Bitcoin Core

This commit adds a new helper class for formatting HTTP response headers in Bitcoin Core's internal web server. It does not change any existing behavior or fix any known problem; it is purely new infrastructure code with accompanying tests.

This commit adds a new internal HTTPServer class to Bitcoin Core that handles low-level network socket binding and listening for the HTTP RPC server. It is a code refactoring/introduction change with no obvious security bug. The new code is covered by unit tests that use mock sockets, so it does not open real network ports during testing.

This commit adds a new internal method for accepting incoming HTTP connections and includes unit tests for it. It is a routine code refactoring and testing change with no apparent security relevance.

This commit introduces a new HTTP request parser for Bitcoin Core's internal web server. It is a defensive, by-the-book implementation that explicitly rejects malformed request lines, bad HTTP versions, NUL bytes, conflicting Content-Length headers, oversized bodies, and non-numeric content lengths. The code is accompanied by extensive unit tests demonstrating these protections. There is no indication in the commit or supplied references that this fixes a known vulnerability; it appears to be a refactoring or hardening change.

This commit changes a low-level string utility so it no longer strips spaces from the beginning and end of lines it reads. It now only removes the actual line-ending characters (carriage return and newline). The change is described as a correctness fix so callers can decide for themselves whether spaces are allowed. It is not presented as a security fix, but overly aggressive trimming could in principle hide or alter data in network messages such as HTTP headers.

This commit only adds new automated tests to Bitcoin Core. It does not change the actual server code that handles HTTP requests. The tests verify that the existing HTTP server correctly rejects or handles common web attacks such as path traversal, request smuggling, null bytes, invalid HTTP versions, and malformed authentication headers. Because no production code is modified, the commit itself does not introduce or fix a vulnerability.

This is a harmless test-only change. It doubles the RPC timeout in one functional test so that a slow test step (mining a long chain) does not fail due to client-side timeout during parallel debug-mode test runs. It does not change any production Bitcoin Core code, consensus rules, networking, or wallet behavior.

This commit fixes a CI (Continuous Integration) configuration mistake. It restores the intended Docker cache provider for Bitcoin Core's own GitHub workflows, using 'warp' for the official bitcoin/bitcoin repository and 'gha' for forks. There is no security issue in the code change itself.

This commit is a documentation-only metadata change. It adds a new 'placeholder' flag to the internal description of several old, ignored RPC parameters so the help system can label them as kept only for backward compatibility. No code behavior changes, no bug fixes, and no security issue is present.

This commit adds small plumbing so that Bitcoin Core's RPC command metadata (descriptions, argument details, result formats) can be inspected by other code. It does not change any user-facing RPC behavior by itself; it merely exposes internal data structures that were already present. There is no obvious security bug in the diff.

This is a small bug-fix in Bitcoin Core's RPC help system. A special placeholder result type called Type::ANY previously caused the help() command to crash with an 'unreachable' assertion when it appeared inside a nested result description. The change makes it render as 'xxx' with description 'any' instead, matching how other types are displayed. It is a denial-of-service-style crash only for the help() RPC output, not for transaction processing, consensus, or wallet operations.

This commit fixes a bookkeeping bug in Bitcoin Core's RPC command registry. When a command was fully removed (for example, when a wallet is unloaded), the command's name was still left behind in an internal list. That caused tools like `getopenrpcinfo` and `listCommands` to report commands that no longer actually exist. The fix simply deletes the empty entry so removed commands disappear from listings. There is no direct evidence this can be exploited to steal funds or crash nodes, but it could mislead monitoring tools or client software that relies on the command list.

This is a routine code-cleanup change: it adds a missing #include <string_view> to a header file so it no longer depends on other headers to provide the std::string_view type. It does not change any program behavior or fix a security bug.

This commit only adds new unit tests for Bitcoin Core's internal test framework. It checks that a helper class for BIP32 extended keys produces the well-known public test-vector outputs. No production wallet, consensus, or networking code is changed, and no security bug is being fixed.

This commit adds a new test-only helper file that implements BIP32-style extended private and public keys for Bitcoin Core's functional test framework. It is purely test infrastructure code and does not change any production wallet, consensus, or networking logic. There is no security-relevant change to the Bitcoin Core software that users run.

This commit only adds a new functional test to Bitcoin Core. It verifies that nodes ignore unsolicited compact block (CMPCTBLOCK) messages from peers that are not in high-bandwidth mode, while still accepting them from high-bandwidth peers or when explicitly requested. There is no change to production code, so it cannot directly introduce or fix a runtime security vulnerability.

This commit only changes a test file. It expands an existing test to verify that Bitcoin Core correctly disconnects peers that send badly formed compact block messages, whether those peers are high-bandwidth or low-bandwidth. It does not change any production code, so it cannot directly introduce or fix a live security vulnerability.

This Bitcoin Core update tightens the rules for compact block messages. Before the change, a peer could send a compressed block (CMPCTBLOCK) even if it had never advertised support for compact blocks via the SENDCMPCT handshake. The fix makes the node ignore such unexpected CMPCTBLOCK messages. The commit also updates the test framework so that simulated peers use the current compact-block version 2 by default. This is a hardening change that reduces the attack surface for malformed or unexpected compact-block traffic, but the commit message does not describe it as a security fix and no exploit is demonstrated.

This commit only changes a Bitcoin Core functional test file. It tightens the checks in a test that verifies how nodes request missing transactions from compact blocks. There is no change to the actual Bitcoin node software, so it cannot directly affect live network behavior or user funds. It is a test-quality improvement that makes future changes to the real code harder to pass by accident if they silently break compact-block behavior.

This Bitcoin Core change tightens the rules for a fast block-relay feature called compact blocks (BIP 152). Previously, any peer could send a compact block announcement without being asked. Now, if a peer sends one without being marked as a 'high-bandwidth' peer and without the node having requested the block from them, the message is ignored. The commit says this partly closes a known mempool information leak and reduces the risk of bandwidth-wasting abuse, but it is only a partial fix because high-bandwidth peers can still send unsolicited compact blocks.

This change fixes a privacy leak in Bitcoin Core's 'blocksonly' mode. Blocksonly nodes intentionally avoid keeping a mempool of unconfirmed transactions. Previously, they would still try to process compact block (CMPCTBLOCK) messages from peers. Because they lack a mempool, they would be missing almost every transaction referenced in a compact block—except for transactions they themselves created. When responding to ask for the missing transactions, the node would reveal exactly which transactions were its own, linking those transactions to that node's IP address. The fix makes blocksonly nodes simply ignore incoming compact block messages, so they never send those revealing responses. The commit message explicitly calls this out as a real privacy issue, not just a defensive cleanup.

This is a minor fix inside Bitcoin Core's own test suite. It changes how test UTXOs are consumed so that different test functions don't accidentally reuse the same fake coin. It does not affect the live Bitcoin network, wallets, or node software.

This commit is a minor code cleanup in Bitcoin Core's test suite. It moves a small helper function from inside one test method to the class level so other tests can reuse it. There is no change to the actual Bitcoin network code, no change to how nodes communicate, and no security issue.

This commit updates two helper scripts used during Bitcoin Core's build process to the latest versions from the GNU project. These scripts only detect what kind of computer and operating system is being used so the build can choose the right settings. The changes add support for newer or less common platforms (Ironclad, mlibc, sw_64) and update copyright years. There is nothing here that changes how Bitcoin handles money, network messages, wallets, or cryptography.

This commit tightens a Bitcoin Core lint check that verifies 'scripted-diff' commits. Previously, the shell command running the script could silently ignore failures due to a fragile chain of '&&' and '||' operators. The fix makes the script explicitly fail if the scripted diff does not apply cleanly or leaves unexpected changes. It is a hardening improvement in developer tooling, not a fix for an active vulnerability in the Bitcoin software itself.