BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

2900 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

254security candidates607second-pass queue2881AI analyses
204commits · 30 days
502commits · 60 days
1531commits · 180 days
2883commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
937Strong · 80–100
1188Adequate · 60–79
687Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot22422170
Ava Chow15750157064
MarcoFalke41021406074
Lőrinc17721177081
fanquake22719226057
Hennadii Stepanov20914208063
rkrux57957074
Sjors Provoost89889074
Sebastian Falbesoner33733073
David Gumberg55655072
Pieter Wuille95595066
Hodlinator66566076
Analysis record

Published AI watches

Last scanned 48 minutes ago

Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35928: doc: mention -DWITH_ZMQ=ON in macOS build guide

This is a one-line documentation update to the macOS build guide. It adds a note telling users to pass a specific CMake option if they want ZeroMQ notification support. There is no code change and no security impact.

8397e09eby merge-script+1−11 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35482: fuzz: exercise the transaction-handling path in process_message(s)

This commit only changes Bitcoin Core's internal fuzz testing code. It makes the fuzz tests exercise more of the transaction-handling code path by toggling Initial Block Download mode and resetting the mempool between test runs. There is n…

No production code modifiedNo consensus, validation, net_processing, or wallet logic changedOnly fuzz test harnesses and test utilities affected
f11dc617by merge-script+105−798 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35914: test, fuzz: Remove unused variables

This commit removes unused variables from Bitcoin Core's test and fuzzing code. It is a cleanup/refactoring change with no effect on the live network software or user funds. It does not fix or introduce any security vulnerability.

d36bf709by merge-script+1−138 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35896: refactor: Default uint256::operator==, add operator<=>

This commit is a routine code cleanup in Bitcoin Core. It switches the uint256 equality and comparison operators to use standard C++20 defaults, removes an old custom Compare() helper, and marks an internal assertion-failure function as ne…

ed2c59abby merge-script+99−245 files
No security note in commit
Moderate 62 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35872: rpc: avoid descriptor range counter overflow

This update fixes a counting bug in several Bitcoin Core RPC commands that scan descriptors. When a user requested a descriptor range ending at the maximum allowed value (2,147,483,647), the internal counter used a smaller integer type and…

Signed integer overflow in descriptor expansion loopCrash/undefined behavior on maximum-range descriptor scansAuthenticated RPC surface affected (scantxoutset, scanblocks, getdescriptoractivity, utxoupdatepsbt, descriptorprocesspsbt)
b388674aby Ava Chow+3−12 files
Vendor flagged security relevance
Informational 19 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35842: rpc: Properly make RPCResult::Type::ANY non-test-only

This is a small cleanup and documentation fix for Bitcoin Core's RPC help system. It removes a comment that incorrectly said a certain output type was 'for testing only' and makes the help text properly display those outputs. There is no d…

No memory safety, cryptography, consensus, or authorization changes observedChange is confined to RPC help/schema metadata generationComment-only/type-label change from 'for testing only' to general use
c36ffd87by merge-script+42−364 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

This is a code cleanup change that turns on a static-analysis rule to prevent a specific C++ coding pattern (anonymous namespaces in header files) and updates two headers to comply. It does not change how Bitcoin Core behaves at runtime an…

No security-relevant code changeNo memory safety, cryptography, consensus, or network changesTooling-only refactor (clang-tidy configuration)
c4fbd3c7by merge-script+9−123 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

This commit only adds new test cases to Bitcoin Core's functional test suite. It does not change any production wallet, node, or RPC code. The tests verify that the importdescriptors RPC reports errors in the right order, rejects bad times…

465196d0by merge-script+77−11 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35180: coins: group private cache helpers

This change is purely a code cleanup: it moves two internal helper functions of a Bitcoin Core cache class into the private section of the class and removes a duplicate 'private:' label. There is no change to what the code does, no bug fix…

c940fd75by merge-script+13−141 file
No security note in commit
Low 29 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

This Bitcoin Core change tightens how three RPC commands (scantxoutset, scanblocks, deriveaddresses) handle the value null when it is passed for optional parameters. Previously, explicitly passing null could be treated differently from sim…

RPC parameter validation changeNull value handling changeAddition of explicit error checks for missing required contextual parameters
3db96eb5by merge-script+18−75 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable misc-definitions-in-headers

This commit is a code cleanup: it turns on a clang-tidy style check called 'misc-definitions-in-headers' and suppresses that check around a large inline implementation block in a benchmark header. There is no change to Bitcoin's runtime be…

fa93132dby MarcoFalke+3−02 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable clang-tidy rule to reject anon namespace in header

This commit only changes a linting configuration file for the project's code style checker. It enables a rule that prevents anonymous namespaces from being used in header files, which is a code-quality and build-hygiene practice. There is …

No security-relevant signals in the diff or commit message.Change is purely a static-analysis/linting configuration update.
fa5ca877by MarcoFalke+2−11 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use C++20 std::identity over IntIdentity

This commit is a straightforward code cleanup: it replaces a small custom helper named IntIdentity with the standard C++20 std::identity from the <functional> header. The behavior of the ConvertBits function is unchanged; only the implemen…

fafe5042by MarcoFalke+4−111 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test the result order of a multiple import request is correct

This commit only adds a new automated test to Bitcoin Core. It checks that when a user asks the wallet to import multiple descriptors at once, the list of results comes back in the same order as the original request, including any error me…

3ac8b806by Pol Espinasa+40−01 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test invalid or missing timestamp throws importdescriptors

This commit only adds new automated tests for the Bitcoin Core wallet's importdescriptors RPC. It checks that the command correctly rejects requests with a missing or invalid timestamp. No production wallet code is changed, so this cannot …

No changes to consensus, networking, wallet logic, or cryptographyOnly functional test code is modifiedAdded assertions are for expected error handling paths
e4732bf0by Pol Espinasa+28−11 file
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Remove unused #include in common/system

This is a minor code cleanup that removes one unused header file include and swaps another for a more specific one. It does not change any program behavior or fix any security issue.

fa7304f3by MarcoFalke+1−22 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

iwyu: Fix warnings in `src/consensus` and treat them as errors

This commit is a routine code cleanup: it adjusts which C++ header files are included in several consensus-related source files and turns on a stricter compiler hygiene check (Include What You Use, or IWYU) for the src/consensus directory.…

13b53f8bby Hennadii Stepanov+42−79 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: don't connman.ReceiveMsgFrom oversized msg

This is a small fix to a Bitcoin Core fuzz test (an automated internal testing harness), not to the live network code. The fuzzer was sometimes creating fake P2P messages larger than the real protocol allows and passing them into a test he…

Test-only fuzz harness hardeningOversized message guard added before ReceiveMsgFrom() in fuzz targetNo change to production P2P message acceptance logic
bb19f1daby Greg Sanders+5−01 file
No security note in commit
Informational 15 AI analysisMessage 97 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: Temporarily remove riscv32 config from GHA matrix

This commit simply removes one failing test configuration (RISC-V 32-bit bare metal) from the project's GitHub Actions CI matrix because it was failing. It is a routine CI maintenance change with no security implications.

fa06ea42by MarcoFalke+0−61 file
No security note in commit
Low 47 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: verify cross-build SDK archives

This change adds checksum verification to the build system's downloads of Apple, FreeBSD, NetBSD, and OpenBSD software development kits (SDKs). Before this patch, those SDK archives were downloaded at build time and extracted without confi…

Adds cryptographic digest verification for downloaded SDK archivesRemoves unchecked extraction of remote SDK archives in CIHardens CI supply chain for macOS/BSD cross-builds
873550beby Lőrinc+25−126 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritytest: Extend named pipe sqlite tool test to use rollbackby Fabian Jahr · d0fd7189 · Apr 2, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Fabian Jahr

test: Extend named pipe sqlite tool test to use rollback

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This is a routine test-only change for a developer tool. It extends an existing functional test so that the utxo-to-sqlite helper tool is exercised with a 'rollback' snapshot instead of a 'latest' snapshot, and compares the result against the coinstats index. There is no change to production code, no wallet or node behavior change, and no security issue.

Lower-priorityrpc: Don't invalidate blocks in dumptxoutsetby Fabian Jahr · 49d5e835 · Apr 2, 2026 · 3 filesMessage 68 · AdequateLow 44Details
Commit message · Fabian Jahr

rpc: Don't invalidate blocks in dumptxoutset

Instead this new approach uses a temporary coins db to roll back the
UTXO set.

This new approach also prevents the node from pruning necessary blocks
during dumptxoutset execution by using prune locks.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validation
AI analysis · Low 44/100

This commit changes how the Bitcoin Core 'dumptxoutset' RPC command creates snapshots of older UTXO sets. Previously, it temporarily invalidated a block to roll back the chain, which suspended network activity and could leave the node in a bad state if something went wrong. The new approach copies the UTXO set to a temporary database and rolls it back there, leaving the main chain untouched. It also uses a prune lock to prevent needed blocks from being deleted during the operation. This is a robustness and operational-safety improvement rather than a fix for a remote exploit.

Lower-priorityblockstorage: Add DeletePruneLockby Fabian Jahr · fe58eb98 · Apr 2, 2026 · 3 filesMessage 60 · AdequateInformational 15Details
Commit message · Fabian Jahr

blockstorage: Add DeletePruneLock

Also adds basic unit test coverage for prune lock management methods.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit adds a new housekeeping function, DeletePruneLock, that lets Bitcoin Core remove a previously created 'prune lock' by name. Prune locks are internal bookkeeping markers that prevent certain block data from being pruned too early. The change also adds unit tests for the new function. There is no indication this fixes a bug or addresses a security issue; it appears to be a normal feature/refactoring addition.

AI review queuedwalletdb: Remove m_mock from SQLiteDatabaseby Ava Chow · 037ea2c7 · Apr 2, 2026 · 4 filesMessage 45 · ThinInformational 12Details
Commit message · Ava Chow

walletdb: Remove m_mock from SQLiteDatabase

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit is a small internal code cleanup in Bitcoin Core's wallet database code. It removes a special 'mock' flag used only for testing and replaces it with a more general way to pass extra SQLite database options. The change only affects test helper code and how mock (in-memory) wallets are created during tests. There is no indication it fixes a security bug or introduces a security risk.

Lower-prioritywallet, bench: Use TestingSetup in CoinSelection benchmarkby Ava Chow · b69f989d · Apr 2, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Ava Chow

wallet, bench: Use TestingSetup in CoinSelection benchmark

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit changes only a benchmark test file used to measure wallet coin-selection performance. It swaps a manually created test chain for the standard TestingSetup helper and wraps the code in a wallet namespace. There is no change to production wallet code, consensus rules, networking, or any code that handles real user funds. It is a test-code cleanup with no security relevance.

AI review queuedbench, wallet: Make WalletMigration's setup WalletBatch scopedby Ava Chow · 964eafb7 · Apr 2, 2026 · 1 fileMessage 77 · AdequateInformational 15Details
Commit message · Ava Chow

bench, wallet: Make WalletMigration's setup WalletBatch scoped

WalletBatch needs to be in a scope so that it is destroyed before the
database is closed during migration.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This change fixes a bug in a benchmark test program, not in the main Bitcoin wallet that users run. The benchmark creates a fake wallet to measure how long migration takes, and the fake wallet's database helper object was not being closed before the migration step tried to close the database. That could make the benchmark crash or fail, but it does not affect real wallets or network security.

AI review queuedwallet: Make Mockable{Database,Batch} subclasses of SQLite classesby Ava Chow · 59484e2f · Apr 2, 2026 · 4 filesMessage 95 · StrongInformational 15Details
Commit message · Ava Chow

wallet: Make Mockable{Database,Batch} subclasses of SQLite classes

The mocking functionality of MockableDatabase, MockableBatch, and
MockableCursor was not really being used. These are changed to be
subclasses of their respective SQLite* classes and will use in-memory
SQLite databases so that the tests are more representative of actual
database behavior.

MockableCursor is removed as there are no overrides needed in
SQLiteCursor for the tests.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a test-only refactoring change. It replaces a custom in-memory fake database used in Bitcoin Core's automated tests with a real SQLite database running in memory. There is no change to how actual user wallets work, no bug fix for live code, and no security issue introduced or fixed.

AI review queuedtest: Make duplicating MockableDatabases use cursor and batchby Ava Chow · e7d67c9f · Apr 2, 2026 · 2 filesMessage 95 · StrongInformational 15Details
Commit message · Ava Chow

test: Make duplicating MockableDatabases use cursor and batch

Instead of directly copying the stored records map when duplicating a
MockableDatabase, use a Cursor to read the records, and a Batch to write
them into the new database. This prepares for using SQLite as the
database backend for MockableDatabase.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a test-only code change. It refactors how a fake in-memory wallet database is copied during unit tests so that the copy uses the same cursor-and-batch interface a real database would use. There is no change to production wallet code, no user-facing behavior change, and no security fix or vulnerability.

AI review queueddoc: Discourage trailing doxygen comments, and fix the broken onesby MarcoFalke · facaeb9c · Apr 2, 2026 · 4 filesMessage 50 · ThinInformational 15Details
Commit message · MarcoFalke

doc: Discourage trailing doxygen comments, and fix the broken ones

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes documentation style guidance and moves or converts code comments. It does not alter any program logic, data handling, or network behavior, so it has no security impact.

Lower-prioritydoc: remove stale shortid collision TODOby w0xlt · fc9987df · Apr 1, 2026 · 1 fileMessage 48 · ThinInformational 15Details
Commit message · w0xlt

doc: remove stale shortid collision TODO

PartiallyDownloadedBlock::InitData() intentionally treats duplicate short IDs in a compact block as READ_STATUS_FAILED.

For an honest peer, block-level short-ID collisions are rare enough that failing the compact block early is preferable to spending CPU scanning the mempool or attempting selective recovery.

Remove the old TODO that suggested requesting both collided transactions, since it since it points at unwanted behavior.

48/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context! Contains work-in-progress language
AI analysis · Informational 15/100

This commit only removes a two-line comment (a TODO note) from the source code. No actual code behavior changes. The TODO had suggested a future improvement for handling rare compact-block short-ID collisions, but the developers decided the current behavior—failing early on collisions—is intentional and preferable. It is purely a documentation cleanup.

Lower-prioritydocs: remove duplicate ///@} from bitcoinkernel.hby Alexander Wiederin · 7abf6f6f · Apr 1, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Alexander Wiederin

docs: remove duplicate ///@} from bitcoinkernel.h

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI analysis · Informational 15/100

This commit removes a duplicate documentation marker (///@}) from a header file. It is purely a cosmetic documentation cleanup with no effect on program behavior or security.

Lower-priorityfuzz: remove GetDescriptorChecksum from string harnessby Bruno Garcia · 91cd0e3a · Apr 1, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Bruno Garcia

fuzz: remove GetDescriptorChecksum from string harness

This function is already strongly fuzzed by other harness.
E.g: descriptor_parse calls it several times during parsing
and serialization. Also, calling GetDescriptorChecksum with
a string of length 32 is not effective to exercise it.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit removes one line from a fuzz test file. Fuzz tests are automated tools that feed random inputs to functions to find crashes or bugs. The change simply stops calling the GetDescriptorChecksum function in this particular test, because other fuzz tests already exercise it more thoroughly. There is no change to any production code, no bug fix, and no security-relevant behavior change in the Bitcoin Core software itself.

Lower-prioritykernel: Remove NONNULL annotation from destroy methodby Alexander Wiederin · 75608547 · Apr 1, 2026 · 1 fileMessage 73 · AdequateInformational 21Details
Commit message · Alexander Wiederin

kernel: Remove NONNULL annotation from destroy method

No other *_destroy function in the Kernel API carries this annotation.
Following the convention set by free(), destroy functions should accept
null pointers.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 21/100

This commit removes a compiler hint telling the destroy function it must never receive a null pointer. The change makes the function behave more like standard free(), which safely accepts null. It is a defensive API-consistency fix, not a fix for an active crash or exploit.

Lower-prioritylint: Clarify rmtree/remove_all error message with preferred alternativesby MarcoFalke · fa955af6 · Apr 1, 2026 · 3 filesMessage 50 · ThinInformational 15Details
Commit message · MarcoFalke

lint: Clarify rmtree/remove_all error message with preferred alternatives

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only rewords two lint error messages and fixes a minor code-formatting import line. It does not change any runtime behavior, security checks, or executable code paths in Bitcoin Core. There is no security issue here.

Security candidatecrypto: disable ASan instrumentation of SSE4 SHA256 for GCCby deadmanoz · fedeff7f · Apr 1, 2026 · 1 fileMessage 83 · StrongInformational 18Details
Commit message · deadmanoz

crypto: disable ASan instrumentation of SSE4 SHA256 for GCC

The existing Clang-only no_sanitize("address") guard is extended to
also cover GCC. When GCC compiles this file with -fsanitize=address
in debug builds, the instrumented inline assembly causes a SEGV during
SHA256AutoDetect()'s self-test on CPUs that use the SSE4 code path
(i.e. those without SHA-NI support), regardless of optimization level.

The original Clang code placed the attribute between the function
declarator and the opening brace. GCC's Attribute Syntax
documentation notes that this position in a function definition
"may, in future, be permitted," so it is not currently supported.
The attribute is moved to the start of the function definition,
which is valid form for both GCC and Clang.

The preprocessor guards are restructured so each compiler branch is
explicit: __clang__ with __has_feature, and __GNUC__ with
__SANITIZE_ADDRESS__.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validationcryptography-sensitive path
AI analysis · Informational 18/100

This is a build-compatibility fix, not a security vulnerability in normal Bitcoin operation. It stops a specific compiler sanitizer (GCC's AddressSanitizer, used only in debug/test builds) from crashing when running SHA-256 self-tests on older CPUs that lack SHA-NI hardware support. The change does not affect production releases or how Bitcoin validates transactions.

AI review queuedqa: Improve error messageby Hodlinator · 257769a7 · Mar 31, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Hodlinator

qa: Improve error message

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This is a tiny quality-of-life change to a test helper. It only makes an error message clearer when a test fails, so developers can see exactly what text was produced. It does not touch Bitcoin's network code, wallet, consensus rules, or any code that runs in production.

Security candidatecli: Clearer error messages on authentication failureby Hodlinator · 20a94c15 · Mar 31, 2026 · 5 filesMessage 70 · AdequateInformational 18Details
Commit message · Hodlinator

cli: Clearer error messages on authentication failure

Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>

70/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
Why it was queued
access control
AI analysis · Informational 18/100

This commit only changes the wording of error messages shown when bitcoin-cli fails to log in to the RPC server. It does not fix or introduce any security vulnerability; it is a user-experience improvement that tells users more precisely why authentication failed (missing cookie file, cookie disabled, bad cookie contents, or wrong password).

Lower-priorityrefactor(rpc): GenerateAuthCookieResult -> AuthCookieResultby Hodlinator · 84c3f8d3 · Mar 31, 2026 · 3 filesMessage 95 · StrongInformational 15Details
Commit message · Hodlinator

refactor(rpc): GenerateAuthCookieResult -> AuthCookieResult

Type will be used for reading the cookie in next commit.

Also corrects ERR/ERROR mismatch in docstring in request.h, and changes to CamelCase to avoid potential collision with Windows headers (https://github.com/bitcoin/bitcoin/pull/34965#issuecomment-4161331392).

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit is a simple code cleanup: it renames an internal status type from GenerateAuthCookieResult to AuthCookieResult and changes its value names to CamelCase. It also fixes a typo in a code comment where 'ERROR' was written as 'ERR'. No behavior of the Bitcoin RPC authentication cookie is changed.

Lower-priorityrefactor: Use NodeClock::time_point for m_last_send/recv and m_ping_startby MarcoFalke · fa244b98 · Mar 31, 2026 · 6 filesMessage 97 · StrongInformational 14Details
Commit message · MarcoFalke

refactor: Use NodeClock::time_point for m_last_send/recv and m_ping_start

The two fields represent a time point, not a duration. Also, it is
unclear why they use second precision.

Fix both issues by using NodeClock::time_point.

This refactor should not change any behavior.

This resolves the two temporary calls to time_since_epoch() added in the
previous commit. However, it adds one new call to time_since_epoch(),
which is resolved in the next commit.

97/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 14/100

This is a code cleanup change in Bitcoin Core. It changes how the program stores timestamps for the last time data was sent or received with a network peer, switching from raw second counts to proper clock time points. The commit message explicitly says this should not change behavior, and the diff shows equivalent conversions where the values are used. There is no indication of a security fix or vulnerability.

Lower-priorityrefactor: Use NodeClock::time_point for CNetMessage::m_timeby MarcoFalke · fa2605b2 · Mar 31, 2026 · 4 filesMessage 85 · StrongInformational 15Details
Commit message · MarcoFalke

refactor: Use NodeClock::time_point for CNetMessage::m_time

The field is not a duration, but a time point.

This will add two temporary calls to time_since_epoch(), which are fixed
in the next commit.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a straightforward code cleanup (refactor) that changes how message timestamps are represented internally. It does not fix a bug, add a feature, or change network behavior. There is no security relevance.

Lower-prioritytest: mining: add coverage for GBT's "coinbasevalue" result fieldby Sebastian Falbesoner · 12c3c3f8 · Mar 30, 2026 · 1 fileMessage 95 · StrongInformational 15Details
Commit message · Sebastian Falbesoner

test: mining: add coverage for GBT's "coinbasevalue" result field

Add missing test coverage for the `getblocktemplate` RPC call
"coinbasevalue" field, specifically that it is set to claim the
full block reward.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a new test to Bitcoin Core's functional test suite. It checks that the getblocktemplate RPC returns a 'coinbasevalue' field equal to the full block reward (subsidy plus fees). There is no change to production code, no bug fix, and no security-relevant behavior change.

Security candidateci, iwyu: Fix warnings in `src/util` and treat them as errorsby Hennadii Stepanov · 8b49e2dd · Mar 30, 2026 · 42 filesMessage 50 · ThinInformational 15Details
Commit message · Hennadii Stepanov

ci, iwyu: Fix warnings in `src/util` and treat them as errors

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a routine code-quality cleanup. It adjusts which C++ header files are included in various source files under src/util and turns on a stricter automated check (IWYU) in the project's continuous integration. There is no functional change to Bitcoin Core's behavior, no bug fix, and no security-relevant change.

AI review queuedrefactor: Move license info into new moduleby Hennadii Stepanov · 6953363b · Mar 30, 2026 · 15 filesMessage 57 · ThinInformational 15Details
Commit message · Hennadii Stepanov

refactor: Move license info into new module

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a straightforward code cleanup: it moves the functions that generate copyright and license text from one source file to a new dedicated module, then updates the various Bitcoin programs to include that new module. There is no change to what the software does, no bug fix, and no security-relevant behavior change.

Lower-priorityiwyu: Remove workaround for issue that has been fixed upstreamby Hennadii Stepanov · eb750d27 · Mar 30, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Hennadii Stepanov

iwyu: Remove workaround for issue that has been fixed upstream

This was overlooked in bitcoin/bitcoin#34896.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit removes a code comment and a special compiler/tooling directive that were only there to work around a bug in a third-party developer tool (include-what-you-use). The actual C++ source code still includes the same header file as before, so program behavior is unchanged. There is no security relevance.

Lower-prioritypolicy: remove incorrect MANDATORY_SCRIPT_VERIFY_FLAGS commentby ismaelsadeeq · 5fa68988 · Mar 30, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · ismaelsadeeq

policy: remove incorrect MANDATORY_SCRIPT_VERIFY_FLAGS comment

The claim that failing mandatory script checks may trigger a DoS ban
is incorrect; Bitcoin Core does not automatically ban peers for
violating any of these flag checks.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only removes a misleading comment in the source code. It does not change any actual code behavior. The old comment incorrectly stated that failing certain script checks could cause a peer to be banned from the network. The commit corrects that documentation-only mistake. There is no security vulnerability being fixed here.