BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

2902 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

254security candidates607second-pass queue2881AI analyses
192commits · 30 days
486commits · 60 days
1502commits · 180 days
2875commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
939Strong · 80–100
1188Adequate · 60–79
687Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot22422170
Ava Chow15750157064
MarcoFalke41021406074
Lőrinc17721177081
fanquake22719226057
Hennadii Stepanov20914208063
rkrux57957074
Sjors Provoost89889074
Sebastian Falbesoner33733073
David Gumberg55655072
Pieter Wuille95595066
Hodlinator66566076
Analysis record

Published AI watches

Last scanned 31 minutes ago

Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35928: doc: mention -DWITH_ZMQ=ON in macOS build guide

This is a one-line documentation update to the macOS build guide. It adds a note telling users to pass a specific CMake option if they want ZeroMQ notification support. There is no code change and no security impact.

8397e09eby merge-script+1−11 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35482: fuzz: exercise the transaction-handling path in process_message(s)

This commit only changes Bitcoin Core's internal fuzz testing code. It makes the fuzz tests exercise more of the transaction-handling code path by toggling Initial Block Download mode and resetting the mempool between test runs. There is n…

No production code modifiedNo consensus, validation, net_processing, or wallet logic changedOnly fuzz test harnesses and test utilities affected
f11dc617by merge-script+105−798 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35914: test, fuzz: Remove unused variables

This commit removes unused variables from Bitcoin Core's test and fuzzing code. It is a cleanup/refactoring change with no effect on the live network software or user funds. It does not fix or introduce any security vulnerability.

d36bf709by merge-script+1−138 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35896: refactor: Default uint256::operator==, add operator<=>

This commit is a routine code cleanup in Bitcoin Core. It switches the uint256 equality and comparison operators to use standard C++20 defaults, removes an old custom Compare() helper, and marks an internal assertion-failure function as ne…

ed2c59abby merge-script+99−245 files
No security note in commit
Moderate 62 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35872: rpc: avoid descriptor range counter overflow

This update fixes a counting bug in several Bitcoin Core RPC commands that scan descriptors. When a user requested a descriptor range ending at the maximum allowed value (2,147,483,647), the internal counter used a smaller integer type and…

Signed integer overflow in descriptor expansion loopCrash/undefined behavior on maximum-range descriptor scansAuthenticated RPC surface affected (scantxoutset, scanblocks, getdescriptoractivity, utxoupdatepsbt, descriptorprocesspsbt)
b388674aby Ava Chow+3−12 files
Vendor flagged security relevance
Informational 19 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35842: rpc: Properly make RPCResult::Type::ANY non-test-only

This is a small cleanup and documentation fix for Bitcoin Core's RPC help system. It removes a comment that incorrectly said a certain output type was 'for testing only' and makes the help text properly display those outputs. There is no d…

No memory safety, cryptography, consensus, or authorization changes observedChange is confined to RPC help/schema metadata generationComment-only/type-label change from 'for testing only' to general use
c36ffd87by merge-script+42−364 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

This is a code cleanup change that turns on a static-analysis rule to prevent a specific C++ coding pattern (anonymous namespaces in header files) and updates two headers to comply. It does not change how Bitcoin Core behaves at runtime an…

No security-relevant code changeNo memory safety, cryptography, consensus, or network changesTooling-only refactor (clang-tidy configuration)
c4fbd3c7by merge-script+9−123 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

This commit only adds new test cases to Bitcoin Core's functional test suite. It does not change any production wallet, node, or RPC code. The tests verify that the importdescriptors RPC reports errors in the right order, rejects bad times…

465196d0by merge-script+77−11 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35180: coins: group private cache helpers

This change is purely a code cleanup: it moves two internal helper functions of a Bitcoin Core cache class into the private section of the class and removes a duplicate 'private:' label. There is no change to what the code does, no bug fix…

c940fd75by merge-script+13−141 file
No security note in commit
Low 29 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

This Bitcoin Core change tightens how three RPC commands (scantxoutset, scanblocks, deriveaddresses) handle the value null when it is passed for optional parameters. Previously, explicitly passing null could be treated differently from sim…

RPC parameter validation changeNull value handling changeAddition of explicit error checks for missing required contextual parameters
3db96eb5by merge-script+18−75 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable misc-definitions-in-headers

This commit is a code cleanup: it turns on a clang-tidy style check called 'misc-definitions-in-headers' and suppresses that check around a large inline implementation block in a benchmark header. There is no change to Bitcoin's runtime be…

fa93132dby MarcoFalke+3−02 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable clang-tidy rule to reject anon namespace in header

This commit only changes a linting configuration file for the project's code style checker. It enables a rule that prevents anonymous namespaces from being used in header files, which is a code-quality and build-hygiene practice. There is …

No security-relevant signals in the diff or commit message.Change is purely a static-analysis/linting configuration update.
fa5ca877by MarcoFalke+2−11 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use C++20 std::identity over IntIdentity

This commit is a straightforward code cleanup: it replaces a small custom helper named IntIdentity with the standard C++20 std::identity from the <functional> header. The behavior of the ConvertBits function is unchanged; only the implemen…

fafe5042by MarcoFalke+4−111 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test the result order of a multiple import request is correct

This commit only adds a new automated test to Bitcoin Core. It checks that when a user asks the wallet to import multiple descriptors at once, the list of results comes back in the same order as the original request, including any error me…

3ac8b806by Pol Espinasa+40−01 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test invalid or missing timestamp throws importdescriptors

This commit only adds new automated tests for the Bitcoin Core wallet's importdescriptors RPC. It checks that the command correctly rejects requests with a missing or invalid timestamp. No production wallet code is changed, so this cannot …

No changes to consensus, networking, wallet logic, or cryptographyOnly functional test code is modifiedAdded assertions are for expected error handling paths
e4732bf0by Pol Espinasa+28−11 file
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Remove unused #include in common/system

This is a minor code cleanup that removes one unused header file include and swaps another for a more specific one. It does not change any program behavior or fix any security issue.

fa7304f3by MarcoFalke+1−22 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

iwyu: Fix warnings in `src/consensus` and treat them as errors

This commit is a routine code cleanup: it adjusts which C++ header files are included in several consensus-related source files and turns on a stricter compiler hygiene check (Include What You Use, or IWYU) for the src/consensus directory.…

13b53f8bby Hennadii Stepanov+42−79 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: don't connman.ReceiveMsgFrom oversized msg

This is a small fix to a Bitcoin Core fuzz test (an automated internal testing harness), not to the live network code. The fuzzer was sometimes creating fake P2P messages larger than the real protocol allows and passing them into a test he…

Test-only fuzz harness hardeningOversized message guard added before ReceiveMsgFrom() in fuzz targetNo change to production P2P message acceptance logic
bb19f1daby Greg Sanders+5−01 file
No security note in commit
Informational 15 AI analysisMessage 97 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: Temporarily remove riscv32 config from GHA matrix

This commit simply removes one failing test configuration (RISC-V 32-bit bare metal) from the project's GitHub Actions CI matrix because it was failing. It is a routine CI maintenance change with no security implications.

fa06ea42by MarcoFalke+0−61 file
No security note in commit
Low 47 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: verify cross-build SDK archives

This change adds checksum verification to the build system's downloads of Apple, FreeBSD, NetBSD, and OpenBSD software development kits (SDKs). Before this patch, those SDK archives were downloaded at build time and extracted without confi…

Adds cryptographic digest verification for downloaded SDK archivesRemoves unchecked extraction of remote SDK archives in CIHardens CI supply chain for macOS/BSD cross-builds
873550beby Lőrinc+25−126 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityEliminate CheckPackageLimits, which no longer does anythingby Suhas Daftuar · 1902111e · Nov 18, 2025 · 4 filesMessage 50 · ThinInformational 15Details
Commit message · Suhas Daftuar

Eliminate CheckPackageLimits, which no longer does anything

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit removes a function called CheckPackageLimits that, according to the commit title and message, no longer did anything useful. The function body simply returned success without performing any checks, and callers were already using other mechanisms (like CheckPolicyLimits) for the relevant limits. This is a straightforward code cleanup with no apparent security impact.

Lower-priorityFix miniminer_tests to work with cluster limitsby Suhas Daftuar · 1ca4f010 · Nov 18, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Suhas Daftuar

Fix miniminer_tests to work with cluster limits

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes a test file (miniminer_tests.cpp) so that existing unit tests still pass after a new mempool 'cluster limit' rule was introduced. It does not change any production code that runs on real Bitcoin nodes, so it cannot directly affect live network security or be exploited by attackers.

Lower-priorityRework RBF and TRUC validationby Suhas Daftuar · 3a646ec4 · Nov 18, 2025 · 6 filesMessage 90 · StrongModerate 63Details
Commit message · Suhas Daftuar

Rework RBF and TRUC validation

Calculating mempool ancestors for a new transaction should not be done until
after cluster size limits have been enforced, to limit CPU DoS potential.

Achieve this by reworking TRUC and RBF validation logic:

- TRUC policy enforcement is now done using only mempool parents of
new transactions, not all mempool ancestors (note that it's fine to calculate
ancestors of in-mempool transactions, if the number of such calls is
reasonably bounded).
- RBF replacement checks are performed earlier (which allows for checking
cluster size limits earlier, because cluster size checks cannot happen until
after all conflicts are staged for removal).
- Verifying that a new transaction doesn't conflict with an ancestor now
happens later, in AcceptSingleTransaction() rather than in PreChecks(). This
means that the test is not performed at all in AcceptMultipleTransactions(),
but in package acceptance we already disallow RBF in situations where a
package transaction has in-mempool parents.

Also to ensure that all RBF validation logic is applied in both the single
transaction and multiple transaction cases, remove the optimization that skips
the PackageMempoolChecks() in the case of a single transaction being validated
in AcceptMultipleTransactions().

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Moderate 63/100

This Bitcoin Core commit reorders and reworks how two new transaction-handling features—RBF (Replace-By-Fee) and TRUC (a restricted version-3 transaction policy)—are validated. The main goal is to avoid doing expensive 'ancestor' calculations on the whole mempool until cheaper cluster-size checks have already run, so a maliciously crafted transaction can't waste a node's CPU as easily. It also makes sure the same RBF checks apply whether one transaction or a whole package is being accepted, and moves a 'spends a transaction it is replacing' check to a later, safer point.

Lower-priorityMake getting parents/children a function of the mempool, not a mempool entryby Suhas Daftuar · 19b84798 · Nov 18, 2025 · 5 filesMessage 50 · ThinInformational 15Details
Commit message · Suhas Daftuar

Make getting parents/children a function of the mempool, not a mempool entry

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup in Bitcoin Core. It moves two helper functions—one that finds child transactions and one that finds parent transactions—from being methods on individual mempool entries to being methods on the mempool itself. The behavior is essentially the same; only the code organization and the caller syntax change. There is no indication this fixes a security bug or changes network behavior.

Lower-priorityRework truc_policy to use descendants, not childrenby Suhas Daftuar · 5560913e · Nov 18, 2025 · 1 fileMessage 50 · ThinLow 42Details
Commit message · Suhas Daftuar

Rework truc_policy to use descendants, not children

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 42/100

This commit fixes how Bitcoin Core counts the descendants of a special transaction type (TRUC) in the memory pool. Previously it looked only at direct children, which could miss deeper descendants introduced by blockchain reorganizations. The change makes the limit enforcement more accurate and adds a lock to prevent race conditions while checking the pool. It is a correctness and robustness improvement rather than a clear, exploitable vulnerability.

Lower-priorityUse txgraph to calculate descendantsby Suhas Daftuar · a4458d6c · Nov 18, 2025 · 1 fileMessage 45 · ThinInformational 16Details
Commit message · Suhas Daftuar

Use txgraph to calculate descendants

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 16/100

This commit simplifies how Bitcoin Core's memory pool (mempool) calculates the descendants of a transaction. It replaces a manual tree-walking routine with a call to a dedicated transaction graph component (m_txgraph). There is no direct evidence in the commit that this fixes a security bug; it appears to be a code cleanup or refactoring change.

Lower-priorityUse txgraph to calculate ancestorsby Suhas Daftuar · c8b6f70d · Nov 18, 2025 · 4 filesMessage 45 · ThinInformational 12Details
Commit message · Suhas Daftuar

Use txgraph to calculate ancestors

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100

This commit is a routine internal refactoring in Bitcoin Core's memory pool (mempool) code. It replaces one way of calculating transaction ancestors with a newer shared component called txgraph. The visible behavior for users and network peers should stay the same. There is no indication this fixes a security bug or introduces a vulnerability.

Lower-prioritySimplify ancestor calculation functionsby Suhas Daftuar · 241a3e66 · Nov 18, 2025 · 6 filesMessage 70 · AdequateInformational 19Details
Commit message · Suhas Daftuar

Simplify ancestor calculation functions

Now that ancestor calculation never fails (due to ancestor/descendant limits
being eliminated), we can eliminate the error handling from
CalculateMemPoolAncestors.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 19/100

This commit is a routine code cleanup in Bitcoin Core's memory pool (mempool) logic. It removes error-handling paths from functions that calculate transaction ancestors, because a previous design change made those errors impossible. The commit does not introduce new behavior or fix a security bug; it simplifies the code after ancestor/descendant limits were removed elsewhere.

AI review queuedMake removeConflicts privateby Suhas Daftuar · b9cec7f0 · Nov 18, 2025 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Suhas Daftuar

Make removeConflicts private

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit simply moves a single internal helper function, removeConflicts, from the public section of a C++ class to the private section in the header file. It does not change what the function does, how it behaves, or any executable code. It is a routine encapsulation/cleanup change with no security effect.

Lower-priorityRemove unused limits from CalculateMemPoolAncestorsby Suhas Daftuar · 0402e6c7 · Nov 18, 2025 · 6 filesMessage 50 · ThinInformational 15Details
Commit message · Suhas Daftuar

Remove unused limits from CalculateMemPoolAncestors

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is a routine code cleanup in Bitcoin Core. It removes an unused 'limits' parameter from several mempool ancestor-calculation functions and their callers. The actual mempool policy limits are still enforced elsewhere, so this change does not alter network rules or introduce a security issue.

Lower-priorityRemove mempool logic designed to maintain ancestor/descendant stateby Suhas Daftuar · 08be765a · Nov 18, 2025 · 3 filesMessage 50 · ThinLow 25Details
Commit message · Suhas Daftuar

Remove mempool logic designed to maintain ancestor/descendant state

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 25/100

This commit removes old bookkeeping code in Bitcoin Core's transaction memory pool (mempool) that tracked the cumulative size, fees, and counts of related transactions (ancestors and descendants). The project is moving this responsibility to a newer component called txgraph. The removed functions are left as empty stubs, meaning they no longer do anything. On its own, this is a cleanup/refactoring change, not a direct security fix, but it alters internal accounting that other parts of the mempool rely on. Without seeing the txgraph replacement and the rest of the surrounding work, it is hard to tell whether any edge cases in fee/size accounting could be affected.

Lower-priorityRemove unused members from CTxMemPoolEntryby Suhas Daftuar · fc4e3e6b · Nov 18, 2025 · 2 filesMessage 45 · ThinInformational 15Details
Commit message · Suhas Daftuar

Remove unused members from CTxMemPoolEntry

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit removes several unused internal accounting fields from Bitcoin Core's memory pool transaction entry class. It is a straightforward code cleanup: fields that tracked descendant and ancestor transaction sizes, fees, and counts are deleted, and the methods that updated them are left empty. There is no security-relevant change visible in the diff.

Lower-prioritymempool: eliminate accessors to mempool entry ancestor/descendant cached stateby Suhas Daftuar · ff3b398d · Nov 18, 2025 · 2 filesMessage 50 · ThinInformational 12Details
Commit message · Suhas Daftuar

mempool: eliminate accessors to mempool entry ancestor/descendant cached state

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100

This commit removes several read-only getter methods from Bitcoin Core's memory pool (mempool) transaction entry class and deletes the corresponding consistency checks in the mempool's internal validation routine. It is a code cleanup/refactoring change: the cached ancestor and descendant statistics are no longer exposed through public accessors, and the debug-only `check()` function no longer independently recomputes those statistics to verify them. There is no change to network behavior, consensus rules, or how transactions are accepted.

Lower-priorityEliminate use of cached ancestor data in miniminer_tests and truc_policyby Suhas Daftuar · b9a2039f · Nov 18, 2025 · 7 filesMessage 50 · ThinLow 28Details
Commit message · Suhas Daftuar

Eliminate use of cached ancestor data in miniminer_tests and truc_policy

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 28/100

This commit refactors how Bitcoin Core's mempool counts transaction ancestors and descendants. It replaces some uses of internally cached counts with freshly calculated counts from a newer transaction graph structure. The change is mostly cleanup and test adaptation, but it touches the TRUC (v3 transaction) policy rules that limit how many related transactions can be in the mempool. There is no clear security bug fixed here, but the change is in a security-sensitive area (mempool policy), so it deserves careful review.

Lower-prioritymempool: Remove unused function CalculateDescendantMaximumby Suhas Daftuar · ba09fc97 · Nov 18, 2025 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · Suhas Daftuar

mempool: Remove unused function CalculateDescendantMaximum

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit simply deletes a private helper function called CalculateDescendantMaximum from Bitcoin Core's memory pool code because nothing in the program was using it anymore. It is a routine cleanup change with no visible security effect.

Lower-prioritywallet: Replace max descendant count with cluster_countby Suhas Daftuar · 8e49477e · Nov 18, 2025 · 4 filesMessage 73 · AdequateInformational 18Details
Commit message · Suhas Daftuar

wallet: Replace max descendant count with cluster_count

With the descendant size limits removed, replace the concept of "max number of
descendants of any ancestor of a given tx" with the cluster count of the cluster
that the transaction belongs to.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit is a code cleanup in Bitcoin Core's transaction memory pool (mempool). It swaps one internal measurement—'maximum descendants'—for a newer equivalent called 'cluster count' after an older size limit was removed. The change is mostly renaming and updating tests to match; it does not appear to fix a security bug or introduce an obvious vulnerability.

Lower-priorityEliminate Single-Conflict RBF Carve Outby Suhas Daftuar · e031085f · Nov 18, 2025 · 1 fileMessage 68 · AdequateLow 32Details
Commit message · Suhas Daftuar

Eliminate Single-Conflict RBF Carve Out

The new cluster mempool RBF rules take into account clusters sizes exactly, so
with the removal of descendant count enforcement this idea is obsolete.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 32/100

This commit removes a special Bitcoin mempool rule that gave a small exception (a 'carve out') for single-conflict RBF replacements. The change is part of a broader redesign called 'cluster mempool' and is described by the developer as making the old carve-out obsolete, not as a security fix. It tightens policy enforcement slightly but does not appear to introduce a vulnerability.

Lower-priorityCalculate descendant information for mempool RPC output on-the-flyby Suhas Daftuar · c0bd04d1 · Nov 18, 2025 · 3 filesMessage 65 · AdequateInformational 19Details
Commit message · Suhas Daftuar

Calculate descendant information for mempool RPC output on-the-fly

This is in preparation for removing the cached descendant state from the
mempool.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 19/100

This commit changes how Bitcoin Core calculates and reports descendant transaction information in mempool RPC output. Previously, descendant counts, sizes, and fees were read from cached values stored on each mempool entry. Now they are computed on-the-fly by walking the descendant graph. The change is described by the project as preparation for removing cached descendant state. There is no direct evidence in the commit or supplied references that this fixes a security vulnerability; it appears to be a refactoring and consistency change.

Lower-priorityUse mempool/txgraph to determine if a tx has descendantsby Suhas Daftuar · bdcefb8a · Nov 18, 2025 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Suhas Daftuar

Use mempool/txgraph to determine if a tx has descendants

Remove a reference to GetCountWithDescendants() in preparation for removing
this function and the associated cached state from the mempool.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a routine internal code cleanup in Bitcoin Core. It replaces one way of checking whether a transaction in the memory pool has dependent ('descendant') transactions with another, newer mechanism. There is no indication this fixes a security bug or introduces a vulnerability.

Lower-priorityReimplement GetTransactionAncestry() to not rely on cached databy Suhas Daftuar · 7961496d · Nov 18, 2025 · 2 filesMessage 73 · AdequateInformational 18Details
Commit message · Suhas Daftuar

Reimplement GetTransactionAncestry() to not rely on cached data

In preparation for removing ancestor data from CTxMemPoolEntry, recalculate the
ancestor statistics on demand wherever needed.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit changes how Bitcoin Core counts a transaction's ancestors in the memory pool (mempool). Previously it read pre-calculated cached numbers stored with each transaction; now it recalculates them on demand by walking the transaction graph. The change is described by the project as a refactoring step to remove cached ancestor data from mempool entries. There is no direct evidence in the commit that this fixes a security vulnerability.

Lower-priorityrpc: Calculate ancestor data from scratch for mempool rpc callsby Suhas Daftuar · 9fbe0a4a · Nov 18, 2025 · 1 fileMessage 50 · ThinLow 31Details
Commit message · Suhas Daftuar

rpc: Calculate ancestor data from scratch for mempool rpc calls

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 31/100

This Bitcoin Core change alters how mempool RPC calls (such as getrawmempool and getmempoolentry) report ancestor data. Previously, the node reused cached ancestor statistics stored with each transaction. Now it recalculates those numbers from scratch every time the RPC is called. The likely reason is that the cached ancestor values can become stale or inconsistent after certain mempool operations, which could cause RPC responses to show incorrect counts, sizes, or fees for a transaction's chain of unconfirmed ancestors. There is no direct evidence in the commit of an exploitable security vulnerability, but inconsistent mempool accounting can mislead wallets, fee estimators, or monitoring tools.

Lower-priorityAdd test case for cluster size limits to TRUC logicby Suhas Daftuar · 69e1eaa6 · Nov 18, 2025 · 1 fileMessage 60 · AdequateInformational 12Details
Commit message · Suhas Daftuar

Add test case for cluster size limits to TRUC logic

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 12/100

This commit only adds a new test case to Bitcoin Core's test suite. It checks that existing mempool cluster-size and cluster-count limits also apply to TRUC (version 3) transactions. There is no code change to the actual Bitcoin Core node software, so it cannot directly introduce, fix, or exploit a security issue in running nodes.

Lower-prioritytest: remove rbf carveout test from mempool_limit.pyby Suhas Daftuar · 89ae38f4 · Nov 18, 2025 · 1 fileMessage 72 · AdequateInformational 12Details
Commit message · Suhas Daftuar

test: remove rbf carveout test from mempool_limit.py

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 12/100

This commit simply removes one test case from a Bitcoin Core functional test file. It does not change any production code, network rules, or wallet behavior. There is no indication this is a security fix.

Security candidateStop enforcing descendant size/count limitsby Suhas Daftuar · cf3ab8e1 · Nov 18, 2025 · 7 filesMessage 45 · ThinLow 32Details
Commit message · Suhas Daftuar

Stop enforcing descendant size/count limits

Cluster size limits should be enough.

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Low 32/100

This Bitcoin Core commit removes enforcement of two older mempool limits—how many child transactions and how much total data can descend from a single transaction—and relies instead on newer 'cluster' limits. The change is described by the project as a simplification, not a security fix. It could alter how large transaction chains are rejected, but the diff itself does not show a vulnerability or emergency patch.

AI review queuedStop enforcing ancestor size/count limitsby Suhas Daftuar · 9cda64b8 · Nov 18, 2025 · 9 filesMessage 60 · AdequateLow 38Details
Commit message · Suhas Daftuar

Stop enforcing ancestor size/count limits

The cluster limits should be sufficient.

Co-Authored-By: Gregory Sanders <gsanders87@gmail.com>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 38/100

This commit removes Bitcoin Core's old 'ancestor count/size' mempool limits, leaving only newer 'cluster' and 'descendant' limits. The change is intentional and part of a broader mempool policy simplification. It does not by itself create a known exploit, but it changes what transaction shapes are allowed into the mempool. A miner or node operator relying on the old ancestor limits now has different protections, which could matter if the remaining cluster limits are weaker in some edge cases.