BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

2902 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

254security candidates607second-pass queue2881AI analyses
197commits · 30 days
497commits · 60 days
1518commits · 180 days
2877commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
939Strong · 80–100
1188Adequate · 60–79
687Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot22422170
Ava Chow15750157064
MarcoFalke41021406074
Lőrinc17721177081
fanquake22719226057
Hennadii Stepanov20914208063
rkrux57957074
Sjors Provoost89889074
Sebastian Falbesoner33733073
David Gumberg55655072
Pieter Wuille95595066
Hodlinator66566076
Analysis record

Published AI watches

Last scanned 59 minutes ago

Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35928: doc: mention -DWITH_ZMQ=ON in macOS build guide

This is a one-line documentation update to the macOS build guide. It adds a note telling users to pass a specific CMake option if they want ZeroMQ notification support. There is no code change and no security impact.

8397e09eby merge-script+1−11 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35482: fuzz: exercise the transaction-handling path in process_message(s)

This commit only changes Bitcoin Core's internal fuzz testing code. It makes the fuzz tests exercise more of the transaction-handling code path by toggling Initial Block Download mode and resetting the mempool between test runs. There is n…

No production code modifiedNo consensus, validation, net_processing, or wallet logic changedOnly fuzz test harnesses and test utilities affected
f11dc617by merge-script+105−798 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35914: test, fuzz: Remove unused variables

This commit removes unused variables from Bitcoin Core's test and fuzzing code. It is a cleanup/refactoring change with no effect on the live network software or user funds. It does not fix or introduce any security vulnerability.

d36bf709by merge-script+1−138 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35896: refactor: Default uint256::operator==, add operator<=>

This commit is a routine code cleanup in Bitcoin Core. It switches the uint256 equality and comparison operators to use standard C++20 defaults, removes an old custom Compare() helper, and marks an internal assertion-failure function as ne…

ed2c59abby merge-script+99−245 files
No security note in commit
Moderate 62 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35872: rpc: avoid descriptor range counter overflow

This update fixes a counting bug in several Bitcoin Core RPC commands that scan descriptors. When a user requested a descriptor range ending at the maximum allowed value (2,147,483,647), the internal counter used a smaller integer type and…

Signed integer overflow in descriptor expansion loopCrash/undefined behavior on maximum-range descriptor scansAuthenticated RPC surface affected (scantxoutset, scanblocks, getdescriptoractivity, utxoupdatepsbt, descriptorprocesspsbt)
b388674aby Ava Chow+3−12 files
Vendor flagged security relevance
Informational 19 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35842: rpc: Properly make RPCResult::Type::ANY non-test-only

This is a small cleanup and documentation fix for Bitcoin Core's RPC help system. It removes a comment that incorrectly said a certain output type was 'for testing only' and makes the help text properly display those outputs. There is no d…

No memory safety, cryptography, consensus, or authorization changes observedChange is confined to RPC help/schema metadata generationComment-only/type-label change from 'for testing only' to general use
c36ffd87by merge-script+42−364 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

This is a code cleanup change that turns on a static-analysis rule to prevent a specific C++ coding pattern (anonymous namespaces in header files) and updates two headers to comply. It does not change how Bitcoin Core behaves at runtime an…

No security-relevant code changeNo memory safety, cryptography, consensus, or network changesTooling-only refactor (clang-tidy configuration)
c4fbd3c7by merge-script+9−123 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

This commit only adds new test cases to Bitcoin Core's functional test suite. It does not change any production wallet, node, or RPC code. The tests verify that the importdescriptors RPC reports errors in the right order, rejects bad times…

465196d0by merge-script+77−11 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35180: coins: group private cache helpers

This change is purely a code cleanup: it moves two internal helper functions of a Bitcoin Core cache class into the private section of the class and removes a duplicate 'private:' label. There is no change to what the code does, no bug fix…

c940fd75by merge-script+13−141 file
No security note in commit
Low 29 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

This Bitcoin Core change tightens how three RPC commands (scantxoutset, scanblocks, deriveaddresses) handle the value null when it is passed for optional parameters. Previously, explicitly passing null could be treated differently from sim…

RPC parameter validation changeNull value handling changeAddition of explicit error checks for missing required contextual parameters
3db96eb5by merge-script+18−75 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable misc-definitions-in-headers

This commit is a code cleanup: it turns on a clang-tidy style check called 'misc-definitions-in-headers' and suppresses that check around a large inline implementation block in a benchmark header. There is no change to Bitcoin's runtime be…

fa93132dby MarcoFalke+3−02 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable clang-tidy rule to reject anon namespace in header

This commit only changes a linting configuration file for the project's code style checker. It enables a rule that prevents anonymous namespaces from being used in header files, which is a code-quality and build-hygiene practice. There is …

No security-relevant signals in the diff or commit message.Change is purely a static-analysis/linting configuration update.
fa5ca877by MarcoFalke+2−11 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use C++20 std::identity over IntIdentity

This commit is a straightforward code cleanup: it replaces a small custom helper named IntIdentity with the standard C++20 std::identity from the <functional> header. The behavior of the ConvertBits function is unchanged; only the implemen…

fafe5042by MarcoFalke+4−111 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test the result order of a multiple import request is correct

This commit only adds a new automated test to Bitcoin Core. It checks that when a user asks the wallet to import multiple descriptors at once, the list of results comes back in the same order as the original request, including any error me…

3ac8b806by Pol Espinasa+40−01 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test invalid or missing timestamp throws importdescriptors

This commit only adds new automated tests for the Bitcoin Core wallet's importdescriptors RPC. It checks that the command correctly rejects requests with a missing or invalid timestamp. No production wallet code is changed, so this cannot …

No changes to consensus, networking, wallet logic, or cryptographyOnly functional test code is modifiedAdded assertions are for expected error handling paths
e4732bf0by Pol Espinasa+28−11 file
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Remove unused #include in common/system

This is a minor code cleanup that removes one unused header file include and swaps another for a more specific one. It does not change any program behavior or fix any security issue.

fa7304f3by MarcoFalke+1−22 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

iwyu: Fix warnings in `src/consensus` and treat them as errors

This commit is a routine code cleanup: it adjusts which C++ header files are included in several consensus-related source files and turns on a stricter compiler hygiene check (Include What You Use, or IWYU) for the src/consensus directory.…

13b53f8bby Hennadii Stepanov+42−79 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: don't connman.ReceiveMsgFrom oversized msg

This is a small fix to a Bitcoin Core fuzz test (an automated internal testing harness), not to the live network code. The fuzzer was sometimes creating fake P2P messages larger than the real protocol allows and passing them into a test he…

Test-only fuzz harness hardeningOversized message guard added before ReceiveMsgFrom() in fuzz targetNo change to production P2P message acceptance logic
bb19f1daby Greg Sanders+5−01 file
No security note in commit
Informational 15 AI analysisMessage 97 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: Temporarily remove riscv32 config from GHA matrix

This commit simply removes one failing test configuration (RISC-V 32-bit bare metal) from the project's GitHub Actions CI matrix because it was failing. It is a routine CI maintenance change with no security implications.

fa06ea42by MarcoFalke+0−61 file
No security note in commit
Low 47 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: verify cross-build SDK archives

This change adds checksum verification to the build system's downloads of Apple, FreeBSD, NetBSD, and OpenBSD software development kits (SDKs). Before this patch, those SDK archives were downloaded at build time and extracted without confi…

Adds cryptographic digest verification for downloaded SDK archivesRemoves unchecked extraction of remote SDK archives in CIHardens CI supply chain for macOS/BSD cross-builds
873550beby Lőrinc+25−126 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityqa: Avoid duplicating output in case the diff is the sameby Hodlinator · 111864ac · Feb 19, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Hodlinator

qa: Avoid duplicating output in case the diff is the same

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is a tiny quality-of-life improvement to Bitcoin Core's internal Python test framework. It stops an error message from printing the same dictionary twice when a test assertion fails. It does not change any production Bitcoin code, network behavior, or security logic.

AI review queuedqa: Disable parts of the test when running under Windows or rootby Hodlinator · 850a80c1 · Feb 19, 2026 · 1 fileMessage 91 · StrongInformational 15Details
Commit message · Hodlinator

qa: Disable parts of the test when running under Windows or root

test_scanning_sub_dir():
- Remove try/finally - we don't need to clean up after a failed test (done in this commit to maintain indentation).

Regarding symlinks: https://github.com/bitcoin/bitcoin/pull/31410#issuecomment-3554721014

Kept some symlink creation which didn't disrupt Windows cross builds to make for a smaller diff and less cumbersome code. There is some hope of eventually getting better symlink support via #34603.

Co-authored-by: Ava Chow <github@achow101.com>

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes a Bitcoin Core test script. It disables certain file-permission and symlink checks when the test runs on Windows or as the root/admin user, because those checks rely on Unix-style behavior that doesn't apply in those environments. There is no change to the actual Bitcoin Core wallet software that users run, and no security vulnerability is being fixed or introduced.

AI review queuedrefactor(qa): Break apart ginormous run_test()by Hodlinator · 64a098a9 · Feb 19, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Hodlinator

refactor(qa): Break apart ginormous run_test()

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a simple cleanup of a test file. It takes one very long test function and splits it into smaller, named helper functions without changing what the test actually does. There is no change to Bitcoin Core's production code or to how wallets behave.

AI review queuedqa: Check for platform-independent part of error messageby Hodlinator · ed43ce57 · Feb 19, 2026 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Hodlinator

qa: Check for platform-independent part of error message

On Windows one gets different exception messages depending on whether running a native build or cross build.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a minor test-only change. It updates a single automated test in Bitcoin Core so that it checks for a stable, platform-independent error message ('Wallet file verification failed.') instead of a Windows-specific filesystem error string. There is no change to the actual Bitcoin Core wallet code that users run, and no security issue is present.

AI review queuedqa: Test scanning errors individuallyby Hodlinator · fb803e3c · Feb 19, 2026 · 1 fileMessage 78 · AdequateInformational 12Details
Commit message · Hodlinator

qa: Test scanning errors individually

This change ensures that each condition potentially triggering the
"Error while scanning" log message is tested independently, avoiding
false positives.

Co-authored-by: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit only changes a test file. It reorganizes existing wallet-scanning tests so each error condition is checked separately, rather than lumping them together. There is no change to the actual Bitcoin Core wallet code, so it does not fix or introduce a security issue in the software users run.

AI review queuedmove-only(qa): Move wallet creation check down to othersby Hodlinator · bb1aff7e · Feb 19, 2026 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Hodlinator

move-only(qa): Move wallet creation check down to others

Makes the functions broken out from run_test() in the next commit more cohesive.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a test-only change that moves a single error-checking test case from one place to another within the same functional test file. It does not change any production code, wallet behavior, or security logic. The commit message explicitly calls it 'move-only'.

AI review queuedrefactor(qa): Lift out functions to outer scopesby Hodlinator · d1a4ddb5 · Feb 19, 2026 · 1 fileMessage 92 · StrongInformational 15Details
Commit message · Hodlinator

refactor(qa): Lift out functions to outer scopes

This prepares for later breaking apart of run_test().

Note that the "wallet" lambda was renamed to "get_wallet" since otherwise the Python interpreter emitted:
"UnboundLocalError: cannot access local variable 'wallet' where it is not associated with a value"

92/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a harmless code cleanup in a test file. It moves some helper functions from inside a test method to the top of the file and renames one variable to avoid a Python language quirk. There is no change to Bitcoin Core's actual wallet behavior or security.

AI review queuedscripted-diff: self.nodes[0] => nodeby Hodlinator · c811e473 · Feb 19, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Hodlinator

scripted-diff: self.nodes[0] => node

-BEGIN VERIFY SCRIPT-
sed --in-place 's/self\.nodes\[0\]/node/g; s/node \= node/node \= self\.nodes\[0\]/' ./test/functional/wallet_multiwallet.py
-END VERIFY SCRIPT-

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a purely cosmetic code cleanup in a Bitcoin Core test file. It replaces repeated references to `self.nodes[0]` with a local variable named `node`. No production code, no behavior changes, and no security implications.

AI review queuedrefactor(qa): Remove unused optionby Hodlinator · 73cf8589 · Feb 19, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Hodlinator

refactor(qa): Remove unused option

Last use was removed in 0d32d661481f099af572e7a08a50e17bcc165c44.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply removes an unused command-line option from a single test script. It is a cleanup change with no effect on Bitcoin Core's runtime behavior, network security, or user funds.

Lower-priorityhttp: properly respond to HTTP request during shutdownby furszy · 726b3663 · Feb 18, 2026 · 1 fileMessage 73 · AdequateLow 35Details
Commit message · furszy

http: properly respond to HTTP request during shutdown

Makes sure we respond to the client as the HTTP request attempts to submit a task to
the thread pool during server shutdown.

Roughly what happens:

1) The server receives an HTTP request and starts calling http_request_cb().
2) Meanwhile on another thread, shutdown is triggered which calls InterruptHTTPServer()
and unregisters libevent http_request_cb() callback and interrupts the thread pool.
3) The request (step 1) resumes and tries to submit a task to the now-interrupted server.

This fix detects failed submissions immediately, and the server responds with
HTTP_SERVICE_UNAVAILABLE.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 35/100

This change fixes a bug in Bitcoin Core's built-in web server (used by RPC and REST interfaces). During server shutdown, incoming HTTP requests could be accepted but then silently dropped because the worker thread pool had already been interrupted. The server would not send any response back to the client, causing the connection to hang until it timed out. The patch detects when a request cannot be queued and immediately replies with a '503 Service Unavailable' status, telling the client the server is shutting down.

Lower-priorityrefactor: Use static_cast<decltype(...)> to suppress integer sanitizer warningby MarcoFalke · fa6af856 · Feb 18, 2026 · 2 filesMessage 95 · StrongInformational 15Details
Commit message · MarcoFalke

refactor: Use static_cast<decltype(...)> to suppress integer sanitizer warning

This refactor does not change any behavior, except for the integer
sanitizer warning.

Can be tested via:

UBSAN_OPTIONS="suppressions=$(pwd)/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1" ./bld-cmake/bin/bitcoin-cli -stdinrpcpass uptime

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Informational 15/100

This is a code cleanup that silences a harmless automated sanitizer warning. It does not change how the program behaves, fix a bug, or close a security hole. The change removes a suppression entry for a warning that is no longer triggered.

Lower-priorityutil: Fix UB in SetStdinEcho when ENOTTYby MarcoFalke · fa692974 · Feb 18, 2026 · 2 filesMessage 45 · ThinLow 34Details
Commit message · MarcoFalke

util: Fix UB in SetStdinEcho when ENOTTY

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 34/100

This commit fixes a bug in the code that controls whether your password is shown on screen when you type it into Bitcoin Core. Previously, if the program was not connected to a normal terminal (for example, when run from a script or a pipe), the code could read and write random or invalid terminal settings, which is undefined behavior. The fix checks whether stdin is actually a terminal before trying to change its echo setting, and it now handles errors from the underlying system calls instead of ignoring them. The practical security risk is low: it mainly prevents crashes or strange behavior in non-interactive environments, rather than being an exploitable vulnerability.

Lower-prioritytest: Enable `system_tests/run_command` "stdin" test on Windowsby Hennadii Stepanov · 97e7e794 · Feb 18, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Hennadii Stepanov

test: Enable `system_tests/run_command` "stdin" test on Windows

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit simply removes two lines that previously skipped a test on Windows. The test checks that a helper program can receive data through standard input and echo it back. There is no change to production code, no security fix, and no vulnerability.

Lower-prioritytest: Remove `system_tests/run_command` runtime dependenciesby Hennadii Stepanov · a4324ce0 · Feb 18, 2026 · 4 filesMessage 72 · AdequateInformational 15Details
Commit message · Hennadii Stepanov

test: Remove `system_tests/run_command` runtime dependencies

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes Bitcoin Core's internal test code. It replaces tests that previously relied on external system commands like 'echo', 'false', and 'cat' with a self-contained mock program. There is no change to the actual Bitcoin node software that users run, and no security issue is introduced or fixed.

Lower-priorityci: [refactor] Drop last use of pwshby MarcoFalke · fa36adeb · Feb 17, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · MarcoFalke

ci: [refactor] Drop last use of pwsh

Seems easier to just use Bash and Python consistently.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit is a minor cleanup in the project's automated testing configuration. It replaces a PowerShell script snippet with an equivalent Bash snippet that does the same thing: record the versions of build tools like CMake and MSBuild. There is no security issue here.

Lower-priorityci: [refactor] Move github_import_vs_env to python scriptby MarcoFalke · fae31b1e · Feb 17, 2026 · 3 filesMessage 77 · AdequateInformational 15Details
Commit message · MarcoFalke

ci: [refactor] Move github_import_vs_env to python script

Also, change the yaml anchor name and the step name.
Also, small refactors while touching the files.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This is a routine cleanup of Bitcoin Core's Windows CI (continuous integration) scripts. It moves a PowerShell snippet that imports Visual Studio environment variables into a Python helper, renames a YAML anchor, and simplifies some repetitive code. There is no security-relevant change.

Lower-prioritythreadpool: make Submit return Expected instead of throwingby furszy · 59d24bd5 · Feb 17, 2026 · 3 filesMessage 81 · StrongLow 31Details
Commit message · furszy

threadpool: make Submit return Expected instead of throwing

Unlike exceptions, which can be ignored as they require extra try-catch
blocks, returning expected errors forces callers to always handle
submission failures.

Not throwing an exception also fixes an unclean shutdown bug
#34573 since we no longer throw when attempting to Submit()
from the libevent callback http_request_cb().

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 31/100

This change refactors Bitcoin Core's internal thread pool so that submitting a task returns an error code instead of throwing an exception. The main practical effect is fixing an unclean shutdown bug (#34573) where an unhandled exception could be thrown from an HTTP event callback. It is a defensive reliability improvement rather than a direct exploit for stealing funds or remote code execution.

Lower-priorityvalidation: reset BLOCK_FAILED_CHILD to BLOCK_FAILED_VALID when loading from diskby stratospher · b5b2956b · Feb 17, 2026 · 1 fileMessage 73 · AdequateLow 44Details
Commit message · stratospher

validation: reset BLOCK_FAILED_CHILD to BLOCK_FAILED_VALID when loading from disk

- there maybe existing block indexes stored in disk with
BLOCK_FAILED_CHILD
- since they don't exist anymore, clean up block index entries with
BLOCK_FAILED_CHILD and reset it to BLOCK_FAILED_VALID.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 44/100

This Bitcoin Core commit cleans up an old block-status flag when loading the blockchain database from disk. The old flag (BLOCK_FAILED_CHILD) is no longer used by current code, so the patch converts any leftover occurrences into the newer equivalent flag (BLOCK_FAILED_VALID) and marks the index entries as needing to be saved. This is a defensive data-consistency fix rather than a fix for an active exploit.

Lower-prioritytest: check LoadBlockIndex correctly recomputes invalidity flagsby stratospher · fb3e1bf9 · Feb 17, 2026 · 1 fileMessage 95 · StrongInformational 12Details
Commit message · stratospher

test: check LoadBlockIndex correctly recomputes invalidity flags

Add a test for block index transitioning from legacy
BLOCK_FAILED_CHILD to BLOCK_FAILED_VALID behavior.

In the scenario where a valid block has a BLOCK_FAILED_CHILD
parent and a BLOCK_FAILED_VALID grandparent, ensure that all
three blocks are correctly marked as BLOCK_FAILED_VALID
after reloading the block index.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 12/100

This commit only adds a new automated test to Bitcoin Core. It does not change any production code. The test verifies that when the block index database is reloaded, a chain of three blocks with mixed invalidity flags is all correctly marked as permanently invalid. There is no direct security fix here, only a regression test for existing behavior.

Lower-priorityvalidation: remove BLOCK_FAILED_MASKby stratospher · 29740c06 · Feb 17, 2026 · 8 filesMessage 50 · ThinInformational 15Details
Commit message · stratospher

validation: remove BLOCK_FAILED_MASK

since it's the same as BLOCK_FAILED_VALID now

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a simple code cleanup: it removes a redundant constant named BLOCK_FAILED_MASK and replaces its uses with BLOCK_FAILED_VALID, because the two had become identical in meaning. There is no functional change to how Bitcoin Core validates blocks or handles invalid chains.

Lower-priorityvalidation: stop using BLOCK_FAILED_CHILDby stratospher · 37bc2078 · Feb 17, 2026 · 5 filesMessage 58 · ThinInformational 20Details
Commit message · stratospher

validation: stop using BLOCK_FAILED_CHILD

even though we have a distinction between BLOCK_FAILED_VALID
and BLOCK_FAILED_CHILD in the codebase, we don't use it for
anything. since there's no functional difference between them
and it's unnecessary code complexity to categorise them correctly,
just mark as BLOCK_FAILED_VALID instead.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 20/100

This is a code cleanup change in Bitcoin Core. It removes the use of a separate 'descendant of a failed block' flag and instead marks those blocks with the same 'validation failed' flag used for the block itself. The commit explicitly states the two flags had no functional difference and were only adding unnecessary complexity. There is no indication this fixes a security bug or changes network behavior.

Lower-priorityrefactor: use clearer variables in InvalidateBlock()by stratospher · 120c631e · Feb 17, 2026 · 1 fileMessage 85 · StrongInformational 15Details
Commit message · stratospher

refactor: use clearer variables in InvalidateBlock()

Improve upon the variable name for `invalid_walk_tip` to make the
InvalidateBlock logic easier to read. Block tip before disconnection
is now tracked directly via `disconnected_tip`, and `new_tip`
is the tip after the disconnect.

Co-authored-by: stickies-v <stickies-v@protonmail.com>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
defensive validation
AI analysis · Informational 15/100

This commit is a straightforward code cleanup in Bitcoin Core's block invalidation logic. It renames a variable from 'invalid_walk_tip' to 'disconnected_tip' and introduces a new variable 'new_tip' to make the code easier to read. There are no functional changes that would affect security.

Security candidatetest: Set assert_debug_log timeout to 0by MarcoFalke · fa4cb96b · Feb 17, 2026 · 13 filesMessage 67 · AdequateInformational 15Details
Commit message · MarcoFalke

test: Set assert_debug_log timeout to 0

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
seed or entropy pathsigning or wallet path
AI analysis · Informational 15/100

This commit only changes Bitcoin Core's internal functional test code. It makes the default timeout for a debug-log assertion helper stricter (0 seconds instead of 2 seconds) and updates existing tests to explicitly pass a 2-second timeout where needed. There is no change to the actual Bitcoin node software that users run, so it cannot affect live networks, wallets, or consensus.

AI review queuedclusterlin: special-case self-merges (optimization)by Pieter Wuille · ae16485a · Feb 17, 2026 · 1 fileMessage 73 · AdequateInformational 13Details
Commit message · Pieter Wuille

clusterlin: special-case self-merges (optimization)

After a split, if the top part has a dependency on the bottom part, the
first MergeSequence will always perform this merge and then stop. This
is referred to as a self-merge.

We can special case these by detecting self-merges early, and avoiding
the overhead of a full MergeSequence which involves two
PickMergeCandidate calls (a succesful and an unsuccesful one).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 13/100

This is a pure performance optimization inside Bitcoin Core's transaction-cluster linearization code. It detects a common situation called a 'self-merge' earlier in the process and skips unnecessary work. There is no user-visible behavior change, no consensus change, and no security fix.

Security candidateclusterlin: inline UpdateChunk into (De)Activate (optimization)by Pieter Wuille · d90f98ab · Feb 17, 2026 · 1 fileMessage 78 · AdequateInformational 12Details
Commit message · Pieter Wuille

clusterlin: inline UpdateChunk into (De)Activate (optimization)

The two calls to UpdateChunk, in Activate and Deactive each, are subtly
different: the top one needs to update the chunk_idx of iterated
transactions, while the bottom one leaves it unchanged. To exploit this
difference, inline the four function calls, getting rid of UpdateChunks.

This is also a preparation for a future improvement that inlines the
recomputation of reachable sets in the same loop in Deactivate.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
explicit security language
AI analysis · Informational 12/100

This commit is a routine code cleanup in Bitcoin Core's transaction-cluster linearization logic. It removes a helper function called UpdateChunk and copies its logic directly into the two places that used it (Activate and Deactivate). The behavior is intended to stay exactly the same; the change is described by the author as an optimization and preparation for future work. There is no indication of a security fix.