BT
← All projectsbtcsuite

btcd

Alternative full-node Bitcoin implementation written in Go.

BitcoinNode implementationsNormal
Repository coverage

198 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

43security candidates20second-pass queue48AI analyses
31commits · 30 days
65commits · 60 days
177commits · 180 days
198commits · 365 days
Backfill bands
Aug 5 → Feb 621 seen1 candidatesComplete
Feb 6 → Jun 6112 seen7 candidatesComplete
Jun 6 → Jul 634 seen13 candidatesComplete
Jul 6 → Aug 530 seen7 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

68/100 average clarity
61Strong · 80–100
75Adequate · 60–79
57Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Lrifton92433186
Erick Cestari812177
Boris Nagaev461515060
Olaoluwa Osuntokun561112073
Oliver Gugger1345047
MPins333079
Drake Thomsen222091
Eric Grill311086
Julio Cesar111045
Jacob Schuler111088
Kim111045
Calvin Kim4300072
Analysis record

Published AI watches

Last scanned 57 minutes ago

Informational 15 AI analysisMessage 85 · Strong
BT btcsuitebtcd BitcoinNode implementations

build: pin tagged submodules and remove local replacements

This commit is a routine build housekeeping change. It updates two internal Go module dependencies to newly published tagged versions and removes local directory overrides so that everyone builds with the same published code. There is no i…

3d3b5e8aby Olaoluwa Osuntokun+8−82 files
No security note in commit
Informational 21 AI analysisMessage 86 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: make HTTP Basic Auth optional via DisableAuth

This change adds a new optional setting called DisableAuth to the btcd RPC client. When a user turns it on, the client will not send username/password credentials automatically. This is meant to let users connect to external Bitcoin API se…

New opt-in configuration flag that disables authentication headersDefault behavior unchanged; authentication still required unless user explicitly disables itNo validation added to ensure alternative authentication is present when DisableAuth is true
5d22b395by Drake Thomsen+25−131 file
No security note in commit
Informational 12 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: harden DisableAuth transport tests

This commit only changes tests and clarifies a public comment. It does not alter the actual authentication behavior of the btcd RPC client. The code already only suppresses the internally generated Basic auth header when DisableAuth is tru…

No functional code change; only tests and commentsComment clarification that DisableAuth only suppresses generated Basic auth, not caller-provided Authorization headersTests now cover WebSocket handshake, cookie bypass, and caller-provided headers
52d2fadeby Olaoluwa Osuntokun+186−1272 files
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

rpcclient: wrap DisableAuth tests to 80 columns

This commit only reformats an existing test file. It wraps long lines to 80 columns, splits nested code into separate variables, and adjusts whitespace. No production code was changed, and no security behavior is altered.

fe84a0e1by Olaoluwa Osuntokun+83−521 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: add tests for DisableAuth header behavior

This commit only adds new unit tests for an existing feature. It does not change any production code, so it cannot introduce a security vulnerability or fix one directly. The tests verify that an existing option called DisableAuth correctl…

9b849c17by Drake Thomsen+109−01 file
No security note in commit
Low 48 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

v2transport: restore responder handshake progress

This commit fixes a deadlock risk in btcd's new Bitcoin v2 transport handshake. Previously, the responder waited until it had received the initiator's full 64-byte key before doing any work, which could cause both sides to sit waiting for …

BIP324 handshake deadlock avoidanceCPU admission lease split to prevent resource exhaustion / lock holding across network I/OResponder now sends key material before full initiator key is received
09717871by Olaoluwa Osuntokun+231−862 files
No security note in commit
Low 41 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

psbt: decode base64 packets incrementally

This commit changes how btcd reads base64-encoded PSBT (Partially Signed Bitcoin Transaction) data. Previously, the code read the entire base64 input into memory before decoding, and it wrongly applied the Bitcoin P2P wire message size lim…

Removes an incorrect size bound that caused base64 PSBT parsing to reject valid large packets (denial-of-service / interoperability issue)Switches from full in-memory base64 decode to incremental streaming, reducing peak memory for large base64 PSBTsRetains strict base64 alphabet checks and rejects trailing data after the PSBT packet
e333817dby Olaoluwa Osuntokun+129−602 files
No security note in commit
Moderate 60 AI analysisMessage 68 · Adequate
BT btcsuitebtcd BitcoinNode implementations

psbt: reject nil taproot pointer fields

This commit fixes a class of crash bugs in btcd's PSBT (Partially Signed Bitcoin Transaction) handling for Taproot transactions. Previously, if certain Taproot-related lists contained a nil (empty) entry, the code would panic when trying t…

nil-pointer dereference / panic prevention in Taproot PSBT finalizernil-pointer dereference / panic prevention in PSBT serializationinput validation added before sort.Slice and pointer dereference
1ead5ba3by Olaoluwa Osuntokun+171−165 files
Vendor flagged security relevance
Moderate 50 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

peer: close late connections after disconnect

This commit fixes a race condition in btcd's peer networking code. If a peer was told to disconnect before a network socket had been attached, the socket could later be attached but never closed, leaking the connection. The fix adds a lock…

Connection leak / resource exhaustion due to missing close pathRace condition between connection association and disconnectionAtomic flag published before connection state is fully initialized
617ebe2bby Boris Nagaev+111−72 files
No security note in commit
Moderate 64 AI analysisMessage 73 · Adequate
BT btcsuitebtcd BitcoinNode implementations

psbt: avoid blocking reads and unbounded allocations in NewFromRawBytes

This commit fixes two problems in the way btcd reads Partially Signed Bitcoin Transactions (PSBTs). First, the parser could hang forever when reading from a network connection or pipe because it tried to read one extra byte to check for le…

Denial-of-service via blocking read on open stream (potential infinite hang)Denial-of-service via unbounded memory allocation on base64 input before validationStrict parsing hardening for PSBT base64 decoding
2ddf73f3by Olaoluwa Osuntokun+87−283 files
Vendor flagged security relevance
Low 38 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: test final witness trailing data rejection

This commit adds a new test to the btcd PSBT (Partially Signed Bitcoin Transaction) library. The test checks that when extracting a final Bitcoin transaction from a PSBT, the library rejects a final witness value that has extra trailing by…

Strict parsing of final witness data to reject malformed/trailing bytesPrevents creation of transactions with non-standard witness encodingTest-only commit implies behavior enforcement elsewhere in the codebase
c87168ebby Boris Nagaev+26−01 file
No security note in commit
Moderate 58 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: reject trailing final witness data

This change tightens how a Bitcoin PSBT library extracts final witness data when turning a partially-signed transaction into a finished transaction. Previously, extra bytes after the declared witness stack were silently ignored. Now the li…

strict parsing of serialized witness datarejection of trailing bytes in PSBT final script witnesspotential malleability / ambiguity reduction in PSBT extraction
468853e4by Boris Nagaev+13−91 file
No security note in commit
Moderate 64 AI analysisMessage 88 · Strong
BT btcsuitebtcd BitcoinNode implementations

btcec/schnorr: reject s >= group order in ParseSignature

This commit fixes a bug in how btcd parses Schnorr (BIP-340) digital signatures. The code was supposed to reject signatures whose 's' number was larger than the allowed group order, but instead it silently wrapped the value around (modulo …

BIP-340 signature parsing non-compliancesilent modulo reduction of s componentsignature malleability risk from non-canonical encodings
83d081a5by Lrifton92+42−12 files
Vendor flagged security relevance
Low 25 AI analysisMessage 80 · Strong
BT btcsuitebtcd BitcoinNode implementations

psbt: compact witness utxo scripts after parsing

This commit fixes a memory-usage issue, not a security vulnerability. When reading PSBT data, the code was keeping a pointer to a large 4 MiB internal memory block even for tiny scripts. The patch copies the small script into its own compa…

memory retention reductionno input validation changeno cryptographic change
b0ab66feby Boris Nagaev+10−12 files
No security note in commit
Low 48 AI analysisMessage 50 · Thin
BT btcsuitebtcd BitcoinNode implementations

musig2: return partial signature read errors

This commit fixes a bug in the MuSig2 multi-signature code where reading a partial signature from an input stream could fail silently. Previously, if the stream ended early or had a read error, the function would return 'no error' as if th…

Silent failure in cryptographic decode pathPartial signature scalar left uninitialized on read errorMuSig2 signing correctness dependency
63bc064dby Boris Nagaev+1−11 file
No security note in commit
Informational 12 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: add strict tx value regression test

This commit only adds a new test file. It does not change any production code. The test checks that the PSBT parser rejects transaction fields that have extra trailing bytes. Because no actual parser logic is modified, this commit by itsel…

Regression test added for strict parsing of transaction-valued PSBT fieldsNo production code changes
0293b6e0by Boris Nagaev+117−01 file
No security note in commit
Low 46 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: decode base64 packets strictly

This change tightens how base64-encoded PSBT (Partially Signed Bitcoin Transaction) data is decoded. Previously, the decoder could silently ignore extra whitespace or unexpected characters in the base64 stream. Now it rejects anything that…

Strict input validation added for base64 decodingRejection of whitespace/newlines inside base64 payloadUse of strict base64 decoder to enforce RFC4648 padding rules
70e8ceb9by Boris Nagaev+28−51 file
No security note in commit
Low 49 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: reject trailing packet data

This change makes the PSBT (Partially Signed Bitcoin Transaction) parser reject files or data that have extra bytes after the end of a valid PSBT. Previously, extra trailing data was silently ignored, which could let an attacker hide malic…

Parser no longer ignores trailing bytesCould prevent smuggling of extra data inside PSBT containersCould prevent canonicalization attacks where different byte sequences parse to the same structure
d1de2bc3by Boris Nagaev+4−01 file
No security note in commit
Low 46 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: parse witness utxo txouts strictly

This commit tightens how a Bitcoin-related library reads transaction outputs stored inside PSBT (Partially Signed Bitcoin Transaction) data. Previously, the code read the output value and script in a loose, hand-rolled way that ignored ext…

Strict canonical parsing of serialized transaction outputsRemoval of hand-rolled length handling that ignored script length byteAddition of full-consumption check on parsed witness UTXO data
b4c5cf16by Boris Nagaev+11−91 file
No security note in commit
Informational 12 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: test trailing packet data rejection

This commit only adds a new test case. It does not change any production code. The test checks that the PSBT parser rejects files that have extra bytes after a valid PSBT packet. Because no code behavior is changed, this commit by itself d…

Test-only commitNo production code changesTests input-validation behavior (trailing data rejection)
0a1300ddby Boris Nagaev+16−01 file
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityserver: serialize peer lifecycle via single goroutineby Or Aharonee · ce913598 · Feb 16, 2026 · 3 filesMessage 83 · StrongTriage 0Details
Commit message · Or Aharonee

server: serialize peer lifecycle via single goroutine

Address review feedback on the peer add/done race fix:

- Make peerLifecycleHandler (renamed from peerDoneHandler) the sole
sender of both peerAdd and peerDone events for each peer. OnVerAck
now closes a signal channel (verAckCh) instead of sending directly,
and peerLifecycleHandler selects on verAckCh vs peer.Done() to
decide whether to send peerAdd before peerDone. This guarantees
ordering by construction: a single goroutine sends both events
sequentially, eliminating the negotiateTimeout race window.

- Add Done() method to peer.Peer exposing the quit channel read-only,
enabling select-based disconnect detection from server code.

- Remove the now-unused AddPeer method.

- Address style feedback: 80-char line limit, empty lines between
switch cases, break long function calls, use require.GreaterOrEqualf
instead of if+Fatalf, bump syncRaceConcurrency to 300 for
backpressure testing, add TestPreVerackDisconnect for disconnect
prior to verack.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityserver: fix peer add/done race between peerHandler and syncManagerby Or Aharonee · 091b7901 · Feb 16, 2026 · 2 filesMessage 85 · StrongTriage 0Details
Commit message · Or Aharonee

server: fix peer add/done race between peerHandler and syncManager

peerDoneHandler ran as a separate goroutine per peer and independently
notified both peerHandler (via donePeers channel) and the sync manager
(via syncManager.DonePeer) about a peer disconnect. Because these two
sends were unsynchronized, the sync manager could observe DonePeer
before NewPeer when a peer connected and disconnected quickly. This
caused the sync manager to log "unknown peer", then later register the
already-dead peer as a sync candidate that was never cleaned up,
potentially leaving it stuck with a dead sync peer.

Two structural changes eliminate the race:

1. Merge the newPeers and donePeers channels into a single
peerLifecycle channel. Since OnVerAck (add) always fires before
WaitForDisconnect returns (done), a single FIFO channel guarantees
peerHandler always processes add before done for a given peer,
removing the select-ambiguity where Go could pick done first.

2. Move the syncManager.DonePeer call and orphan eviction from
peerDoneHandler into handleDonePeerMsg, which runs inside
peerHandler. All sync manager peer lifecycle notifications now
originate from the single peerHandler goroutine and flow into
sm.msgChan in guaranteed add-before-done order.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI review queuedbtcec/schnorr: fix nonce generation commentsby Erick Cestari · 3a0df885 · Jan 15, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Erick Cestari

btcec/schnorr: fix nonce generation comments

The comments in schnorrSign and Sign incorrectly stated that CustomNonce
triggers RFC6979 nonce generation. The actual behavior is the opposite:

- With CustomNonce: BIP-340 compliant nonce derivation (steps 6-8)
- Without CustomNonce (default): RFC6979 deterministic nonce generation

Also fixes typo "set 14" -> "step 14".

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only fixes documentation comments in the code. It corrects a description about which nonce-generation method is used when a custom nonce option is provided. No actual signing logic or behavior was changed, so there is no security risk from this patch itself.

Lower-prioritybuild: bump version of Go container for release buildsby Olaoluwa Osuntokun · 7d4da229 · Jan 13, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Olaoluwa Osuntokun

build: bump version of Go container for release builds

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queuedfix spelling errorby Jameson Lopp · d3615dcc · Dec 25, 2025 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Jameson Lopp

fix spelling error

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
Lower-priorityregtest: align activations with Bitcoin Coreby Boris Nagaev · cd4e5426 · Dec 25, 2025 · 8 filesMessage 90 · StrongTriage 0Details
Commit message · Boris Nagaev

regtest: align activations with Bitcoin Core

Set regtest buried heights to match Core: BIP34/65/66 at height 1 and make
CSV/SegWit/Taproot always active. Added regtest coverage for header version
floors, coinbase height enforcement, and deployment state to ensure we now
reject the blocks Core rejects and accept the ones Core accepts.

Updated package fullblocktests to generate BIP34-compliant blocks.

Test helpers now set prev block height to 0 (not the default -1) so generated
blocks start at height 1 and satisfy coinbase height rules.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Lower-priorityblockchain: run BIP30 check at BIP0034Heightby Boris Nagaev · f7dd09f5 · Dec 24, 2025 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · Boris Nagaev

blockchain: run BIP30 check at BIP0034Height

Sync the behaviour with Bitcoin Core.

See https://github.com/bitcoin/bitcoin/pull/6931

In Core, the BIP30 flag is cleared only if the previous block's ancestor chain
already contains the BIP34 activation block. For the activation block itself
(height = BIP0034Height), pindex->pprev->GetAncestor(BIP34Height) returns
nullptr, so the flag stays on and BIP30 is still enforced. In other words, Core
enforces BIP30 for the activation block and skips it starting with the following
block.

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-priorityblockchain: make BIP30 enforcement logic testableby Boris Nagaev · 29d105bb · Dec 24, 2025 · 2 filesMessage 78 · AdequateTriage 0Details
Commit message · Boris Nagaev

blockchain: make BIP30 enforcement logic testable

Upcoming commits tweak the conditions under which the expensive BIP30
duplicate-coinbase check should run. To unit-test those changes, this
commit moves the decision logic out of BlockChain.checkConnectBlock and
into a dedicated helper, bip0030CheckNeeded. The behaviour is unchanged;
the new helper is covered by tests in bip30_test.go.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityblockchain: fix overly eager BIP30 bypassby Boris Nagaev · 6803c625 · Dec 24, 2025 · 2 filesMessage 86 · StrongTriage 5Details
Commit message · Boris Nagaev

blockchain: fix overly eager BIP30 bypass

Bitcoin Core PR https://github.com/bitcoin/bitcoin/pull/12204 tightened BIP30
handling: re-enable the check once height 1,983,702 is reached.

This change ports that logic into btcd and adds a regression test.

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidence
Lower-priorityblockchain: run BIP30 if we are on non-BIP34 forkby Boris Nagaev · 5baa6387 · Dec 24, 2025 · 3 filesMessage 76 · AdequateTriage 0Details
Commit message · Boris Nagaev

blockchain: run BIP30 if we are on non-BIP34 fork

Mirror BIP34-aware BIP30 skip logic from Bitcoin Core.

PR https://github.com/bitcoin/bitcoin/pull/6931 in Bitcoin Core introduced
an optimization that skips the expensive BIP30 duplicate coinbase check once
BIP34 is active *and* the chain actually contains the recorded activation block.
See the comment in that PR "//Only continue to enforce if we're below BIP34
activation height or the block hash at that height doesn't correspond."

btcd used to drop the check purely based on height. On a fork that lacks the
BIP34 activation block, that difference lets a duplicate coinbase slip through
consensus. This patch ports the missing pieces: we store the activation hash in
chain parameters and only disable BIP30 after we see that block on-chain.

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-prioritytreap, ffldb: change Put() to take in multiple key-value pairsby Calvin Kim · e0091247 · Nov 14, 2025 · 4 filesMessage 85 · StrongTriage 0Details
Commit message · Calvin Kim

treap, ffldb: change Put() to take in multiple key-value pairs

Previously, the Put() function took in a single key-value pair,
resulting in memory allocation overhead as the intermediary treapNodes
got allocated and immediately garbage collected, resulting in
performance loss due to the garbage collection overhead.

We're able to recycle the intermediary treapNodes allocated by taking in
multiple key-value pairs. This results in better performance of the
node especially during UTXO cache flushes.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Lower-prioritytreap: add recycle() method on treapNodeby Calvin Kim · 0e95ae38 · Oct 30, 2025 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · Calvin Kim

treap: add recycle() method on treapNode

The recycle method resets and puts the treapNode into the treapNodePool
to be recycled at a future date.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritytreap: return newly created treapNodes in put()by Calvin Kim · 65d39687 · Oct 30, 2025 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · Calvin Kim

treap: return newly created treapNodes in put()

The newly created treapNodes in put() are now returned so that the
caller has access to them. This is done so that the caller can put back
some of the treapNodes to sync.Pool.

For multiple put operations, an immutable treap will allocate many
treapNodes that will immediately be garbage collected. Let's say
there's 3 key-value pairs that are going to be inserted:

key 1: 50
key 2: 10
key 3: 4

Then the insertion is like so:

1: allocate 50.

50

2: clone 50, allocate 10.

50
/ \
10

3: clone 50, clone 10, allocate 4

50
/ \
10
/
4

In this example, only the nodes allocated during insertion of (3) is
going to be used. The rest is going to be garbage collected and they
can be safely be put in the sync.Pool if there's a guarantee that the
previous copies are not being accessed. This is true if the put
operations are going to be called in batches.

By returning the pointers of these allocated treapNodes, we allow the
caller to make such optimizations.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Lower-priorityrpcclient: ensure http dial respects timeoutby Matt Leon · 582b999f · Oct 29, 2025 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Matt Leon

rpcclient: ensure http dial respects timeout

Ensure that the dial phase of rpcclient's HTTP posts respects the http.Client's Timeout. It was instead falling back to the OS settings.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritybuild: bump version to v0.25by Olaoluwa Osuntokun · 798b4ed4 · Oct 27, 2025 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Olaoluwa Osuntokun

build: bump version to v0.25

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI review queuedmusig2: add combinedNonce getterby sputn1ck · 21eb99e3 · Oct 13, 2025 · 2 filesMessage 35 · OpaqueTriage 0Details
Commit message · sputn1ck

musig2: add combinedNonce getter

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedmusig2: add Session.RegisterCombinedNonceby sputn1ck · 8f54cc6e · Oct 13, 2025 · 2 filesMessage 58 · ThinTriage 0Details
Commit message · sputn1ck

musig2: add Session.RegisterCombinedNonce

This commit adds a new function to musig2.Session, which allows the caller
to add an external aggregated nonce to the session.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
Lower-prioritybuild: bump version to v0.25.0-beta.rc1by Olaoluwa Osuntokun · 31a762b3 · Sep 25, 2025 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Olaoluwa Osuntokun

build: bump version to v0.25.0-beta.rc1

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-prioritytreap: add treapNodePool and fetch from it for cloneTreapNode and newTreapNodeby Calvin Kim · e3d237d3 · Sep 20, 2025 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · Calvin Kim

treap: add treapNodePool and fetch from it for cloneTreapNode and
newTreapNode

The treapNodePool will allow for less memory allocations during
immutable treap operations. We first change the cloneTreapNode and
newTreapNode to allocate a treapNode from the sync.Pool.

The allocated treapNodes will be put back into the sync.Pool in later
commits.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritytreap: refactor the Put() code into exported and unexported versionsby Calvin Kim · 26ef499a · Sep 20, 2025 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Calvin Kim

treap: refactor the Put() code into exported and unexported versions

We do this to later add batch put logic into the exported Put()
function.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityMakefile+workflows: fallback to `GOPATH/bin` on non-existent `GOBIN`by Mohamed Awnallah · 29f42153 · Aug 20, 2025 · 2 filesMessage 65 · AdequateTriage 0Details
Commit message · Mohamed Awnallah

Makefile+workflows: fallback to `GOPATH/bin` on non-existent `GOBIN`

Co-authored-by: Oliver Gugger <gugger@gmail.com>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Security candidateDockerfile: update go base imageby Kim · 2577dd3e · Aug 20, 2025 · 3405 filesMessage 45 · ThinInformational 17Details
Commit message · Kim

Dockerfile: update go base image

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 17/100

This commit is a large repository import or rebase that adds the entire btcd codebase plus new GitHub templates, CI workflows, a Makefile, and Dockerfiles. The stated purpose is 'Dockerfile: update go base image'. The actual Dockerfile change moves the build base image from a pinned SHA256 digest of golang:1.23.12-alpine3.21 to a tag-based golang:1.22.11-alpine3.21 in the GitHub Actions Dockerfile. There is no direct code-level security fix visible in the diff; the security relevance is limited to supply-chain/dependency hygiene of the Go base image used in Docker builds.

Lower-priorityrpcclient: add bitcoind version dependent error matchingby Oliver Gugger · ffcda0f6 · Aug 19, 2025 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · Oliver Gugger

rpcclient: add bitcoind version dependent error matching

Fixes #2404.
If different versions of bitcoind return different error strings, we
need a way to match those as well.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference