BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

2878 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

252security candidates603second-pass queue1092AI analyses
208commits · 30 days
493commits · 60 days
1523commits · 180 days
2878commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
917Strong · 80–100
1187Adequate · 60–79
686Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot2248170
Ava Chow15649130064
MarcoFalke40721110074
Lőrinc1772183081
fanquake2271976057
Hennadii Stepanov2081455063
rkrux57944074
Sjors Provoost89825074
Sebastian Falbesoner33717073
David Gumberg55638072
Pieter Wuille95518066
Hodlinator66523076
Analysis record

Published AI watches

Last scanned 57 minutes ago

Informational 15 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

This is a code cleanup change that turns on a static-analysis rule to prevent a specific C++ coding pattern (anonymous namespaces in header files) and updates two headers to comply. It does not change how Bitcoin Core behaves at runtime an…

No security-relevant code changeNo memory safety, cryptography, consensus, or network changesTooling-only refactor (clang-tidy configuration)
c4fbd3c7by merge-script+9−123 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

This commit only adds new test cases to Bitcoin Core's functional test suite. It does not change any production wallet, node, or RPC code. The tests verify that the importdescriptors RPC reports errors in the right order, rejects bad times…

465196d0by merge-script+77−11 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35180: coins: group private cache helpers

This change is purely a code cleanup: it moves two internal helper functions of a Bitcoin Core cache class into the private section of the class and removes a duplicate 'private:' label. There is no change to what the code does, no bug fix…

c940fd75by merge-script+13−141 file
No security note in commit
Low 29 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

This Bitcoin Core change tightens how three RPC commands (scantxoutset, scanblocks, deriveaddresses) handle the value null when it is passed for optional parameters. Previously, explicitly passing null could be treated differently from sim…

RPC parameter validation changeNull value handling changeAddition of explicit error checks for missing required contextual parameters
3db96eb5by merge-script+18−75 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable misc-definitions-in-headers

This commit is a code cleanup: it turns on a clang-tidy style check called 'misc-definitions-in-headers' and suppresses that check around a large inline implementation block in a benchmark header. There is no change to Bitcoin's runtime be…

fa93132dby MarcoFalke+3−02 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Enable clang-tidy rule to reject anon namespace in header

This commit only changes a linting configuration file for the project's code style checker. It enables a rule that prevents anonymous namespaces from being used in header files, which is a code-quality and build-hygiene practice. There is …

No security-relevant signals in the diff or commit message.Change is purely a static-analysis/linting configuration update.
fa5ca877by MarcoFalke+2−11 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use C++20 std::identity over IntIdentity

This commit is a straightforward code cleanup: it replaces a small custom helper named IntIdentity with the standard C++20 std::identity from the <functional> header. The behavior of the ConvertBits function is unchanged; only the implemen…

fafe5042by MarcoFalke+4−111 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test the result order of a multiple import request is correct

This commit only adds a new automated test to Bitcoin Core. It checks that when a user asks the wallet to import multiple descriptors at once, the list of results comes back in the same order as the original request, including any error me…

3ac8b806by Pol Espinasa+40−01 file
No security note in commit
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: test invalid or missing timestamp throws importdescriptors

This commit only adds new automated tests for the Bitcoin Core wallet's importdescriptors RPC. It checks that the command correctly rejects requests with a missing or invalid timestamp. No production wallet code is changed, so this cannot …

No changes to consensus, networking, wallet logic, or cryptographyOnly functional test code is modifiedAdded assertions are for expected error handling paths
e4732bf0by Pol Espinasa+28−11 file
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Remove unused #include in common/system

This is a minor code cleanup that removes one unused header file include and swaps another for a more specific one. It does not change any program behavior or fix any security issue.

fa7304f3by MarcoFalke+1−22 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

iwyu: Fix warnings in `src/consensus` and treat them as errors

This commit is a routine code cleanup: it adjusts which C++ header files are included in several consensus-related source files and turns on a stricter compiler hygiene check (Include What You Use, or IWYU) for the src/consensus directory.…

13b53f8bby Hennadii Stepanov+42−79 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: don't connman.ReceiveMsgFrom oversized msg

This is a small fix to a Bitcoin Core fuzz test (an automated internal testing harness), not to the live network code. The fuzzer was sometimes creating fake P2P messages larger than the real protocol allows and passing them into a test he…

Test-only fuzz harness hardeningOversized message guard added before ReceiveMsgFrom() in fuzz targetNo change to production P2P message acceptance logic
bb19f1daby Greg Sanders+5−01 file
No security note in commit
Informational 15 AI analysisMessage 97 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: Temporarily remove riscv32 config from GHA matrix

This commit simply removes one failing test configuration (RISC-V 32-bit bare metal) from the project's GitHub Actions CI matrix because it was failing. It is a routine CI maintenance change with no security implications.

fa06ea42by MarcoFalke+0−61 file
No security note in commit
Low 47 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: verify cross-build SDK archives

This change adds checksum verification to the build system's downloads of Apple, FreeBSD, NetBSD, and OpenBSD software development kits (SDKs). Before this patch, those SDK archives were downloaded at build time and extracted without confi…

Adds cryptographic digest verification for downloaded SDK archivesRemoves unchecked extraction of remote SDK archives in CIHardens CI supply chain for macOS/BSD cross-builds
873550beby Lőrinc+25−126 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: update NetBSD cross-build SDK

This is a routine maintenance update to Bitcoin Core's continuous integration (CI) system. It changes the version number of the NetBSD operating system used for cross-compilation testing from a release candidate (11.0_RC6) to the final rel…

2c87337eby Lőrinc+1−11 file
No security note in commit
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: require `TryGetTotalRam()` detection

This commit only changes a test file and build configuration. It removes the option to skip a test when the system cannot detect total RAM, and instead requires the RAM detection to succeed. It does not change any production wallet, networ…

6a2de55aby Lőrinc+3−112 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: use `MIN_DBCACHE_BYTES`

This commit is a simple automated rename of a constant from MIN_DB_CACHE to MIN_DBCACHE_BYTES across five files. The value stays the same (4 MiB), and no behavior changes. It is a code-cleanup/refactoring change with no security relevance.

7cfa21d6by Lőrinc+5−55 files
No security note in commit
Informational 20 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

kernel: allow setting chainstate `dbcache`

This commit adds a new public API knob to the Bitcoin Core 'libbitcoinkernel' library so that programs using the kernel can choose how much memory to use for the chainstate database cache. It also enforces minimum and maximum size limits. …

New configurable cache-size API with explicit min/max validationReplaces hard-coded DEFAULT_KERNEL_CACHE with caller-supplied valueAdds unit tests for out-of-range rejection and 32-bit upper-bound rejection
8bd9f460by Lőrinc+41−14 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

kernel, node: colocate dbcache bounds

This commit is a small code cleanup: it moves two constants that define the minimum and maximum size of the database cache (dbcache) into a shared kernel header so that both the node and kernel code use the same limits. There is no change …

8aa21e11by Lőrinc+7−74 files
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

node, qt: inline `DEFAULT_DB_CACHE`

This is a small code cleanup change in Bitcoin Core. It removes a misleading alias named DEFAULT_DB_CACHE and replaces it with the underlying name DEFAULT_KERNEL_CACHE in a few places. The behavior of the program is unchanged; only the nam…

cd086c16by Lőrinc+5−74 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedrefactor: move CreatedTransactionResult to types.hby furszy · e2c3ec9b · Feb 6, 2026 · 2 filesMessage 77 · AdequateInformational 15Details
Commit message · furszy

refactor: move CreatedTransactionResult to types.h

So it can be used by external modules without requiring
wallet.h dependency.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a simple code reorganization: it moves a data structure called CreatedTransactionResult from one internal header file to another so other parts of the codebase can use it without pulling in the entire wallet header. There is no change to behavior, no bug fix, and no security-related content.

AI review queuedgui: remove AmountWithFeeExceedsBalance error special caseby furszy · 45372175 · Feb 6, 2026 · 3 filesMessage 73 · AdequateInformational 20Details
Commit message · furszy

gui: remove AmountWithFeeExceedsBalance error special case

Since bitcoin#34299, the wallet handles the error internally
and retrieves the proper message.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This commit removes a special error message in the Bitcoin Core graphical wallet that told users when their balance was too small to cover both the payment amount and the transaction fee. The wallet now lets an underlying internal function produce the error message instead. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a code cleanup and user-experience simplification.

AI review queuedrefactor: [rpc] Remove confusing and brittle integral casts (take 2)by MarcoFalke · fa680136 · Feb 6, 2026 · 10 filesMessage 62 · AdequateInformational 18Details
Commit message · MarcoFalke

refactor: [rpc] Remove confusing and brittle integral casts (take 2)

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a code cleanup in Bitcoin Core's RPC (remote procedure call) output code. It removes explicit type casts when adding numeric values to JSON responses, relying on the underlying types instead. There is no direct evidence this fixes a security vulnerability; it is presented by the author as a refactoring to make the code less confusing and brittle.

AI review queuedwallet: introduce "tx amount exceeds balance when fees are included" errorby stratospher · 48161f6a · Feb 6, 2026 · 3 filesMessage 73 · AdequateInformational 20Details
Commit message · stratospher

wallet: introduce "tx amount exceeds balance when fees are included" error

This was previously implemented at the GUI level but we never hit that
code path.

Co-authored-by: furszy <matiasfurszyfer@protonmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This change improves the error message shown when a Bitcoin wallet user tries to send an amount that fits their balance but leaves no room for the network transaction fee. Previously the wallet just said 'Insufficient funds.' Now it explains that the total exceeds the balance once the fee is included. It is a user-experience and diagnostic improvement, not a security fix.

AI review queuedwallet: remove PreSelectedInputsby stratospher · b7fa609e · Feb 6, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · stratospher

wallet: remove PreSelectedInputs

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply removes an unused internal data structure called PreSelectedInputs from a wallet header file. It is a code cleanup change with no functional behavior change and no apparent security relevance.

AI review queuedwalllet: use CoinsResult instead of PreSelectedInputsby stratospher · 7819da2c · Feb 6, 2026 · 4 filesMessage 85 · StrongLow 27Details
Commit message · stratospher

walllet: use CoinsResult instead of PreSelectedInputs

PreSelectedInputs is confusing to use. it's `total_amount`
might store total amount or effective amount based on SFFO.
ex: we might accidentally sum preselected inputs effective
amount (named `total_amount`) with automatically selected
inputs actual total amount.

CoinsResult has a cleaner interface with separate fields
for both these amounts.

2 behavioural changes:

1. no more default assert error if effective value is unset
- previously PreSelectedInputs::Insert() called
COutput::GetEffectiveValue() which assert failed
if the optional was unset.
- now we don't default assert anymore.
* in GUI/getAvailableBalance better not to assert.
* SelectCoins's preselected inputs always contain a
feerate, so effective amount should be set.
explicitly added an assertion to ensure this.

2. FetchSelectedInputs uses OutputType::UNKNOWN as key to
populate CoinsResult's coins map. it's discarded later.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100

This is a Bitcoin Core wallet code cleanup that replaces an internal data structure called PreSelectedInputs with a cleaner one called CoinsResult. The commit message says the old structure was confusing because a field named total_amount could hold two different kinds of amounts, which could lead to accidentally mixing them. The patch separates those amounts and adds an explicit safety check where it matters. It is a defensive refactor rather than a fix for a known live bug or exploit.

AI review queuedci: Refactor Windows CI into scriptby MarcoFalke · fabdd4e8 · Feb 6, 2026 · 2 filesMessage 90 · StrongInformational 15Details
Commit message · MarcoFalke

ci: Refactor Windows CI into script

This makes it easier to:

* Run the exact command of any CI type and step locally
* Re-Run older CI tasks on GHA and using the latest merged config.
(.github/ci-windows.py is merged with master on re-runs, but
.github/workflows/ci.yml is NOT)

Also, writing it in Python has benefits:

* Any developer (even non-Windows ones) can read and modify the script.
* Python is already required for tests, so no new dependency is needed.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit simply moves the Windows CI build command out of the GitHub Actions YAML file and into a small Python helper script. It does not change what software is built, how it is built, or any user-facing behavior. There is no security issue here.

AI review queuedrefactor: Use SpanReader over DataStreamby MarcoFalke · fa0677d1 · Feb 6, 2026 · 23 filesMessage 90 · StrongInformational 14Details
Commit message · MarcoFalke

refactor: Use SpanReader over DataStream

This refactor does not change behavior. However, it avoids a vector
copy, which can lead to a minimal speed-up of 1%-5%, depending on the
call-site. This is mostly relevant for the fuzz tests and utils that
read large blobs of data (like a full block).

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 14/100

This is a routine code cleanup in Bitcoin Core that swaps one internal data-reading helper (DataStream) for another (SpanReader) across many files. The commit message explicitly says it does not change behavior, and the diff only shows mechanical replacements with no new logic. There is no security issue visible in the change.

AI review queuedwallet: ensure COutput added in set are uniqueby stratospher · 7072d825 · Feb 6, 2026 · 7 filesMessage 76 · AdequateLow 32Details
Commit message · stratospher

wallet: ensure COutput added in set are unique

before #25806, set<COutput> was used and would not
contain same COutputs in the set.

now we use set<shared_ptr<COutput>> and it might be
possible for 2 distinct shared_ptr (different pointer
address but same COutputs) to be added into the set.

so preserve previous behaviour by making sure values
in the set are also distinct

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 32/100

This Bitcoin Core change fixes a subtle bug in how the wallet keeps track of selected coins. Previously, the wallet used a set of coin objects directly, which automatically prevented duplicates. After a recent refactor, it started using a set of pointers to coin objects, where the default behavior only prevents duplicate pointer addresses—not duplicate coins. This meant two different pointers representing the same coin could both end up in the selection, potentially causing the wallet to try to spend the same coin twice or miscalculate fees and change. The fix makes the set compare the actual coin data, not just pointer addresses, restoring the old duplicate-prevention behavior.

AI review queuedwallet: correctly reserve in CoinsResult::All()by stratospher · d8ea921d · Feb 6, 2026 · 1 fileMessage 68 · AdequateInformational 16Details
Commit message · stratospher

wallet: correctly reserve in CoinsResult::All()

coins.size() would be the number of the OutputType keys in the map.
whereas Size() would return total number of COutput objects when
flattening the map.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 16/100

This is a tiny performance fix in the Bitcoin Core wallet code. A helper function that gathers all spendable coins into one flat list was reserving memory based on the number of coin categories (for example, how many output types exist) rather than the actual total number of coins. The change makes it reserve the correct, larger amount of memory up front. It does not change any security logic, balances, or transaction construction rules.

AI review queuedwallet: introduce GetAppropriateTotal() in CoinsResultby stratospher · e5474079 · Feb 6, 2026 · 1 fileMessage 85 · StrongInformational 15Details
Commit message · stratospher

wallet: introduce GetAppropriateTotal() in CoinsResult

returns the total amount (if SFFO), otherwise the effective amount.
previously, this was the logic in calculating
PreSelectedInputs::total_amount when PreSelectedInputs::Insert()
was called.

return optional to force callers to explicitly handle the case
when effective amount optional is not set.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a small, clean code refactor inside the Bitcoin Core wallet. It moves an existing calculation into a new helper function and makes a few methods 'const' (read-only). There is no change to behavior, no bug fix, and no security issue visible in the diff.

AI review queuedwallet: fix, make 'total_effective_amount' optional actually optionalby stratospher · fefa3be7 · Feb 6, 2026 · 2 filesMessage 81 · StrongLow 30Details
Commit message · stratospher

wallet: fix, make 'total_effective_amount' optional actually optional

this is not needed for the remaining commits but good to fix
and came up in #25269 review.

Co-authored-by: furszy <matiasfurszyfer@protonmail.com>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 30/100

This is a small code cleanup in Bitcoin Core's wallet coin-selection logic. The change makes a cached optional value behave as actually optional (unset by default) and only updated when it has a value. It fixes a logic inconsistency found during code review, but there is no direct evidence it prevents a real-world exploit or user-visible bug on its own.

AI review queuedsignals: use an alias for the boost::signals2 namespaceby Cory Fields · edc29780 · Feb 5, 2026 · 10 filesMessage 65 · AdequateInformational 15Details
Commit message · Cory Fields

signals: use an alias for the boost::signals2 namespace

The next commit will add a real implementation in this namespace.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a simple code cleanup: it creates a project-specific alias `btcsignals` for the external library namespace `boost::signals2`, and replaces all direct uses of `boost::signals2` with the new alias. There is no functional change, no bug fix, and no security-relevant behavior change.

AI review queuedsignals: use forwarding header for boost signalsby Cory Fields · 037e58b5 · Feb 5, 2026 · 9 filesMessage 60 · AdequateInformational 15Details
Commit message · Cory Fields

signals: use forwarding header for boost signals

For now, including btcsignals.h simply includes boost's signals. A follow-up
commit will replace the implementation.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a simple code cleanup: it creates a new internal header file called btcsignals.h that currently just forwards to Boost's signals library, and then replaces direct Boost signals includes across several source files with this new header. There is no functional change, no bug fix, and no security-relevant behavior change.

AI review queuedwallet: remove `DBErrors::NEED_REWRITE` enum valueby rkrux · c6a6435c · Feb 5, 2026 · 3 filesMessage 73 · AdequateInformational 19Details
Commit message · rkrux

wallet: remove `DBErrors::NEED_REWRITE` enum value

As highlighted in the PR review comment, this enum seems no longer
required as the specific issue it solves for involves BDB based wallets
that can't be loaded anymore outside the context of wallet migration,
which rewrites the database anyway.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit removes an old wallet-loading code path called NEED_REWRITE that was used to automatically rewrite certain very old Berkeley DB (BDB) wallets from Bitcoin versions 0.4.0 and 0.5.0. The change is described as cleanup because those wallets can no longer be loaded outside of migration, and migration already rewrites the database. There is no direct evidence in the commit of a security vulnerability being fixed.

AI review queuedwallet: remove unimplemented `RewriteDB` calls from SPKMby rkrux · 61039d72 · Feb 5, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · rkrux

wallet: remove unimplemented `RewriteDB` calls from SPKM

ISTM that there is no implementation left of the `RewriteDB` method
in any of the SPKMs, and thus, its call sites can be removed safely.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit removes leftover calls to a wallet method called RewriteDB that no longer had any real implementation. It is a small code cleanup with no security impact.

AI review queueddoc: add release notesby ismaelsadeeq · 8966352d · Feb 5, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · ismaelsadeeq

doc: add release notes

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds documentation: a release note explaining that the Bitcoin Core fee estimator now tracks lower fee rates (down to 0.1 sat/vB instead of 1 sat/vB). There is no code change, no bug fix, and no security issue in the diff itself.

AI review queuedFUZZ: Test that BnB finds best solutionby Murch · 54d03930 · Feb 4, 2026 · 1 fileMessage 78 · AdequateInformational 14Details
Commit message · Murch

FUZZ: Test that BnB finds best solution

BnB’s solution is the input set with the lowest waste score, excluding
any supersets of other solution candidates.
This fuzz test compares a brute force search with the BnB result to
ensure that BnB succeeds.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 14/100

This commit adds a new automated fuzz test for Bitcoin Core's coin selection algorithm. It does not change any production wallet code, network behavior, or consensus rules. The test brute-forces small coin-selection problems and checks that the Branch-and-Bound (BnB) solver finds a minimum-waste solution. It is purely a testing/quality-assurance addition.

AI review queuedbuild: don't pass on boost dependency to kernel consumersby Cory Fields · a50d0b67 · Feb 3, 2026 · 1 fileMessage 77 · AdequateInformational 15Details
Commit message · Cory Fields

build: don't pass on boost dependency to kernel consumers

This is unnecessary now that the kernel now exports a (boost-less) API.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine build-system cleanup. Bitcoin Core's internal 'kernel' library no longer needs to force programs that use it to also depend on the Boost C++ library, because the kernel's public interface has been rewritten to avoid BOOST. The change simply removes one line from a CMake build file so BOOST is kept as a private dependency of the kernel itself rather than being propagated to downstream consumers. There is no security-relevant code change.

AI review queuedci: Use without embedded asmap build option in one ci jobby Fabian Jahr · bab085d2 · Feb 3, 2026 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · Fabian Jahr

ci: Use without embedded asmap build option in one ci job

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit changes one Bitcoin Core continuous integration (CI) test job to compile the software with the embedded asmap feature turned off. It does not change any production code, user-facing behavior, or network logic. It is purely a build/test configuration tweak to ensure that building without embedded asmap still works in CI.

AI review queuedtest: Test for musig() in various miniscript expressionsby Ava Chow · 4b53cbd6 · Feb 2, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Ava Chow

test: Test for musig() in various miniscript expressions

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds new test cases for an existing Bitcoin wallet feature (MuSig multi-signature support inside miniscript expressions). It does not change production wallet logic, consensus rules, or network behavior. The changes are confined to a single functional test file and expand coverage for different miniscript patterns such as pkh and pk_h.

AI review queuedtest: Test that key expression indexes match key countby Ava Chow · ce4c66eb · Feb 2, 2026 · 5 filesMessage 72 · AdequateInformational 18Details
Commit message · Ava Chow

test: Test that key expression indexes match key count

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit adds new internal test-only checks to make sure Bitcoin Core's descriptor parser correctly counts key expressions. It does not change user-facing behavior or fix a known live bug; it is a regression test and small helper-code addition to verify an invariant (every key has a unique index and the count matches).

AI review queuedsignals: Use a lambda to avoid connecting a signal to another signalby Cory Fields · fd5e9d99 · Feb 2, 2026 · 1 fileMessage 93 · StrongInformational 17Details
Commit message · Cory Fields

signals: Use a lambda to avoid connecting a signal to another signal

This is undocumented and unspecified Boost behavior that happens to work as
intended for now, but could break at any point in the future.

See the boost discussion here: https://groups.google.com/g/boost-list/c/So4i8JXneJ0

It also complicates a potential replacement of Boost::signals2.

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This is a small code-quality cleanup in Bitcoin Core's wallet code. It changes how an internal notification signal is wired up so that it no longer relies on an obscure, undocumented feature of the Boost signals library. The change prevents a future risk that a Boost update could silently break wallet address notifications, but there is no known current bug or security vulnerability being exploited.

AI review queuedmove-only: move logging categories to logging/categories.hby stickies-v · 56d113ca · Feb 2, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · stickies-v

move-only: move logging categories to logging/categories.h

Logging categories are currently shared between node and kernel. This
separation allows future commits to completely remove kernel's
dependency on logging.h.

Also applies clang-format suggestions to the moved code.

Review with --color-moved=dimmed-zebra --color-moved-ws=ignore-all-space

Co-authored-by: Ryan Ofsky <ryan@ofsky.org>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit is a simple code reorganization: it moves the list of logging categories from one header file to a new header file, without changing what the categories are or how they behave. It is purely a structural cleanup to make future work easier.

AI review queuedrefactor: Use empty() over eof() in the streams interfaceby MarcoFalke · fa20bc2e · Feb 2, 2026 · 5 filesMessage 77 · AdequateInformational 15Details
Commit message · MarcoFalke

refactor: Use empty() over eof() in the streams interface

End-of-file does not really make sense for streams that wrap buffers. So
replace it by the equivalent empty() checks.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a straightforward code cleanup: it renames the stream check from eof() (end-of-file) to empty() because the streams actually wrap in-memory buffers, not files. The behavior is identical, so there is no security issue here.