BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

2935 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

260security candidates613second-pass queue2893AI analyses
184commits · 30 days
474commits · 60 days
1490commits · 180 days
2855commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
969Strong · 80–100
1189Adequate · 60–79
689Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot22422170
Ava Chow16452162065
MarcoFalke41021406074
Lőrinc18121177081
fanquake22919226057
Hennadii Stepanov21214208063
rkrux57957074
Sjors Provoost89889074
merge-script42819088
Sebastian Falbesoner33733073
David Gumberg55655072
Pieter Wuille95595066
Analysis record

Published AI watches

Last scanned 58 minutes ago

Low 26 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#32784: wallet: derivehdkey RPC to get xpub at arbitrary path

This commit adds a new Bitcoin Core wallet RPC called derivehdkey that lets a user derive an extended public key (xpub) — or optionally the matching extended private key (xprv) — at a chosen BIP32 path from one of the wallet's own HD keys.…

New RPC exposes xpub/xprv derivation from wallet HD keysRequires at least one hardened derivation stepRejects watch-only wallets and locked/encrypted wallets
a8b582ecby Ava Chow+633−15819 files
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35852: scripted-diff: Use inline const(expr) over static constexpr in headers

This is a large but purely mechanical code cleanup in Bitcoin Core. It changes how constants are declared in header files from older C++ styles (static const, static constexpr) to the modern C++17 inline constexpr/inline const form. The pu…

dec68f99by merge-script+440−440102 files
No security note in commit
Low 28 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35959: Update secp256k1 subtree to latest master

This commit updates Bitcoin Core's embedded copy of the secp256k1 cryptographic library to a newer version. The update adds a new Silent Payments module, lets advanced users swap in a custom SHA256 compression function, removes some old de…

Dependency update of a core cryptographic library (libsecp256k1)New runtime SHA256 compression callback with self-test/smoke test to catch mis-implementations earlyBehavior change in ellswift_xdh to reject secret keys >= curve order (vendor states not a security issue)
625f951bby Ava Chow+297−11626 files
No security note in commit
Informational 23 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35605: wallet: rpc: Deprecate `removeprunedfunds` RPC

This commit deprecates a Bitcoin Core wallet RPC command called removeprunedfunds. The command lets users delete transactions from their own wallet, which can alter displayed balances. The change does not fix a software bug; it is a cleanu…

RPC allows deletion of arbitrary wallet transactions, affecting balancesDeprecation framed by authors as removing a dangerous and maintenance-burden featureNo authentication bypass, memory corruption, or consensus change present in diff
e9ed5e83by Ava Chow+64−695 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35930: wallet: post-#35501 cleanups in CWalletTx

This is a follow-up cleanup and hardening patch for the Bitcoin Core wallet's handling of transactions that have multiple possible witness versions (same transaction ID but different witness data). It renames a variable, simplifies a helpe…

Added input-validation during wallet transaction deserializationNew unit test specifically exercises rejection of mismatched variant txidFollow-up to PR #35501 which introduced witness-variant tracking in the wallet
512dc9afby Ava Chow+68−315 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35729: refactor: test: Unroll `&&` conditions in macros

This commit only changes Bitcoin Core's internal test code. It splits combined conditions inside test-check macros (like BOOST_CHECK(a && b)) into separate checks so that when a test fails, the test output points to the exact failing condi…

aa0e0f79by merge-script+196−9519 files
No security note in commit
Low 26 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35493: wallet, descriptor: Fix MuSig private key completeness checks on `importdescriptors`

This commit fixes a bug in Bitcoin Core's wallet import logic for a new type of multi-signature setup called MuSig. Previously, when a user imported a MuSig descriptor that already contained all needed private keys, the wallet incorrectly …

False-positive warning in wallet import for fully-private MuSig descriptorsIncorrect private-key completeness check on synthetic aggregate public keyDescriptor logic now delegates completeness to `Descriptor::HavePrivateKeys()`
2c01832fby merge-script+76−374 files
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35943: doc: fix dead link in txrequest.h

This commit only fixes a broken web link in a code comment. It replaces an outdated URL to a research paper with a working URL to the same paper. There is no change to program logic, no security fix, and no vulnerability.

5d051c05by merge-script+1−11 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#33186: wallet, test: Ancient Wallet Migration from v0.14.3 (no-HD and Single Chain)

This commit only adds new automated tests for migrating very old Bitcoin Core wallets (version 0.14.3 from 2017) to the modern descriptor wallet format. It does not change any wallet production code, consensus rules, or network behavior. T…

757aa573by merge-script+246−124 files
No security note in commit
Low 28 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35925: wallet, rpc: Exclude non-owned addresses from listreceivedby*

This update fixes a wallet reporting bug. When a user asked their Bitcoin wallet to list every address that had received money, including empty ones, the result incorrectly included foreign addresses that the wallet merely knew about (for …

Information disclosure: wallet RPCs leaked existence/labels of foreign addressesIncorrect access-control boundary: non-owned addresses exposed in 'received' reportFix uses IsMine() rather than address purpose metadata, avoiding inconsistent purpose handling
e8cc21c5by Ava Chow+19−32 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35937: test: Append print_suppressions=0 to LSAN_OPTIONS, and suppress bitcoin-qt

This commit only changes test configuration. It tells the LeakSanitizer tool used during automated testing to stop printing long lists of suppressed memory leaks, and it narrows the list of ignored leaks to the bitcoin-qt GUI test binary. …

5973e075by merge-script+3−42 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35928: doc: mention -DWITH_ZMQ=ON in macOS build guide

This is a one-line documentation update to the macOS build guide. It adds a note telling users to pass a specific CMake option if they want ZeroMQ notification support. There is no code change and no security impact.

8397e09eby merge-script+1−11 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35482: fuzz: exercise the transaction-handling path in process_message(s)

This commit only changes Bitcoin Core's internal fuzz testing code. It makes the fuzz tests exercise more of the transaction-handling code path by toggling Initial Block Download mode and resetting the mempool between test runs. There is n…

No production code modifiedNo consensus, validation, net_processing, or wallet logic changedOnly fuzz test harnesses and test utilities affected
f11dc617by merge-script+105−798 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35914: test, fuzz: Remove unused variables

This commit removes unused variables from Bitcoin Core's test and fuzzing code. It is a cleanup/refactoring change with no effect on the live network software or user funds. It does not fix or introduce any security vulnerability.

d36bf709by merge-script+1−138 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35896: refactor: Default uint256::operator==, add operator<=>

This commit is a routine code cleanup in Bitcoin Core. It switches the uint256 equality and comparison operators to use standard C++20 defaults, removes an old custom Compare() helper, and marks an internal assertion-failure function as ne…

ed2c59abby merge-script+99−245 files
No security note in commit
Moderate 62 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35872: rpc: avoid descriptor range counter overflow

This update fixes a counting bug in several Bitcoin Core RPC commands that scan descriptors. When a user requested a descriptor range ending at the maximum allowed value (2,147,483,647), the internal counter used a smaller integer type and…

Signed integer overflow in descriptor expansion loopCrash/undefined behavior on maximum-range descriptor scansAuthenticated RPC surface affected (scantxoutset, scanblocks, getdescriptoractivity, utxoupdatepsbt, descriptorprocesspsbt)
b388674aby Ava Chow+3−12 files
Vendor flagged security relevance
Informational 19 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35842: rpc: Properly make RPCResult::Type::ANY non-test-only

This is a small cleanup and documentation fix for Bitcoin Core's RPC help system. It removes a comment that incorrectly said a certain output type was 'for testing only' and makes the help text properly display those outputs. There is no d…

No memory safety, cryptography, consensus, or authorization changes observedChange is confined to RPC help/schema metadata generationComment-only/type-label change from 'for testing only' to general use
c36ffd87by merge-script+42−364 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

This is a code cleanup change that turns on a static-analysis rule to prevent a specific C++ coding pattern (anonymous namespaces in header files) and updates two headers to comply. It does not change how Bitcoin Core behaves at runtime an…

No security-relevant code changeNo memory safety, cryptography, consensus, or network changesTooling-only refactor (clang-tidy configuration)
c4fbd3c7by merge-script+9−123 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

This commit only adds new test cases to Bitcoin Core's functional test suite. It does not change any production wallet, node, or RPC code. The tests verify that the importdescriptors RPC reports errors in the right order, rejects bad times…

465196d0by merge-script+77−11 file
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateindex: Fix coinstatsindex overflow issueby Fabian Jahr · 431a076a · Sep 7, 2025 · 6 filesMessage 73 · AdequateModerate 57Details
Commit message · Fabian Jahr

index: Fix coinstatsindex overflow issue

The index originally stored cumulative values in a CAmount type but this allowed for
potential overflow issues which were observed on Signet. Fix this by
storing the values that are in danger of overflowing in a arith_uint256.

Also turns an unnecessary copy into a reference in RevertBlock and
CustomAppend and gets
rid of the explicit total unspendable tracking which can be calculated
by adding the four categories of unspendables together.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
memory safety
AI analysis · Moderate 57/100

This commit fixes an integer overflow bug in Bitcoin Core's optional coin statistics index. The index keeps running totals of spent and created coins, and on long-running or high-activity networks these totals could exceed the range of the 64-bit 'CAmount' type, causing wrong statistics or node instability. The fix widens the at-risk totals to a 256-bit type and removes a redundant stored total that can be computed from other values. It also changes the index's database directory name so upgraded nodes do not reuse the old, buggy data, while leaving the old directory in place for users who might downgrade.

Lower-priorityci: Checkout latest merged pullsby MarcoFalke · fa8f081a · Sep 7, 2025 · 1 fileMessage 57 · ThinInformational 18Details
Commit message · MarcoFalke

ci: Checkout latest merged pulls

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 18/100

This commit changes Bitcoin Core's GitHub Actions CI configuration so that when a CI job is re-run for a pull request, it checks out the latest merged state of that PR branch rather than a possibly stale cached version. The change is purely in the CI workflow file and does not touch Bitcoin Core's actual code, consensus logic, wallet, or networking. It is a reliability/correctness improvement for automated testing, not a fix for a vulnerability in the Bitcoin software itself.

Lower-prioritySquashed 'src/ipc/libmultiprocess/' changes from 1b8d4a6f1e54..13424cf2ecc1by Ryan Ofsky · a334bbe9 · Sep 5, 2025 · 10 filesMessage 81 · StrongLow 29Details
Commit message · Ryan Ofsky

Squashed 'src/ipc/libmultiprocess/' changes from 1b8d4a6f1e54..13424cf2ecc1

13424cf2ecc1 Merge bitcoin-core/libmultiprocess#205: cmake: check for Cap'n Proto / Clang / C++20 incompatibility
72dce118649b Merge bitcoin-core/libmultiprocess#200: event loop: add LogOptions struct and reduce the log size
85003409f964 eventloop: add `LogOptions` struct
657d80622f81 cmake: capnproto pkg missing helpful error
d314057775a5 cmake: check for Cap'n Proto / Clang / C++20 incompatibility
878e84dc3030 Merge bitcoin-core/libmultiprocess#203: cmake: search capnproto in package mode only
1a85da5873c2 Merge bitcoin-core/libmultiprocess#202: doc: correct the build instructions for the example
df01873e1ecb Merge bitcoin-core/libmultiprocess#197: ci: Add freebsd and macos build
3bee07ab3367 cmake: search capnproto in package mode only
b6d3dc44194c doc: correct the build instructions for example
fa1ac3000055 ci: Add macos and freebsd task

git-subtree-dir: src/ipc/libmultiprocess
git-subtree-split: 13424cf2ecc1e5eadc85556cf1f4c65e915f702a

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 29/100

This commit updates the libmultiprocess subtree used by Bitcoin Core. The most notable change is a build-time check that refuses to compile with older, vulnerable versions of the Cap'n Proto library (CVE-2022-46149) and with Cap'n Proto versions that are incompatible with Clang 16+ under C++20. It also adds FreeBSD and macOS CI jobs, fixes example build instructions, and reduces the maximum size of IPC debug log messages from 1000 to 200 characters via a new LogOptions struct.

Lower-prioritykernel: make blockTip index constby stickies-v · 75d9b724 · Sep 5, 2025 · 4 filesMessage 60 · AdequateInformational 15Details
Commit message · stickies-v

kernel: make blockTip index const

Notification interface subscribers need to view, but not mutate,
the index.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a straightforward code-quality change: it adds the word 'const' to a notification callback parameter so subscribers receive a read-only view of the current block tip index. It does not fix a bug, close a vulnerability, or change any behavior. It simply prevents future implementations of the callback from accidentally modifying the index.

AI review queuedci: test IPC on additional hostsby Sjors Provoost · a341e11a · Sep 5, 2025 · 5 filesMessage 90 · StrongInformational 15Details
Commit message · Sjors Provoost

ci: test IPC on additional hosts

Install pycapnp on all (active) CI hosts which have IPC enabled and
run the functional tests.

Except for previous_releases, which uses an older version of pip
that doesn't support --break-system-packages.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes Bitcoin Core's continuous integration (CI) test scripts. It adds the Python pycapnp package to several CI environments so that inter-process communication (IPC) tests run on more platforms. There is no change to the Bitcoin software that users run, and no security vulnerability is present in the diff.

Lower-priorityci: enable IPC tests in CIby Pieter Wuille · 6aee573b · Sep 5, 2025 · 2 filesMessage 67 · AdequateInformational 15Details
Commit message · Pieter Wuille

ci: enable IPC tests in CI

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes Bitcoin Core's continuous integration (CI) test setup. It installs the Python pycapnp package so that inter-process communication (IPC) tests can run automatically in GitHub Actions. There is no change to the actual Bitcoin node code that users run, and nothing in the commit suggests a security vulnerability or fix.

Lower-prioritytests: add functional tests for IPC interfaceby Pieter Wuille · 8d2ee88f · Sep 5, 2025 · 4 filesMessage 78 · AdequateInformational 15Details
Commit message · Pieter Wuille

tests: add functional tests for IPC interface

Co-Authored-By: ismaelsadeeq <ask4ismailsadiq@gmail.com>
Co-Authored-By: ryanofsky <ryan@ofsky.org>
Co-Authored-By: TheCharlatan <seb.kung@gmail.com>
Co-Authored-By: Sjors Provoost <sjors@sprovoost.nl>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds new automated tests for Bitcoin Core's IPC (inter-process communication) interface. It does not change any production code, wallet logic, consensus rules, or network behavior. There is no security issue here.

Lower-prioritytest: add is_ipc_compiled() and skip_if_no_ipc() functionsby Ryan Ofsky · 8c7f0056 · Sep 5, 2025 · 3 filesMessage 87 · StrongInformational 15Details
Commit message · Ryan Ofsky

test: add is_ipc_compiled() and skip_if_no_ipc() functions

Expose ENABLE_IPC build option to functional tests so new tests can test
IPC-only features.

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds test infrastructure so that Bitcoin Core's functional test suite can detect whether the software was built with IPC (inter-process communication) support and skip tests that require it. It does not change any production code, network behavior, or wallet logic, and it introduces no security issue.

Lower-prioritytest: Provide path to `bitcoin` binaryby Ryan Ofsky · 3cceb60a · Sep 5, 2025 · 2 filesMessage 98 · StrongInformational 15Details
Commit message · Ryan Ofsky

test: Provide path to `bitcoin` binary

Set new `BitcoinTestFramework.binary_paths.bitcoin_bin` property with path to
the `bitcoin` wrapper binary. This allows new tests for `bitcoin-mine` in
#30437 and `bitcoin-cli` in #32297 to find the `bitcoin` binary and call
`bitcoin -m` to start nodes with IPC support. This way the new tests can run
whenever the ENABLE_IPC build option is enabled, instead of only running when
the `BITCOIN_CMD` environment variable is set to `bitcoin -m`

98/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit is a harmless test-infrastructure change. It tells the Bitcoin Core test framework where to find the new `bitcoin` wrapper binary by adding an environment variable override (`BITCOIN_BIN`) and a default path. There is no security issue here.

Lower-prioritytest: Add TestNode ipcbind optionby Ryan Ofsky · 3cc9a06c · Sep 5, 2025 · 2 filesMessage 98 · StrongInformational 15Details
Commit message · Ryan Ofsky

test: Add TestNode ipcbind option

With this change, tests can specify `self.extra_init = [{ipcbind: True}]` to
start a node listening on an IPC socket, instead of needing to choose which
node binary to invoke and what `self.extra_args=[["-ipcbind=..."]]` value to
pass to it.

The eliminates boilerplate code #30437 (interface_ipc_mining.py), #32297
(interface_ipc_cli.py), and #33201 (interface_ipc.py) previously needed in
their test setup.

98/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit only changes the Bitcoin Core test framework. It adds a convenience option so automated tests can more easily start a test node with inter-process communication (IPC) enabled. It does not change the production Bitcoin Core software that users run, and there is no indication it fixes or introduces a security problem.

Lower-prioritynet: Prevent node from binding to the same CServiceby woltx · 4d4789df · Sep 5, 2025 · 2 filesMessage 73 · AdequateLow 25Details
Commit message · woltx

net: Prevent node from binding to the same CService

Currently, if the user inadvertently starts the node with duplicate bind options,
such as `-bind=0.0.0.0 -bind=0.0.0.0`, it will cause a fatal error with the
misleading message "Bitcoin Core is probably already running".

This commit adds early validation to detect duplicate bindings across all binding
configurations (-bind, -whitebind, and onion bindings) before attempting to bind.
When duplicates are detected, the node terminates with a clear, specific error
message: "Duplicate binding configuration for address <addr>. Please check your
-bind, -bind=...=onion and -whitebind settings."

The validation catches duplicates both within the same option type (e.g.,
`-bind=X -bind=X`) and across different types (e.g., `-bind=X -whitebind=Y@X`),
helping users identify and fix configuration mistakes.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 25/100

This change is a user-experience and reliability fix, not a security patch in the traditional sense. It stops Bitcoin Core from starting when the user accidentally gives it the same network binding address twice (for example, '-bind=0.0.0.0 -bind=0.0.0.0'). Previously the node would crash later with a confusing 'already running' message. Now it exits early with a clear message about the duplicate configuration. There is no evidence it fixes an exploitable vulnerability.

Lower-priorityclang-tidy: Disable `UndefinedBinaryOperatorResult` check in `src/ipc`by Hennadii Stepanov · 589b65f0 · Sep 4, 2025 · 2 filesMessage 81 · StrongInformational 15Details
Commit message · Hennadii Stepanov

clang-tidy: Disable `UndefinedBinaryOperatorResult` check in `src/ipc`

The warnings are false positive and have been fixed upstream.
See: https://github.com/capnproto/capnproto/pull/2334.

This change disables the `UndefinedBinaryOperatorResult` clang-tidy
check for source files generated by the `mpgen` tool.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit only changes build tooling configuration. It tells the clang-tidy static analyzer to ignore a specific warning class in generated IPC source files because the upstream Cap'n Proto project considers the warnings false positives. There is no change to Bitcoin Core's runtime code, no bug fix, and no security-relevant behavior change.

Lower-prioritynet: Quiet down logging when router doesn't support natpmp/pcpby laanwj · 4f1a4cbc · Sep 4, 2025 · 1 fileMessage 81 · StrongInformational 15Details
Commit message · laanwj

net: Quiet down logging when router doesn't support natpmp/pcp

When the router doesn't support natpmp and PCP, one'd normally expect
the UDP packet to be ignored, and hit a time out. This logs a warning
that is already in the debug category. However, there's also the case in
which sending an UDP packet causes a ICMP response. This is returned to
user space as "connection refused" (despite UDP having no concept of
connections).

Move the warnings from `Send` and `Recv` to debug level too, to reduce
log spam in that case.

Closes #33301.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit simply changes two log messages from 'warning' level to 'debug' level in the network code that handles NAT-PMP/PCP router discovery. When a router does not support these protocols, the software was printing warnings that could flood logs; now those messages only appear in debug logging. There is no security vulnerability being fixed here.

Security candidatetrace: Workaround GCC bug compiling with old systemtapby Luke Dashjr · 93a29ff2 · Sep 4, 2025 · 2754 filesMessage 50 · ThinInformational 15Details
Commit message · Luke Dashjr

trace: Workaround GCC bug compiling with old systemtap

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 15/100

This commit is not a focused code patch. The supplied diff shows the addition of thousands of unrelated repository files (CI configs, templates, build files, documentation, source trees, etc.) under a commit title that only mentions a GCC/systemtap tracing workaround. The actual claimed change is not visible in the provided diff, so there is no basis to assess any security issue.

Lower-priorityci: reduce runner sizes on various jobsby will · 5eeb2fac · Sep 4, 2025 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · will

ci: reduce runner sizes on various jobs

These jobs can use reduced runner size to avoid wasting CPU, as much of
the long-running part of the job is single-threaded.

Suggested in: https://github.com/bitcoin/bitcoin/pull/32989#discussion_r2321775620

Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>

100/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only changes the sizes of virtual machines used by Bitcoin Core's automated testing pipeline on GitHub. It switches several jobs from medium/large runners to smaller ones to save computing resources. There is no change to the Bitcoin software itself, no user-facing change, and no security relevance.

Lower-priority[doc] archive v29.1 release notesby glozow · 61ec8866 · Sep 4, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · glozow

[doc] archive v29.1 release notes

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit simply adds a documentation file: the archived release notes for Bitcoin Core version 29.1. It contains no code changes, no configuration changes, and no executable modifications. It is purely informational text describing what was already released in version 29.1.

Lower-prioritydoc: fix LIBRARY_PATH commentby fanquake · a2a35b58 · Sep 4, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · fanquake

doc: fix LIBRARY_PATH comment

Now that we build capnp, qt isn't the only native package.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only changes a single comment in a build script. It updates the explanation for why a library path is set on macOS, because the previous comment mentioned only Qt but the build now also uses another native package (capnp). No code behavior changes.

Lower-priorityindex, refactor: DRY coinbase checkby Fabian Jahr · 84e813a0 · Sep 4, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Fabian Jahr

index, refactor: DRY coinbase check

Also marks a few additional variables const.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a small internal cleanup in Bitcoin Core's coin statistics index. It removes repeated calls checking whether a transaction is a coinbase transaction by storing the result once in a local variable, and marks a few objects as const so the compiler can enforce they are not modified. There is no change to network rules, consensus logic, or user-facing behavior.

Lower-priorityindex, refactor: Rename ReverseBlock to RevertBlockby Fabian Jahr · fab842b3 · Sep 4, 2025 · 2 filesMessage 65 · AdequateInformational 15Details
Commit message · Fabian Jahr

index, refactor: Rename ReverseBlock to RevertBlock

Semantically this is the correct name for what the function is doing.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit simply renames a private internal function from 'ReverseBlock' to 'RevertBlock' because the new name better describes what the function does during blockchain reorganizations. No behavior, logic, or security properties change.

Lower-prioritydepends: strip when installing qtby fanquake · c9d5f211 · Sep 4, 2025 · 2 filesMessage 72 · AdequateInformational 15Details
Commit message · fanquake

depends: strip when installing qt

Otherwise we end up with ~1.5GB of binaries (Linux) when DEBUG=1..

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit changes the Bitcoin Core build system so that when Qt (the graphical user-interface library) is installed into the dependency staging area, its binaries are stripped of debug symbols. The change only affects build artifact size and does not alter runtime behavior, network protocol, wallet logic, or consensus code. It is a build-size optimization, not a security fix.

Lower-priorityci: Remove redundant RUN_UNIT_TESTS_SEQUENTIALby MarcoFalke · fae610d8 · Sep 4, 2025 · 3 filesMessage 47 · ThinInformational 15Details
Commit message · MarcoFalke

ci: Remove redundant RUN_UNIT_TESTS_SEQUENTIAL

47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a routine cleanup of Bitcoin Core's continuous integration (CI) scripts. It removes an unused environment variable called RUN_UNIT_TESTS_SEQUENTIAL and merges its behavior into the standard unit test path. There is no change to the Bitcoin software that users run, no security fix, and no vulnerability.

Security candidatenet: handle multi-part netlink responsesby willcl-ark · 88db09ba · Sep 3, 2025 · 2767 filesMessage 80 · StrongLow 37Details
Commit message · willcl-ark

net: handle multi-part netlink responses

Handle multi-part netlink responses to prevent truncated results from
large routing tables.

Previously, we only made a single recv call, which led to incomplete
results when the kernel split the message into multiple responses (which
happens frequently with NLM_F_DUMP).

Also guard against a potential hanging issue where the code would
indefinitely wait for NLMSG_DONE for non-multi-part responses by
detecting the NLM_F_MULTI flag and only continue waiting when necessary.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Low 37/100

This commit fixes how Bitcoin Core reads network routing information from the Linux kernel. Previously, the code only made one request and could receive incomplete routing data on systems with large routing tables, or could hang waiting for a 'done' signal that never comes. The fix loops to collect all kernel response parts and only waits for the 'done' marker when the kernel says the response is multi-part. This is a reliability bug fix, not a direct money-stealing vulnerability, but incorrect routing data could affect how the node connects to peers.

AI review queuedwallet: Add m_cached_from_me to cache "from me" statusby Ava Chow · 113a4228 · Sep 3, 2025 · 2 filesMessage 73 · AdequateInformational 19Details
Commit message · Ava Chow

wallet: Add m_cached_from_me to cache "from me" status

m_cached_from_me is used to track whether a transaction is "from me", i.e. has
any inputs which belong to the wallet. This is held in memory only in
the same way that a transaction's balances are.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit adds a small in-memory cache to Bitcoin Core's wallet so it can remember whether a transaction spends coins that belong to the wallet, instead of recalculating that fact every time it is needed. It is a performance and code-clarity change, not a fix for a known security bug. There is no evidence in the commit or supplied references that this addresses an active vulnerability.

AI review queuedtest: Add a test for anchor outputs in the walletby Ava Chow · 609d265e · Sep 3, 2025 · 3 filesMessage 67 · AdequateInformational 15Details
Commit message · Ava Chow

test: Add a test for anchor outputs in the wallet

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a new automated test for Bitcoin Core's wallet behavior regarding 'anchor outputs'—a special zero-value or tiny output type used in some transaction protocols. It does not change any production wallet, node, or consensus code. The test verifies that the wallet can detect anchor outputs during a blockchain rescan but cannot spend them. There is no security vulnerability here.

AI review queuedwallet: Throw an error in sendall if the tx size cannot be calculatedby Ava Chow · c40dc822 · Sep 3, 2025 · 1 fileMessage 50 · ThinLow 32Details
Commit message · Ava Chow

wallet: Throw an error in sendall if the tx size cannot be calculated

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 32/100

This commit changes the Bitcoin Core wallet's 'sendall' RPC command so that instead of relying on an internal assumption that every coin's size is known, it explicitly checks whether the final transaction size can be calculated and throws a clear error if it cannot. Previously, the code used a non-fatal assertion that could be skipped in release builds, potentially allowing the command to proceed with an invalid or unknown transaction size when the wallet contained descriptors it could not fully solve.