LBRYFoundation/lbcd holds a health index of 54 out of 100, placing it in the Moderate band. It scores highest on Vitality (70/100) and lowest on Community & Adoption (14/100). It was last updated 2 days ago. 2 contributors account for most of its recent work.
54
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
54
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Direct dependencies free of known advisories — 4 affected: golang.org/x/crypto v0.25.0 (critical 10.0), golang.org/x/crypto v0.40.0 (critical 10.0), golang.org/x/sys v0.22.0 (unknown), +1 more
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
26.7/40
No advisories left outstanding — 2 advisory-carrying package(s) unaddressed past 90 days; oldest published 587 days ago
Inputs used
source
osv
advisories
70
affected_packages
4
assessed_packages
37
unassessed_packages
1
affected_by_severity
critical 2, unknown 2
direct_affected_packages
4
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 37 resolved dependencies against OSV. 1 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
go package 'github.com/btcsuite/btcd' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring
go package 'github.com/btcsuite/btcd/psbt/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring
go package 'github.com/btcsuite/btcd/wire/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring
go package 'github.com/btcsuite/btcd/btcec/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring
go package 'github.com/btcsuite/btcd/address/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring
go package 'github.com/btcsuite/btcd/btcutil/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring
go package 'github.com/btcsuite/btcd/chaincfg/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring
go package 'github.com/btcsuite/btcd/txscript/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring
More detail
Star and fork history 0 ★ / 4 ⇿
0Stars
4Forks
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
OpenSSF Scorecard 4.3 / 10
4.3aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-22 11:33 UTC
Full resolved dependency set from the GitHub dependency graph: 31 direct and 7 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
Go
github.com/aead/siphash
v1.0.1
direct
Go
github.com/btcsuite/btcd/address/v2
v2.0.0
direct
Go
github.com/btcsuite/btcd/btcec/v2
v2.4.0
direct
Go
github.com/btcsuite/btcd/btcec/v2
v2.5.0
direct
Go
github.com/btcsuite/btcd/btcutil/v2
v2.0.0
direct
Go
github.com/btcsuite/btcd/chaincfg/v2
v2.0.0
direct
Go
github.com/btcsuite/btcd/chainhash/v2
v2.0.0
direct
Go
github.com/btcsuite/btcd/txscript/v2
v2.0.0
direct
Go
github.com/btcsuite/btcd/v2transport
v1.0.1
direct
Go
github.com/btcsuite/btcd/wire/v2
v2.0.0
direct
Go
github.com/btcsuite/btclog
v0.0.0-20170628155309-84c8d2346e9f
direct
Go
github.com/btcsuite/btclog
v1.0.0
direct
Go
github.com/btcsuite/go-socks
v0.0.0-20170105172521-4720035b7bfd
direct
Go
github.com/btcsuite/websocket
v0.0.0-20150119174127-31079b680792
direct
Go
github.com/btcsuite/winsvc
v1.0.0
direct
Go
github.com/davecgh/go-spew
v1.1.1
direct
Go
github.com/decred/dcrd/dcrec/secp256k1/v4
v4.4.0
direct
Go
github.com/decred/dcrd/lru
v1.1.3
direct
Go
github.com/gorilla/websocket
v1.5.3
direct
Go
github.com/jessevdk/go-flags
v1.6.1
direct
Go
github.com/jrick/logrotate
v1.1.2
direct
Go
github.com/kcalvinalvin/anet
v0.0.0-20251112173137-d8ddc1f6dbee
direct
Go
github.com/kkdai/bstream
v1.0.0
direct
Go
github.com/stretchr/testify
v1.10.0
direct
Go
github.com/stretchr/testify
v1.8.0
direct
Go
github.com/syndtr/goleveldb
v1.0.1-0.20210819022825-2ae1ddf74ef7
direct
Go
golang.org/x/crypto
v0.25.0
direct
Go
golang.org/x/crypto
v0.40.0
direct
Go
golang.org/x/sys
v0.22.0
direct
Go
golang.org/x/sys
v0.35.0
direct
Go
pgregory.net/rapid
v1.2.0
direct
Go
github.com/btcsuite/btcd/chaincfg/chainhash
v1.2.0
indirect
Go
github.com/decred/dcrd/crypto/blake256
v1.1.0
indirect
Go
github.com/golang/snappy
v1.0.0
indirect
Go
github.com/pmezard/go-difflib
v1.0.0
indirect
Go
github.com/stretchr/objx
v0.5.2
indirect
Go
gopkg.in/yaml.v3
v3.0.1
indirect
PyPI
sphinx-markdown-tables
—
indirect
Dependency advisories 4
This repository publishes no package the index resolves, so its own dependency graph was assessed — 37 packages, which also include development and test pins that never ship: 4 carry known advisories, of which 4 are direct. 1 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.
Package
Version
Relation
Severity
Advisories
Fixed in
golang.org/x/crypto
v0.25.0
direct
critical
36
0.52.0
golang.org/x/crypto
v0.40.0
direct
critical
32
0.52.0
golang.org/x/sys
v0.22.0
direct
unknown
1
0.44.0
golang.org/x/sys
v0.35.0
direct
unknown
1
0.44.0
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": true,
"size_kb": 27789,
"has_wiki": true,
"homepage": "https://lbry.com/",
"languages": {
"Go": 6233927,
"Shell": 4552,
"Makefile": 5813,
"Dockerfile": 1501
},
"pushed_at": "2026-07-19T12:17:12Z",
"created_at": "2024-01-04T16:20:56Z",
"owner_type": "Organization",
"updated_at": "2026-07-19T12:17:16Z",
"description": "An alternative full node implementation of LBRY's blockchain written in Go (golang)",
"is_archived": false,
"is_disabled": false,
"license_spdx": "ISC",
"default_branch": "master",
"license_spdx_raw": "ISC",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://lbry.org",
"name": "LBRY Foundation",
"type": "Organization",
"login": "LBRYFoundation",
"company": null,
"location": "United States of America",
"followers": 62,
"avatar_url": "https://avatars.githubusercontent.com/u/68559801?v=4",
"created_at": "2020-07-20T17:20:40Z",
"is_verified": null,
"public_repos": 47,
"account_age_days": 2192
},
"license": {
"state": "standard",
"spdx_id": "ISC",
"raw_spdx": "ISC",
"file_present": true,
"scorecard_found": true,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v0.22.119",
"kind": "patch",
"published_at": "2024-01-04T16:26:48Z"
}
],
"recent_commits": [
{
"oid": "3b6d7d8543fdd9224407da92a63f95a210e7e794",
"body": null,
"is_bot": false,
"headline": "Patch folder: addrmgr",
"author_name": "Ben van Hartingsveldt",
"author_login": "ben221199",
"committed_at": "2026-07-19T12:17:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e041999a840ece42b23f0cddfca297260513d13",
"body": null,
"is_bot": false,
"headline": "Patch root files",
"author_name": "Ben van Hartingsveldt",
"author_login": "ben221199",
"committed_at": "2026-07-18T13:23:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f9db82c6f3068effeab4fb0369b7b47ddca9767",
"body": null,
"is_bot": false,
"headline": "Patch folder: wire",
"author_name": "Ben van Hartingsveldt",
"author_login": "ben221199",
"committed_at": "2026-07-18T13:08:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "280d4d2db6400136f284f121189d9c2942425a78",
"body": "version: bump to v0.26.0-beta for final release",
"is_bot": false,
"headline": "Merge pull request #2552 from btcsuite/version-bump",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-06-18T22:57:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abec11012eaeda97aae1d57eee43d3165f3f4bb6",
"body": "In this commit, we drop the rc1 pre-release suffix, taking the version\nfrom v0.26.0-beta.rc1 to v0.26.0-beta for the final release.",
"is_bot": false,
"headline": "version: bump to v0.26.0-beta for final release",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-06-18T22:45:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9dcdd4814b0d12f7c77b244c534ab6d8ff33425f",
"body": "netsync: require block-serving services on regtest/simnet sync peers",
"is_bot": false,
"headline": "Merge pull request #2548 from guggero/netsync-simnet-sync-candidate",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-06-17T18:10:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b9f0eb4ff6af7e0878870e12b319ae36cf47281",
"body": "…ackage\n\nrpcclient: add typed SubmitPackage method",
"is_bot": false,
"headline": "Merge pull request #2551 from ellemouton/ellemouton/rpcclient-submitp…",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-06-17T18:09:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de3d460e762641995390b8c4c4a44f76d6b1bc9d",
"body": "Add SubmitPackage / SubmitPackageAsync / FutureSubmitPackageResult,\nwrapping the submitpackage RPC the same way TestMempoolAccept wraps\ntestmempoolaccept: serialize the topologically-sorted package to hex,\nissue the btcjson submitpackage command, and decode the response into\nbtcjson.SubmitPackageRes\n[…]\nkend RPC layering intact so callers (e.g.\nbtcwallet's chain.Interface) can invoke a typed method instead of a\nRawRequest. submitpackage is a Bitcoin Core RPC (v24+); btcd has no\nserver handler for it.",
"is_bot": false,
"headline": "rpcclient: add typed SubmitPackage method",
"author_name": "Elle Mouton",
"author_login": "ellemouton",
"committed_at": "2026-06-17T15:59:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7e980dd34b3b8215675e8012ff800f88415922f",
"body": "Commit 26124d275 made every peer a sync candidate on regtest and\nsimnet so that nodes on non-localhost networks (e.g. Docker bridge\nnetworks) can be synced from. Dropping the address requirement was\nthe intent, but the change also dropped the service-flag requirement,\nso light clients became eligibl\n[…]\nneutrino instance and other btcd nodes never synced.\n\nKeep accepting any peer address on regtest/simnet, but require the\npeer to signal SFNodeNetwork or SFNodeNetworkLimited like on any\nother network.",
"is_bot": false,
"headline": "netsync: require block-serving services on regtest/simnet sync peers",
"author_name": "Oli",
"author_login": "guggero",
"committed_at": "2026-06-17T11:45:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1966c384533d08539685d4ef4f1cd07bb11a549b",
"body": "…ken-integration-tests-1\n\n.github: actually run the integration tests in the CI",
"is_bot": false,
"headline": "Merge pull request #2536 from kcalvinalvin/2026-05-30-run-and-fix-bro…",
"author_name": "Yong",
"author_login": "yyforyongyu",
"committed_at": "2026-06-04T07:18:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f8ce7a7da824e9e5664fda5d5b93ce23f0c550ab",
"body": "Two pieces of rpctest's global state silently aliased across concurrent\ntest processes (which is what `go test ./...` does by default, so any\n`make unit` that exercises -tags=rpctest hit this):\n\n- btcdExecutablePath compiled to a fixed path /tmp/btcd/rpctest/btcd.\n Two `go build` invocations would \n[…]\n\"connection refused\"\n when btcd failed to bind.\n\nSuffix the executable with a random uint32 and seed lastPort with a\nrandom offset into a 50k-port window so each process climbs through\nits own range.",
"is_bot": false,
"headline": "rpctest: scope shared state to the current process",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-30T08:49:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bfb36e52e72dacf576b0a0f6f0c509c7231dd438",
"body": "handleInvMsg early-returned for any inv from a non-syncPeer whenever\nsm.current() was false, with the comment that it prevents fetching a\nmass of orphans. That guard assumes a syncPeer is already fetching\nblocks; when syncPeer is nil, the assumption breaks down and the\nearly return becomes a deadloc\n[…]\ns.\n\nOnly skip the inv when we actually have a syncPeer. When syncPeer is\nnil, fall through and let the normal request path queue the block --\nthe inv is the only signal that there are blocks to fetch.",
"is_bot": false,
"headline": "netsync: process inv announcements when no syncPeer is set",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-30T08:25:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "79752a8880bf03e330bc1f2def93a29fc645cf54",
"body": "StringOrArray.MarshalJSON emits JSON null for a nil slice (see existing\ntest \"nil slice marshals as null\" in TestStringOrArrayMarshalJSON), but\nUnmarshalJSON did not have a matching case for null and fell to the\ndefault branch, returning \"invalid string_or_array value: <nil>\". A\nround trip of a nil \n[…]\n decode the response.\n\nHandle the nil case explicitly so null decodes back to a nil slice, and\nadd regression cases for \"warnings: null\" and an omitted warnings field\nto TestGetBlockChainInfoWarnings.",
"is_bot": false,
"headline": "btcjson: accept null in StringOrArray.UnmarshalJSON",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-30T07:47:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "221178501c6cc46b8bc3dbc93e135b9cfbab02ca",
"body": "p2a_test.go calls btcutil.NewAddressPayToAnchor, but the\nNewAddressPayToAnchor constructor lives in the address/v2 module's\naddress package. Import that package and call it through there so the\nintegration package builds when -tags=rpctest is set.",
"is_bot": false,
"headline": "integration: fix p2a_test build under -tags=rpctest",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-30T07:47:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61c215ec1a592bc236a99ccb1f723637645b6273",
"body": "`make build`, `make unit-cover`, and `make unit-race` all use plain\n`go test` without the rpctest build tag, so anything under\n//go:build rpctest -- the entire integration/ package outside of\nrpctest/, and parts of rpctest/ itself -- is not exercised by CI.\nBugs that only surface under -tags=rpctest can land on master without\ndetection.\n\nAdd a test-rpctest job that runs `make unit` (which sets\n-tags=rpctest) so rpctest-tagged tests are part of every push and PR.",
"is_bot": false,
"headline": "ci: run rpctest integration tests",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-30T07:47:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b3cbf4f80ec6e0deef47b9a0b8af777572d3a2f7",
"body": "multi: pin new v2 submodule tags and bump to v0.26.0-beta.rc1",
"is_bot": false,
"headline": "Merge pull request #2532 from Roasbeef/release-v0.26-rc1",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-15T02:51:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fdad1fab1f6ea6a9636f09d5af631d84e9712bf9",
"body": "In this commit, we strip all of the local `replace ... => ../...`\ndirectives that were introduced as part of #1825 (the v2 module\nrestructuring), now that proper tags exist for every freshly carved-out\nsubmodule. Every in-tree go.mod is pinned to the newly published tags:\nchainhash/v2.0.0, wire/v2.0\n[…]\n5 across every\nsubmodule so the workspace resolves a consistent set of language\nfeatures.\n\nFinally, we bump the main btcd version to v0.26.0-beta.rc1 in\npreparation for the upcoming release candidate.",
"is_bot": false,
"headline": "multi: pin new v2 submodule tags and bump to v0.26.0-beta.rc1",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-15T02:25:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "258049c9eb58bc993fe0ce98c8680958bb757ca0",
"body": "mod: remove `btcutil` circular dependency with main module",
"is_bot": false,
"headline": "Merge pull request #1825 from guggero/btcec-v2-no-circular-dep",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-15T02:18:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b29ce9735062979a592957a5d8b442f3e8cb1ea9",
"body": null,
"is_bot": false,
"headline": "rpcwebsocket: fi linter complaint about unused functions",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T01:05:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9dfa926fff501850673dc12d14be1aa1e60cd792",
"body": null,
"is_bot": false,
"headline": "server: fix linter issue",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T01:05:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c0cfa06111fc29d0b08c0dcd1c478bc8e4e7db59",
"body": null,
"is_bot": false,
"headline": "multi: update make and CI goals with new packages",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T01:05:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dccea8febadcc50c2a96a3d6f2a386aa0392fe73",
"body": null,
"is_bot": false,
"headline": "multi: use new v2 modules everywhere",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T01:05:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c0db6dfa115957cfeb6989547bad3df1ee400560",
"body": null,
"is_bot": false,
"headline": "psbt: move to top-level module, use v2, remove btcutil dep",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T01:01:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e9ec6ec506f7336954b2c3c3612dd72f4af69a46",
"body": null,
"is_bot": false,
"headline": "btcutil: remove circular dependency, use v2",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T01:00:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "55a463a35f51d67af42c730efaf46563cf4465c4",
"body": null,
"is_bot": false,
"headline": "txscript: turn into own module, use v2",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T00:59:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3000c455f8a7a7717bb1588d113ceb7099a2e695",
"body": null,
"is_bot": false,
"headline": "address: move to top-level module, use v2",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T00:56:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd65d6d6bb378cf021a1f8bfbfcffd8c4b0e38ca",
"body": null,
"is_bot": false,
"headline": "chaincfg: add own module, use v2",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T00:56:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "039baa252041960926f5ad95be021cc9a6302ec3",
"body": null,
"is_bot": false,
"headline": "wire: make own module, use v2",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T00:56:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf8006d8e76d69567675885db3fc9649c33c0de1",
"body": null,
"is_bot": false,
"headline": "btcec: use new chainhash/v2 module",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T00:56:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28c77e7dcfd6b1eedd57433478aedb6f5c79130b",
"body": null,
"is_bot": false,
"headline": "chainhash: move to top-level module, use v2",
"author_name": "Oliver Gugger",
"author_login": "guggero",
"committed_at": "2026-05-15T00:54:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44d51eb043ec9d39d75bda03fe5d96f0224e1adc",
"body": "multi: bump in-tree go.mod files to new submodule tags",
"is_bot": false,
"headline": "Merge pull request #2531 from Roasbeef/release-prep-bump-modules",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-15T00:44:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "62cc0a6b771c6a50e4920152fde2233644f49839",
"body": "In this commit, we fix two go vet errors that go 1.26 now treats as\nhard failures during test compilation.\n\nIn btcjson/help.go, the final result row of a complex help description\nwas emitted via fmt.Fprintf with a non-constant format string (the\nresult text could contain '%' chars). Switch to fmt.Fp\n[…]\nfailure. Fatalf only\nexits the calling goroutine, so the test goroutine would keep running\nwith stale state. Use t.Errorf + return so the failure is recorded\ncorrectly and the goroutine exits cleanly.",
"is_bot": false,
"headline": "multi: appease go 1.26 vet for non-const format + goroutine Fatalf",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-15T00:36:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1863073cb06fa922cce4d78312470637cbdf3a7e",
"body": "In this commit, we update every in-tree go.mod to declare go 1.25 and\nhave CI build with 1.26.3 (Dockerfile uses the golang:1.26-alpine base).\nDocs that mention the minimum required Go version are aligned with the\nnew floor as well.\n\nFixes #2527, which flagged the README.md / go.mod version mismatch (the\nREADME claimed 1.22 while the root + v2transport go.mod files already\nrequired 1.23.2).",
"is_bot": false,
"headline": "multi: bump Go toolchain to 1.25, build CI with 1.26.3",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-15T00:32:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e59dfeb949bb5177c72fc05e069d6d6dbb614432",
"body": "In this commit, we pin every in-tree go.mod to the freshly cut submodule\ntags ahead of a btcd point release: btcec/v2.4.0, btcutil/v1.2.0,\nbtcutil/psbt/v1.2.0, and chaincfg/chainhash/v1.2.0. The btcec bump also\ndrags secp256k1 up to v4.4.0 (and blake256 to v1.1.0 transitively) for\nevery module that imports btcec.\n\nv2transport stays at v1.0.1 since no v2transport code changed since the\nlast tag, but its go.mod is bumped here so the workspace resolves to a\nconsistent set of internal deps.",
"is_bot": false,
"headline": "multi: bump in-tree go.mod files to newly tagged submodule versions",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-15T00:02:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "90540b821ed87fdea20576bccf97b2b06bca9f6e",
"body": "Add VerifyLowS helper function to ECDSA signature",
"is_bot": false,
"headline": "Merge pull request #2524 from MPins/verifylows",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-14T23:47:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c728090e63ae5f3d763675264a68af129f50fa03",
"body": "btcutil, main: fix android builds",
"is_bot": false,
"headline": "Merge pull request #2461 from kcalvinalvin/2025-11-12-fix-android-builds",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-14T23:31:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c05692401e15b91defb1318c6a72fd83e1cb60d",
"body": "Add a build step to the existing Build job that cross-compiles both the\ntop-level module and btcutil for GOOS=android GOARCH=arm64.\n\nThis catches regressions in the android-specific build path (e.g. the\nnet_android.go wrapper around anet.InterfaceAddrs) without needing an\nemulator or NDK toolchain - android/arm64 builds without cgo.",
"is_bot": false,
"headline": "github: cross-compile android/arm64 in CI",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-14T23:22:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73af4d6f8871d46aa089d8d64feaa45276e01f3d",
"body": "The previous commit exported the interfaceAddrs helper in net.go but\nmissed the parallel definition in net_noop.go (build tag: appengine),\nwhich left builds with -tags appengine broken with:\n\n ./certgen.go:79:16: undefined: InterfaceAddrs\n\nRename the appengine no-op variant to match, restoring the appengine\nbuild.",
"is_bot": false,
"headline": "btcutil: rename interfaceAddrs to InterfaceAddrs in appengine variant",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-14T23:22:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8bffc8ada81ded0176f4f850a4f33d0bca58bdcd",
"body": "rpcclient: compute httpURL once at construction time",
"is_bot": false,
"headline": "Merge pull request #2526 from JLSchuler99/rpcclient-httpurl-no-resolve",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-14T23:18:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "589d7c0ae083d3e615628b4838f3abe4506ef949",
"body": "We use this as the net.InterfaceAddr is broken from android 11.",
"is_bot": false,
"headline": "main: use btcutil.InterfaceAddr",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-14T23:16:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f603feffabe71d60f0830aca4dc4e6df6fea0d1",
"body": "We update go.mod and go.sum to point to the local btcutil library.\n\nThis commit should be updated later on so that we do it right.",
"is_bot": false,
"headline": "main: update go.mod and go.sum",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-14T23:16:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c90e88ee234fbdf7224169776cf8269047671aab",
"body": null,
"is_bot": false,
"headline": "btcutil: export interfaceAddr",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-14T23:16:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "153bf6d828b7477f2b4992292feeefc995d42020",
"body": "Golang's net package has been broken for android since android 11\nand the node will not be able to call net.InterfaceAddr() without\nroot.\n\nFor android builds, we use anet so that the btcd node can be used\nwithout root.",
"is_bot": false,
"headline": "btcutil: use anet instead of net for android builds",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-05-14T23:16:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "807cbce3bf3b3940627bbae83d9fac5a7cebb357",
"body": "httpURL was being recomputed on every JSON-RPC POST. It went through\nParseAddressString to discriminate Unix sockets from TCP, which\ncalled net.ResolveTCPAddr and triggered a DNS lookup whose result\nwas thrown away.\n\nBoth inputs (config.Host and config.DisableTLS) are immutable after\nNew, so the URL\n[…]\n error) signature — with the resolve gone\nnothing can fail. Add table coverage for the URL strings, plus a\nwiring test that catches refactors of New silently dropping the\nassignment to Client.httpURL.",
"is_bot": false,
"headline": "rpcclient: compute httpURL once at construction time",
"author_name": "Jacob Schuler",
"author_login": "JLSchuler99",
"committed_at": "2026-05-14T23:04:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "56613bb876ff78251390fbee23fa9e297eb7ad38",
"body": "server: fix peer add/done race between peerHandler and syncManager",
"is_bot": false,
"headline": "Merge pull request #2480 from Aharonee/bugfix/peer_race_condition",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-14T22:59:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f2a24d41d109286fd15522bd7c7b0846c12609b1",
"body": "The peerLifecycle channel is sized cfg.MaxPeers*2 because each\npeer can emit two lifecycle events (peerAdd followed by peerDone).\nWithout an inline comment a future reader could \"simplify\" the\nfactor to cfg.MaxPeers and tighten back-pressure under normal\nconnect/disconnect churn, causing peerLifecycleHandler goroutines\nto block.",
"is_bot": false,
"headline": "server: document peerLifecycle channel buffer sizing",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T23:20:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6f589e5152fda743dc76377712f6b2d578c1279",
"body": "peer.processRemoteVerAckMsg sets verAckReceived=true *before* it\ninvokes the OnVerAck listener that closes verAckCh. If the peer\ndisconnects in that window, the peerLifecycleHandler select may\npick Peer.Done() over verAckCh and skip the peerAdd send -- yet\nVerAckReceived() still returns true. handle\n[…]\nregistered.\n\nThis tightens the \"peerAdd precedes peerDone, or peerAdd is\nskipped entirely\" invariant from this PR into something explicit\nrather than something derived from a flag that races OnVerAck.",
"is_bot": false,
"headline": "server: gate handleDonePeerMsg on peerAdded, not VerAckReceived",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T23:20:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f1b95f8fd9875c94dc1909498bee23a11a9892d0",
"body": "The prior select/default+close() guard on verAckCh is correct only\nunder the invariant that OnVerAck is invoked from a single goroutine\n(peer.processRemoteVerAckMsg on the input handler). The two steps\nare not atomic: any future change that invokes listeners off the\ninput goroutine would let two con\n[…]\nc on double-close.\n\nReplace the guard with sync.Once. This makes the close-once\ncontract obviously correct rather than correct-by-distant-invariant\nand drops the dead \"called more than once\" log path.",
"is_bot": false,
"headline": "server: guard OnVerAck with sync.Once",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T23:20:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aacc9882caa59e8cb310778ecb471dd314d0f661",
"body": "wire: reject messages with unconsumed trailing payload bytes",
"is_bot": false,
"headline": "Merge pull request #2491 from btcsuite/block-fix",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T22:04:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d12d39dae11f0728d0ba1c0d5aab2152b93c93a0",
"body": "multi: recognize new standard P2A output type",
"is_bot": false,
"headline": "Merge pull request #2433 from Roasbeef/p2a",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T22:04:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de921aee28555e3ee7c512b7742af24880da36c8",
"body": "We make sure it'll be accepted into the mempool, and can be spent\nwithout a witness.",
"is_bot": false,
"headline": "rpctest: add new e2e test for new P2A behavior",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T17:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2682f2c1e3eccbe0ca974e51c068a17e4d2cd3d5",
"body": "P2A is standard if the witness and the sigscript is empty. We make a\nsmol refactor to be able to write a unit test for the input\nstandardness.",
"is_bot": false,
"headline": "mempool: add p2a specific policy",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T17:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "891bcb2db8e31893b94e2d6c0d10ca18d42bf979",
"body": "In this commit, we modify the execution logic, such that the P2A witness\nprogram doesn't appear as a unknown witness program version. For\nexecution, we just make sure the script passes.",
"is_bot": false,
"headline": "txscript: recognize P2A witness program during script execution",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T17:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "053fb4c1d3762a3842f0d99647be0365ef0caaea",
"body": null,
"is_bot": false,
"headline": "txscript: add tests for new P2A awareness",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T17:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f26e6bb71835dc328c8319dadd0a4af1818e9ef1",
"body": null,
"is_bot": false,
"headline": "txscript: recognize P2A scripts in ParsePkScript",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T17:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "241bf7cac27a8258f399dd1894c236b2885d434b",
"body": null,
"is_bot": false,
"headline": "txscript: support trivial signing for P2A",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T17:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e07d161e9b4655d37863f525d0875dc0c8befe90",
"body": null,
"is_bot": false,
"headline": "txscript: add initial awareness of new P2A output script",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T17:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "939b9394dc6bff358725d729e748f721aec86769",
"body": null,
"is_bot": false,
"headline": "btcutil: add new AddressPayToAnchor addr type",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T17:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9099f6c2aaac305a20a3094c95d4ef4e182f488",
"body": "btcjson: fix StringOrArray JSON marshaling and add warnings to GetBlockChainInfoResult",
"is_bot": false,
"headline": "Merge pull request #2476 from EricGrill/fix/json-marshal-recursion",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T00:33:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91cf7b241e17818afb09650d4452c31af54cd2d5",
"body": "Add a regression test for the StringOrArray.MarshalJSON infinite-recursion\nfix that exercises both the direct method call and the path through\njson.Marshal. Without the fix, the test triggers a goroutine stack\noverflow.\n\nAlso add a round-trip test and tests for the new Warnings field on\nGetBlockChainInfoResult, covering both the legacy single-string form and\nthe post-bitcoin#29845 array form.",
"is_bot": false,
"headline": "btcjson: add tests for StringOrArray and Warnings field",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-12T00:22:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6392419373f38b50a5b31112dd3e6f704594282a",
"body": "Bitcoin Core added a warnings field to getblockchaininfo in PR #10858,\nand recently changed it from a string to an array in PR #29845. Add\nthe field using StringOrArray type to handle both formats.\n\nThis allows rpcclient to properly unmarshal getblockchaininfo responses\nfrom all Bitcoin Core versions.\n\nCloses #2444\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "btcjson: add Warnings field to GetBlockChainInfoResult",
"author_name": "Eric Grill",
"author_login": "EricGrill",
"committed_at": "2026-05-12T00:22:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b528a3530379fa5a6d5471f383675d2c682fc608",
"body": "The MarshalJSON method was calling json.Marshal(h) where h is of type\nStringOrArray. Since StringOrArray implements json.Marshaler, this\ncaused json.Marshal to call MarshalJSON again, resulting in infinite\nrecursion and a stack overflow.\n\nFix by converting to the underlying []string type before marshaling,\nwhich breaks the interface lookup cycle.\n\nCloses #2369\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "btcjson: fix infinite recursion in StringOrArray.MarshalJSON",
"author_name": "Eric Grill",
"author_login": "EricGrill",
"committed_at": "2026-05-12T00:21:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "edaf2845bdfe395e523d746fe7e2926d4dae36ae",
"body": "rpcclient: fix several synchronization bugs",
"is_bot": false,
"headline": "Merge pull request #2500 from starius/rpcclient-fixes",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-11T23:12:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74f48480e0dba4665b848dbdbb0267c6c05fb25d",
"body": "PR #2467 changed regtest to match Core's BIP34/65/66 activation rules, and\nthe merged stack carries that (commit cd4e5426 \"regtest: align activations\nwith Bitcoin Core\"). Height-1 regtest blocks now need a BIP34-compliant\ncoinbase height and a post-BIP66 block version.\n\nThe failing tests came from c\n[…]\ne generating descendants,\nusing Version 4 in the regtest block/header helpers, and encoding the test\ncoinbase height with a minimal BIP34 push plus padding for the generic coinbase\nscript-length rule.",
"is_bot": false,
"headline": "tests: fix stale regtest assumptions after #2467",
"author_name": "Boris Nagaev",
"author_login": "starius",
"committed_at": "2026-05-06T22:16:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "51944b270ccd0b8801dcfed60e50d06b9b60fe70",
"body": null,
"is_bot": false,
"headline": "make fmt",
"author_name": "Boris Nagaev",
"author_login": "starius",
"committed_at": "2026-05-06T21:32:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f00e1a31f1fdd3d6c1ccc685470c34c63c054e7",
"body": "NewBatch called New() and then called start() again. In HTTP POST mode that\ncreated a second sendPostHandler and another shutdown-cancel goroutine, which\nbroke the expected single-flight serialization of POST sends.\n\nKeep NewBatch as a semantic toggle only: rely on New() to start handlers\nonce, then set batch=true. A regression test now checks that batch POST\nrequests stay serialized through one active transport call.",
"is_bot": false,
"headline": "rpcclient: avoid duplicate batch POST handlers",
"author_name": "Boris Nagaev",
"author_login": "starius",
"committed_at": "2026-05-06T21:29:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fac1a225f9692ce35b9b29e4b4f083d8b9160e3a",
"body": "Batch requests were only clearing batchList on Send() errors. The\nper-request futures remained unresolved, so callers waiting on Receive\ncould block forever after a failed batch round trip.\n\nAdd failBatchRequests to fan out the Send() error to every queued batch\nrequest and clear tracking state in one place. A regression test now\nverifies queued futures complete with the same error returned by Send().",
"is_bot": false,
"headline": "rpcclient: resolve all batch futures if Send fails",
"author_name": "Boris Nagaev",
"author_login": "starius",
"committed_at": "2026-05-06T21:29:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13ccec2c9a8b8da6d9ec3f4f36e78dd48d45327e",
"body": "When shutdown races with sendPostRequest, a request could be marked\nas ErrClientShutdown and still be enqueued. The sendPostHandler cleanup\nloop would then try to send a second terminal response and could block\nforever on a full response channel.\n\nFix this by prioritizing the shutdown path. First ch\n[…]\n already closed.\nThen use a second select to choose between enqueue and shutdown for the\nremaining race window.\n\nA regression test verifies a shutdown request is failed immediately and\nnever enqueued.",
"is_bot": false,
"headline": "rpcclient: avoid double-resolving POST requests on shutdown",
"author_name": "Boris Nagaev",
"author_login": "starius",
"committed_at": "2026-05-06T21:29:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5b189f5f6c6fe8a7763b42dc5a99a146d6921c36",
"body": "Use a shutdown-aware context for HTTP POST handling so shutdown can\ninterrupt in-flight requests.\n\nCentralize shutdown error remapping in sendPostRequestAndRespond so all\nerror exits consistently return ErrClientShutdown when shutdown causes a\ncontext cancellation. Move the retrying HTTP POST path into\nsendPostRequestWithRetry and cover it with shutdown regression tests.",
"is_bot": false,
"headline": "rpcclient: support canceling in-flight http requests",
"author_name": "Matt Leon",
"author_login": "wydengyre",
"committed_at": "2026-05-06T21:29:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4fe5985f84489d008f5537306d27da550f89787",
"body": "chaincfg/chainhash: add strict parsing",
"is_bot": false,
"headline": "Merge pull request #2520 from starius/strict-chainhash-parsing-1",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-05-06T21:17:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c794769dc23fef28ed99b1fa3a1be92582559452",
"body": "rpcclient: add GetTxOutProof{,Async} methods, speed up string parsing",
"is_bot": false,
"headline": "Merge pull request #2489 from guggero/gettxoutproof",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-30T19:16:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac0394ffe2b7e4259b277627cf253167888d9f49",
"body": " Sync BIP30/BIP34 Handling With Bitcoin Core",
"is_bot": false,
"headline": "Merge pull request #2467 from starius/bip30bypassfix",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-30T19:08:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24e3318ec47adb575346063e8c7858b6396501ae",
"body": "txscript: reject OP_CODESEPARATOR in unexecuted branches for non-segwit",
"is_bot": false,
"headline": "Merge pull request #2485 from Roasbeef/fix-codesep-unexecuted-branch",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-30T17:56:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ee91afcf578a70e64a379d9f11f4f3f1ddc82a56",
"body": "Extract the nested P2SH analysis from CalcScriptInfo into a dedicated\ncalcP2SHScriptInfo helper, and switch it to use finalOpcodeData for\nredeem-script extraction (matching the consolidation in NewEngine and\nGetWitnessSigOpCount). The helper also threads the inner witness-script\nexpected-input contribution for nested P2WSH spends, which the previous\ninline code did not account for.",
"is_bot": false,
"headline": "txscript: refactor CalcScriptInfo for nested P2SH analysis",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "63772e521bddd77910c1078ec012d69e47799982",
"body": "Both NewEngine and GetWitnessSigOpCount used sigScript[1:] (a raw byte\nsuffix of the scriptSig) to identify the candidate redeem script for\nnested P2SH witness detection. GetPreciseSigOpCount and the existing\nP2SH execution path already get the redeem script as the final pushed\nelement of the push-o\n[…]\n in NewEngine becomes redundant — the\nredeem script's shape alone determines whether the spend is nested\nwitness, and verifyWitnessProgram already enforces the required\nwitness-stack shape downstream.",
"is_bot": false,
"headline": "txscript: use finalOpcodeData for nested P2SH redeem script extraction",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "af7f379215aa3d318b33439d4bef2e29d6176ee4",
"body": "The refreshed Bitcoin Core script reference tests cover cases where an\nempty CHECKSIG input must still fail pubkey encoding checks before the\ninterpreter falls back to a generic false result.",
"is_bot": false,
"headline": "txscript: align empty CHECKSIG pubkey validation with Core",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "023589605313f9bde8351d9e0a46f5b124fecba2",
"body": "The refreshed Bitcoin Core script reference tests expect witness\nclean-stack failures to report CLEANSTACK rather than a generic\nEVAL_FALSE result.",
"is_bot": false,
"headline": "txscript: return ErrCleanStack for witness cleanstack failures",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b76fcb4994a641d02fe39c44d0b8e7ec8d766a2",
"body": "Updated from Bitcoin Core master\n(e32bc7f817e7adeffef22a985bf8dbd4aa3e08d8), file\nsrc/test/data/tx_invalid.json.",
"is_bot": false,
"headline": "txscript: update tx_invalid.json from Bitcoin Core",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77a33163cb45219c2bd3f8a04eb860c28190e8fb",
"body": "Updated from Bitcoin Core master\n(e32bc7f817e7adeffef22a985bf8dbd4aa3e08d8), file\nsrc/test/data/tx_valid.json.",
"is_bot": false,
"headline": "txscript: update tx_valid.json from Bitcoin Core",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44bfb2b7774b540a8f7612c476960887ea346c05",
"body": "Updated from Bitcoin Core master\n(e32bc7f817e7adeffef22a985bf8dbd4aa3e08d8), file\nsrc/test/data/script_tests.json.",
"is_bot": false,
"headline": "txscript: update script_tests.json from Bitcoin Core",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4d03fb1ec1f63d36ceb35909e5a86b37a057b575",
"body": "Handle BADTX sanity cases while keeping tx_invalid on Bitcoin Core's\nincluded-flags convention.",
"is_bot": false,
"headline": "txscript: support latest Core tx_invalid semantics",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d93e3d60365b666ff429a168ff4fb7eda10a05f",
"body": "Bitcoin Core's tx_valid vectors now specify flags to exclude from the\nfull script-flag set. Apply that parser directly in TestTxValidTests.",
"is_bot": false,
"headline": "txscript: support latest Core tx_valid semantics",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53036fdbe3b7d30311d6d82a8bd1d67d8f97abd0",
"body": "Add support for newly named Bitcoin Core script-test result tokens and\nskip taproot placeholder rows that are already covered by\nTestTaprootReferenceTests.",
"is_bot": false,
"headline": "txscript: support latest Core script_tests format",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ee32c69986fd5a66a807182d04dd4a132643592",
"body": "In this commit, we fix a policy-level divergence with Bitcoin Core when\nhandling OP_CODESEPARATOR inside unexecuted OP_IF branches in non-segwit\nscripts with the ScriptVerifyConstScriptCode flag.\n\nBitcoin Core's EvalScript (interpreter.cpp:474-476) places the\nSCRIPT_VERIFY_CONST_SCRIPTCODE check for\n[…]\nDATORY_SCRIPT_VERIFY_FLAGS),\nso this was not a consensus divergence. Both implementations would accept\nsuch transactions if mined in a block.\n\nFound via differential fuzzing by Bruno from bitcoinfuzz.",
"is_bot": false,
"headline": "txscript: reject OP_CODESEPARATOR in unexecuted branches for non-segwit",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-29T05:44:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8c40eb75eeddcf82e1574a4c0a11794408f896fd",
"body": "Update the expected error strings in recoveryTests to match the new\nerror message format introduced by the secp256k1 v4.4.0 upgrade.\nAlso replace reflect.DeepEqual with a string-based errorStringEqual\nhelper to avoid type mismatches between fmt.Errorf and wrapped errors,\nand drop the now-unused \"reflect\" import.",
"is_bot": false,
"headline": "ecdsa: update recovery error messages and fix test comparison",
"author_name": "MPins",
"author_login": "MPins",
"committed_at": "2026-04-24T15:01:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77e3f98a6f1ad7f4382a8dbee1c70c84877b9dfd",
"body": "Introduce a VerifyLowS helper to detect non-canonical\nhigh-S ECDSA signatures, along with unit tests.",
"is_bot": false,
"headline": "ecdsa: add VerifyLowS helper and tests",
"author_name": "MPins",
"author_login": "MPins",
"committed_at": "2026-04-23T22:44:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5d5251d8e7fad91abb3a7c3ad70e8dd687974228",
"body": "The new version exposes Signature.S(), giving direct access to the S\nscalar without re-parsing the DER bytes. This enables a cleaner\nimplementation of the VerifyLowS helper added in this branch.",
"is_bot": false,
"headline": "go.mod, go.sum: updated secp256k1 to v4.4.0",
"author_name": "MPins",
"author_login": "MPins",
"committed_at": "2026-04-18T03:12:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd70f77f90e54b391fac9a3cb03ea1e95376899e",
"body": "This commit replaces the parsing of a JSON string with a simple\nprefix/suffix replacement of the quotes. That is much faster than\nallocating memory for a JSON parser.\nWhere possible, we also directly decode the hex with a decoder to\nfurther reduce the number of allocations.",
"is_bot": false,
"headline": "rpcclient: speed up string parsing",
"author_name": "Oli",
"author_login": "guggero",
"committed_at": "2026-04-09T17:07:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d1a428e381cd2bb36b8719553b9f2ce67f683bcd",
"body": null,
"is_bot": false,
"headline": "rpcclient: add GetTxOutProof{,Async} methods",
"author_name": "Oli",
"author_login": "guggero",
"committed_at": "2026-04-09T17:07:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "08be37f3b6ed35ce5ca18fa109b9531575820c84",
"body": "Address review feedback on the peer add/done race fix:\n\nAdd three direct unit tests in server_test.go that exercise the fix\nwithout the full server or rpctest harness:\n\n- TestOnVerAckDoubleCall: call OnVerAck twice on the same serverPeer,\n assert no panic and verAckCh remains closed.\n- TestPeerLife\n[…]\nstead of discarding.\n- Extract dialAndSendVersion helper for TestPreVerackDisconnect;\n check all errors instead of silently continuing.\n- Fix comment wording (\"produces\" -> \"is expected to produce\").",
"is_bot": false,
"headline": "server, integration: add unit regression tests for peer lifecycle fix",
"author_name": "Or Aharonee",
"author_login": "Aharonee",
"committed_at": "2026-04-09T15:19:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5fefcc66679c0a2ace7d203fc208b7ed5778e8e2",
"body": "Add NewHashFromStrStrict and DecodeStrict for callers that must\nparse full txids or block hashes exactly.\n\nKeep NewHashFromStr and Decode lenient for compatibility, but add\nNOTE docs steering typical parsing to the strict helpers.\n\nAdd tests for the new strict behavior and preserve coverage for the\nexisting lenient short and odd hex behavior.",
"is_bot": false,
"headline": "chaincfg/chainhash: add strict parsing",
"author_name": "Boris Nagaev",
"author_login": "starius",
"committed_at": "2026-04-09T05:44:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "51e9b53c785d1c8d8bbeac66c0202a3798764834",
"body": "…-message-len-on-msg-reject\n\nwire: use maxprotocol message len on msg reject",
"is_bot": false,
"headline": "Merge pull request #2518 from kcalvinalvin/2026-04-06-use-maxprotocol…",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-08T23:49:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b047478a2674b5d6858f650263b8b63627891640",
"body": "wire: separate protocol message limit from serialization bound",
"is_bot": false,
"headline": "Merge pull request #2504 from erickcestari/fix-max-message-payload",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-04-08T23:49:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28fd6a7fd7efa921abdcb88edfd8cfd4d79e537b",
"body": "As we introduced a new MaxProtocolMessageLength, MsgReject max size\nshould also be lowered to MaxProtocolMessageLength.\n\nIf this isn't lowered and if we ever have a MsgReject message that is\nbigger than MaxProtocolMessageLength, then the MaxPayloadLength() check\non the message will pass but it won't serialize in functions\nWriteMessageWithEncodingN() and WriteV2MessageN() as both of these\nfunctions have a separate check that each message isn't greater than\nMaxProtocolMessageLength.",
"is_bot": false,
"headline": "wire: use MaxProtocolMessageLength as a max size for MsgReject",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-04-06T06:36:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dd78e092763785ac00506ee03ddb268454d985d7",
"body": "…-ipv6\n\nwire: don't wrap ipv4 in ipv6 addresses",
"is_bot": false,
"headline": "Merge pull request #2515 from kcalvinalvin/2026-03-30-no-wrap-ipv4-in…",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-03-31T23:18:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "14e32c216d37d8d46001cbe50868b48268dc4076",
"body": "main: add regtest port for btcwallet",
"is_bot": false,
"headline": "Merge pull request #2488 from Abdulkbk/btcwallet-regtest",
"author_name": "Yong",
"author_login": "yyforyongyu",
"committed_at": "2026-03-31T12:45:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c19db8a4d2f33405df3ff430a7feb28b28ab3ee",
"body": "Since btcwallet now supports regtest, we add the default port\n`18332`. Now `--wallet` command works on regtest.",
"is_bot": false,
"headline": "main: add regtest port for btcwallet",
"author_name": "Abdullahi Yunus",
"author_login": "Abdulkbk",
"committed_at": "2026-03-30T09:40:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "077c9b7c6f2862601414260b25c4e2d8bf1909fa",
"body": "Go's net.ParseIP stores IPv4 addresses as 16-byte IPv4-mapped IPv6\naddresses (::ffff:x.x.x.x). NetAddressV2FromBytes dispatches on\naddress length, so these 16-byte addresses were incorrectly matched\nas IPv6 and serialized with networkID 0x02 (IPv6) instead of 0x01\n(IPv4). BIP-155 doesn't forbid this, but Bitcoin Core silently drops\nthem anyway (undocumented, naturally). Detect IPv4-mapped IPv6\naddresses and extract the 4-byte IPv4 address with the correct\nnetworkID.",
"is_bot": false,
"headline": "wire: fix IPv4-mapped IPv6 addresses using wrong networkID in addrv2",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-03-30T08:12:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1031309a22c280e8c1b1841c3f73a27409f73872",
"body": "Add a test case that passes a 16-byte IPv4-mapped IPv6 address\n(::ffff:127.0.0.1) to NetAddressV2FromBytes and asserts that it\nis recognized as IPv4 with networkID 0x01, not IPv6 with 0x02.",
"is_bot": false,
"headline": "wire: add test for IPv4-mapped IPv6 address in NetAddressV2FromBytes",
"author_name": "Calvin Kim",
"author_login": "kcalvinalvin",
"committed_at": "2026-03-30T08:12:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c47cb8aae0105f0fcb86e39eece00e6e5c8c9772",
"body": "treap, ffldb: add treapNodePool",
"is_bot": false,
"headline": "Merge pull request #2425 from kcalvinalvin/2025-09-20-add-treapnode-pool",
"author_name": "Olaoluwa Osuntokun",
"author_login": "Roasbeef",
"committed_at": "2026-03-25T23:28:22Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 1,
"commits_last_year": 168,
"latest_release_at": "2024-01-04T16:26:48Z",
"latest_release_tag": "v0.22.119",
"releases_from_tags": false,
"days_since_last_push": 2,
"active_weeks_last_year": 34,
"days_since_latest_release": 929,
"mean_days_between_releases": null
},
"community": {
"has_readme": false,
"has_license": false,
"has_description": false,
"has_contributing": false,
"health_percentage": null,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/btcsuite/btcd",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/btcsuite/btcd",
"is_deprecated": false,
"latest_version": "v0.26.0",
"repository_url": "https://github.com/btcsuite/btcd",
"versions_count": 43,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-06-18T22:57:54Z",
"latest_version_yanked": null,
"days_since_latest_publish": 33
},
{
"name": "github.com/btcsuite/btcd/psbt/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/btcsuite/btcd/psbt/v2",
"is_deprecated": false,
"latest_version": "v2.0.0",
"repository_url": "https://github.com/btcsuite/btcd",
"versions_count": 1,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-05-15T02:18:54Z",
"latest_version_yanked": null,
"days_since_latest_publish": 68
},
{
"name": "github.com/btcsuite/btcd/wire/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/btcsuite/btcd/wire/v2",
"is_deprecated": false,
"latest_version": "v2.0.1",
"repository_url": "https://github.com/btcsuite/btcd",
"versions_count": 2,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-22T01:02:59Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/btcsuite/btcd/btcec/v2",
"is_deprecated": false,
"latest_version": "v2.5.0",
"repository_url": "https://github.com/btcsuite/btcd",
"versions_count": 17,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-05-15T02:18:54Z",
"latest_version_yanked": null,
"days_since_latest_publish": 68
},
{
"name": "github.com/btcsuite/btcd/address/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/btcsuite/btcd/address/v2",
"is_deprecated": false,
"latest_version": "v2.0.0",
"repository_url": "https://github.com/btcsuite/btcd",
"versions_count": 1,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-05-15T02:18:54Z",
"latest_version_yanked": null,
"days_since_latest_publish": 68
},
{
"name": "github.com/btcsuite/btcd/btcutil/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/btcsuite/btcd/btcutil/v2",
"is_deprecated": false,
"latest_version": "v2.0.1",
"repository_url": "https://github.com/btcsuite/btcd",
"versions_count": 2,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-22T01:02:59Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "github.com/btcsuite/btcd/chaincfg/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/btcsuite/btcd/chaincfg/v2",
"is_deprecated": false,
"latest_version": "v2.0.0",
"repository_url": "https://github.com/btcsuite/btcd",
"versions_count": 1,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-05-15T02:18:54Z",
"latest_version_yanked": null,
"days_since_latest_publish": 68
},
{
"name": "github.com/btcsuite/btcd/txscript/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/btcsuite/btcd/txscript/v2",
"is_deprecated": false,
"latest_version": "v2.0.0",
"repository_url": "https://github.com/btcsuite/btcd",
"versions_count": 1,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-05-15T02:18:54Z",
"latest_version_yanked": null,
"days_since_latest_publish": 68
}
]
},
"popularity": {
"forks": 4,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2025-08-26",
"count": 1
},
{
"date": "2025-11-27",
"count": 1
},
{
"date": "2026-05-18",
"count": 1
},
{
"date": "2026-07-14",
"count": 1
}
],
"complete": true,
"collected": 4,
"total_forks": 4
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0
},
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile",
"docs/Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"address/go.mod",
"btcec/go.mod",
"btcutil/go.mod",
"chaincfg/go.mod",
"chainhash/go.mod",
"go.mod",
"psbt/go.mod",
"txscript/go.mod",
"v2transport/go.mod",
"wire/go.mod"
],
"largest_source_bytes": 157587,
"source_files_sampled": 534,
"oversized_source_files": 14,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"address/go.mod",
"btcec/go.mod",
"btcutil/go.mod",
"chaincfg/go.mod",
"chainhash/go.mod",
"docs/requirements.txt",
"go.mod",
"psbt/go.mod",
"txscript/go.mod",
"v2transport/go.mod",
"wire/go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/crypto",
"direct": true,
"version": "v0.25.0",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 10,
"advisory_ids": [
"GHSA-45gg-vh54-h5m9",
"GHSA-5cgq-3rg8-m6cv",
"GHSA-78mq-xcr3-xm33",
"GHSA-89gr-r52h-f8rx",
"GHSA-9m57-25v3-79x9",
"GHSA-f5wc-c3c7-36mc",
"GHSA-f6x5-jh6r-wrfv",
"GHSA-hcg3-q754-cr77",
"GHSA-j5w8-q4qc-rx2x",
"GHSA-jppx-rxg9-jmrx"
],
"fixed_version": "0.52.0",
"advisory_count": 36,
"oldest_advisory_days": 587
},
{
"name": "golang.org/x/crypto",
"direct": true,
"version": "v0.40.0",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 10,
"advisory_ids": [
"GHSA-45gg-vh54-h5m9",
"GHSA-5cgq-3rg8-m6cv",
"GHSA-78mq-xcr3-xm33",
"GHSA-89gr-r52h-f8rx",
"GHSA-9m57-25v3-79x9",
"GHSA-f5wc-c3c7-36mc",
"GHSA-f6x5-jh6r-wrfv",
"GHSA-j5w8-q4qc-rx2x",
"GHSA-jppx-rxg9-jmrx",
"GHSA-q4h4-gmj2-qvw2"
],
"fixed_version": "0.52.0",
"advisory_count": 32,
"oldest_advisory_days": 250
},
{
"name": "golang.org/x/sys",
"direct": true,
"version": "v0.22.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5024"
],
"fixed_version": "0.44.0",
"advisory_count": 1,
"oldest_advisory_days": 60
},
{
"name": "golang.org/x/sys",
"direct": true,
"version": "v0.35.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5024"
],
"fixed_version": "0.44.0",
"advisory_count": 1,
"oldest_advisory_days": 60
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 2,
"critical": 2
},
"advisory_count": 70,
"affected_count": 4,
"assessed_count": 37,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 1,
"direct_affected_count": 4
},
"ecosystems": [
"go",
"pypi"
],
"dependencies": [
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"manifest": "address/go.mod",
"ecosystem": "go",
"version_constraint": "v2.5.0"
},
{
"name": "github.com/btcsuite/btcd/chaincfg/v2",
"manifest": "address/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/wire/v2",
"manifest": "address/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/stretchr/testify",
"manifest": "address/go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.0"
},
{
"name": "golang.org/x/crypto",
"manifest": "address/go.mod",
"ecosystem": "go",
"version_constraint": "v0.40.0"
},
{
"name": "github.com/btcsuite/btcd/chainhash/v2",
"manifest": "btcec/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/davecgh/go-spew",
"manifest": "btcec/go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.1"
},
{
"name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
"manifest": "btcec/go.mod",
"ecosystem": "go",
"version_constraint": "v4.4.0"
},
{
"name": "github.com/stretchr/testify",
"manifest": "btcec/go.mod",
"ecosystem": "go",
"version_constraint": "v1.8.0"
},
{
"name": "github.com/aead/siphash",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.1"
},
{
"name": "github.com/btcsuite/btcd/address/v2",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v2.5.0"
},
{
"name": "github.com/btcsuite/btcd/chaincfg/v2",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/chainhash/v2",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/txscript/v2",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/wire/v2",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/davecgh/go-spew",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.1"
},
{
"name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v4.4.0"
},
{
"name": "github.com/kcalvinalvin/anet",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20251112173137-d8ddc1f6dbee"
},
{
"name": "github.com/kkdai/bstream",
"manifest": "btcutil/go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.0"
},
{
"name": "github.com/btcsuite/btcd/chainhash/v2",
"manifest": "chaincfg/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/wire/v2",
"manifest": "chaincfg/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/davecgh/go-spew",
"manifest": "chaincfg/go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.1"
},
{
"name": "github.com/stretchr/testify",
"manifest": "chaincfg/go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.0"
},
{
"name": "github.com/btcsuite/btcd/address/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.5.0"
},
{
"name": "github.com/btcsuite/btcd/btcutil/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/chaincfg/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/chainhash/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/txscript/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/v2transport",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.1"
},
{
"name": "github.com/btcsuite/btcd/wire/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btclog",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.0"
},
{
"name": "github.com/btcsuite/go-socks",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20170105172521-4720035b7bfd"
},
{
"name": "github.com/btcsuite/websocket",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20150119174127-31079b680792"
},
{
"name": "github.com/btcsuite/winsvc",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.0"
},
{
"name": "github.com/davecgh/go-spew",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.1"
},
{
"name": "github.com/decred/dcrd/lru",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.3"
},
{
"name": "github.com/gorilla/websocket",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.5.3"
},
{
"name": "github.com/jessevdk/go-flags",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.1"
},
{
"name": "github.com/jrick/logrotate",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.2"
},
{
"name": "github.com/stretchr/testify",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.0"
},
{
"name": "github.com/syndtr/goleveldb",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.1-0.20210819022825-2ae1ddf74ef7"
},
{
"name": "golang.org/x/crypto",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.40.0"
},
{
"name": "golang.org/x/sys",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.35.0"
},
{
"name": "pgregory.net/rapid",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.2.0"
},
{
"name": "github.com/btcsuite/btcd/address/v2",
"manifest": "psbt/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"manifest": "psbt/go.mod",
"ecosystem": "go",
"version_constraint": "v2.5.0"
},
{
"name": "github.com/btcsuite/btcd/btcutil/v2",
"manifest": "psbt/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/chainhash/v2",
"manifest": "psbt/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/txscript/v2",
"manifest": "psbt/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/wire/v2",
"manifest": "psbt/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/davecgh/go-spew",
"manifest": "psbt/go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.1"
},
{
"name": "github.com/stretchr/testify",
"manifest": "psbt/go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.0"
},
{
"name": "github.com/btcsuite/btcd/address/v2",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v2.5.0"
},
{
"name": "github.com/btcsuite/btcd/chaincfg/v2",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/chainhash/v2",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btcd/wire/v2",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/btcsuite/btclog",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.0"
},
{
"name": "github.com/davecgh/go-spew",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.1"
},
{
"name": "github.com/stretchr/testify",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.0"
},
{
"name": "golang.org/x/crypto",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v0.40.0"
},
{
"name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
"manifest": "txscript/go.mod",
"ecosystem": "go",
"version_constraint": "v4.4.0"
},
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"manifest": "v2transport/go.mod",
"ecosystem": "go",
"version_constraint": "v2.4.0"
},
{
"name": "github.com/btcsuite/btclog",
"manifest": "v2transport/go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20170628155309-84c8d2346e9f"
},
{
"name": "golang.org/x/crypto",
"manifest": "v2transport/go.mod",
"ecosystem": "go",
"version_constraint": "v0.25.0"
},
{
"name": "github.com/btcsuite/btcd/chainhash/v2",
"manifest": "wire/go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0"
},
{
"name": "github.com/davecgh/go-spew",
"manifest": "wire/go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.1"
},
{
"name": "github.com/stretchr/testify",
"manifest": "wire/go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.0"
},
{
"name": "golang.org/x/crypto",
"manifest": "wire/go.mod",
"ecosystem": "go",
"version_constraint": "v0.40.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/aead/siphash",
"direct": true,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/address/v2",
"direct": true,
"version": "v2.0.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"direct": true,
"version": "v2.4.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/btcec/v2",
"direct": true,
"version": "v2.5.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/btcutil/v2",
"direct": true,
"version": "v2.0.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/chaincfg/v2",
"direct": true,
"version": "v2.0.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/chainhash/v2",
"direct": true,
"version": "v2.0.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/txscript/v2",
"direct": true,
"version": "v2.0.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/v2transport",
"direct": true,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/wire/v2",
"direct": true,
"version": "v2.0.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btclog",
"direct": true,
"version": "v0.0.0-20170628155309-84c8d2346e9f",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btclog",
"direct": true,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/go-socks",
"direct": true,
"version": "v0.0.0-20170105172521-4720035b7bfd",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/websocket",
"direct": true,
"version": "v0.0.0-20150119174127-31079b680792",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/winsvc",
"direct": true,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/davecgh/go-spew",
"direct": true,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
"direct": true,
"version": "v4.4.0",
"ecosystem": "go"
},
{
"name": "github.com/decred/dcrd/lru",
"direct": true,
"version": "v1.1.3",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/websocket",
"direct": true,
"version": "v1.5.3",
"ecosystem": "go"
},
{
"name": "github.com/jessevdk/go-flags",
"direct": true,
"version": "v1.6.1",
"ecosystem": "go"
},
{
"name": "github.com/jrick/logrotate",
"direct": true,
"version": "v1.1.2",
"ecosystem": "go"
},
{
"name": "github.com/kcalvinalvin/anet",
"direct": true,
"version": "v0.0.0-20251112173137-d8ddc1f6dbee",
"ecosystem": "go"
},
{
"name": "github.com/kkdai/bstream",
"direct": true,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/testify",
"direct": true,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/testify",
"direct": true,
"version": "v1.8.0",
"ecosystem": "go"
},
{
"name": "github.com/syndtr/goleveldb",
"direct": true,
"version": "v1.0.1-0.20210819022825-2ae1ddf74ef7",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": true,
"version": "v0.25.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": true,
"version": "v0.40.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": true,
"version": "v0.22.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": true,
"version": "v0.35.0",
"ecosystem": "go"
},
{
"name": "pgregory.net/rapid",
"direct": true,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/btcsuite/btcd/chaincfg/chainhash",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/decred/dcrd/crypto/blake256",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/golang/snappy",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/pmezard/go-difflib",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/objx",
"direct": false,
"version": "v0.5.2",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": false,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "sphinx-markdown-tables",
"direct": false,
"version": null,
"ecosystem": "pypi"
}
],
"collected": true,
"truncated": false,
"total_count": 38,
"direct_count": 31,
"indirect_count": 7
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 1,
"open_issues": 1,
"closed_ratio": 0.667,
"closed_issues": 2,
"closed_unmerged_prs": 0
},
"bus_factor": 2,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "davecgh",
"commits": 1662,
"avatar_url": "https://avatars.githubusercontent.com/u/2115102?v=4"
},
{
"type": "User",
"login": "Roasbeef",
"commits": 540,
"avatar_url": "https://avatars.githubusercontent.com/u/998190?v=4"
},
{
"type": "User",
"login": "dajohi",
"commits": 316,
"avatar_url": "https://avatars.githubusercontent.com/u/3308193?v=4"
},
{
"type": "User",
"login": "jrick",
"commits": 231,
"avatar_url": "https://avatars.githubusercontent.com/u/1420313?v=4"
},
{
"type": "User",
"login": "kcalvinalvin",
"commits": 143,
"avatar_url": "https://avatars.githubusercontent.com/u/37185887?v=4"
},
{
"type": "User",
"login": "cfromknecht",
"commits": 131,
"avatar_url": "https://avatars.githubusercontent.com/u/2013993?v=4"
},
{
"type": "User",
"login": "jcvernaleo",
"commits": 104,
"avatar_url": "https://avatars.githubusercontent.com/u/768163?v=4"
},
{
"type": "User",
"login": "guggero",
"commits": 101,
"avatar_url": "https://avatars.githubusercontent.com/u/1008879?v=4"
},
{
"type": "User",
"login": "yyforyongyu",
"commits": 54,
"avatar_url": "https://avatars.githubusercontent.com/u/5845072?v=4"
},
{
"type": "User",
"login": "aakselrod",
"commits": 50,
"avatar_url": "https://avatars.githubusercontent.com/u/1268625?v=4"
}
],
"contributors_sampled": 100,
"top_contributor_share": 0.423
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"dimagespub.yml",
"main.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 40 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 10,
"reason": "project is fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 3,
"reason": "dependency not pinned by hash detected -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 4,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "20 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "3b6d7d8543fdd9224407da92a63f95a210e7e794",
"ran_at": "2026-07-22T11:33:49Z",
"aggregate_score": 4.3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-19T12:25:12Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2025-08-29T13:52:02Z",
"ci_last_conclusion": "FAILURE",
"oldest_open_issues": [
{
"number": 4,
"created_at": "2025-09-17T00:30:02Z",
"last_comment_at": "2025-09-18T05:52:11Z",
"last_comment_author": "bitcoinbrisbane"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/LBRYFoundation/lbcd",
"host": "github.com",
"name": "lbcd",
"owner": "LBRYFoundation"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"security": 43,
"vitality": 70,
"community": 14,
"governance": 66,
"engineering": 68
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 70,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 88,
"inputs": {
"commits_last_year": 168,
"human_commit_share": 1,
"days_since_last_push": 2,
"active_weeks_last_year": 34
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 2 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 2
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "34/52 weeks with commits",
"points": 23.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 34
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "168 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 168
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "at_risk",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 44,
"inputs": {
"releases_count": 1,
"latest_release_tag": "v0.22.119",
"releases_from_tags": false,
"days_since_latest_release": 929,
"mean_days_between_releases": null
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "1 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 1
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 929 days ago",
"points": 0,
"status": "missed",
"details": [
{
"code": "release_recency",
"params": {
"days": 929
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "cadence unknown (single release)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "release_cadence_unknown",
"params": {}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 2,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 2 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 2
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 14,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 4,
"inputs": {
"forks": 4,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "4 forks",
"points": 4,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 4
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "critical",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": false,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (ISC)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "ISC"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 66,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 62,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 100,
"top_contributor_share": 0.423
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 42% of commits",
"points": 13,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 42
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "100 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 100
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 40 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"merged_prs": 1,
"open_issues": 1,
"closed_issues": 2,
"issue_closed_ratio": 0.667,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "67% of issues closed",
"points": 31.2,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 67
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "1/1 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 1,
"decided": 1
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 67,
"inputs": {
"followers": 62,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "LBRYFoundation",
"public_repos": 47,
"account_age_days": 2192
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "62 followers of LBRYFoundation",
"points": 12.9,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 62,
"login": "LBRYFoundation"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "47 public repos, account ~6 yr old",
"points": 24.2,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 47
}
},
{
"code": "account_age_years",
"params": {
"years": 6
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 68,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": "https://lbry.com/",
"has_readme": false,
"has_docs_dir": true,
"has_description": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://lbry.com/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 43,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 43,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 4.3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 40 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is fuzzed",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 2,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "20 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "at_risk",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 37 resolved dependencies against OSV; 1 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 37
}
},
{
"code": "advisories_unassessed",
"params": {
"count": 1
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 42,
"inputs": {
"source": "osv",
"advisories": 70,
"affected_packages": 4,
"assessed_packages": 37,
"unassessed_packages": 1,
"affected_by_severity": "critical 2, unknown 2",
"direct_affected_packages": 4
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "4 affected: golang.org/x/crypto v0.25.0 (critical 10.0), golang.org/x/crypto v0.40.0 (critical 10.0), golang.org/x/sys v0.22.0 (unknown), +1 more",
"points": 5,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 4,
"packages": "golang.org/x/crypto v0.25.0 (critical 10.0), golang.org/x/crypto v0.40.0 (critical 10.0), golang.org/x/sys v0.22.0 (unknown)"
}
},
{
"code": "advisories_affected_more",
"params": {
"count": 1
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "2 advisory-carrying package(s) unaddressed past 90 days; oldest published 587 days ago",
"points": 26.7,
"status": "partial",
"details": [
{
"code": "advisories_stale",
"params": {
"days": 90,
"count": 2,
"oldest": 587
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 37,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 23
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 64,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.96,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "96 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 96,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile",
"docs/Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.02,
"toolchain_manifests": [
"address/go.mod",
"btcec/go.mod",
"btcutil/go.mod",
"chaincfg/go.mod",
"chainhash/go.mod",
"go.mod",
"psbt/go.mod",
"txscript/go.mod",
"v2transport/go.mod",
"wire/go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile, docs/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile, docs/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "2 of the last 100 commits agent-authored or agent-credited",
"points": 4,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 2,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 157587,
"source_files_sampled": 534,
"oversized_source_files": 14
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "14/534 source files over 60KB",
"points": 53.6,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 534,
"oversized": 14
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Community profile unavailable",
"go package 'github.com/btcsuite/btcd' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring",
"go package 'github.com/btcsuite/btcd/psbt/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring",
"go package 'github.com/btcsuite/btcd/wire/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring",
"go package 'github.com/btcsuite/btcd/btcec/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring",
"go package 'github.com/btcsuite/btcd/address/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring",
"go package 'github.com/btcsuite/btcd/btcutil/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring",
"go package 'github.com/btcsuite/btcd/chaincfg/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring",
"go package 'github.com/btcsuite/btcd/txscript/v2' points at a different repository (https://github.com/btcsuite/btcd); excluded from ecosystem scoring"
],
"report_type": "repository",
"generated_at": "2026-07-22T11:34:08.349771Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/l/LBRYFoundation/lbcd.svg",
"full_name": "LBRYFoundation/lbcd",
"license_state": "standard",
"license_spdx": "ISC"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with LBRYFoundation/lbcd. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.26.0 — full methodology · metrics wiki.
