BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

2902 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

254security candidates607second-pass queue2881AI analyses
192commits · 30 days
482commits · 60 days
1502commits · 180 days
2875commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
939Strong · 80–100
1188Adequate · 60–79
687Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot22422170
Ava Chow15750157064
MarcoFalke41021406074
Lőrinc17721177081
fanquake22719226057
Hennadii Stepanov20914208063
rkrux57957074
Sjors Provoost89889074
Sebastian Falbesoner33733073
David Gumberg55655072
Pieter Wuille95595066
Hodlinator66566076
Analysis record

Published AI watches

Last scanned 7 minutes ago

Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35928: doc: mention -DWITH_ZMQ=ON in macOS build guide

This is a one-line documentation update to the macOS build guide. It adds a note telling users to pass a specific CMake option if they want ZeroMQ notification support. There is no code change and no security impact.

8397e09eby merge-script+1−11 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35482: fuzz: exercise the transaction-handling path in process_message(s)

This commit only changes Bitcoin Core's internal fuzz testing code. It makes the fuzz tests exercise more of the transaction-handling code path by toggling Initial Block Download mode and resetting the mempool between test runs. There is n…

No production code modifiedNo consensus, validation, net_processing, or wallet logic changedOnly fuzz test harnesses and test utilities affected
f11dc617by merge-script+105−798 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35914: test, fuzz: Remove unused variables

This commit removes unused variables from Bitcoin Core's test and fuzzing code. It is a cleanup/refactoring change with no effect on the live network software or user funds. It does not fix or introduce any security vulnerability.

d36bf709by merge-script+1−138 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35896: refactor: Default uint256::operator==, add operator<=>

This commit is a routine code cleanup in Bitcoin Core. It switches the uint256 equality and comparison operators to use standard C++20 defaults, removes an old custom Compare() helper, and marks an internal assertion-failure function as ne…

ed2c59abby merge-script+99−245 files
No security note in commit
Moderate 62 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35872: rpc: avoid descriptor range counter overflow

This update fixes a counting bug in several Bitcoin Core RPC commands that scan descriptors. When a user requested a descriptor range ending at the maximum allowed value (2,147,483,647), the internal counter used a smaller integer type and…

Signed integer overflow in descriptor expansion loopCrash/undefined behavior on maximum-range descriptor scansAuthenticated RPC surface affected (scantxoutset, scanblocks, getdescriptoractivity, utxoupdatepsbt, descriptorprocesspsbt)
b388674aby Ava Chow+3−12 files
Vendor flagged security relevance
Informational 19 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35842: rpc: Properly make RPCResult::Type::ANY non-test-only

This is a small cleanup and documentation fix for Bitcoin Core's RPC help system. It removes a comment that incorrectly said a certain output type was 'for testing only' and makes the help text properly display those outputs. There is no d…

No memory safety, cryptography, consensus, or authorization changes observedChange is confined to RPC help/schema metadata generationComment-only/type-label change from 'for testing only' to general use
c36ffd87by merge-script+42−364 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

This is a code cleanup change that turns on a static-analysis rule to prevent a specific C++ coding pattern (anonymous namespaces in header files) and updates two headers to comply. It does not change how Bitcoin Core behaves at runtime an…

No security-relevant code changeNo memory safety, cryptography, consensus, or network changesTooling-only refactor (clang-tidy configuration)
c4fbd3c7by merge-script+9−123 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

This commit only adds new test cases to Bitcoin Core's functional test suite. It does not change any production wallet, node, or RPC code. The tests verify that the importdescriptors RPC reports errors in the right order, rejects bad times…

465196d0by merge-script+77−11 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35180: coins: group private cache helpers

This change is purely a code cleanup: it moves two internal helper functions of a Bitcoin Core cache class into the private section of the class and removes a duplicate 'private:' label. There is no change to what the code does, no bug fix…

c940fd75by merge-script+13−141 file
No security note in commit
Low 29 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

This Bitcoin Core change tightens how three RPC commands (scantxoutset, scanblocks, deriveaddresses) handle the value null when it is passed for optional parameters. Previously, explicitly passing null could be treated differently from sim…

RPC parameter validation changeNull value handling changeAddition of explicit error checks for missing required contextual parameters
3db96eb5by merge-script+18−75 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable misc-definitions-in-headers

This commit is a code cleanup: it turns on a clang-tidy style check called 'misc-definitions-in-headers' and suppresses that check around a large inline implementation block in a benchmark header. There is no change to Bitcoin's runtime be…

fa93132dby MarcoFalke+3−02 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable clang-tidy rule to reject anon namespace in header

This commit only changes a linting configuration file for the project's code style checker. It enables a rule that prevents anonymous namespaces from being used in header files, which is a code-quality and build-hygiene practice. There is …

No security-relevant signals in the diff or commit message.Change is purely a static-analysis/linting configuration update.
fa5ca877by MarcoFalke+2−11 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use C++20 std::identity over IntIdentity

This commit is a straightforward code cleanup: it replaces a small custom helper named IntIdentity with the standard C++20 std::identity from the <functional> header. The behavior of the ConvertBits function is unchanged; only the implemen…

fafe5042by MarcoFalke+4−111 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test the result order of a multiple import request is correct

This commit only adds a new automated test to Bitcoin Core. It checks that when a user asks the wallet to import multiple descriptors at once, the list of results comes back in the same order as the original request, including any error me…

3ac8b806by Pol Espinasa+40−01 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test invalid or missing timestamp throws importdescriptors

This commit only adds new automated tests for the Bitcoin Core wallet's importdescriptors RPC. It checks that the command correctly rejects requests with a missing or invalid timestamp. No production wallet code is changed, so this cannot …

No changes to consensus, networking, wallet logic, or cryptographyOnly functional test code is modifiedAdded assertions are for expected error handling paths
e4732bf0by Pol Espinasa+28−11 file
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Remove unused #include in common/system

This is a minor code cleanup that removes one unused header file include and swaps another for a more specific one. It does not change any program behavior or fix any security issue.

fa7304f3by MarcoFalke+1−22 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

iwyu: Fix warnings in `src/consensus` and treat them as errors

This commit is a routine code cleanup: it adjusts which C++ header files are included in several consensus-related source files and turns on a stricter compiler hygiene check (Include What You Use, or IWYU) for the src/consensus directory.…

13b53f8bby Hennadii Stepanov+42−79 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: don't connman.ReceiveMsgFrom oversized msg

This is a small fix to a Bitcoin Core fuzz test (an automated internal testing harness), not to the live network code. The fuzzer was sometimes creating fake P2P messages larger than the real protocol allows and passing them into a test he…

Test-only fuzz harness hardeningOversized message guard added before ReceiveMsgFrom() in fuzz targetNo change to production P2P message acceptance logic
bb19f1daby Greg Sanders+5−01 file
No security note in commit
Informational 15 AI analysisMessage 97 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: Temporarily remove riscv32 config from GHA matrix

This commit simply removes one failing test configuration (RISC-V 32-bit bare metal) from the project's GitHub Actions CI matrix because it was failing. It is a routine CI maintenance change with no security implications.

fa06ea42by MarcoFalke+0−61 file
No security note in commit
Low 47 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: verify cross-build SDK archives

This change adds checksum verification to the build system's downloads of Apple, FreeBSD, NetBSD, and OpenBSD software development kits (SDKs). Before this patch, those SDK archives were downloaded at build time and extracted without confi…

Adds cryptographic digest verification for downloaded SDK archivesRemoves unchecked extraction of remote SDK archives in CIHardens CI supply chain for macOS/BSD cross-builds
873550beby Lőrinc+25−126 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedRemove dependency on cached ancestor data in mini-minerby Suhas Daftuar · 1f93227a · Nov 18, 2025 · 1 fileMessage 50 · ThinLow 27Details
Commit message · Suhas Daftuar

Remove dependency on cached ancestor data in mini-miner

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI analysis · Low 27/100

This small code change updates an internal Bitcoin mining-simulation tool so it calculates ancestor transaction data on the spot rather than relying on a precomputed cache. The change appears aimed at preventing the mini-miner from using stale or incorrect cached values, which could lead to wrong fee estimates when simulating which transactions to include in a block. There is no direct evidence in the commit that this fixes an active security vulnerability, but it removes a dependency that could produce inconsistent results.

Lower-priorityUse cluster linearization for transaction relay sort orderby Suhas Daftuar · 21b5cea5 · Nov 18, 2025 · 4 filesMessage 95 · StrongInformational 19Details
Commit message · Suhas Daftuar

Use cluster linearization for transaction relay sort order

Previously, transaction batches were first sorted by ancestor count and then
feerate, to ensure transactions are announced in a topologically valid order,
while prioritizing higher feerate transactions. Ancestor count is a crude
topological sort criteria, so replace this with linearization order so that the
highest feerate transactions (as would be observed by the mining algorithm) are
relayed before lower feerate ones, in a topologically valid way.

This also fixes a test that only worked due to the ancestor-count-based sort
order.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 19/100

This commit changes the order in which Bitcoin nodes announce pending transactions to peers. Previously, transactions were announced based on how many ancestor transactions they had, then by fee rate. Now they are announced using the same 'cluster linearization' order the mining code uses, so higher-fee transactions are relayed first while still respecting dependency order. The change also updates a test that depended on the old ordering. There is no indication this fixes a security vulnerability; it is a behavior refinement.

Lower-prioritytest: rewrite PopulateMempool to not violate mempool policy (cluster size) limitsby Suhas Daftuar · c3f1afc9 · Nov 18, 2025 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Suhas Daftuar

test: rewrite PopulateMempool to not violate mempool policy (cluster size) limits

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This is a test-only code change. It fixes a helper function used by Bitcoin Core's internal test suite so that the fake transactions it creates no longer accidentally break the simulated mempool's own rules. It does not change any production code that runs on real Bitcoin nodes, so it cannot affect real users or the live network.

Lower-prioritypolicy: Remove CPFP carveout ruleby Suhas Daftuar · ff8f115d · Nov 18, 2025 · 4 filesMessage 90 · StrongInformational 23Details
Commit message · Suhas Daftuar

policy: Remove CPFP carveout rule

The addition of a cluster size limit makes the CPFP carveout rule useless,
because carveout cannot be used to bypass the cluster size limit. Remove this
policy rule and update tests to no longer rely on the behavior.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 23/100

This commit removes a special Bitcoin mempool rule called the 'CPFP carve-out' that previously let one small extra transaction squeeze into an otherwise-full chain of unconfirmed transactions. The change is intentional policy cleanup, not a security fix, because a newer 'cluster size limit' already blocks the same bypass path. Some payment-channel-like protocols that relied on this carve-out may need to adjust, but the commit itself does not introduce a code vulnerability.

Lower-priorityImplement new RBF logic for cluster mempoolby Suhas Daftuar · 216e6937 · Nov 18, 2025 · 11 filesMessage 80 · StrongLow 35Details
Commit message · Suhas Daftuar

Implement new RBF logic for cluster mempool

With a total ordering on mempool transactions, we are now able to calculate a
transaction's mining score at all times. Use this to improve the RBF logic:

- we no longer enforce a "no new unconfirmed parents" rule

- we now require that the mempool's feerate diagram must improve in order
to accept a replacement

- the topology restrictions for conflicts in the package rbf setting have been
eliminated

Revert the temporary change to mempool_ephemeral_dust.py that were previously
made due to RBF validation checks being reordered.

Co-authored-by: Gregory Sanders <gsanders87@gmail.com>, glozow <gloriajzhao@gmail.com>

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Low 35/100

This commit rewrites how Bitcoin Core decides whether a transaction can replace existing mempool transactions via RBF (Replace-By-Fee). It removes two old rules—'no new unconfirmed inputs' and 'replacement must pay a higher per-transaction feerate than each conflict'—and replaces them with a stricter economic test: the replacement must improve the mempool's overall feerate diagram. It also changes the limit on how many transactions can be replaced from a raw count of transactions to a count of distinct transaction clusters. The change is a deliberate policy redesign, not a bug fix, and the tests are updated to match the new behavior.

Lower-priorityRemove CTxMemPool::GetSortedDepthAndScoreby Suhas Daftuar · feceaa42 · Nov 18, 2025 · 2 filesMessage 58 · ThinInformational 16Details
Commit message · Suhas Daftuar

Remove CTxMemPool::GetSortedDepthAndScore

The mempool clusters and linearization permit sorting the mempool topologically
without making use of ancestor counts (as long as the graph is not oversized).

Co-authored-by: Pieter Wuille <pieter@wuille.net>

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 16/100

This commit refactors how Bitcoin Core's mempool sorts transactions for internal consistency checks and information reporting. It replaces an older sorting method based on 'ancestor count' with a newer topology-aware method that relies on the recently introduced mempool graph/linearization code. The change is a code cleanup and architectural simplification, not a fix for an active security bug. A new assertion is added to ensure the mempool graph is not oversized when this sorting is used for the consistency check.

Lower-priorityRemove the ancestor and descendant indices from the mempoolby Suhas Daftuar · 6445aa7d · Nov 18, 2025 · 3 filesMessage 50 · ThinInformational 12Details
Commit message · Suhas Daftuar

Remove the ancestor and descendant indices from the mempool

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100

This commit removes two internal sorting indexes from Bitcoin Core's memory pool (mempool) data structure. It is a code cleanup/refactoring change: the ancestor_score and descendant_score indexes are no longer needed because their jobs have been taken over by a newer transaction graph module (m_txgraph). The commit also deletes the unit tests that exercised those old indexes and adjusts a memory-usage estimate to reflect fewer indexes. There is no indication in the commit or supplied references that this fixes a security bug.

Lower-priorityAdd new (unused) limits for cluster size/countby Suhas Daftuar · 34e32985 · Nov 18, 2025 · 4 filesMessage 45 · ThinInformational 15Details
Commit message · Suhas Daftuar

Add new (unused) limits for cluster size/count

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds two new command-line options, -limitclustercount and -limitclustersize, and corresponding data fields for mempool limits. However, the commit title and code make clear these new limits are currently unused: no enforcement logic consumes them. It is purely preparatory infrastructure for future mempool policy changes. There is no immediate security impact.

Lower-prioritySelect transactions for blocks based on chunk feerateby Suhas Daftuar · 47ab32fd · Nov 18, 2025 · 3 filesMessage 65 · AdequateLow 32Details
Commit message · Suhas Daftuar

Select transactions for blocks based on chunk feerate

Co-Authored-By: Gregory Sanders <gsanders87@gmail.com>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Low 32/100

This commit refactors how Bitcoin Core selects transactions for new blocks. It replaces an older, more complex ancestor-feerate algorithm with a new 'chunk feerate' approach driven by a new mempool graph builder. The change is a significant rewrite of mining transaction selection logic, but the commit itself does not describe any security bug or fix. Because it is a large behavioral change in consensus-adjacent code, it carries ordinary implementation risks, but there is no direct evidence in the commit of a vulnerability.

Lower-prioritybench: rewrite ComplexMemPool to not create oversized clustersby Suhas Daftuar · 6c2bceb2 · Nov 18, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Suhas Daftuar

bench: rewrite ComplexMemPool to not create oversized clusters

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit changes only a benchmark test file used to measure mempool performance. It rewrites how fake transactions are generated so the test creates many small independent groups instead of one huge interconnected cluster. There is no change to the actual Bitcoin network code that users run, so this cannot affect real funds, nodes, or network security.

Lower-priorityLimit mempool size based on chunk feerateby Suhas Daftuar · 1ad4590f · Nov 18, 2025 · 2 filesMessage 80 · StrongLow 38Details
Commit message · Suhas Daftuar

Limit mempool size based on chunk feerate

Rather than evicting the transactions with the lowest descendant feerate,
instead evict transactions that have the lowest chunk feerate.

Once mining is implemented based on choosing transactions with highest chunk
feerate (see next commit), mining and eviction will be opposites, so that we
will evict the transactions that would be mined last.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Low 38/100

This Bitcoin Core commit changes how the mempool (the waiting area for unconfirmed transactions) decides which transactions to kick out when it gets too full. Previously it used 'descendant feerate'; now it uses 'chunk feerate' so that the transactions a miner would pick last are the same ones the mempool evicts first. This is a consistency improvement in transaction selection policy, not a fix for a clear exploit. The change could affect transaction propagation, fee estimation, and mempool behavior under load, but the commit itself does not describe any security vulnerability.

Lower-priorityRework miner_tests to not require large cluster limitby Suhas Daftuar · b11c89ca · Nov 18, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Suhas Daftuar

Rework miner_tests to not require large cluster limit

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes Bitcoin Core's internal unit tests. It rewrites how the miner_tests create large transaction clusters so the tests no longer need an unusually large mempool cluster-size limit. There is no change to production code, consensus rules, network behavior, or wallet handling, so it does not affect real users or the live Bitcoin network.

Lower-priorityCheck cluster limits when using -walletrejectlongchainsby Suhas Daftuar · 95a8297d · Nov 18, 2025 · 3 filesMessage 50 · ThinLow 42Details
Commit message · Suhas Daftuar

Check cluster limits when using -walletrejectlongchains

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 42/100

This Bitcoin Core patch tightens a wallet safety check. The '-walletrejectlongchains' option is meant to stop a user's own wallet from creating long chains of unconfirmed transactions, which can be hard to get mined. The old code only checked the size of the transaction package, but did not check the newer 'cluster' limits that count related transactions more broadly. The fix adds a cluster-limit check before the package-size check, so the wallet now rejects transactions that would violate current mempool policy. This is a defensive correctness fix; it mainly protects users from creating transactions that the network would currently refuse to relay or mine.

Lower-priority[test] rework/delete feature_rbf tests requiring large clustersby glozow · edb3e7cd · Nov 18, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · glozow

[test] rework/delete feature_rbf tests requiring large clusters

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes Bitcoin Core's functional test suite. It reworks and deletes some Replace-By-Fee (RBF) tests that previously needed very large transaction clusters. The production mempool rules are not modified, and no security vulnerability is present in the commit.

Lower-prioritytest: update feature_rbf.py replacement testby Suhas Daftuar · 435fd567 · Nov 18, 2025 · 1 fileMessage 82 · StrongInformational 15Details
Commit message · Suhas Daftuar

test: update feature_rbf.py replacement test

Preparatory commit to the rbf functional test, before changes are made to the
rbf rules as part of cluster mempool.

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This is a minor test-only change in Bitcoin Core's functional test suite. It adds a constant and changes one test variable from 100 to 64 in preparation for future mempool work. It does not modify any production code, consensus rules, or network behavior, and presents no security issue.

Lower-priorityAdd transactions to txgraph, but without cluster dependenciesby Suhas Daftuar · 838d7e35 · Nov 18, 2025 · 3 filesMessage 65 · AdequateInformational 23Details
Commit message · Suhas Daftuar

Add transactions to txgraph, but without cluster dependencies

Effectively this is treating all transactions in txgraph as being in a cluster
of size 1.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 23/100

This commit is a step in a larger Bitcoin Core project to replace the mempool's internal transaction graph with a new component called TxGraph. The change starts tracking every mempool transaction inside TxGraph, but deliberately ignores parent-child dependencies between transactions, treating each one as if it were isolated. It also restructures how mempool locks are held during transaction acceptance so the new graph can be updated consistently. There is no claim in the commit that this fixes a security bug; it reads like an incremental refactor or feature-in-progress.

Lower-priorityfuzz: remove comparison between mini_miner block construction and minerby Suhas Daftuar · dec138d1 · Nov 18, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Suhas Daftuar

fuzz: remove comparison between mini_miner block construction and miner

After cluster mempool, the mini_miner will no longer match the miner's block
construction. Eventually mini_miner should be reworked to directly use
linearizations done in the mempool.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit removes a fuzz test that compared two internal Bitcoin components (MiniMiner and BlockAssembler) to ensure they built the same block. The test is being deleted because an upcoming code change ('cluster mempool') will make their outputs intentionally differ. This is a test-only cleanup, not a fix for a security bug.

Security candidateDo not allow mempool clusters to exceed configured limitsby Suhas Daftuar · 95762e67 · Nov 18, 2025 · 6 filesMessage 95 · StrongLow 47Details
Commit message · Suhas Daftuar

Do not allow mempool clusters to exceed configured limits

Include an adjustment to mempool_tests.cpp due to the additional memory used by
txgraph.

Includes a temporary change to the mempool_ephemeral_dust.py functional test,
due to validation checks being reordered. This change will revert once the RBF
rules are changed in a later commit.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
boot or update path
AI analysis · Low 47/100

This Bitcoin Core commit enforces a new mempool policy: groups of related unconfirmed transactions ('clusters') are now capped by configured size and count limits. Previously these limits existed as settings but were not fully enforced by the new in-memory transaction graph. The patch wires the limits into the graph, rejects submissions that would exceed them, and removes transactions from the mempool when a newly accepted block creates oversized clusters. It also reorders some validation checks so cluster-size rejection happens before certain standardness checks, which is why one functional test was temporarily adjusted.

Lower-prioritydoc: CI - Describe qemu-user-static usageby Hodlinator · 552eb900 · Nov 18, 2025 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Hodlinator

doc: CI - Describe qemu-user-static usage

Should help in cases such as: https://github.com/bitcoin/bitcoin/pull/31144#issuecomment-2450578651

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds documentation to the CI README explaining how to set up QEMU user-mode emulation for running tests on foreign CPU architectures. It is a pure documentation change with no code modifications, no security fixes, and no functional changes to Bitcoin Core.

Lower-prioritydoc: CI - Clarify how important `env -i` is and whyby Hodlinator · 2afbbdde · Nov 18, 2025 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · Hodlinator

doc: CI - Clarify how important `env -i` is and why

Would hopefully have helped me in this case: https://github.com/bitcoin/bitcoin/pull/31176#issuecomment-2526410039
Since then however, fd813bf863b1ffa91429de6342285b35bab2bfa4 also made sure a minimal environment is used.

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates a documentation file (ci/README.md) to explain more clearly why the CI system should be run inside a clean environment using the `env -i` command. It does not change any code, build scripts, or configuration that could affect Bitcoin Core's runtime security. There is no vulnerability or security fix here.

Lower-priorityclang-format: Set InsertNewlineAtEOF: trueby MarcoFalke · fa1bf681 · Nov 18, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · MarcoFalke

clang-format: Set InsertNewlineAtEOF: true

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit changes a single formatting setting in Bitcoin Core's code style configuration file. It tells the clang-format tool to automatically add a blank newline at the end of source files when it runs. This has no effect on how the software runs, what data it processes, or its security. It only affects whitespace in source code files.

Security candidateMerge bitcoin/bitcoin#32419: psbt: clarify PSBT, PSBTInput, PSBTOutput unserialization flowsby Ava Chow · a90f3922 · Nov 17, 2025 · 2865 filesMessage 81 · StrongInformational 15Details
Commit message · Ava Chow

Merge bitcoin/bitcoin#32419: psbt: clarify PSBT, PSBTInput, PSBTOutput unserialization flows

d31158d3646f3c7e4832b9ca50f6ffe02800ff4c psbt: clarify PSBT, PSBTInput, PSBTOutput unserialization flows (rkrux)

Pull request description:

The unserialization flows of the PSBT types work based on few underlying assumptions of functions from `serialize.h` & `stream.h` that takes some to understand when read the first time.

Add few comments that highlight these assumptions hopefully making it easier to grasp. Also, mention key/value format types as per BIP 174.

ACKs for top commit:
achow101:
ACK d31158d3646f3c7e4832b9ca50f6ffe02800ff4c
theStack:
ACK d31158d3646f3c7e4832b9ca50f6ffe02800ff4c

Tree-SHA512: 45111ef7f0258ebbc41d058b3ef2a72472774ab2878caf2d71d7b57b27549c46a51ccbeda5fe164bcf4f7ec10627bbae6e7763aa80b1e66912703a2088682817

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarycryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol pathmerge-commit duplicate discount
AI analysis · Informational 15/100

This commit is a documentation-only change for Bitcoin Core. It adds comments explaining how PSBT (Partially Signed Bitcoin Transaction) data is read from serialized bytes, with no changes to actual code behavior. The surrounding merge commit also includes a very large number of unrelated file additions (build files, templates, docs, etc.), but the titled change itself is purely explanatory comments.

Lower-prioritynet: Remove unused `local_socket_bytes` variable in `CConnman::GetAddresses()`by WakeTrainDev · 4d893c0f · Nov 17, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · WakeTrainDev

net: Remove unused `local_socket_bytes` variable in `CConnman::GetAddresses()`

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit simply removes an unused local variable from a single function in Bitcoin Core's networking code. There is no functional change, no bug fix, and no security relevance.

Lower-priorityci: Move lint exec snippet to stand-alone py fileby MarcoFalke · fa1dacae · Nov 17, 2025 · 2 filesMessage 80 · StrongInformational 15Details
Commit message · MarcoFalke

ci: Move lint exec snippet to stand-alone py file

Moving the python code out of the yaml string makes it easier to lint,
format, and edit.

This can be reviewed with the git options:

--color-moved=dimmed-zebra --color-moved-ws=ignore-all-space

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit simply moves a chunk of Python code from inside a GitHub Actions workflow file into its own separate Python file. The code that runs is unchanged; only its location changed. There is no security issue here.

Lower-prioritytest: Remove tests violating hardened std::spanby MarcoFalke · fadb4f63 · Nov 17, 2025 · 1 fileMessage 67 · AdequateInformational 14Details
Commit message · MarcoFalke

test: Remove tests violating hardened std::span

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
defensive validation
AI analysis · Informational 14/100

This is a test-only change. It removes unit tests that created a std::span from a null pointer with a non-zero length, which is undefined behavior and now trapped by hardened std::span implementations. The production code is not changed, and no vulnerability in live Bitcoin Core is introduced or fixed here.