcasting transactions. Previously, the wa…

New wallet startup option -maxfeerate to cap transaction fee rateNew transaction error type MAX_FEE_RATE_EXCEEDEDBroadcastTransaction now checks both max absolute fee and max fee rate
f80aaf4bby Ava Chow+303−7930 files
No security note in commit
Moderate 64 AI analysisMessage 86 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35984: sign: skip signing SIGHASH_SINGLE inputs with no corresponding output

This Bitcoin Core update fixes a wallet-signing quirk. When a user chose the SIGHASH_SINGLE signature mode, an input that had no matching output index would sign essentially nothing meaningful. That signature could then stay valid even if …

Funds-redirection footgun from SIGHASH_SINGLE signatures with no committed outputInconsistent guard between SignTransaction and SignPSBTInput pathsFix centralizes the guard in the low-level signature creator to cover future signing paths
e19f83e9by Ava Chow+37−82 files
Vendor flagged security relevance
Low 35 AI analysisMessage 86 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35696: i2p: update leaseset encryption types

This change updates Bitcoin Core's I2P (Invisible Internet Project) privacy network settings to use newer, stronger encryption for the published 'leaseset' that describes how other peers can contact a node. The old setting included ElGamal…

Cryptographic algorithm update (ElGamal to MLKEM-768)Use of I2P 'legacy' encryption type removedConfiguration-only change in network privacy layer
65e075f8by Ava Chow+2−21 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35948: init: correct first-run disk space estimate

This change fixes a labeling bug in Bitcoin Core's first-run disk-space warning. The estimate was stored in GiB (binary gigabytes, 1024-based) but displayed as GB (decimal gigabytes, 1000-based), and for pruned nodes it showed the full-cha…

d26f19c7by Ava Chow+5−42 files
No security note in commit
Low 44 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36284: wallet: don't double discard output groups with avoidpartialspends

This is a wallet bug, not a theft or remote-code bug. When a Bitcoin Core user turns on the optional 'avoidpartialspends' or 'avoid_reuse' setting, an output group rejected during coin selection could be counted twice as 'discarded.' That …

Logic error causing double-counting of discarded UTXO groupsCan trigger false 'insufficient funds' failure in coin selectionAffects avoidpartialspends / avoid_reuse wallets only
e8e7e91aby Ava Chow+43−14 files
No security note in commit
Informational 18 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35890: doc: use overwrite (>) instead of append (>>) for one-shot PSBT files in offline-signing-tutorial.md

This is a documentation-only fix in a tutorial file. It changes two shell examples from using '>>' (append to file) to '>' (overwrite file). If a user followed the old instructions and ran the same command twice, the file would contain two…

No security signal: change is limited to documentationNo code changes to Bitcoin Core binaries, RPC, wallet, or consensus logicNo cryptographic, network, or privilege-boundary implications
bfdcd979by merge-script+2−21 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35675: mining: add block template manager

This is a large internal code reorganization (refactor) in Bitcoin Core. It creates a new BlockTemplateManager class that takes over block-template creation, block submission, and tip-waiting helpers that were previously spread across seve…

Large refactor touching mining, RPC, interfaces, and test shutdown pathsNew object lifetime dependency: BlockTemplateManager holds references to mempool, chainman, and notifications; explicit reset ordering added in Shutdown/InitAndLoadChainstate/test setupsRemoval of early-init node.mining interface; BlockTemplateManager is now created after chainstate load, with a comment that it must exist before setChainstateLoaded(true) unblocks IPC waiters
5c726f20by Ryan Ofsky+561−44926 files
No security note in commit
Informational 12 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35301: Silent Payments: Implement bip352 (take 2)

This commit adds the first implementation of BIP352 (Silent Payments) to Bitcoin Core. Silent Payments are a new type of privacy-preserving Bitcoin address that lets someone receive payments without publicly revealing a fixed address. The …

New cryptographic feature implementation (BIP352 Silent Payments)Extensive use of secp256k1 silentpayments moduleInput public key extraction from P2PKH, P2WPKH, P2SH-P2WPKH, and P2TR inputs
be5d0b55by Ava Chow+6951−010 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedtest: avoid interface_ipc.py race and null pointer dereferenceby Ryan Ofsky · 1c1de334 · Mar 2, 2026 · 1 fileMessage 100 · StrongInformational 16Details
Commit message · Ryan Ofsky

test: avoid interface_ipc.py race and null pointer dereference

Avoid race condition in run_deprecated_mining_test caused by creating and
immediately destroying an unused worker thread. This leads to test failures
reported by maflcko in #34711

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 16/100

This is a fix for a flaky Bitcoin Core functional test, not a security vulnerability in the live Bitcoin network or wallet software. The test was creating and immediately destroying an unused worker thread, which could trigger a race condition or null pointer dereference during testing. The patch avoids the problematic helper function and directly creates the needed connection. It does not affect production code paths.

Lower-prioritydepends: Allow building Qt packages after interruptionby Hennadii Stepanov · 2a7a4f60 · Mar 2, 2026 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · Hennadii Stepanov

depends: Allow building Qt packages after interruption

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This change simply makes the Bitcoin Core build system more forgiving when compiling Qt-related dependencies. If a previous build was interrupted, the directories it needs to create might already exist; the new commands won't fail in that case. It is a build reliability fix, not a security fix.

Lower-prioritydoc: explain swapping in `reduce-memory.md`by Lőrinc · a61907e5 · Mar 2, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Lőrinc

doc: explain swapping in `reduce-memory.md`

Document what swapping is and why it can severely degrade `bitcoind` performance.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds documentation to a user guide about how operating-system swapping can slow down Bitcoin Core. It is a non-code change with no security implications.

AI review queuedtest: improve `wallet_backup` testby rkrux · 5c005363 · Mar 2, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · rkrux

test: improve `wallet_backup` test

Remove the unused functions that were ported many years back.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only cleans up an unused helper functions in a test file and fixes a grammar typo in a comment. It does not change any production code, network behavior, or wallet logic, so it has no security relevance.

AI review queuedtest: improve `wallet_assumeutxo` func testby rkrux · 04d95157 · Mar 2, 2026 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · rkrux

test: improve `wallet_assumeutxo` func test

Reduce the number of blocks that need to be generated before pruning
the blockchain.

Unload the wallet that was restored in a prior test because it is not
needed anymore after the test.

Both the above steps should reduce the number of chain notifications
that need to be processed by the wallet(s) when an erroneous scenario
of restoring wallet is checked.

100/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes a single functional test file. It reduces the number of blocks generated in a test from 500 to 200 and unloads a wallet earlier to make the test run faster and produce fewer chain notifications. There is no change to production code, no bug fix, and no security-relevant behavior change.

AI review queueddoc: Improve dependencies.md IPC documentationby Ryan Ofsky · b87a1c27 · Mar 1, 2026 · 1 fileMessage 76 · AdequateInformational 15Details
Commit message · Ryan Ofsky

doc: Improve dependencies.md IPC documentation

Improve dependencies.md to document IPC dependencies better:

- Link to native_capnp.mk file not capnp.mk file so it's possible to see what
version of Cap'n Proto is being used in release binaries. This is important
since #31895 dropped the "Version Used" column and the capnp.mk file does not
include version number.
- Indicate Capn"Proto is used for IPC and link to multiprocess.md documenting
the feature.
- Link to correct PR requiring Cap'n Proto 0.7.1. Previous link was
pointing at PR which required 0.7.0.
- Mention libmultiprocess as a dependency even though it is included as a git
subtree and can be built as a cmake subproject. Libmultiprocess still needs
to be built separately when cross compiling, and is useful to build separately
when developing, and is still a depends package.

Based on 2cf352fd8e6a77003e38d954b6c879b20d4b960a from #33623 by willcl-ark
which made similar changes in the 29.x branch.

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit is a documentation-only update to the Bitcoin Core dependencies guide. It fixes links, adds a missing dependency entry for libmultiprocess, and clarifies that Cap'n Proto is used for inter-process communication (IPC). No code was changed, so there is no direct security impact.

Lower-prioritydoc: Fix `fee` field in `getblock` RPC resultby nervana21 · f580cc7e · Mar 1, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · nervana21

doc: Fix `fee` field in `getblock` RPC result

The `fee` field in the `getblock` RPC result (verbosity 2 and 3) may be
omitted when block undo data is not available. Marking it optional in
the `RPCResult` aligns the documented schema with the runtime behavior.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a one-line documentation fix. It marks the 'fee' field in the getblock RPC help output as optional, matching the actual behavior where the field is omitted when block undo data is not available. There is no code behavior change and no security impact.

Lower-prioritydoc: add release notes for dbcache bumpby Andrew Toth · 4ae9a10a · Feb 28, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Andrew Toth

doc: add release notes for dbcache bump

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds documentation. It creates a release note explaining that the default database cache size setting (-dbcache) has been raised from 450 MB to 1024 MB on systems with at least 4 GB of RAM. There is no code change, no bug fix, and no security issue in this commit itself.

Lower-prioritydoc: mention Miniscript expressions inside referenceby Pieter Wuille · 37d49f5d · Feb 28, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Pieter Wuille

doc: mention Miniscript expressions inside reference

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This is a one-line documentation update that adds a reference to Miniscript expressions in the descriptors documentation. It does not change any code, executable logic, or configuration. There is no security relevance.

Lower-prioritydoc: fix typo in descriptors.mdby Pieter Wuille · 771f7642 · Feb 28, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Pieter Wuille

doc: fix typo in descriptors.md

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit fixes a single grammar typo in a documentation file, changing 'first 32 bit' to 'first 32 bits'. It does not change any code, executable logic, or security behavior.

Lower-prioritydoc: reference descriptor BIPs in descriptors.mdby Pieter Wuille · 708b8499 · Feb 28, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Pieter Wuille

doc: reference descriptor BIPs in descriptors.md

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates the documentation file doc/descriptors.md. It adds hyperlinks to the relevant Bitcoin Improvement Proposals (BIPs) for each descriptor type and makes minor formatting changes (for example, adding a space in 'BIP174' to 'BIP 174'). No code, logic, or behavior of the Bitcoin Core software was changed. There is no security impact.

Lower-prioritydoc: do not list descriptor RPCs or historyby Pieter Wuille · 8f2a869a · Feb 28, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Pieter Wuille

doc: do not list descriptor RPCs or history

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only edits documentation. It removes a list of Bitcoin Core RPC commands that support output descriptors and shortens the introduction. No code, RPC behavior, or security logic was changed.

Lower-prioritydoc: mention musig() in descriptors.mdby Pieter Wuille · 65a8b6c2 · Feb 28, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Pieter Wuille

doc: mention musig() in descriptors.md

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates documentation. It adds two lines to the descriptors.md file explaining that the musig() expression is supported in output descriptors for MuSig2 key aggregation. There is no code change, no bug fix, and no security issue.

Lower-prioritydoc: update dbcache default in reduce-memory.mdby Andrew Toth · c510d126 · Feb 28, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Andrew Toth

doc: update dbcache default in reduce-memory.md

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This is a one-line documentation update that corrects the described default value of a memory-cache setting. It does not change any code, behavior, or configuration. There is no security issue.

Lower-priorityqt: show GetDefaultDBCache() in settingsby Andrew Toth · 027cac85 · Feb 28, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Andrew Toth

qt: show GetDefaultDBCache() in settings

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is a tiny user-interface change in Bitcoin Core's settings screen. It makes the displayed default database cache size match the value calculated by a shared helper function, instead of a hardcoded constant. There is no security issue visible in the change.

Lower-prioritydbcache: bump default from 450MB -> 1024MB if enough memoryby Andrew Toth · 5b34f251 · Feb 28, 2026 · 3 filesMessage 65 · AdequateInformational 19Details
Commit message · Andrew Toth

dbcache: bump default from 450MB -> 1024MB if enough memory

If dbcache is unset, bump default from 450MB to 1024MB on 64-bit systems
that have at least 4GB of detected RAM.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 19/100

This change simply raises the default database cache size for Bitcoin Core from 450 MB to 1,024 MB on 64-bit computers that have at least 4 GB of RAM. It is a performance tuning change, not a security fix. There is no indication it addresses a vulnerability or was triggered by a security report.

Lower-priorityscript: Fix undefined behavior in Clone() -- std::transform writes past end of empty vectorby Weixie Cui · 44feab23 · Feb 28, 2026 · 1 fileMessage 50 · ThinLow 49Details
Commit message · Weixie Cui

script: Fix undefined behavior in Clone() -- std::transform writes past end of empty vector

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 49/100

This commit fixes a programming bug in Bitcoin Core's descriptor code where a vector was reserved but never resized before being written to. Using std::transform with providers.begin() on an empty vector causes undefined behavior because it writes past the end of the vector. The fix uses std::back_inserter to safely append elements. The bug could cause crashes or memory corruption when cloning certain wallet descriptors, but it is not a remote exploit by itself.

Lower-prioritybitcoin-gui: Implement missing Init::makeMining methodby Ryan Ofsky · 4565cff7 · Feb 27, 2026 · 1 fileMessage 93 · StrongLow 26Details
Commit message · Ryan Ofsky

bitcoin-gui: Implement missing Init::makeMining method

A missing Init::makeMining implementation was causing internal code using the
mining interface (like the `waitforblockheight` RPC method) to not work when
running inside the `bitcoin-gui` binary. It was working the other bitcoin
binaries ('bitocind`, `bitcoin-qt`, and `bitcoin-node`) because they
implmemented `Init::makeMining` methods in commit
8ecb6816781c7c7f423b501cbb2de3abd7250119 from #30200, but the `bitcoin-gui`
init class was forgotten in that change.

This bug was reported by Matthew Zipkin <pinheadmz@gmail.com>
https://github.com/bitcoin/bitcoin/pull/32297#pullrequestreview-2932651216

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Low 26/100

This commit fixes a simple oversight: the bitcoin-gui program was missing a factory method that creates the 'mining' interface. Because that interface was absent, some internal code paths—such as the waitforblockheight RPC—did not work when running inside bitcoin-gui, even though they worked in bitcoind, bitcoin-qt, and bitcoin-node. The patch adds the missing one-line method and its header include. It is a functionality bug, not an obvious security vulnerability, but any broken RPC path can have downstream reliability or, in rare cases, security-adjacent effects.

AI review queuedrefactor: Add ExecuteHTTPRPC functionby Ryan Ofsky · df76891a · Feb 27, 2026 · 4 filesMessage 70 · AdequateInformational 13Details
Commit message · Ryan Ofsky

refactor: Add ExecuteHTTPRPC function

Add ExecuteHTTPRPC to provide a way to execute an HTTP request without relying
on HTTPRequest and libevent types.

Behavior is not changing in any way, this is just moving code. This commit may
be easiest to review using git's --color-moved option.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 13/100

This commit is a code cleanup that splits the existing JSON-RPC request handling into a new helper function called ExecuteHTTPRPC. The commit message explicitly says behavior is not changing, and the diff shows the same logic being moved around rather than added or removed. There is no indication of a security fix or vulnerability.

Lower-priorityipc: Add MakeBasicInit functionby Ryan Ofsky · 3cd1cd3a · Feb 27, 2026 · 2 filesMessage 78 · AdequateInformational 15Details
Commit message · Ryan Ofsky

ipc: Add MakeBasicInit function

Add a MakeBasicInit() function so simpler standalone IPC clients like
bitcoin-mine in #30437 and bitcoin-cli in #32297 that only initiate IPC
connections without exposing any IPC interfaces themselves can to avoid needing
to implement their own specialized interfaces::Init subclasses.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit adds a small helper function that makes it easier for simple Bitcoin tools (like command-line utilities) to connect to other Bitcoin processes over IPC without needing to write boilerplate setup code. It does not change existing behavior or fix any bug; it is purely a code organization and convenience addition.

Lower-prioritytest: add interface_ipc_cli.py testing bitcoin-cli -ipcconnectby Ryan Ofsky · fbea576c · Feb 27, 2026 · 3 filesMessage 87 · StrongInformational 15Details
Commit message · Ryan Ofsky

test: add interface_ipc_cli.py testing bitcoin-cli -ipcconnect

Co-authored-by: Sjors Provoost <sjors@sprovoost.nl>

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds new automated tests for the bitcoin-cli command-line tool's IPC (inter-process communication) connection feature. It does not change any production code, so it cannot introduce a security vulnerability or fix one in the software users run.

Lower-priorityipc: Improve -ipcconnect error checkingby Ryan Ofsky · 0448a19b · Feb 27, 2026 · 1 fileMessage 90 · StrongInformational 18Details
Commit message · Ryan Ofsky

ipc: Improve -ipcconnect error checking

When an invalid socket path is passed to -ipcconnect, either because the path
exceeds the maximum socket length, or the path includes a directory component
which is not actually a directory, treat this the same as the same as the
socket refusing connections or not existing, instead of treating it like a more
serious I/O error and throwing a fatal exception.

This is needed to avoid CI errors after the following commit which adds a
functional test and uses -datadir paths exceeding the maximum socket length
when running in CI.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 18/100

This change makes Bitcoin Core handle two specific invalid -ipcconnect socket path cases more gracefully. Previously, a socket path that was too long or pointed to a non-directory component would crash the process with a fatal error. Now, when the connection type is set to 'auto', these cases are treated like a missing or refusing socket, and the program simply returns null instead of crashing. The commit message says this is mainly to avoid CI test failures caused by long data directory paths, not to fix a security vulnerability.

Lower-prioritybitcoin-cli: Add -ipcconnect optionby Ryan Ofsky · 8d614bfa · Feb 27, 2026 · 4 filesMessage 86 · StrongInformational 20Details
Commit message · Ryan Ofsky

bitcoin-cli: Add -ipcconnect option

This implements an idea from Pieter Wuille <pieter@wuille.net>
https://github.com/bitcoin/bitcoin/issues/28722#issuecomment-2807026958 to
allow `bitcoin-cli` to connect to the node via IPC instead of TCP, if the
`ENABLE_IPC` cmake option is enabled and the node has been started with
`-ipcbind`.

The feature can be tested with:

build/bin/bitcoin-node -regtest -ipcbind=unix -debug=ipc
build/bin/bitcoin-cli -regtest -ipcconnect=unix -getinfo

The `-ipconnect` parameter can also be omitted, since this change also makes
`bitcoin-cli` prefer IPC over HTTP by default, and falling back to HTTP if an
IPC connection can't be established.

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 20/100

This commit adds a new command-line option to bitcoin-cli that lets it talk to a local Bitcoin node over a local inter-process communication (IPC) socket instead of the usual network HTTP connection. It is a feature addition, not a fix for a known bug or vulnerability. The change is opt-in at build time and runtime, and it does not appear to introduce an obvious security flaw, but it does add new code paths for authentication and transport that need careful review.

Lower-priorityipc: Expose an RPC interface over the -ipcbind socketby Ryan Ofsky · 6a548348 · Feb 27, 2026 · 12 filesMessage 65 · AdequateLow 35Details
Commit message · Ryan Ofsky

ipc: Expose an RPC interface over the -ipcbind socket

This allows `bitcoin-cli` to connect to the node via IPC instead TCP to execute
RPC methods in an upcoming commit.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Low 35/100

This commit adds a new way for local programs to talk to Bitcoin Core: instead of connecting over a regular network port, they can connect through a Unix socket file using a feature called -ipcbind. The commit itself is a building block for a later change that will let bitcoin-cli use this socket. The code exposes the same RPC commands that already exist, but over the local socket. The commit also updates the help text to warn that any local process that can reach the socket gets unauthenticated RPC access, so the socket file's permissions matter.

AI review queuedfuzz: wallet: add target for `MigrateToDescriptor`by brunoerg · 779e7825 · Feb 27, 2026 · 1 fileMessage 60 · AdequateInformational 14Details
Commit message · brunoerg

fuzz: wallet: add target for `MigrateToDescriptor`

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 14/100

This commit adds a new automated fuzz test for Bitcoin Core's wallet migration feature. It does not change production wallet code; it only adds test code that feeds random inputs to the existing migration function to help find bugs. There is no indication this commit fixes or introduces a security vulnerability.