CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

multi: pin new v2 submodule tags and bump to v0.26.0-beta.rc1

BTfdad1fab View source ↗
Public commit record

What the developer wrote

Authored by Olaoluwa Osuntokun

81/100 · Strong
multi: pin new v2 submodule tags and bump to v0.26.0-beta.rc1

In this commit, we strip all of the local `replace ... => ../...`
directives that were introduced as part of #1825 (the v2 module
restructuring), now that proper tags exist for every freshly carved-out
submodule. Every in-tree go.mod is pinned to the newly published tags:
chainhash/v2.0.0, wire/v2.0.0, chaincfg/v2.0.0, address/v2.0.0,
txscript/v2.0.0, btcutil/v2.0.0, psbt/v2.0.0, and btcec is bumped to
v2.5.0 since it now depends on chainhash/v2 (previously
chaincfg/chainhash).

While here, we also unify the Go toolchain to 1.25 across every
submodule so the workspace resolves a consistent set of language
features.

Finally, we bump the main btcd version to v0.26.0-beta.rc1 in
preparation for the upcoming release candidate.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This is a routine release-preparation commit. It removes temporary local path overrides in Go module files, pins submodules to newly published version tags, bumps one dependency version (btcec to v2.5.0), unifies the Go toolchain version to 1.25, and updates the project's own version number. There are no code logic changes and nothing in the commit suggests a security fix or vulnerability.

Recommended action

No security action required. Treat as normal release engineering / dependency housekeeping.

Security signals we found

No strong security signals were identified.

Risk score

Why this scored 15/100

Our methodology →
Potential impact 0/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 0/15
Confidence 10/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from btcd

Related watches

Informational 12 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: harden DisableAuth transport tests

This commit only changes tests and clarifies a public comment. It does not alter the actual authentication behavior of the btcd RPC client. The code already only suppresses the internally generated Basic auth header when DisableAuth is tru…

No functional code change; only tests and commentsComment clarification that DisableAuth only suppresses generated Basic auth, not caller-provided Authorization headersTests now cover WebSocket handshake, cookie bypass, and caller-provided headers
52d2fadeby Olaoluwa Osuntokun+186−1272 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: add tests for DisableAuth header behavior

This commit only adds new unit tests for an existing feature. It does not change any production code, so it cannot introduce a security vulnerability or fix one directly. The tests verify that an existing option called DisableAuth correctl…

9b849c17by Drake Thomsen+109−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

psbt: decode base64 packets incrementally

This commit changes how btcd reads base64-encoded PSBT (Partially Signed Bitcoin Transaction) data. Previously, the code read the entire base64 input into memory before decoding, and it wrongly applied the Bitcoin P2P wire message size lim…

Removes an incorrect size bound that caused base64 PSBT parsing to reject valid large packets (denial-of-service / interoperability issue)Switches from full in-memory base64 decode to incremental streaming, reducing peak memory for large base64 PSBTsRetains strict base64 alphabet checks and rejects trailing data after the PSBT packet
e333817dby Olaoluwa Osuntokun+129−602 files
No security note in commit
Open full analysis →Source commit ↗