CommitWatch RSS
ER
← All projectselectrs

electrs

Rust Electrum server that indexes Bitcoin Core data for wallet queries.

BitcoinIndexing infrastructureSoftware walletsNormal
Source repository ↗
Repository coverage

65 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

0security candidates41second-pass queue5AI analyses
5commits · 30 days
9commits · 60 days
24commits · 180 days
64commits · 365 days
Backfill bands
Aug 5 → Feb 641 seen0 candidatesComplete
Feb 6 → Jun 615 seen0 candidatesComplete
Jun 6 → Jul 64 seen0 candidatesComplete
Jul 6 → Aug 55 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

61/100 average clarity
2Strong · 80–100
35Adequate · 60–79
18Thin · 40–59
10Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dependabot[bot]2801076
Roman Zeyde2203041
Rej Ect200061
Antoni Spaanderman200056
Martin Habovstiak100068
MozirDmitriy100058
Olexandr88100036
Snezhkko100070
Torkel Rogstad101078
vastonus100085
yancy100060
Yuki Kishimoto100076
Analysis record

Published AI watches

Last scanned 1 hour, 2 minutes ago

Informational 15 AI analysisMessage 45 · Thin
ER electrselectrs BitcoinIndexing infrastructureSoftware wallets

Update documentation for the upcoming release

This commit only updates user-facing documentation and a helper shell script for an upcoming release. It changes wording in setup guides, replaces old example output with newer version numbers, and switches the default database directory i…

9cd09afaby Roman Zeyde+62−1176 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
ER electrselectrs BitcoinIndexing infrastructureSoftware wallets

Bump log from 0.4.29 to 0.4.33

This is an automated dependency update by Dependabot that bumps the Rust `log` crate from version 0.4.29 to 0.4.33. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication in t…

9175b0f9by dependabot[bot]+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
ER electrselectrs BitcoinIndexing infrastructureSoftware wallets

Update bitcoind release in CI

This commit simply updates the version of Bitcoin Core used in the project's automated testing environment from a release candidate (31.0rc2) to the final stable release (31.1). It is a routine CI/infrastructure maintenance change with no …

eed01b98by Roman Zeyde+4−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
ER electrselectrs BitcoinIndexing infrastructureSoftware wallets

Require latest bitcoind

This commit only updates a single line in the installation documentation, changing the recommended minimum version of Bitcoin Core from 0.21+ to 31.0+. There is no code change, no bug fix, and no security patch in the diff itself.

c0a4b3faby Roman Zeyde+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 78 · Adequate
ER electrselectrs BitcoinIndexing infrastructureSoftware wallets

multi: expose configurable magic on non-signet

This commit is a large repository import or merge that adds many project files (documentation, CI, Docker, helper scripts, dependency lock file, etc.) and makes one small functional change: it allows users to configure the Bitcoin P2P netw…

New configuration option exposes network magic override beyond signetLarge repository import obscures the precise code changeNo validation or bounds checking on the magic value is visible in the diff
d846cc75by Torkel Rogstad+12271−074 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityUpdate documentation for the upcoming releaseby Roman Zeyde · 9cd09afa · Jul 18, 2026 · 6 filesMessage 45 · ThinInformational 15Details
Commit message · Roman Zeyde

Update documentation for the upcoming release

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only updates user-facing documentation and a helper shell script for an upcoming release. It changes wording in setup guides, replaces old example output with newer version numbers, and switches the default database directory in server.sh from ./_db to ./db. There is no code change that fixes or introduces a security vulnerability.

AI review queuedBump log from 0.4.29 to 0.4.33by dependabot[bot] · 9175b0f9 · Jul 18, 2026 · 1 fileMessage 76 · AdequateInformational 15Details
Commit message · dependabot[bot]

Bump log from 0.4.29 to 0.4.33

Bumps [log](https://github.com/rust-lang/log) from 0.4.29 to 0.4.33.
- [Release notes](https://github.com/rust-lang/log/releases)
- [Changelog](https://github.com/rust-lang/log/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/log/compare/0.4.29...0.4.33)

---
updated-dependencies:
- dependency-name: log
dependency-version: 0.4.33
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is an automated dependency update by Dependabot that bumps the Rust `log` crate from version 0.4.29 to 0.4.33. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication in the commit of any security fix or vulnerability being addressed, and the `log` crate is a widely-used, stable logging utility. This appears to be a routine maintenance patch with no direct security relevance.

AI review queuedRequire latest bitcoindby Roman Zeyde · c0a4b3fa · Jul 18, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Roman Zeyde

Require latest bitcoind

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates a single line in the installation documentation, changing the recommended minimum version of Bitcoin Core from 0.21+ to 31.0+. There is no code change, no bug fix, and no security patch in the diff itself.

Lower-priorityUpdate bitcoind release in CIby Roman Zeyde · eed01b98 · Jul 18, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Roman Zeyde

Update bitcoind release in CI

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit simply updates the version of Bitcoin Core used in the project's automated testing environment from a release candidate (31.0rc2) to the final stable release (31.1). It is a routine CI/infrastructure maintenance change with no direct security fix or code change to the electrs software itself.

Lower-priorityAllow setting REST server URLby Roman Zeyde · 1255a377 · Jul 18, 2026 · 3 filesMessage 45 · ThinTriage 0Details
Commit message · Roman Zeyde

Allow setting REST server URL

Requires `bindex` 0.1.2

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritydocs: fix beta Debian repository linksby haoshengzhen · 31c3fc5b · Jun 30, 2026 · 2 filesMessage 72 · AdequateTriage 0Details
Commit message · haoshengzhen

docs: fix beta Debian repository links

Signed-off-by: haoshengzhen <haoshengzhen@outlook.com>

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI review queuedBump serde_json from 1.0.149 to 1.0.150by dependabot[bot] · ca254cb5 · Jun 16, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump serde_json from 1.0.149 to 1.0.150

Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.149 to 1.0.150.
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150)

---
updated-dependencies:
- dependency-name: serde_json
dependency-version: 1.0.150
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump bytes from 1.11.0 to 1.11.1by dependabot[bot] · d889624f · Jun 16, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump bytes from 1.11.0 to 1.11.1

Bumps [bytes](https://github.com/tokio-rs/bytes) from 1.11.0 to 1.11.1.
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tokio-rs/bytes/compare/v1.11.0...v1.11.1)

---
updated-dependencies:
- dependency-name: bytes
dependency-version: 1.11.1
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump jsonrpc from 0.18.0 to 0.20.1by dependabot[bot] · acf4b98d · Jun 15, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump jsonrpc from 0.18.0 to 0.20.1

Bumps [jsonrpc](https://github.com/rust-bitcoin/corepc) from 0.18.0 to 0.20.1.
- [Commits](https://github.com/rust-bitcoin/corepc/commits/jsonrpc-0.20.1)

---
updated-dependencies:
- dependency-name: jsonrpc
dependency-version: 0.20.1
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedSwitch to `bindex`by Roman Zeyde · 0fe14fdf · May 31, 2026 · 24 filesMessage 28 · OpaqueTriage 0Details
Commit message · Roman Zeyde

Switch to `bindex`

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit messagesecond-pass: unusually broad change
AI review queuedBump bitcoin from 0.32.8 to 0.32.9by dependabot[bot] · 32e5944a · May 30, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump bitcoin from 0.32.8 to 0.32.9

Bumps [bitcoin](https://github.com/rust-bitcoin/rust-bitcoin) from 0.32.8 to 0.32.9.
- [Release notes](https://github.com/rust-bitcoin/rust-bitcoin/releases)
- [Changelog](https://github.com/rust-bitcoin/rust-bitcoin/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-bitcoin/rust-bitcoin/compare/bitcoin-0.32.8...bitcoin-0.32.9)

---
updated-dependencies:
- dependency-name: bitcoin
dependency-version: 0.32.9
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump rayon from 1.11.0 to 1.12.0by dependabot[bot] · d81dc35a · May 10, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump rayon from 1.11.0 to 1.12.0

Bumps [rayon](https://github.com/rayon-rs/rayon) from 1.11.0 to 1.12.0.
- [Changelog](https://github.com/rayon-rs/rayon/blob/main/RELEASES.md)
- [Commits](https://github.com/rayon-rs/rayon/compare/rayon-core-v1.11.0...rayon-core-v1.12.0)

---
updated-dependencies:
- dependency-name: rayon
dependency-version: 1.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
Lower-priorityRevert "Support Unix sockets"by Roman Zeyde · c134d64d · May 10, 2026 · 10 filesMessage 50 · ThinTriage 0Details
Commit message · Roman Zeyde

Revert "Support Unix sockets"

This reverts commit 898e57dcdded9e9a77c6026d2d80d4331489b1d3.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Lower-prioritySupport Unix socketsby Martin Habovstiak · 898e57dc · May 3, 2026 · 10 filesMessage 68 · AdequateTriage 0Details
Commit message · Martin Habovstiak

Support Unix sockets

Unix sockets provide better security and performance, so it is natural
for electrs to want to support them. Because of how similar they are to
TCP sockets the required changes are theoretically small. However, there
is no crate I know of that provided the abstract API, so I made one.

I originally only wanted to support electrum RPC but it turns out not
having to deal with two sets of `SocketAddr` is easier and it wasn't too
difficult. Unix socket was already supported by `tiny_http` via their
own abstraction and we have no other dependencies requiring TCP.

Because this also required modifying the logic around publishing the
electrum address I added an option to set it explicitly regardless of
whether the user is dealing with Unix or TCP socket because having this
is useful for TCP too - the user might want to publish a different port
number if the port was mapped via NAT or a different address when
tunnelled. In theory, this is still not perfect because the same server
could be tunnelled multiple times but we don't bother with such edge
case until someone requires it.

Another side improvement is reporting if the accept thread ends because
of incoming stream ending rather than error. This should never happen
but is useful for debugging if it ever does.

68/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Names security-relevant behavior explicitly
AI review queuedBump rand from 0.8.5 to 0.8.6by dependabot[bot] · fb1013af · Apr 23, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · dependabot[bot]

Bump rand from 0.8.5 to 0.8.6

Bumps [rand](https://github.com/rust-random/rand) from 0.8.5 to 0.8.6.
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.6/CHANGELOG.md)
- [Commits](https://github.com/rust-random/rand/compare/0.8.5...0.8.6)

---
updated-dependencies:
- dependency-name: rand
dependency-version: 0.8.6
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

81/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedFix clippy commentby Roman Zeyde · bad9dfdc · Apr 23, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Roman Zeyde

Fix clippy comment

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
Lower-priorityFix `server.features` response formatby Yuki Kishimoto · 414dc90e · Apr 12, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · Yuki Kishimoto

Fix `server.features` response format

The current `server.features` implementation returns an invalid `hosts`
structure:

```json
"hosts": {"tcp_port": 50001}
```

According to the Electrum protocol, `hosts` must be a dictionary keyed by
hostname, where each value is a dictionary containing optional keys such as
`tcp_port` and/or `ssl_port`.

This change updates the response to the correct format, i.e.:

```json
{
"genesis_hash": "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",
"hosts": {
"127.0.0.1": {
"tcp_port": 50001
},
}
"protocol_max": "1.4",
"protocol_min": "1.4",
"pruning": null,
"server_version": "electrs/0.10.0",
"hash_function": "sha256"
}
```

See: https://electrumx.readthedocs.io/en/latest/protocol-methods.html#server-features

Signed-off-by: Yuki Kishimoto <yukikishimoto@protonmail.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI review queuedBump bitcoin_slices from 0.10.0 to 0.11.0by dependabot[bot] · ca542016 · Apr 6, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump bitcoin_slices from 0.10.0 to 0.11.0

Bumps [bitcoin_slices](https://github.com/RCasatta/bitcoin_slices) from 0.10.0 to 0.11.0.
- [Commits](https://github.com/RCasatta/bitcoin_slices/commits)

---
updated-dependencies:
- dependency-name: bitcoin_slices
dependency-version: 0.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedTest bitcoind 31.0rc2by Roman Zeyde · 22db4c64 · Apr 6, 2026 · 1 fileMessage 38 · OpaqueTriage 0Details
Commit message · Roman Zeyde

Test bitcoind 31.0rc2

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedBump signal-hook from 0.4.3 to 0.4.4by dependabot[bot] · f223bd57 · Apr 6, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump signal-hook from 0.4.3 to 0.4.4

Bumps [signal-hook](https://github.com/vorner/signal-hook) from 0.4.3 to 0.4.4.
- [Changelog](https://github.com/vorner/signal-hook/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vorner/signal-hook/compare/v0.4.3...v0.4.4)

---
updated-dependencies:
- dependency-name: signal-hook
dependency-version: 0.4.4
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump tempfile from 3.24.0 to 3.25.0by dependabot[bot] · 0bcb9798 · Feb 23, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump tempfile from 3.24.0 to 3.25.0

Bumps [tempfile](https://github.com/Stebalien/tempfile) from 3.24.0 to 3.25.0.
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Stebalien/tempfile/commits)

---
updated-dependencies:
- dependency-name: tempfile
dependency-version: 3.25.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump ctrlc from 3.5.1 to 3.5.2by dependabot[bot] · 945e7e6a · Feb 22, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump ctrlc from 3.5.1 to 3.5.2

Bumps [ctrlc](https://github.com/Detegr/rust-ctrlc) from 3.5.1 to 3.5.2.
- [Release notes](https://github.com/Detegr/rust-ctrlc/releases)
- [Commits](https://github.com/Detegr/rust-ctrlc/compare/3.5.1...3.5.2)

---
updated-dependencies:
- dependency-name: ctrlc
dependency-version: 3.5.2
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedRelease 0.11.1by Roman Zeyde · 35216c6d · Feb 22, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Roman Zeyde

Release 0.11.1

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedBump signal-hook from 0.4.1 to 0.4.3by dependabot[bot] · 4752f5bd · Feb 11, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump signal-hook from 0.4.1 to 0.4.3

Bumps [signal-hook](https://github.com/vorner/signal-hook) from 0.4.1 to 0.4.3.
- [Changelog](https://github.com/vorner/signal-hook/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vorner/signal-hook/compare/v0.4.1...v0.4.3)

---
updated-dependencies:
- dependency-name: signal-hook
dependency-version: 0.4.3
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
Lower-priorityUpdate transaction.id_from_pos response for API complianceby JHB · 66b1de65 · Jan 19, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · JHB

Update transaction.id_from_pos response for API compliance

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body