btcd

This commit fixes a bug in how btcd decodes Bitcoin private keys stored in the common Wallet Import Format (WIF). Previously, the software silently accepted invalid private keys, including the all-zero key and keys larger than the allowed secp256k1 group order. For keys larger than the allowed maximum, the library would quietly reduce the value modulo the group order, returning a different, valid-looking private key than the one actually encoded in the WIF. This could cause a wallet or application to import the wrong key without any warning, potentially leading to loss of funds or unexpected addresses. The fix now rejects these out-of-range keys and returns an error instead.

This commit adds a safety check in btcd's PSBT (Partially Signed Bitcoin Transaction) handling code. Previously, if a taproot leaf script entry was accidentally set to nil (empty/missing), the code could crash with a panic when trying to sort or encode the PSBT. The fix now rejects nil entries with a clear error message instead of crashing. This is a defensive hardening change rather than a remote exploit, but it prevents a denial-of-service-style crash for applications that process untrusted PSBTs.

This commit fixes a test-only reliability bug, not a security vulnerability. When running btcd's integration tests in parallel, two test processes were accidentally sharing the same temporary file path and the same starting port number. That caused random test failures: one process could overwrite the other's freshly built test binary, or two processes could try to use the same network port. The fix gives each test process its own random file name and a random starting port range. It does not change anything in the live Bitcoin node software end users run.

This commit fixes a logic bug in btcd's block synchronization code. When two Bitcoin nodes connected at the same block height, the node would refuse to process new-block announcements from its peer, causing synchronization to stall (a deadlock). The fix allows those announcements to be processed when no dedicated sync peer has been selected, so the node can continue downloading new blocks.

This commit fixes a build error in an integration test file when a special build tag is used. It changes which internal package provides a helper function for creating a test Bitcoin address. There is no security issue here—just a straightforward code fix to make tests compile.

This commit fixes a harmless JSON decoding bug. When a Bitcoin RPC server returned a null value for the 'warnings' field, the client couldn't understand it and threw an error. The fix lets null decode to an empty list, restoring normal operation. There is no security attack here.

This commit only changes the project's continuous integration (CI) configuration. It adds a new automated test job that runs a previously skipped set of tests tagged with 'rpctest'. There is no change to application code, no bug fix, and no security patch.

This is a routine release-preparation commit. It removes temporary local path overrides in Go module files, pins submodules to newly published version tags, bumps one dependency version (btcec to v2.5.0), unifies the Go toolchain version to 1.25, and updates the project's own version number. There are no code logic changes and nothing in the commit suggests a security fix or vulnerability.

This is a large, routine refactoring commit. It updates the btcd project to use new 'v2' versions of its own Go modules (such as btcutil/v2, chaincfg/v2, wire/v2, txscript/v2, and a newly split-out address/v2 package) across the entire codebase. It also updates some third-party dependencies and Go version requirements. There is no indication of a security fix or vulnerability being addressed.

This is a one-line code cleanup that silences a Go linter warning by explicitly discarding the return value of a function call. It does not change program behavior or fix any security issue.

This commit only changes build, test, and continuous-integration configuration files. It adds new Go packages to the test/coverage targets and updates how coverage report files are cleaned up. There is no change to the actual Bitcoin node or library code that users run, and nothing in the commit suggests a security fix or vulnerability.

This commit simply deletes two helper functions that were no longer being used anywhere in the code. It is a routine cleanup to silence a linter warning. There is no security issue here.

This commit is a routine code reorganization: it moves the PSBT (Partially Signed Bitcoin Transaction) package from a nested location under btcutil to a top-level module, updates internal import paths to use v2 module versions, and removes a dependency on btcutil. The diff shows files being deleted from btcutil/psbt and equivalent files being added under psbt/. There is no indication of a security bug fix, vulnerability patch, or behavior change intended to address an exploit.

This commit is a routine internal restructuring of the btcd project's Go module layout. It switches the btcutil package and its subpackages from the old module path to a new 'v2' path, and updates imports throughout the code to point at newly split-out submodules (address, chaincfg, chainhash, txscript, wire). It also copies one small helper function (HashMerkleBranches) into the bloom package to avoid depending on the blockchain package. There is no indication in the commit of any security bug being fixed.

This commit is a routine code reorganization: it splits the Bitcoin transaction-script library (txscript) into its own Go module and updates all internal references to use new v2 versions of related packages. There are no visible security fixes or behavior changes in the script engine, signature validation, or consensus logic. The changes are mostly import-path updates and replacing one test helper library with inline code to avoid a circular dependency.

This commit is a large code reorganization: it moves the Bitcoin address-handling code into its own top-level Go module and upgrades its internal import path to version 2. The actual address/base58/bech32 logic appears to be copied over largely unchanged, with only minor additions such as a new pay-to-anchor address type. There is no obvious security bug introduced by the move itself, and the commit message does not describe any security fix.

This commit is a routine Go module restructuring: it makes the chaincfg package its own versioned module (chaincfg/v2) and updates its internal imports to use versioned chainhash/v2 and wire/v2 modules. There are no code logic changes, no bug fixes, and no security-sensitive behavior changes visible in the diff.

This commit is a routine dependency update inside the btcd cryptocurrency project. It changes the btcec cryptographic package to use a newer version (v2) of the internal chainhash module instead of the older v1 path. No security bug is fixed or introduced in the visible code; it is purely an import-path and module-reference change.

This commit is a routine Go module restructuring: it makes the `wire` package its own standalone Go module and updates its import path to version 2 (`github.com/btcsuite/btcd/wire/v2`). It also updates internal imports of the `chainhash` package to use its new v2 path. There are no functional code changes, no bug fixes, and no security-relevant modifications visible in the diff.

This commit is a pure refactoring move: the chainhash package is relocated from `chaincfg/chainhash` to a top-level `chainhash` directory and its Go module path is bumped to `github.com/btcsuite/btcd/chainhash/v2`. The actual source code, tests, and behavior are identical to the previous location. There is no security fix or vulnerability introduced here.

This commit fixes two minor issues flagged by Go 1.26's vet tool. One is a test-only bug where a failing test inside a goroutine used the wrong error-and-exit call, which could leave the test running with bad state. The other is a non-security formatting bug in help text generation where percent signs in user-visible descriptions could be misinterpreted as format codes. Neither appears to be an exploitable security vulnerability.

This commit simply updates the Go programming language version required to build the project from 1.22/1.23.2 to 1.25, and updates the continuous integration build environment to use Go 1.26.3. It also fixes documentation that incorrectly stated the minimum version. There are no code logic changes and no security vulnerability is introduced or fixed.

This commit only updates version numbers in Go package files (go.mod and go.sum) to prepare for a new release. It does not change any actual program code, fix a bug, or alter behavior. There is no direct security issue visible in this change.

This commit only adds a new automated build step in GitHub Actions to compile the project for Android on ARM64. It does not change any application code, fix any bug, or alter how the software behaves. There is no security relevance.

This is a straightforward build-fix rename. A previous commit exported a helper function in one file but forgot to rename the matching no-op version used for appengine builds. This patch simply renames the function so appengine-tagged builds compile again. There is no security issue.