{"results": [{"sha": "2b95b45a9abd63a1532ce9deea1438e07e7a635f", "project": "Bitcoin Core", "vendor": "Bitcoin Core", "title": "Merge bitcoin/bitcoin#35813: wallet, rpc: Add listrawtransactions RPC", "committed_at": "2026-09-22T21:18:40+00:00", "severity": "informational", "risk_score": 20, "summary": "This commit adds a new wallet RPC called listrawtransactions to Bitcoin Core. It is a feature addition that lets users list every transaction their wallet knows about, including internal transfers and consolidations that the existing listtransactions RPC hides. The change is mostly a refactor of existing code into shared helpers plus a new RPC endpoint. There is no direct evidence in the commit of a security vulnerability, bug fix, or exploit.", "author": "Ava Chow", "commit_message": "Merge bitcoin/bitcoin#35813: wallet, rpc: Add listrawtransactions RPC\n\n7c311f5c6c3ea5a0d0cc4da35177e6977cda87d1 doc: Add release notes for listrawtransactions (pablomartin4btc)\nb377786df14e4098cc2af2fa3a108b3371df9471 test: Add functional test for listrawtransactions (pablomartin4btc)\n605c4fd3aee0cea04aef583e7ceeca2dd9a17718 wallet, rpc: Add listrawtransactions RPC (pablomartin4btc)\nba6c179ba07cafb3f7e8a0baf9c9a73992b36695 wallet, rpc: allow omitting parent_descs from TransactionDescriptionString (pablomartin4btc)\ndc3e2bc6df6814f6b9b5ce1d5b24933e3f10ca8a wallet, rpc: extract PushTxAmountAndFee/PushTxDecoded helpers (pablomartin4btc)\n\nPull request description:\n\n  Add a new `listrawtransactions` RPC that returns wallet transactions without logical interpretation. Unlike `listtransactions`, which only lists transactions with an economic category (sends to external addresses, receives from outside), this RPC returns every transaction the wallet knows about \u2014 including consolidations and self-transfers that would otherwise be invisible.\n\n  Each transaction appears exactly once with its net wallet balance change (`amount`) and, when the wallet funded the transaction, the fee paid (`fee`). Pagination is supported via `count` and `skip` parameters, matching the interface of `listtransactions`.\n\n  Next possible follow-ups:\n  - A filter parameter (`\"all\"` / `\"received\"` / `\"sent\"` / `\"self\"`) once per-tx semantics are agreed on\n  - Some fields inherited from `TransactionDescriptionString()` carry references to `category` (e.g. `replaced_by_txid`, `parent_descs`) which don't apply here \u2014 could be cleaned up in a separate pass\n\n  Closes #34632.\n\n  Previous attempt: #35009 (by alfonsoromanz), closed in favour of a separate RPC as suggested by achow101.\n\nACKs for top commit:\n  Bicaru20:\n    reACK 7c311f5c6c\n  achow101:\n    ACK 7c311f5c6c3ea5a0d0cc4da35177e6977cda87d1\n  polespinasa:\n    ACK 7c311f5c6c3ea5a0d0cc4da35177e6977cda87d1\n\nTree-SHA512: c80f98844124d10b16a7f275107e22d4f5983329d93208e95b3e56ac7295c7265eebdb247a4fa7d70da8d38f4b453df17efaee29a4bd6bae8cb1da60b029c489", "message_quality_score": 100, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/bitcoin-core/2b95b45a9abd63a1532ce9deea1438e07e7a635f/"}, {"sha": "7ee3d622e5fa1dc8a568ad243aa8970234c78673", "project": "Bitcoin Core", "vendor": "Bitcoin Core", "title": "Merge bitcoin/bitcoin#35752: wallet: make encryption state updates atomic", "committed_at": "2026-09-22T18:53:26+00:00", "severity": "moderate", "risk_score": 68, "summary": "This Bitcoin Core update fixes several wallet bugs where a failed database write could leave a wallet in an inconsistent state. For example, encrypting a wallet or changing its passphrase could appear to succeed in memory while the change was not actually saved to disk, or could leave unencrypted private keys behind. The patch makes these operations atomic: in-memory state is only updated after the database transaction commits, and failures now return clear, structured error messages instead of crashing the program or giving misleading 'wrong passphrase' errors.", "author": "Ava Chow", "commit_message": "Merge bitcoin/bitcoin#35752: wallet: make encryption state updates atomic\n\n6d2414542b86ff7d6eae0f4c873e47bc4e57a57c wallet: reuse unlock and passphrase change errors (Ava Chow)\n593554622e2ced30eb5c2b2fbc642e31c66b2bb8 wallet: return passphrase errors with Expected (Ava Chow)\nf949b3ba2ad78eed70540a31564032ab3efefda6 wallet: publish descriptor keys after writes (L\u0151rinc)\ne3712b7d492fc72a763c9e5c73a5a174be59dd21 test: characterize descriptor insertion failure (L\u0151rinc)\nbd558107784cf1170482700a13904cfa5b6816a8 wallet: abort failed descriptor key erases (L\u0151rinc)\n537e79191585ca5ea46c527287d311c9abdcabd0 test: cover encrypted descriptor key insertion (L\u0151rinc)\nd8a6f5e48d6b007207ba00e70167affbff2900f9 wallet: abort failed descriptor key writes (L\u0151rinc)\n14ce3fdb493ac1cbb8e8fb583c9c2e99d9d9fb65 test: characterize descriptor key failures (L\u0151rinc)\n5bc0be16fe4d910d363b5cd8eeb11a9b9629e0b9 wallet: reject failed passphrase changes (L\u0151rinc)\nee6d45a07e3ae06e490e30c9d4a3f01d9917c740 test: characterize passphrase write failure (L\u0151rinc)\n2daa2f94f4a2930c2f315cf9e50ffd027d4bc101 wallet: restore lock state before re-encryption (Ava Chow)\n8b23fa47737a8e1deb23953b5e3b438454e10e73 wallet: abort failed encryption transactions (L\u0151rinc)\ne6c374d302018f352d0583c38c5c4211f9b59a2f test: characterize encryption transaction failures (L\u0151rinc)\n70381010c0af96db8b23e2af02599798b063c92b refactor/test: add wallet failure injection (L\u0151rinc)\n\nPull request description:\n\n  **Problem:** Wallet encryption and passphrase changes can leave database records and live key state out of sync when a database operation fails.\n  Encryption can report success without persisting the master key, and a passphrase change can activate the new passphrase only in memory.\n  Descriptor key write failures can publish keys that were not persisted, while erase failures can leave plaintext keys on disk.\n  A failed encryption transaction commit aborts the node, and a re-encryption failure during a passphrase change can leave a previously locked wallet unlocked.\n  Boolean results also force callers to duplicate error messages or report database and encryption failures as incorrect passphrases.\n\n  **Fix:** Publish wallet encryption state only after the database transaction commits, and publish newly inserted descriptor keys only after their database writes succeed.\n  For passphrase changes, restore the original lock state after validating the old passphrase and replace the live master key only after persisting its re-encrypted value.\n  These changes preserve the affected keys on failure and allow retries.\n  Return structured errors from wallet unlock and passphrase changes so callers can share messages and report the specific failure.\n  Fresh descriptor setup after the encryption transaction remains unchanged.\n\nACKs for top commit:\n  achow101:\n    ACK 6d2414542b86ff7d6eae0f4c873e47bc4e57a57c\n  w0xlt:\n    reACK 6d2414542b86ff7d6eae0f4c873e47bc4e57a57c\n\nTree-SHA512: 2d7293d9482ef259732cd0c3dd31eb2c376fc39e23a76141032b6e308b0e71c5d86b3f03995ef3f923cabbc431a139a39a4be02853f352f7103a7f9f52a95299", "message_quality_score": 91, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/bitcoin-core/7ee3d622e5fa1dc8a568ad243aa8970234c78673/"}, {"sha": "248ce46faf708a832b7922ae7ef9227dbcadf0e5", "project": "Bitcoin Core", "vendor": "Bitcoin Core", "title": "Merge bitcoin/bitcoin#35619: test:  ExtendedPrivateKey follow-ups", "committed_at": "2026-09-22T16:12:36+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit only changes Bitcoin Core's internal functional test code. It replaces hard-coded test keys and addresses with ones generated from a new test helper class, and unifies how tests tell nodes not to create a default wallet. There is no change to the actual Bitcoin Core software that users run, so it cannot affect live wallets, transactions, or network security.", "author": "merge-script", "commit_message": "Merge bitcoin/bitcoin#35619: test:  ExtendedPrivateKey follow-ups\n\na34861d280b3db81175b6692ba00ccc62edff52e test: unify how to avoid the creation of the default wallet in nodes (rkrux)\n3458837a0b76fb7f5d4c2f5d9ebb9bd7818794be test: use ExtendedPrivateKey in wallet_importdescriptors.py (rkrux)\n\nPull request description:\n\n  Looks like a case was missed in PR #35543 that introduced the utility xprv\n  and xpub classes.\n\n  Also, unify how to avoid the creation of the default wallet in nodes.\n\nACKs for top commit:\n  davidgumberg:\n    reACK  https://github.com/bitcoin/bitcoin/pull/35619/commits/a34861d280b3db81175b6692ba00ccc62edff52e\n  nebula-21:\n    ACK a34861d280b3db81175b6692ba00ccc62edff52e\n  sedited:\n    ACK a34861d280b3db81175b6692ba00ccc62edff52e\n\nTree-SHA512: 4ed5d2375d915bfff1898babdd7311ead15169bc1156ab5168b5c7ca2e969c850f752d36caa585b8fe856dca26f3ceb3f7a98ce091d4a8a7c38f532b87250d3f", "message_quality_score": 100, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/bitcoin-core/248ce46faf708a832b7922ae7ef9227dbcadf0e5/"}, {"sha": "bef804218f8b15ea198378551a694afce1e01d0b", "project": "Electrum", "vendor": "Electrum", "title": "Merge pull request #10987 from spesmilo/fix_10986", "committed_at": "2026-09-22T15:51:22+00:00", "severity": "low", "risk_score": 44, "summary": "This commit fixes a bug where Electrum failed to recognize certain already-signed Bitcoin transactions as complete. Specifically, for native SegWit inputs, Bitcoin Core can produce a finalized PSBT with a valid witness but an empty scriptSig. Electrum's 'is this transaction complete?' check previously required a non-empty scriptSig for such inputs, so it wrongly treated these valid, signed transactions as incomplete. The fix adds a rule: if a native SegWit input has a non-empty witness, treat it as complete. This could have led users to try re-signing or re-broadcasting, or to confusion about whether a transaction was ready.", "author": "ghost43", "commit_message": "Merge pull request #10987 from spesmilo/fix_10986\n\ntransaction: treat native segwit input with non-empty witness as complete", "message_quality_score": 68, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/electrum/bef804218f8b15ea198378551a694afce1e01d0b/"}, {"sha": "9701113f31ac50896be970031d26746a426dc3ca", "project": "libsecp256k1", "vendor": "Bitcoin Core", "title": "Merge bitcoin-core/secp256k1#1840: ci: Simplify module configuration and extend test coverage", "committed_at": "2026-09-22T15:33:09+00:00", "severity": "informational", "risk_score": 15, "summary": "This change only edits the project's automated continuous-integration (CI) configuration file. It turns on all optional cryptographic modules by default in CI and adds test runs that disable each module one at a time. There is no change to the actual library source code, build scripts, or released binaries, so it cannot directly introduce a runtime security vulnerability or fix one in shipped code. It is a testing-infrastructure cleanup that also increases coverage of build configurations.", "author": "merge-script", "commit_message": "Merge bitcoin-core/secp256k1#1840: ci: Simplify module configuration and extend test coverage\n\n63f7e222c9d78550f70365f2ac57d24158ad3447 ci: Simplify module configuration (mllwchrry)\n\nPull request description:\n\n  Enables all modules by default, and tests the disabling of each module separately (respecting the dependency chain). This simplifies the configuration of modules in CI and extends the test coverage.\n\n  The extended coverage is proven by exposing pre-existing issues fixed in #1837 and #1839.\n\nACKs for top commit:\n  hebasto:\n    re-ACK 63f7e222c9d78550f70365f2ac57d24158ad3447.\n  theStack:\n    Concept and code-review ACK 63f7e222c9d78550f70365f2ac57d24158ad3447\n\nTree-SHA512: 4817c46eeb18d1d565fdcf91e9cd40d3b57ca9fb6c71a74940ed46631deb55bf54b3ef8dbbb3cf548721ce05ad7e1ea724421349f3a1d1c54badea98a5859e04", "message_quality_score": 91, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/libsecp256k1/9701113f31ac50896be970031d26746a426dc3ca/"}, {"sha": "6162e2aa8f0c696e5e8c7cd5168f0a08ade4c6d0", "project": "Eclair", "vendor": "ACINQ", "title": "Use bitcoin-kmp 0.49 (depends on bitcoin-kmp 0.32.0 and secp256k1-kmp 0.24.0) (#3362)", "committed_at": "2026-09-22T13:30:33+00:00", "severity": "low", "risk_score": 31, "summary": "This commit updates Eclair's Bitcoin library dependency from version 0.48 to 0.49, which internally uses newer versions of bitcoin-kmp and secp256k1-kmp. The code changes only replace old property accesses (like `.txid`) with new method calls (like `.getTxid`) to match the updated library's API. There is no explicit security fix described in the commit, and no verified external references are provided. The change could include bug fixes or security improvements in the upstream cryptographic libraries, but the commit itself does not disclose any specific vulnerability.", "author": "Fabrice Drouin", "commit_message": "Use bitcoin-kmp 0.49 (depends on bitcoin-kmp 0.32.0 and secp256k1-kmp 0.24.0) (#3362)", "message_quality_score": 58, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/eclair/6162e2aa8f0c696e5e8c7cd5168f0a08ade4c6d0/"}, {"sha": "97357e8cd1db0f16fff4550c5b3f5a0b8fd06c0d", "project": "BTCPay Server", "vendor": "BTCPay Server", "title": "Containerize the server settings views into sections (#7501)", "committed_at": "2026-09-22T11:52:30+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit is a user-interface redesign, not a security fix. It wraps existing server settings pages into consistent visual sections and adds short explanatory subtitles. No code handling payments, authentication, permissions, or data validation was changed.", "author": "dstrukt", "commit_message": "Containerize the server settings views into sections (#7501)", "message_quality_score": 58, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/btcpay-server/97357e8cd1db0f16fff4550c5b3f5a0b8fd06c0d/"}, {"sha": "40f772063546f5cc5b75290b3d575a062c894bf0", "project": "Sparrow Wallet", "vendor": "Sparrow", "title": "remove the surplus signatures progress bar segments a finalized multisig transaction discards", "committed_at": "2026-09-22T09:27:13+00:00", "severity": "informational", "risk_score": 17, "summary": "This commit fixes a UI display bug in Sparrow Wallet's signature progress bar. When a multi-signature Bitcoin transaction becomes finalized, extra signatures beyond the required threshold are discarded. Previously, the progress bar did not remove the visual segments representing those discarded signatures, which could leave the bar showing more segments than actually exist. The fix cleans up those surplus segments and resets progress to zero for any segment whose signature was removed. There is no direct evidence this affects funds or transaction security.", "author": "Craig Raw", "commit_message": "remove the surplus signatures progress bar segments a finalized multisig transaction discards", "message_quality_score": 50, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/sparrow-wallet/40f772063546f5cc5b75290b3d575a062c894bf0/"}, {"sha": "e9bb42e6323308d515e054fe796545549ca54d1e", "project": "Electrum", "vendor": "Electrum", "title": "transaction: treat native segwit input with non-empty witness as complete", "committed_at": "2026-09-22T09:10:43+00:00", "severity": "low", "risk_score": 35, "summary": "This commit fixes a bug where Electrum incorrectly treated finalized Bitcoin transactions as incomplete. Some wallet software (like Bitcoin Core and Sparrow) creates native SegWit transactions that omit an empty placeholder field Electrum expected. As a result, Electrum could wrongly refuse to broadcast or mishandle valid, already-signed transactions. The fix makes Electrum recognize these transactions as complete when the witness data is present.", "author": "ThomasV", "commit_message": "transaction: treat native segwit input with non-empty witness as complete\n\nBitcoin Core, Sparrow omit the final scriptSig is empty, for native\nsegwit inputs, and only write the witness. PartialTxInput.is_complete()\nshould not require both fields to be present. fixes #10986", "message_quality_score": 81, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/electrum/e9bb42e6323308d515e054fe796545549ca54d1e/"}, {"sha": "bbc40ede1ba6f88255ecdf6e678a1fa8c5674689", "project": "Bitcoin Core", "vendor": "Bitcoin Core", "title": "Merge bitcoin/bitcoin#36261: test: cover PSBT unknown field merging", "committed_at": "2026-09-22T08:24:43+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit only adds a new automated test to Bitcoin Core. It checks that when two partially-signed Bitcoin transactions (PSBTs) are combined, any custom 'unknown' data fields attached to them are preserved correctly. There is no change to the actual Bitcoin Core software behavior\u2014only test code was added.", "author": "merge-script", "commit_message": "Merge bitcoin/bitcoin#36261: test: cover PSBT unknown field merging\n\n21e4ea8134d8ca95416e065490d99f82be66bd67 test: cover PSBT unknown field merging (w0xlt)\n\nPull request description:\n\n  Continuing the work from #35310 gere in agreement with w0xlt\n\n  This PR adds functional coverage for combinepsbt preserving unknown PSBT fields across global, input, and output maps, as suggested [here](https://github.com/bitcoin/bitcoin/pull/34893#issuecomment-4390043746).\n\n  The test covers both PSBTv0 and PSBTv2 by creating valid base PSBTs with `createpsbt`, injecting unknown key-value pairs into two copies, combining them, and asserting that all unknown fields are retained in the decoded result.\n\nACKs for top commit:\n  polespinasa:\n    ACK 21e4ea8134d8ca95416e065490d99f82be66bd67\n  nebula-21:\n    ACK 21e4ea8134d8ca95416e065490d99f82be66bd67\n  winterrdog:\n    tACK 21e4ea8134d8ca95416e065490d99f82be66bd67\n  w0xlt:\n    ACK 21e4ea8134d8ca95416e065490d99f82be66bd67\n\nTree-SHA512: 0f83ff2b9a519b613c6efaca3707bd8c6fdd00887370e16e927b19f059b751813737adc85ad81366f5c57b91226f56b3b0bdc996451f4d6bc9ec83aa4a189923", "message_quality_score": 91, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/bitcoin-core/bbc40ede1ba6f88255ecdf6e678a1fa8c5674689/"}, {"sha": "d3d1f1d023aa07b7465842a634b0c9960ca8576a", "project": "LND", "vendor": "Lightning Labs", "title": "Merge pull request #11132 from yyforyongyu/task-11129-pong", "committed_at": "2026-09-22T02:40:49+00:00", "severity": "moderate", "risk_score": 53, "summary": "This change fixes how LND answers network 'ping' messages from other Lightning nodes. Previously, LND would sometimes silently ignore valid pings to limit reply traffic, which violates the Lightning protocol (BOLT 1) and could make a peer think the connection is dead. Now LND replies to every valid ping, while still disconnecting peers that flood too many pings. The cost of a reply is counted against a single flood budget based on how large the reply would be.", "author": "Olaoluwa Osuntokun", "commit_message": "Merge pull request #11132 from yyforyongyu/task-11129-pong\n\npeer: answer every valid ping", "message_quality_score": 58, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/lnd/d3d1f1d023aa07b7465842a634b0c9960ca8576a/"}, {"sha": "3af940846dd97828d6af3cb8fb7368b14ee865a1", "project": "BTCPay Server", "vendor": "BTCPay Server", "title": "Rename global search keywords to aliases (#7586)", "committed_at": "2026-09-22T01:47:01+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit simply renames the search feature's 'Keywords' field to 'Aliases' across the BTCPay Server codebase. It is a non-functional refactoring that does not change any security behavior, access controls, or data handling. Backward compatibility is preserved with an obsolete property that maps to the new name.", "author": "Nicolas Dorier", "commit_message": "Rename global search keywords to aliases (#7586)", "message_quality_score": 53, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/btcpay-server/3af940846dd97828d6af3cb8fb7368b14ee865a1/"}, {"sha": "4ed7c068b32e75e21b2436696734f19eca1beb06", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0", "committed_at": "2026-09-21T17:08:11+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability. The change only affects internal project workflow automation and does not touch the rust-bitcoin library code that users install.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0\n\nf6c31cbd78e1142d2454ec3fe7979b755c56e12e build(deps): bump actions/labeler from 6.2.0 to 7.0.0 (dependabot[bot])\n\nPull request description:\n\n  Bumps [actions/labeler](https://github.com/actions/labeler) from 6.2.0 to 7.0.0.\n  <details>\n  <summary>Release notes</summary>\n  <p><em>Sourced from <a href=\"https://github.com/actions/labeler/releases\">actions/labeler's releases</a>.</em></p>\n  <blockquote>\n  <h2>v7.0.0</h2>\n  <h2>What's Changed</h2>\n  <h3>Enhancements:</h3>\n  <ul>\n  <li>Migrate to ESM and update dependencies by <a href=\"https://github.com/chiranjib-swain\"><code>@\u200bchiranjib-swain</code></a> in <a href=\"https://redirect.github.com/actions/labeler/pull/949\">actions/labeler#949</a></li>\n  </ul>\n  <p><strong>Full Changelog</strong>: <a href=\"https://github.com/actions/labeler/compare/v6...v7.0.0\">https://github.com/actions/labeler/compare/v6...v7.0.0</a></p>\n  </blockquote>\n  </details>\n  <details>\n  <summary>Commits</summary>\n  <ul>\n  <li><a href=\"https://github.com/actions/labeler/commit/bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13\"><code>bf12e9b</code></a> feat: migrate to ESM and update dependencies (<a href=\"https://redirect.github.com/actions/labeler/issues/949\">#949</a>)</li>\n  <li>See full diff in <a href=\"https://github.com/actions/labeler/compare/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13\">compare view</a></li>\n  </ul>\n  </details>\n  <br />\n  \n  \n  [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/labeler&package-manager=github_actions&previous-version=6.2.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n  \n  Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n  \n  [//]: # (dependabot-automerge-start)\n  [//]: # (dependabot-automerge-end)\n  \n  ---\n  \n  <details>\n  <summary>Dependabot commands and options</summary>\n  <br />\n  \n  You can trigger Dependabot actions by commenting on this PR:\n  - `@dependabot rebase` will rebase this PR\n  - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n  - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency\n  - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n  \n  \n  </details>\n\n\nACKs for top commit:\n  apoelstra:\n    ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e; successfully ran local tests\n  satsfy:\n    ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e\n\n\nTree-SHA512: c01e93f62f62f0053adf8d6356c4b4766e12f338d8886004cdf4817e74362717807bee30b26b63bf39f1ad59b7586b628631e739606534e11e6215d4dccbf7c1", "message_quality_score": 96, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/4ed7c068b32e75e21b2436696734f19eca1beb06/"}, {"sha": "328c4ae9f3c65d668ffabe035ef6854de2c19c3d", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1", "committed_at": "2026-09-21T12:57:26+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There is no indication this introduces a security problem.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1\n\n55c3a6f5d46ee147b0aea9abaee585ff22e47897 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot])\n\nPull request description:\n\n  Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.\n  <details>\n  <summary>Release notes</summary>\n  <p><em>Sourced from <a href=\"https://github.com/actions/checkout/releases\">actions/checkout's releases</a>.</em></p>\n  <blockquote>\n  <h2>v7.0.1</h2>\n  <h2>What's Changed</h2>\n  <ul>\n  <li>skip running unsafe pr check if input is default by <a href=\"https://github.com/aiqiaoy\"><code>@\u200baiqiaoy</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2518\">actions/checkout#2518</a></li>\n  <li>trim only ascii whitespace for branch by <a href=\"https://github.com/aiqiaoy\"><code>@\u200baiqiaoy</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2521\">actions/checkout#2521</a></li>\n  <li>escape values passed to --unset by <a href=\"https://github.com/aiqiaoy\"><code>@\u200baiqiaoy</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2530\">actions/checkout#2530</a></li>\n  <li>Various dependency updates</li>\n  </ul>\n  <p><strong>Full Changelog</strong>: <a href=\"https://github.com/actions/checkout/compare/v7...v7.0.1\">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>\n  </blockquote>\n  </details>\n  <details>\n  <summary>Changelog</summary>\n  <p><em>Sourced from <a href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\">actions/checkout's changelog</a>.</em></p>\n  <blockquote>\n  <h1>Changelog</h1>\n  <h2>v7.0.1</h2>\n  <ul>\n  <li>Skip running unsafe pr check if input is default by <a href=\"https://github.com/aiqiaoy\"><code>@\u200baiqiaoy</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2518\">actions/checkout#2518</a></li>\n  <li>Trim only ascii whitespace for branch by <a href=\"https://github.com/aiqiaoy\"><code>@\u200baiqiaoy</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2521\">actions/checkout#2521</a></li>\n  <li>Escape values passed to --unset by <a href=\"https://github.com/aiqiaoy\"><code>@\u200baiqiaoy</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2530\">actions/checkout#2530</a></li>\n  <li>Various dependency updates</li>\n  </ul>\n  <h2>v7.0.0</h2>\n  <ul>\n  <li>Block checking out fork PR for pull_request_target and workflow_run by <a href=\"https://github.com/aiqiaoy\"><code>@\u200baiqiaoy</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2454\">actions/checkout#2454</a></li>\n  <li>Various dependency updates</li>\n  </ul>\n  <h2>v6.0.3</h2>\n  <ul>\n  <li>Fix checkout init for SHA-256 repositories by <a href=\"https://github.com/yaananth\"><code>@\u200byaananth</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2439\">actions/checkout#2439</a></li>\n  <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href=\"https://github.com/yaananth\"><code>@\u200byaananth</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2414\">actions/checkout#2414</a></li>\n  </ul>\n  <h2>v6.0.2</h2>\n  <ul>\n  <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href=\"https://github.com/ericsciple\"><code>@\u200bericsciple</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2356\">actions/checkout#2356</a></li>\n  </ul>\n  <h2>v6.0.1</h2>\n  <ul>\n  <li>Add worktree support for persist-credentials includeIf by <a href=\"https://github.com/ericsciple\"><code>@\u200bericsciple</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2327\">actions/checkout#2327</a></li>\n  </ul>\n  <h2>v6.0.0</h2>\n  <ul>\n  <li>Persist creds to a separate file by <a href=\"https://github.com/ericsciple\"><code>@\u200bericsciple</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2286\">actions/checkout#2286</a></li>\n  <li>Update README to include Node.js 24 support details and requirements by <a href=\"https://github.com/salmanmkc\"><code>@\u200bsalmanmkc</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2248\">actions/checkout#2248</a></li>\n  </ul>\n  <h2>v5.0.1</h2>\n  <ul>\n  <li>Port v6 cleanup to v5 by <a href=\"https://github.com/ericsciple\"><code>@\u200bericsciple</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2301\">actions/checkout#2301</a></li>\n  </ul>\n  <h2>v5.0.0</h2>\n  <ul>\n  <li>Update actions checkout to use node 24 by <a href=\"https://github.com/salmanmkc\"><code>@\u200bsalmanmkc</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2226\">actions/checkout#2226</a></li>\n  </ul>\n  <h2>v4.3.1</h2>\n  <ul>\n  <li>Port v6 cleanup to v4 by <a href=\"https://github.com/ericsciple\"><code>@\u200bericsciple</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2305\">actions/checkout#2305</a></li>\n  </ul>\n  <h2>v4.3.0</h2>\n  <ul>\n  <li>docs: update README.md by <a href=\"https://github.com/motss\"><code>@\u200bmotss</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/1971\">actions/checkout#1971</a></li>\n  <li>Add internal repos for checking out multiple repositories by <a href=\"https://github.com/mouismail\"><code>@\u200bmouismail</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/1977\">actions/checkout#1977</a></li>\n  <li>Documentation update - add recommended permissions to Readme by <a href=\"https://github.com/benwells\"><code>@\u200bbenwells</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2043\">actions/checkout#2043</a></li>\n  <li>Adjust positioning of user email note and permissions heading by <a href=\"https://github.com/joshmgross\"><code>@\u200bjoshmgross</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2044\">actions/checkout#2044</a></li>\n  <li>Update README.md by <a href=\"https://github.com/nebuk89\"><code>@\u200bnebuk89</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2194\">actions/checkout#2194</a></li>\n  <li>Update CODEOWNERS for actions by <a href=\"https://github.com/TingluoHuang\"><code>@\u200bTingluoHuang</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2224\">actions/checkout#2224</a></li>\n  <li>Update package dependencies by <a href=\"https://github.com/salmanmkc\"><code>@\u200bsalmanmkc</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/2236\">actions/checkout#2236</a></li>\n  </ul>\n  <h2>v4.2.2</h2>\n  <ul>\n  <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href=\"https://github.com/jww3\"><code>@\u200bjww3</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/1941\">actions/checkout#1941</a></li>\n  <li>Expand unit test coverage for <code>isGhes</code> by <a href=\"https://github.com/jww3\"><code>@\u200bjww3</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/1946\">actions/checkout#1946</a></li>\n  </ul>\n  <h2>v4.2.1</h2>\n  <ul>\n  <li>Check out other refs/* by commit if provided, fall back to ref by <a href=\"https://github.com/orhantoy\"><code>@\u200borhantoy</code></a> in <a href=\"https://redirect.github.com/actions/checkout/pull/1924\">actions/checkout#1924</a></li>\n  </ul>\n  <!-- raw HTML omitted -->\n  </blockquote>\n  <p>... (truncated)</p>\n  </details>\n  <details>\n  <summary>Commits</summary>\n  <ul>\n  <li><a href=\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"><code>3d3c42e</code></a> prep v7.0.1 release (<a href=\"https://redirect.github.com/actions/checkout/issues/2531\">#2531</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"><code>2880268</code></a> escape values passed to --unset (<a href=\"https://redirect.github.com/actions/checkout/issues/2530\">#2530</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href=\"https://redirect.github.com/actions/checkout/issues/2521\">#2521</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href=\"https://redirect.github.com/actions/checkout/issues/2518\">#2518</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href=\"https://redirect.github.com/actions/checkout/issues/2499\">#2499</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"><code>631c942</code></a> eslint 9 (<a href=\"https://redirect.github.com/actions/checkout/issues/2474\">#2474</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href=\"https://redirect.github.com/actions/checkout/issues/2476\">#2476</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href=\"https://redirect.github.com/actions/checkout/issues/2488\">#2488</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href=\"https://redirect.github.com/actions/checkout/issues/2479\">#2479</a>)</li>\n  <li><a href=\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href=\"https://redirect.github.com/actions/checkout/issues/2478\">#2478</a>)</li>\n  <li>Additional commits viewable in <a href=\"https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1\">compare view</a></li>\n  </ul>\n  </details>\n  <br />\n  \n  \n  [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=7.0.0&new-version=7.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n  \n  Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n  \n  [//]: # (dependabot-automerge-start)\n  [//]: # (dependabot-automerge-end)\n  \n  ---\n  \n  <details>\n  <summary>Dependabot commands and options</summary>\n  <br />\n  \n  You can trigger Dependabot actions by commenting on this PR:\n  - `@dependabot rebase` will rebase this PR\n  - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n  - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency\n  - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n  \n  \n  </details>\n\n\nACKs for top commit:\n  apoelstra:\n    ACK 55c3a6f5d46ee147b0aea9abaee585ff22e47897; successfully ran local tests\n  satsfy:\n    ACK 55c3a6f5d46ee147b0aea9abaee585ff22e47897\n\n\nTree-SHA512: c8ef2a044088d870e6f65e4aa9fff004d26d1fb72af787a3d4663d49fe7a5e8497f89710b35a6ddd8408584189d891330909371d39bd8ec4623d4bf44941dae2", "message_quality_score": 96, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/328c4ae9f3c65d668ffabe035ef6854de2c19c3d/"}, {"sha": "4a9cf168a3451cfc600a6c90c3c75f4e6bc3fd79", "project": "Trezor firmware", "vendor": "Trezor", "title": "feat(core): app root packet downgrade protection", "committed_at": "2026-09-21T12:35:28+00:00", "severity": "moderate", "risk_score": 59, "summary": "This commit adds downgrade protection for a new 'app root packet' system in Trezor firmware. Previously, the code had a TODO note saying downgrade protection needed to be considered. The change makes the device remember the timestamps of previously accepted root packets and reject older or inconsistent ones. It also adds a new Python-exposed state object so the wallet software can persist these timestamps. This is a security-hardening feature rather than a fix for a currently exploitable bug, but it closes a design gap that could have allowed an attacker to roll back trusted application lists to older, potentially vulnerable versions.", "author": "cepetr", "commit_message": "feat(core): app root packet downgrade protection\n\n[no changelog]", "message_quality_score": 57, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/trezor-firmware/4a9cf168a3451cfc600a6c90c3c75f4e6bc3fd79/"}, {"sha": "034b9d04ccbc0b917506293107646dd38127a502", "project": "Ledger Bitcoin app", "vendor": "Ledger", "title": "Merge pull request #569 from LedgerHQ/client-fixes", "committed_at": "2026-09-21T11:59:04+00:00", "severity": "low", "risk_score": 37, "summary": "This commit fixes how Ledger's Bitcoin client libraries convert older PSBTv0 transaction data into the newer PSBTv2 format that Ledger hardware wallets expect. The changes correct several field-handling bugs: the transaction locktime is now written to the right place, missing input sequence numbers are treated as the default final value, and the Rust client now forwards unknown PSBTv2 fields (such as required locktimes) instead of dropping them. It also rejects malformed PSBTs where v0 and v2 fields contradict each other, rather than producing an invalid PSBT that the device would refuse. These are client-side robustness fixes; they do not appear to be a security patch for the device firmware itself.", "author": "Salvatore Ingala", "commit_message": "Merge pull request #569 from LedgerHQ/client-fixes\n\nClient fixes on PSBTv2 field handling", "message_quality_score": 58, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/ledger-bitcoin-app/034b9d04ccbc0b917506293107646dd38127a502/"}, {"sha": "429a283d76f6f382fb40c61ecc0435cd952cf56a", "project": "Trezor firmware", "vendor": "Trezor", "title": "fix(core/rust): discard low-order keys in THP handshake", "committed_at": "2026-09-21T11:58:26+00:00", "severity": "moderate", "risk_score": 67, "summary": "This commit fixes a cryptographic edge case in Trezor's THP (Trezor Host Protocol) handshake. It now rejects Curve25519 public keys that are all zeros or that produce an all-zero shared secret. A zero public key can cause the Diffie-Hellman exchange to collapse to a predictable value, which could let an attacker on the USB/bus learn or manipulate session keys. The patch also makes the handshake fail more gracefully for that single channel instead of aborting all channels.", "author": "M1nd3r", "commit_message": "fix(core/rust): discard low-order keys in THP handshake\n\n[no changelog]", "message_quality_score": 62, "message_quality_label": "Adequate", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/trezor-firmware/429a283d76f6f382fb40c61ecc0435cd952cf56a/"}, {"sha": "1cc940a435847dd43401343f49683b5565f7fa23", "project": "Trezor firmware", "vendor": "Trezor", "title": "feat(core): enable -Wsign-compare", "committed_at": "2026-09-21T11:37:48+00:00", "severity": "low", "risk_score": 27, "summary": "This commit turns on a compiler warning (-Wsign-compare) that catches places where signed and unsigned numbers are compared, and fixes the resulting warnings across the Trezor firmware. Most changes are clean-up casts and loop-index type changes. A few spots also fix real logic bugs, such as treating a negative I/O return value as a successful byte count, or using the wrong argument index for an optional offset. These are defensive improvements rather than a single obvious exploit, but in embedded security code they can prevent subtle memory or parsing issues.", "author": "cepetr", "commit_message": "feat(core): enable -Wsign-compare\n\n[no changelog]", "message_quality_score": 57, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/trezor-firmware/1cc940a435847dd43401343f49683b5565f7fa23/"}, {"sha": "65402aecf6d6e7ad2ae402e25f5a130df676a134", "project": "Trezor firmware", "vendor": "Trezor", "title": "refactor(core): merge passphrase__access_hidden_wallet into passphrase__access_wallet", "committed_at": "2026-09-21T10:40:50+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit is a simple user-interface cleanup. It removes one duplicate translation label ('Access hidden wallet') and makes the device use a single, consistent label ('Access wallet') when asking the user to confirm opening a passphrase-protected wallet. There is no change to security logic, cryptography, or how passphrases are handled.", "author": "Michal Kazda", "commit_message": "refactor(core): merge passphrase__access_hidden_wallet into passphrase__access_wallet\n[no changelog]", "message_quality_score": 62, "message_quality_label": "Adequate", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/trezor-firmware/65402aecf6d6e7ad2ae402e25f5a130df676a134/"}, {"sha": "7ce6887f4d48ae077eb0e000c435ecb2aa00632f", "project": "Trezor firmware", "vendor": "Trezor", "title": "refactor(core): merge passphrase__hidden_wallet into passphrase__wallet", "committed_at": "2026-09-21T10:39:07+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit is a simple user-interface cleanup. It merges two translation labels that both meant 'Passphrase wallet' into a single label, and updates the screens that used the old duplicate label. There is no security-relevant behavior change.", "author": "Michal Kazda", "commit_message": "refactor(core): merge passphrase__hidden_wallet into passphrase__wallet\n[no changelog]", "message_quality_score": 62, "message_quality_label": "Adequate", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/trezor-firmware/7ce6887f4d48ae077eb0e000c435ecb2aa00632f/"}, {"sha": "676007955240a4d7ece5e7d6a968189f09d81785", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0", "committed_at": "2026-09-21T08:30:36+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mention no security fixes; the only breaking change is that cache pruning is now disabled by default, which can increase GitHub Actions cache usage and cost. There is no evidence this affects the security of the rust-bitcoin library or its build outputs.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0\n\n7d7e7269e50df6412aab796fd67b59abc94cc4ba build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (dependabot[bot])\n\nPull request description:\n\n  Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.\n  <details>\n  <summary>Release notes</summary>\n  <p><em>Sourced from <a href=\"https://github.com/astral-sh/setup-uv/releases\">astral-sh/setup-uv's releases</a>.</em></p>\n  <blockquote>\n  <h2>v9.0.0 \ud83c\udf08 Change <code>prune-cache</code> default to <code>false</code></h2>\n  <h2>Changes</h2>\n  <p>This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.\n  Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in <a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/967\">#967</a></p>\n  <p>Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the &quot;big ones&quot; and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.</p>\n  <h2>\ud83d\udea8 Breaking changes</h2>\n  <ul>\n  <li>Change <code>prune-cache</code> default to <code>false</code> <a href=\"https://github.com/charliermarsh\"><code>@\u200bcharliermarsh</code></a> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/967\">#967</a>)</li>\n  </ul>\n  <h2>\ud83d\udc1b Bug fixes</h2>\n  <ul>\n  <li>fix: fall back to distribution ID when os-release has no version field <a href=\"https://github.com/cxzhong\"><code>@\u200bcxzhong</code></a> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/961\">#961</a>)</li>\n  </ul>\n  <h2>\ud83d\ude80 Enhancements</h2>\n  <ul>\n  <li>Speed up version client by partial response reads <a href=\"https://github.com/eifinger\"><code>@\u200beifinger</code></a> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/807\">#807</a>)</li>\n  </ul>\n  <h2>\ud83e\uddf0 Maintenance</h2>\n  <ul>\n  <li>chore: update known checksums for 0.11.30 @<a href=\"https://github.com/apps/github-actions\">github-actions[bot]</a> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/968\">#968</a>)</li>\n  <li>chore: update known checksums for 0.11.29 @<a href=\"https://github.com/apps/github-actions\">github-actions[bot]</a> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/960\">#960</a>)</li>\n  </ul>\n  <h2>\ud83d\udcda Documentation</h2>\n  <ul>\n  <li>docs: update version references to v8.3.2 @<a href=\"https://github.com/apps/github-actions\">github-actions[bot]</a> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/949\">#949</a>)</li>\n  </ul>\n  <h2>\u2b06\ufe0f Dependency updates</h2>\n  <ul>\n  <li>chore(deps): roll up Dependabot updates <a href=\"https://github.com/eifinger\"><code>@\u200beifinger</code></a> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/970\">#970</a>)</li>\n  <li>chore(deps): roll up Dependabot updates <a href=\"https://github.com/eifinger\"><code>@\u200beifinger</code></a> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/962\">#962</a>)</li>\n  </ul>\n  </blockquote>\n  </details>\n  <details>\n  <summary>Commits</summary>\n  <ul>\n  <li><a href=\"https://github.com/astral-sh/setup-uv/commit/c771a70e6277c0a99b617c7a806ffedaca235ff9\"><code>c771a70</code></a> chore(deps): roll up Dependabot updates (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/970\">#970</a>)</li>\n  <li><a href=\"https://github.com/astral-sh/setup-uv/commit/2f537ca87c1ffa233ca2a1b84815388e3e42d845\"><code>2f537ca</code></a> chore: update known checksums for 0.11.30 (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/968\">#968</a>)</li>\n  <li><a href=\"https://github.com/astral-sh/setup-uv/commit/2269552d547df6f50e57442326930d30d943afe3\"><code>2269552</code></a> Speed up version client by partial response reads (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/807\">#807</a>)</li>\n  <li><a href=\"https://github.com/astral-sh/setup-uv/commit/47a7f4fb2e900d6c33a5b5f231fa21dbfaeba52f\"><code>47a7f4f</code></a> Change <code>prune-cache</code> default to <code>false</code> (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/967\">#967</a>)</li>\n  <li><a href=\"https://github.com/astral-sh/setup-uv/commit/71966eff34a27b0a62ed4b9f6f6e383e071b1bb5\"><code>71966ef</code></a> chore(deps): roll up Dependabot updates (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/962\">#962</a>)</li>\n  <li><a href=\"https://github.com/astral-sh/setup-uv/commit/f12b1f0a84bd6dc2331b36b2bbdbb1d1e617dbcc\"><code>f12b1f0</code></a> fix: fall back to distribution ID when os-release has no version field (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/961\">#961</a>)</li>\n  <li><a href=\"https://github.com/astral-sh/setup-uv/commit/ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84\"><code>ecd24dd</code></a> chore: update known checksums for 0.11.29 (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/960\">#960</a>)</li>\n  <li><a href=\"https://github.com/astral-sh/setup-uv/commit/6a191366842ac1502ba6c07e9b5acd5c2d9d8db3\"><code>6a19136</code></a> docs: update version references to v8.3.2 (<a href=\"https://redirect.github.com/astral-sh/setup-uv/issues/949\">#949</a>)</li>\n  <li>See full diff in <a href=\"https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9\">compare view</a></li>\n  </ul>\n  </details>\n  <br />\n  \n  \n  [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/setup-uv&package-manager=github_actions&previous-version=8.3.2&new-version=9.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n  \n  Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n  \n  [//]: # (dependabot-automerge-start)\n  [//]: # (dependabot-automerge-end)\n  \n  ---\n  \n  <details>\n  <summary>Dependabot commands and options</summary>\n  <br />\n  \n  You can trigger Dependabot actions by commenting on this PR:\n  - `@dependabot rebase` will rebase this PR\n  - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n  - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency\n  - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n  \n  \n  </details>\n\n\nACKs for top commit:\n  apoelstra:\n    ACK 7d7e7269e50df6412aab796fd67b59abc94cc4ba; successfully ran local tests\n\n\nTree-SHA512: 0618eec83ba5925b0fdcb30e6ec5dee7fa1763bca5e1b84b663683342b2c5307c5b8e93f35cac39d9e8b93edd3a726733e2b1aa798c0107a249a728d154c79da", "message_quality_score": 100, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/676007955240a4d7ece5e7d6a968189f09d81785/"}, {"sha": "b51cec639fce671117b040b4727e9688824fc24b", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3", "committed_at": "2026-09-21T07:03:11+00:00", "severity": "informational", "risk_score": 15, "summary": "This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch the project's Rust code, dependencies, or build outputs. The upstream release notes state there are no user-facing changes in 4.37.3. There is no indication this introduces or fixes a security issue in rust-bitcoin itself.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3\n\n2cac6e38036b3c175f0fc1368e231e06abf80817 build(deps): bump github/codeql-action/upload-sarif (dependabot[bot])\n\nPull request description:\n\n  Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.\n  <details>\n  <summary>Release notes</summary>\n  <p><em>Sourced from <a href=\"https://github.com/github/codeql-action/releases\">github/codeql-action/upload-sarif's releases</a>.</em></p>\n  <blockquote>\n  <h2>v4.37.3</h2>\n  <p>No user facing changes.</p>\n  <h2>v4.37.2</h2>\n  <ul>\n  <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href=\"https://redirect.github.com/github/codeql-action/pull/4023\">#4023</a></li>\n  <li>The CodeQL Action can now make use of <a href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href=\"https://redirect.github.com/github/codeql-action/pull/4007\">#4007</a></li>\n  </ul>\n  <h2>v4.37.1</h2>\n  <ul>\n  <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href=\"https://redirect.github.com/github/codeql-action/pull/3956\">#3956</a></li>\n  <li>Update default CodeQL bundle version to <a href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\">2.26.1</a>. <a href=\"https://redirect.github.com/github/codeql-action/pull/4019\">#4019</a></li>\n  </ul>\n  </blockquote>\n  </details>\n  <details>\n  <summary>Changelog</summary>\n  <p><em>Sourced from <a href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\">github/codeql-action/upload-sarif's changelog</a>.</em></p>\n  <blockquote>\n  <h1>CodeQL Action Changelog</h1>\n  <p>See the <a href=\"https://github.com/github/codeql-action/releases\">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>\n  <h2>[UNRELEASED]</h2>\n  <p>No user facing changes.</p>\n  <h2>4.38.1 - 18 Sept 2026</h2>\n  <ul>\n  <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href=\"https://redirect.github.com/github/codeql-action/pull/4146\">#4146</a></li>\n  </ul>\n  <h2>4.38.0 - 09 Sept 2026</h2>\n  <ul>\n  <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href=\"https://redirect.github.com/github/codeql-action/pull/4124\">#4124</a></li>\n  <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href=\"https://redirect.github.com/github/codeql-action/pull/4072\">#4072</a></li>\n  <li>Update default CodeQL bundle version to <a href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\">2.27.0</a>. <a href=\"https://redirect.github.com/github/codeql-action/pull/4129\">#4129</a></li>\n  </ul>\n  <h2>4.37.9 - 26 Aug 2026</h2>\n  <ul>\n  <li>Update default CodeQL bundle version to <a href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\">2.26.4</a>. <a href=\"https://redirect.github.com/github/codeql-action/pull/4106\">#4106</a></li>\n  </ul>\n  <h2>4.37.8 - 21 Aug 2026</h2>\n  <p>No user facing changes.</p>\n  <h2>4.37.7 - 13 Aug 2026</h2>\n  <ul>\n  <li>Update default CodeQL bundle version to <a href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\">2.26.3</a>. <a href=\"https://redirect.github.com/github/codeql-action/pull/4085\">#4085</a></li>\n  </ul>\n  <h2>4.37.6 - 04 Aug 2026</h2>\n  <ul>\n  <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href=\"https://redirect.github.com/github/codeql-action/pull/4070\">#4070</a></li>\n  </ul>\n  <h2>4.37.5 - 03 Aug 2026</h2>\n  <ul>\n  <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href=\"https://redirect.github.com/github/codeql-action/pull/4061\">#4061</a></li>\n  </ul>\n  <h2>4.37.4 - 29 Jul 2026</h2>\n  <ul>\n  <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href=\"https://redirect.github.com/github/codeql-action/pull/4037\">#4037</a></li>\n  <li>Update default CodeQL bundle version to <a href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\">2.26.2</a>. <a href=\"https://redirect.github.com/github/codeql-action/pull/4051\">#4051</a></li>\n  </ul>\n  <h2>4.37.3 - 22 Jul 2026</h2>\n  <p>No user facing changes.</p>\n  <h2>4.37.2 - 21 Jul 2026</h2>\n  <ul>\n  <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href=\"https://redirect.github.com/github/codeql-action/pull/4023\">#4023</a></li>\n  </ul>\n  <!-- raw HTML omitted -->\n  </blockquote>\n  <p>... (truncated)</p>\n  </details>\n  <details>\n  <summary>Commits</summary>\n  <ul>\n  <li><a href=\"https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81\"><code>e4fba86</code></a> Merge pull request <a href=\"https://redirect.github.com/github/codeql-action/issues/4031\">#4031</a> from github/update-v4.37.3-72f6a9da0</li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7\"><code>fb50ab5</code></a> Update changelog for v4.37.3</li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1\"><code>72f6a9d</code></a> Merge pull request <a href=\"https://redirect.github.com/github/codeql-action/issues/4030\">#4030</a> from github/mbg/fix/no-proxy</li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646\"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778\"><code>bfb6be4</code></a> Merge pull request <a href=\"https://redirect.github.com/github/codeql-action/issues/4028\">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba\"><code>526ab84</code></a> Rebuild</li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07\"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1\"><code>e064762</code></a> Merge pull request <a href=\"https://redirect.github.com/github/codeql-action/issues/4027\">#4027</a> from github/update-v4.37.2-385bcdc5a</li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df\"><code>e0faed8</code></a> Add a couple of change notes</li>\n  <li><a href=\"https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20\"><code>73aad0e</code></a> Update changelog for v4.37.2</li>\n  <li>Additional commits viewable in <a href=\"https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81\">compare view</a></li>\n  </ul>\n  </details>\n  <br />\n  \n  \n  [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action/upload-sarif&package-manager=github_actions&previous-version=4.37.0&new-version=4.37.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n  \n  Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n  \n  [//]: # (dependabot-automerge-start)\n  [//]: # (dependabot-automerge-end)\n  \n  ---\n  \n  <details>\n  <summary>Dependabot commands and options</summary>\n  <br />\n  \n  You can trigger Dependabot actions by commenting on this PR:\n  - `@dependabot rebase` will rebase this PR\n  - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n  - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency\n  - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n  \n  \n  </details>\n\n\nACKs for top commit:\n  apoelstra:\n    ACK 2cac6e38036b3c175f0fc1368e231e06abf80817; successfully ran local tests\n\n\nTree-SHA512: 2df8a48df0f6bbfd286fe6fc7d9f0ec28a60df05a6665e1e39bba0ffa32711e0e79d2d1634cf2e0ccd5a6645822d83ec483329033e0097f65bcc574da200321d", "message_quality_score": 96, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/b51cec639fce671117b040b4727e9688824fc24b/"}, {"sha": "90330d153d87c1722bbb93063967fc3014c2b128", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de", "committed_at": "2026-09-21T01:19:51+00:00", "severity": "informational", "risk_score": 15, "summary": "This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin library code that users install or run, and nothing in the commit indicates a security problem.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de\n\na31e0b0e89778bbbd3d60ebc61c66c99b575a317 build(deps): bump dtolnay/rust-toolchain (dependabot[bot])\n\nPull request description:\n\n  Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de.\n  <details>\n  <summary>Commits</summary>\n  <ul>\n  <li><a href=\"https://github.com/dtolnay/rust-toolchain/commit/02cb101ec7c40f2c49e1d9714d64511d8e1b74de\"><code>02cb101</code></a> Merge pull request 185 from fufesou/feat/force-non-host</li>\n  <li><a href=\"https://github.com/dtolnay/rust-toolchain/commit/b38a663c5df0fd5ac7bb65ded7b02a3f7af3b636\"><code>b38a663</code></a> Pass --force-non-host unconditionally</li>\n  <li><a href=\"https://github.com/dtolnay/rust-toolchain/commit/a4f61a09a512763ecbf6a72db0464f906f59f011\"><code>a4f61a0</code></a> Document rustup non-host opt-in requirement</li>\n  <li><a href=\"https://github.com/dtolnay/rust-toolchain/commit/06b350f08c8596edaf3d95d38686ba934fc4a6a7\"><code>06b350f</code></a> Support force-non-host toolchains</li>\n  <li><a href=\"https://github.com/dtolnay/rust-toolchain/commit/d1031067263f94b142dd6c0ce24c5eb9d02d52a0\"><code>d103106</code></a> Predefine branches up to 1.120</li>\n  <li><a href=\"https://github.com/dtolnay/rust-toolchain/commit/3ea7b2dde9987cecfa88322de1f09983972fc8e9\"><code>3ea7b2d</code></a> Add 1.98.1 patch release</li>\n  <li>See full diff in <a href=\"https://github.com/dtolnay/rust-toolchain/compare/6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772...02cb101ec7c40f2c49e1d9714d64511d8e1b74de\">compare view</a></li>\n  </ul>\n  </details>\n  <br />\n  \n  \n  Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n  \n  [//]: # (dependabot-automerge-start)\n  [//]: # (dependabot-automerge-end)\n  \n  ---\n  \n  <details>\n  <summary>Dependabot commands and options</summary>\n  <br />\n  \n  You can trigger Dependabot actions by commenting on this PR:\n  - `@dependabot rebase` will rebase this PR\n  - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n  - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency\n  - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n  - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n  \n  \n  </details>\n\n\nACKs for top commit:\n  apoelstra:\n    ACK a31e0b0e89778bbbd3d60ebc61c66c99b575a317; successfully ran local tests\n\n\nTree-SHA512: 526c648af02ba919dcd53aac0d930303bd8e344360e703ad04f099a2948a933f107333f7a01d0d6f0a12668568a4abbf393c0c9c2c5bdc35543b04e62b3d185c", "message_quality_score": 91, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/90330d153d87c1722bbb93063967fc3014c2b128/"}, {"sha": "26042182c24721b4c62176b75a366c9f0f64dc6b", "project": "Blockstream Jade", "vendor": "Blockstream", "title": "fmt: fix and prevent future use of unsupported format spec \"zu\"", "committed_at": "2026-09-21T00:09:19+00:00", "severity": "informational", "risk_score": 20, "summary": "This commit fixes the use of the \"%zu\" printf format specifier, which is not supported by the ESP32 toolchain used in this project. The unsupported format could cause log messages and user-facing strings to display incorrect or garbage values. The commit also adds a CI check to prevent future use of \"%zu\". There is no direct evidence in the commit that this caused a security vulnerability such as information disclosure or memory corruption, but it is a code-quality fix that removes undefined/unsupported formatting behavior.", "author": "Jon Griffiths", "commit_message": "fmt: fix and prevent future use of unsupported format spec \"zu\"\n\nReported-by: oroderico <oroderico@users.noreply.github.com>", "message_quality_score": 65, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/blockstream-jade/26042182c24721b4c62176b75a366c9f0f64dc6b/"}, {"sha": "1a365d53027be8391c4886ce14c03bad6357c2df", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction", "committed_at": "2026-09-20T23:47:28+00:00", "severity": "informational", "risk_score": 20, "summary": "This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication it addresses a security bug or was triggered by a security report.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction\n\n0ac85705e849c7a44a730f6f2a41c6f0d069e42b primitives: make transaction and block exact encodable (Nick Johnson)\n95b2d374f7a48e30a951722df7e6120b660f0d18 primitives: refactor handrolled witness encoder iterator (Nick Johnson)\n50e81ce80404dd1d89557b0f2ea51e765e260eb4 consensus_encoding: add ExactSizeEncoder implementations to iterators (Nick Johnson)\n\nPull request description:\n\n  It is helpful in higher level protocols like PSBT to be able to get the serialized size of a type for things like length prefixes. To expose this on the top of the hierarchy `Block` and `Transaction` types, the lower level iterator needs to support exact size calculations (for stuff like inputs and outputs). A small code change, however, I think this is the first non-constant time exact size implementations due to iterator's dynamic size. I think it is worth it.\n\n\nACKs for top commit:\n  apoelstra:\n    ACK 0ac85705e849c7a44a730f6f2a41c6f0d069e42b; successfully ran local tests\n  tcharding:\n    ACK 0ac85705e849c7a44a730f6f2a41c6f0d069e42b\n\n\nTree-SHA512: ad73c908257bc3da58bd27842391fd851e01279dccd79f29bc29034c70854e9eff5d4537ec78eec677584b048b1b44fd7c0d90a866bc90267a26167c1eded6c2", "message_quality_score": 100, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/1a365d53027be8391c4886ce14c03bad6357c2df/"}, {"sha": "a31e0b0e89778bbbd3d60ebc61c66c99b575a317", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "build(deps): bump dtolnay/rust-toolchain", "committed_at": "2026-09-20T21:04:11+00:00", "severity": "informational", "risk_score": 15, "summary": "This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it does not change any library code, cryptographic logic, or user-facing behavior of the rust-bitcoin crate itself. There is no indication of a security issue in the diff.", "author": "dependabot[bot]", "commit_message": "build(deps): bump dtolnay/rust-toolchain\n\nBumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de.\n- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)\n- [Commits](https://github.com/dtolnay/rust-toolchain/compare/6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772...02cb101ec7c40f2c49e1d9714d64511d8e1b74de)\n\n---\nupdated-dependencies:\n- dependency-name: dtolnay/rust-toolchain\n  dependency-version: 02cb101ec7c40f2c49e1d9714d64511d8e1b74de\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>", "message_quality_score": 88, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/a31e0b0e89778bbbd3d60ebc61c66c99b575a317/"}, {"sha": "2cac6e38036b3c175f0fc1368e231e06abf80817", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "build(deps): bump github/codeql-action/upload-sarif", "committed_at": "2026-09-20T21:04:00+00:00", "severity": "informational", "risk_score": 15, "summary": "This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing behavior. There is no indication of a security fix or vulnerability.", "author": "dependabot[bot]", "commit_message": "build(deps): bump github/codeql-action/upload-sarif\n\nBumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/upload-sarif\n  dependency-version: 4.37.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>", "message_quality_score": 93, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/2cac6e38036b3c175f0fc1368e231e06abf80817/"}, {"sha": "7d7e7269e50df6412aab796fd67b59abc94cc4ba", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0", "committed_at": "2026-09-20T21:02:56+00:00", "severity": "informational", "risk_score": 15, "summary": "This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the workflow still uses it only to install and run the zizmor security scanner. There is no indication in the commit of any security bug, malicious change, or vulnerability being fixed or introduced.", "author": "dependabot[bot]", "commit_message": "build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.\n- [Release notes](https://github.com/astral-sh/setup-uv/releases)\n- [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9)\n\n---\nupdated-dependencies:\n- dependency-name: astral-sh/setup-uv\n  dependency-version: 9.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>", "message_quality_score": 93, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/7d7e7269e50df6412aab796fd67b59abc94cc4ba/"}, {"sha": "457cb9b54e91acde6a3216e9217876f9f197dc92", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates", "committed_at": "2026-09-20T10:00:24+00:00", "severity": "informational", "risk_score": 21, "summary": "This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated silently by the compiler. The team wants to drop it from errors because once an error type promises to be `Copy`, it can never later hold a `String` or other non-copyable data without a breaking change. This is a forward-looking API-cleanup change, not a fix for an active security bug. It also changes some error methods from taking `self` by value to taking `&self`, which is a minor API adjustment.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates\n\n836624fc736cff9382923ae3b512bf6a17aecc55 chacha20_poly1305: drop Copy from Error (satsfy (Renato Britto))\n642d545046f5f48ec26e7d4ef9dc28fd38fdec74 p2p: drop Copy from error types (satsfy (Renato Britto))\n8c2e6b1841211cff624d2492276066b8bcc1c0db key_expression: drop Copy from bip32 error types (satsfy (Renato Britto))\n61677cc71f0e35d2d6bcf3efcee5f969b634fa00 units: drop Copy from OutOfRangeError (satsfy (Renato Britto))\ndae6356f31b717a9dce7bdc71dd0954bd86e07a5 policy: say when an error type derives Copy (satsfy (Renato Britto))\n\nPull request description:\n\n  I'm reviewing every trait in units for 1.0. We try to use `Copy` on rust-bitcoin types, but I claim that the errors should not use it.\n  \n  The old criteria, \"`Copy` if and only if not `non_exhaustive`\", demands `Copy` on parse errors such as `ParseIntError`, which hold their input as a String and cannot derive it, and forbids it on `NumOpError`, which `NumOpResult` requires, and also misses important observations made previously in rust-bitcoin's history about the `Copy` trait (read the brief history below).\n  \n  An error that implements `Copy` cannot later be updated to include, say, a `String`, so every `Copy` put into an error is a public commitment that would require a breaking change later, making it valuable to remove before 1.0. The codebase tends to the minimization of Copy usage on errors already, 30+ changes would be required in units alone to satisfy the existing rule in policy.md atm.\n  \n  The only exception for using `Copy` are in errors that are a field of a type that derives `Copy`. That situation requires `Copy`, e.g.:\n  ```rs\n  #[derive(Copy, Clone)]\n  pub enum NumOpResult<T> {\n      Valid(T),\n      Error(NumOpError), // a field of a Copy type, so NumOpError must be Copy\n  }\n  ```\n  \n  A brief history of `Copy` trait discussions on rust-bitcoin:\n  \n  - [#843 PR checklist](https://github.com/rust-bitcoin/rust-bitcoin/issues/843): project adds checklist item for every public type and qualifies with \"does not implement traits we could regret (mainly `Copy`, `Eq`, `Ord`, `PartialOrd`)\".\n  - [#1127 Add policy section](https://github.com/rust-bitcoin/rust-bitcoin/pull/1127): \"error types should not commit to implementing traits they may not be able to implement in the future, especially `Copy`\". Turned into our present \"if and only if\".\n  - [#3879 Remove Copy from PushBytesError](https://github.com/rust-bitcoin/rust-bitcoin/pull/3879): \"it makes the code less maintainable because we must commit to implementing `Copy`\".\n  - [#4076 Derive Copy for NumOpResult](https://github.com/rust-bitcoin/rust-bitcoin/pull/4076): PR makes `NumOpError` `Copy` because the container needs it. The one exception on our new policy.\n  - [#6347 units: Clean up the api tests](https://github.com/rust-bitcoin/rust-bitcoin/pull/6347): `Copy` asserted on the `Enums`, errors excluded.\n\n\nACKs for top commit:\n  apoelstra:\n    ACK 836624fc736cff9382923ae3b512bf6a17aecc55; successfully ran local tests\n\n\nTree-SHA512: 3569d75dd11f84b6b9afe1806f2fb61a38d41720eaf5083bab9934019468d1caae3a1a861253b6de5599ad534d2306ba18a8009db9ef042987723afeb9afb95f", "message_quality_score": 100, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/457cb9b54e91acde6a3216e9217876f9f197dc92/"}, {"sha": "9da4c342a631a150565805a10b867a643703b1f6", "project": "Electrum", "vendor": "Electrum", "title": "Merge pull request #10981 from spesmilo/do_not_sign_txin_with_witness", "committed_at": "2026-09-20T09:42:54+00:00", "severity": "moderate", "risk_score": 68, "summary": "This change prevents Electrum from re-signing Bitcoin transaction inputs that already contain a witness (the data proving the input was authorized). The patch fixes a bug where Electrum could incorrectly sign a non-SegWit input as if it were SegWit when a PSBT already included a witness for that input. This could lead to producing invalid or unintended signatures during transaction signing, especially when handling partially-signed transactions from external signers.", "author": "ThomasV", "commit_message": "Merge pull request #10981 from spesmilo/do_not_sign_txin_with_witness\n\ntransaction: do not sign txin if if already has a witness", "message_quality_score": 73, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/electrum/9da4c342a631a150565805a10b867a643703b1f6/"}, {"sha": "ed42dabdcac431e15dc7d9c8120f8853b60d8a0f", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`", "committed_at": "2026-09-19T20:49:35+00:00", "severity": "informational", "risk_score": 18, "summary": "This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion logic is copied unchanged, and the old extension trait is removed so users can call the method more naturally. There is no indication this fixes a bug or vulnerability.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`\n\nfe90ee7a2142d6b589604bbc431dbf910675b8d4 addresses: Adjust Address::from_script docs (Mitchell Bagot)\n1161a9f4e53253ecb9be1b2363d92bfda55d7c47 Move from_script to Address and drop AddressExt (Mitchell Bagot)\n\nPull request description:\n\n  The Address::from_script method in AddressExt takes an AsRef\\<Params> argument. This argument is only used to extract the contained Network. Rather than use the Params type in the signature, which requires a bitcoin dep, the stable Network type should be used directly. With this change, the method can be directly moved to the main Address type. With said move, the extension trait can also be dropped entirely.\n  \n  Adjust and move AddressExt::from_script to the Address type in addresses. Drop the AddressExt trait.\n\n\nACKs for top commit:\n  apoelstra:\n    ACK fe90ee7a2142d6b589604bbc431dbf910675b8d4; successfully ran local tests\n  Kixunil:\n    ACK fe90ee7a2142d6b589604bbc431dbf910675b8d4\n\n\nTree-SHA512: b728a9c010799223704e5cf9097a95cb23ba156beb7efd34b6dcb6c0086df8cbbf08744e91ee500af43529ba8fbb416ebd251f1e5bcf9cda57d2f1a198563d8c", "message_quality_score": 96, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/ed42dabdcac431e15dc7d9c8120f8853b60d8a0f/"}, {"sha": "b225ae77e9251a813cf2bd61e7874629d6f3cb10", "project": "SeedSigner", "vendor": "SeedSigner", "title": "Merge pull request #1032 from kdmukai/psbt_output_ownership", "committed_at": "2026-09-19T20:39:33+00:00", "severity": "high", "risk_score": 80, "summary": "This commit fixes a security flaw in SeedSigner, a small hardware-wallet-like device used to sign Bitcoin transactions. Previously, the software trusted the PSBT file's own claim about which 'change' outputs belong back to the user's wallet. A malicious or buggy PSBT could mark an external payment as the user's own change, tricking the user into approving a transaction that sends funds to an attacker. The patch now independently rebuilds each output's receiving address from the user's seed and compares it to what the PSBT actually commits to, rejecting the transaction if the two disagree. It also adds checks for contradictory or malformed derivation-path claims.", "author": "Nick Klockenga", "commit_message": "Merge pull request #1032 from kdmukai/psbt_output_ownership\n\n[security] Verify that change outputs actually pay this seed", "message_quality_score": 88, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/seedsigner/b225ae77e9251a813cf2bd61e7874629d6f3cb10/"}, {"sha": "f94608590edbd60c4d0327cbc77f5eea0affee0d", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6061: Units improvements", "committed_at": "2026-09-19T16:33:52+00:00", "severity": "low", "risk_score": 35, "summary": "This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, and removes an artificial restriction. The changes are mostly additive or renaming; they do not appear to fix a known vulnerability and the commit message does not describe any security issue.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6061: Units improvements\n\na002978d05f88a0864bcb07ed3711999ab92dc22 Improve error messages of `serde` errors (Martin Habovstiak)\n30f7aba5ab61a27ab017cfd6dce93751338adb69 Add `FeeRate::from_sat_per_{vb,kvb,kwu}` methods (Martin Habovstiak)\nfc1bed37e0bdc3d19b78f26fca0238ea72d939a2 Rename `u32`-taking `FeeRate::from_sat_per_*` (Martin Habovstiak)\n861a8d609514423771e96e362b8ed345b27bb7c3 Deduplicate `FeeRate` constants in tests (Martin Habovstiak)\ne4e124e87aee47ed637b87932dcddf7a6867c5d4 Remove artificial restriction from `from_per_vb` (Martin Habovstiak)\n\nPull request description:\n\n  This makes various improvements to units - see commits.\n\n\nACKs for top commit:\n  apoelstra:\n    ACK a002978d05f88a0864bcb07ed3711999ab92dc22; successfully ran local tests\n\n\nTree-SHA512: 64978ac0bcc559d1148afc7f3b4683876575d5b2f816c5d3bc0b1dc71a110cdaaad898d5c7897b1ea195d734514f2e999b39417d82f267067fb4ee7a9fa5f511", "message_quality_score": 91, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/f94608590edbd60c4d0327cbc77f5eea0affee0d/"}, {"sha": "4a583f38ef2f18ae228ce802d4e10b8a6608ac2f", "project": "Bitcoin Core", "vendor": "Bitcoin Core", "title": "Merge bitcoin/bitcoin#36230: wallet: Improve `HasWalletDescriptor` performance and other canonical descriptor string followups", "committed_at": "2026-09-19T16:05:47+00:00", "severity": "informational", "risk_score": 18, "summary": "This is a Bitcoin Core wallet maintenance patch. It speeds up a wallet function that checks whether a descriptor already exists by caching a hash of the descriptor's canonical text, instead of rebuilding that text every time. It also tidies up serialization code, removes a default constructor, and adds v31.1 to backwards-compatibility tests. There is no indication this fixes an exploitable security bug.", "author": "merge-script", "commit_message": "Merge bitcoin/bitcoin#36230: wallet: Improve `HasWalletDescriptor` performance and other canonical descriptor string followups\n\n61edcf92532502e91c2e17b8c2a23b45f5773936 test: Add 31.1 to wallet back compat (Ava Chow)\nebf2f69ee81925057cdcc881e42e861dbdf39ae5 test: Simplify miniscript descriptor check in wallet back compat (Ava Chow)\nf6cbcfd98a000deb17521520074ba46965c410b1 wallet: Document WalletDescriptor::UpdateFrom (Ava Chow)\nf0f6dce849634e801ac81705176ca8b96abbaa09 descriptor, doc: Clarify miniscript CompatDescriptorHash (Ava Chow)\n405b1d6055e78866fe2d86ba6fb16534f9554a32 descriptor: Explicitly handle use_apostrophe cases (Ava Chow)\n64abb3e8d3610449d541bfff2db23b9ace3fa111 wallet: Compare descriptors by hash of canonical string (Ava Chow)\nbb5e8320d76f5175fdf86bdc4c2d24bfc1eed438 wallet: Make WalletDescriptor's descriptor const (Ava Chow)\n4cc00f7bc04b4c07827728ba5ce1094b338a76a8 wallet: Remove WalletDescriptor's default constructor (Ava Chow)\n\nPull request description:\n\n  Instead of re-computing the canonical descriptor string for every call to `HasWalletDescriptor`. `WalletDescriptor` will now compute it once upon construction and cache the hash of that string. The comparison uses a new `WalletDescriptor::Equals` function which compares the canonical string hashes. The hash is used to avoid holding possibly a large amount of memory for a string that is rarely used. This should fix the performance regression described in https://github.com/bitcoin/bitcoin/pull/35445#issuecomment-5633483553\n\n  Also addresses several review comments related to documentation and code readability:\n  - https://github.com/bitcoin/bitcoin/pull/35445#discussion_r3924705885\n  - https://github.com/bitcoin/bitcoin/pull/35445#discussion_r3924785232\n  - https://github.com/bitcoin/bitcoin/pull/35445#discussion_r3925352894\n  - https://github.com/bitcoin/bitcoin/pull/35445#discussion_r3925462409\n  - https://github.com/bitcoin/bitcoin/pull/35445#discussion_r3937800942\n  - https://github.com/bitcoin/bitcoin/pull/35445#discussion_r3961028442\n\nACKs for top commit:\n  Sjors:\n    ACK 61edcf92532502e91c2e17b8c2a23b45f5773936\n  polespinasa:\n    ACK 61edcf92532502e91c2e17b8c2a23b45f5773936\n\nTree-SHA512: d13057cdfa89f9831950502f19159a40ca1da693f47d8ae63613fbc74b588994f6748b9124947b29ad1f035cff6650f8ae3d7396025a2363fcf3d32de002adf1", "message_quality_score": 100, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/bitcoin-core/4a583f38ef2f18ae228ce802d4e10b8a6608ac2f/"}, {"sha": "5f05d8c5f6ddfa3821511f979651c81300fbe722", "project": "Bitcoin Core", "vendor": "Bitcoin Core", "title": "Merge bitcoin/bitcoin#36297: rpc: Correct invalid OpenRPC defaults", "committed_at": "2026-09-19T15:48:48+00:00", "severity": "informational", "risk_score": 21, "summary": "This is a documentation-only fix for Bitcoin Core's machine-readable RPC help data. It changes several default values from literal strings to 'hint' labels (because the real default depends on context) and corrects one boolean default from the string \"false\" to the actual value false. It does not change how Bitcoin Core processes transactions, validates blocks, or handles money. The only risk is that tools reading the OpenRPC metadata could previously receive invalid schema examples; this patch makes those examples valid.", "author": "merge-script", "commit_message": "Merge bitcoin/bitcoin#36297: rpc: Correct invalid OpenRPC defaults\n\nb7f740c594ba1482344a7906b799fb62c533464f rpc: Correct OpenRPC default metadata (will)\n\nPull request description:\n\n  `getopenrpcinfo` emits two defaults that do not satisfy their schemas.\n\n  This changes `getdeploymentinfo.blockhash` to a default hint, since its fallback describes the current chain tip, and makes `send.options.include_watching` default to boolean `false`.\n\nACKs for top commit:\n  nervana21:\n    ACK b7f740c594ba1482344a7906b799fb62c533464f\n  sedited:\n    ACK b7f740c594ba1482344a7906b799fb62c533464f\n\nTree-SHA512: fd99c3642ff39ef13116f7f18e2a93b398e347330ea24e5bfd01744528744e5c6fbff12a56213961f8703218a6100f0ea74a10fe3b1d9a221ba8b1fa307a907a", "message_quality_score": 81, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/bitcoin-core/5f05d8c5f6ddfa3821511f979651c81300fbe722/"}, {"sha": "88959aec3d7a9d11a509714d9bee97c29ee02269", "project": "LND", "vendor": "Lightning Labs", "title": "Merge pull request #11198 from gijswijs/amp-setlocal-reconstruction-fix", "committed_at": "2026-09-19T00:38:39+00:00", "severity": "moderate", "risk_score": 60, "summary": "This change fixes a bug in LND's handling of AMP (Atomic Multi-Path) payments. Previously, if one partial payment set failed to reconstruct its secret preimage, the entire invoice was canceled, including unrelated partial payment sets from other payers. Now only the failing set is canceled, and the invoice stays open so other valid sets can still complete and settle. This is a correctness/availability fix for reusable AMP invoices.", "author": "Olaoluwa Osuntokun", "commit_message": "Merge pull request #11198 from gijswijs/amp-setlocal-reconstruction-fix\n\ninvoices: cancel only the failing AMP set on reconstruction failure", "message_quality_score": 73, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/lnd/88959aec3d7a9d11a509714d9bee97c29ee02269/"}, {"sha": "ef4820e5dfa08c63c7f689dfd6b8b748986db05e", "project": "LND", "vendor": "Lightning Labs", "title": "Merge pull request #11200 from ziggie1984/build-go-1.27.1", "committed_at": "2026-09-18T23:42:13+00:00", "severity": "low", "risk_score": 29, "summary": "This commit updates the Go programming language version used to build LND from 1.25.13/1.26.6 to 1.26.8 (language version) and 1.27.1 (toolchain). It also regenerates many automatically generated RPC files and adjusts linter settings. The main security angle is that newer Go releases typically fix bugs and security vulnerabilities in the Go runtime and standard library, so staying current is good defensive hygiene. However, the commit itself does not describe any specific vulnerability being fixed, and the code changes are mostly version bumps and generated file updates rather than targeted security patches.", "author": "Olaoluwa Osuntokun", "commit_message": "Merge pull request #11200 from ziggie1984/build-go-1.27.1\n\nbuild: bump Go language to 1.26.8 and toolchain to 1.27.1", "message_quality_score": 73, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/lnd/ef4820e5dfa08c63c7f689dfd6b8b748986db05e/"}, {"sha": "6e2cb6b69f4d1e76720141476c351b3b6c333e90", "project": "Blockstream Jade", "vendor": "Blockstream", "title": "otp: release md context on failure and clean temporary buffers", "committed_at": "2026-09-18T20:45:41+00:00", "severity": "low", "risk_score": 33, "summary": "This commit fixes cleanup in the one-time-password (OTP) code. Previously, if setting up the cryptographic hash context failed, the code could return without freeing that context, and temporary buffers holding sensitive counter/HMAC data were not always wiped. The change ensures the context is released on failure and wipes temporary buffers before returning. It is a defensive hardening fix rather than a clear exploitable vulnerability.", "author": "Mike Tolkachev", "commit_message": "otp: release md context on failure and clean temporary buffers", "message_quality_score": 30, "message_quality_label": "Opaque", "message_quality_flags": ["No meaningful explanatory body", "Contains work-in-progress language", "Opaque security-relevant change"], "url": "https://commitwatch.org/watch/blockstream-jade/6e2cb6b69f4d1e76720141476c351b3b6c333e90/"}, {"sha": "b7f740c594ba1482344a7906b799fb62c533464f", "project": "Bitcoin Core", "vendor": "Bitcoin Core", "title": "rpc: Correct OpenRPC default metadata", "committed_at": "2026-09-18T19:22:55+00:00", "severity": "informational", "risk_score": 20, "summary": "This commit fixes documentation metadata for six Bitcoin Core RPC arguments. It changes how default values are described so that automatically generated API docs and schemas are accurate. The actual behavior of the software when running is unchanged, so there is no direct security risk to users.", "author": "will", "commit_message": "rpc: Correct OpenRPC default metadata\n\nCorrect six argument metadata entries that produce misleading or invalid\nOpenRPC defaults.\n\nThe getdeploymentinfo blockhash fallback and four sighashtype fallbacks\ndescribe how omitted arguments are resolved. They are not literal values\naccepted by the RPCs, so mark them as DefaultHint values.\n\nThe send include_watching option is boolean, but its string default makes\nthe generated schema internally inconsistent. Use a boolean value,\nmatching the analogous sendall option.\n\nRuntime behavior is unchanged.", "message_quality_score": 68, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/bitcoin-core/b7f740c594ba1482344a7906b799fb62c533464f/"}, {"sha": "46408a78b6a891dc869245f0e81ee10e0fa54c1a", "project": "Electrum", "vendor": "Electrum", "title": "Merge pull request #10974 from SomberNight/202609_nostr_psbt_xpub", "committed_at": "2026-09-18T17:08:26+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit only adds a long code comment explaining a design choice in Electrum's PSBT-over-Nostr plugin. It does not change any program behavior. The comment documents that the plugin derives each cosigner's Nostr secret key from their Bitcoin extended public key (xpub), which means every cosigner can also compute every other cosigner's secret key. The developers explicitly call this an accepted tradeoff because the only shared cryptographic material among cosigners is the xpubs, and the Nostr keys are only used to exchange proposed transaction drafts (PSBTs). No vulnerability is introduced or fixed by this change.", "author": "ThomasV", "commit_message": "Merge pull request #10974 from SomberNight/202609_nostr_psbt_xpub\n\nplugins: psbt_nostr: document design choice for using xpub as nsec", "message_quality_score": 73, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/electrum/46408a78b6a891dc869245f0e81ee10e0fa54c1a/"}, {"sha": "5324e59a5b9c1e336076c2b0f409bbd2fdfdd4bf", "project": "rust-bitcoin", "vendor": "Rust Bitcoin", "title": "Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub", "committed_at": "2026-09-18T16:32:02+00:00", "severity": "low", "risk_score": 49, "summary": "This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error with a misleading 'overflow' error. Now it correctly keeps and reports the original error. This is a defensive correctness fix: it prevents error details from being lost, which could hide the true cause of a failure in downstream software.", "author": "Andrew Poelstra", "commit_message": "Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub\n\nb0d240127f78cffa4cfdba72c5b85bcfcd0a0810 units: Test add and sub preserve div-by-zero error (Jamil Lambert, PhD)\n0004180290e08500d3833e7289451fdf78b8049a units: Preserve error in NumOpResult add and sub (Jamil Lambert, PhD)\n\nPull request description:\n\n  Adding or subtracting `NumOpResults` replaced any error operand with a fresh overflow error.\n  \n  Propagate the original error instead of constructing a new overflow error.\n  \n  Closes project-loupe/audit-rust-bitcoin#167\n  Closes project-loupe/audit-rust-bitcoin#168\n\n\nACKs for top commit:\n  tcharding:\n    ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810\n  Kixunil:\n    ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810\n  apoelstra:\n    ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810; successfully ran local tests\n\n\nTree-SHA512: f4f8ae1aaa011842fa0e350a43f1dff3b6fd3a944f971beeae85f6422a4b81d3e8f9c23df9c42ec870a72eeb09f13d16508eb1c977790e7b78147f702640d960", "message_quality_score": 96, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/rust-bitcoin/5324e59a5b9c1e336076c2b0f409bbd2fdfdd4bf/"}, {"sha": "2bf0eed62d9bbefb678e83c837604e5f8ba0d414", "project": "Ledger Bitcoin app", "vendor": "Ledger", "title": "python client: use default value for nSequence if not given", "committed_at": "2026-09-18T15:48:02+00:00", "severity": "informational", "risk_score": 24, "summary": "This commit fixes a small bug in the Python helper library that builds unsigned Bitcoin transactions from PSBT data. Previously, if a PSBT did not explicitly include a per-input sequence number, the code would crash with an assertion error. The change follows the BIP-370 standard and HWI by treating a missing sequence number as the default final value (0xffffffff). This is a client-side convenience fix; it does not change how the Ledger device itself validates or signs transactions.", "author": "Salvatore Ingala", "commit_message": "python client: use default value for nSequence if not given\n\nMatches BIP-370 and HWI's implementation upstream.", "message_quality_score": 65, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/ledger-bitcoin-app/2bf0eed62d9bbefb678e83c837604e5f8ba0d414/"}, {"sha": "bb9d32804f1b1feb16dc7eda0c1c09dcf1f9cd06", "project": "Electrum", "vendor": "Electrum", "title": "Merge pull request #10980 from spesmilo/add_input_from_network_do_not_ignore_exceptions", "committed_at": "2026-09-18T15:41:23+00:00", "severity": "low", "risk_score": 42, "summary": "This is a one-line bugfix in Electrum's transaction handling. Previously, the code accidentally swallowed (hid) almost all exceptions when fetching extra transaction data from the network, only re-raising errors that were both network-related and not set to be ignored. After the fix, any unexpected error is re-raised so it can be handled or reported properly. The change improves reliability and error visibility, but the diff alone does not show an active security vulnerability being exploited.", "author": "ghost43", "commit_message": "Merge pull request #10980 from spesmilo/add_input_from_network_do_not_ignore_exceptions\n\nadd_info_from_network: do not swallow exceptions", "message_quality_score": 73, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/electrum/bb9d32804f1b1feb16dc7eda0c1c09dcf1f9cd06/"}, {"sha": "4b92c0f27f4d41e209d577eda31aecc4e26e6ee9", "project": "Electrum", "vendor": "Electrum", "title": "Merge pull request #10970 from f321x/fix_bolt11_bugs_2", "committed_at": "2026-09-18T14:50:56+00:00", "severity": "moderate", "risk_score": 60, "summary": "This commit fixes several bugs in Electrum's handling of BOLT11 Lightning invoices. The most user-visible fixes are: stricter validation of invoice amounts (rejecting zero, negative, sub-millisatoshi, and leading-zero amounts), correct padding of the timestamp field so small dates don't get corrupted, preserving the 'n' (public key) tag when decoding so re-encoding doesn't silently drop it, and removing support for the non-standard 't' routing tag that could previously hide malformed data. There is also a fix to how description fields are truncated so they don't produce invalid UTF-8. These are correctness and robustness fixes rather than a single critical vulnerability, but they could have allowed malformed or ambiguous invoices to be accepted or re-encoded incorrectly.", "author": "ghost43", "commit_message": "Merge pull request #10970 from f321x/fix_bolt11_bugs_2\n\nbolt11: bugfixes and cleanup", "message_quality_score": 58, "message_quality_label": "Thin", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/electrum/4b92c0f27f4d41e209d577eda31aecc4e26e6ee9/"}, {"sha": "d48e76e689bb4d680d9d8a70b67f994be2f0cdd1", "project": "Bitcoin Core", "vendor": "Bitcoin Core", "title": "Merge bitcoin/bitcoin#36286: crypto: Fix MuHash3072 division by itself", "committed_at": "2026-09-18T14:46:38+00:00", "severity": "informational", "risk_score": 24, "summary": "This commit fixes a bug in Bitcoin Core's MuHash3072 cryptographic code where dividing a MuHash object by itself (x /= x) produced the wrong mathematical result. The fix is straightforward: the code now saves the divisor's numerator before modifying it, so the second multiplication step uses the original value rather than the already-changed one. The bug only affects self-division, and the project maintainers state that no live node or index code actually performs this operation, so running Bitcoin nodes are not affected. Tests and fuzzing targets were updated to catch this case in the future.", "author": "merge-script", "commit_message": "Merge bitcoin/bitcoin#36286: crypto: Fix MuHash3072 division by itself\n\nb388f9bd0d2bcc259d488638d479ba09a30ba040 crypto: Fix MuHash3072 division by itself (Fabian Jahr)\n\nPull request description:\n\n  `MuHash3072::operator/=` multiplies the numerator by the divisor's denominator and then the denominator by the divisor's numerator. But as it is currently implemented the divisor could be the MuHash object itself. When that is the case, the second step reads the numerator that the first step already updated, so `x /= x` actually leaves `1/D` instead of the empty set. This only goes unnoticed when the denominator is 1, which is the case in our existing fuzz target and benchmark. No code in the node/index divides MuHash objects by themselves, so runnings nodes are not affected.\n\n  Fixes the code by not using the potentially changed nominator, adds a test that reproduces the issue and updates the fuzz test to not always use denominator 1.\n\nACKs for top commit:\n  furszy:\n    utACK b388f9bd0d2bcc259d488638d479ba09a30ba040\n  sedited:\n    ACK b388f9bd0d2bcc259d488638d479ba09a30ba040\n  sipa:\n    utACK b388f9bd0d2bcc259d488638d479ba09a30ba040\n\nTree-SHA512: ae2eb845db07fb140e7946dfc7d084766e5f6d06060b91da6acc3434fdf6b59ad1eb050b4be79bc4644dea032d1ca0d01dd9e9b366bd04a545cf5224e57526df", "message_quality_score": 91, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/bitcoin-core/d48e76e689bb4d680d9d8a70b67f994be2f0cdd1/"}, {"sha": "3f67b21be72ac7b6199429b22acd464b1daa0e4b", "project": "Electrum", "vendor": "Electrum", "title": "add_info_from_network: do not swallow exceptions", "committed_at": "2026-09-18T14:36:52+00:00", "severity": "moderate", "risk_score": 61, "summary": "Electrum's transaction builder had a bug where it would ignore certain consistency errors when fetching extra transaction data from the network. A malicious or misbehaving server could supply a wrong input amount, and Electrum would silently continue and sign the transaction with that wrong amount. The resulting transaction would be invalid and not accepted by the Bitcoin network, so no funds could be lost, but it could cause confusion, failed payments, or be used to probe wallet behavior.", "author": "ThomasV", "commit_message": "add_info_from_network: do not swallow exceptions\n\nAn attacker can provide a witness_utxo whose value disagrees  with\nthe real previous transaction. That would raise PSBTInputConsistencyFailure,\nwhich is swallowed because it is not a NetworkException.\n\nThis would lead us to sign a tx with the wrong input amount.\n(no fund loss: the tx is invalid under BIP143)", "message_quality_score": 80, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/electrum/3f67b21be72ac7b6199429b22acd464b1daa0e4b/"}, {"sha": "e78fba28f8a435742b32de3ada4eca66384059f7", "project": "Electrum", "vendor": "Electrum", "title": "bolt11: remove tag arg from get_routing_info", "committed_at": "2026-09-18T14:29:08+00:00", "severity": "informational", "risk_score": 15, "summary": "This is a small code cleanup change. A function that reads routing hints from Lightning invoices no longer takes a tag argument because only one type of routing hint ('r') is now supported. All callers are updated accordingly. There is no security issue visible in the change.", "author": "f321x", "commit_message": "bolt11: remove tag arg from get_routing_info\n\nThrough the removal of t-type routing info tags\nthis argument isn't neccessary anymore.", "message_quality_score": 60, "message_quality_label": "Adequate", "message_quality_flags": [], "url": "https://commitwatch.org/watch/electrum/e78fba28f8a435742b32de3ada4eca66384059f7/"}, {"sha": "bada7ea3a76268b05fb013a304d2279688cdb148", "project": "LND", "vendor": "Lightning Labs", "title": "build: adopt focused golangci-lint v2.13 checks", "committed_at": "2026-09-18T13:59:25+00:00", "severity": "informational", "risk_score": 15, "summary": "This commit is a routine build-maintenance change. It updates the project's Go linter configuration to a newer version and fixes the resulting style warnings: a WebSocket header spelling and several documentation comments that didn't start with the correct symbol names. There is no functional code change that affects security.", "author": "ziggie", "commit_message": "build: adopt focused golangci-lint v2.13 checks\n\nThe linter configuration uses default: all, so upgrading golangci-lint also\nenables checks introduced after v2.4. Adopt canonicalheader, clickhouselint,\ngodoclint, iotamixing, and unqueryvet because they add focused HTTP,\ndocumentation, const-block, and SQL safeguards.\n\nFix the canonical WebSocket protocol header spelling required by the expanded\ncanonicalheader implementation. Update twelve existing doc comments to begin\nwith their declared symbol names as required by godoclint.\n\nKeep modernize disabled for now because its findings require broader code\nchanges that should be reviewed separately against the Go 1.26 support\nbaseline.", "message_quality_score": 92, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/lnd/bada7ea3a76268b05fb013a304d2279688cdb148/"}, {"sha": "dc937ba29ae04bbccfa3a1c6467d1372640f3b0e", "project": "Trezor firmware", "vendor": "Trezor", "title": "fix(core/bootloader): keep the full block length for block-0 retries", "committed_at": "2026-09-18T11:37:22+00:00", "severity": "low", "risk_score": 45, "summary": "This commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the bootloader tried to retry, it accidentally asked for only the leftover remainder but placed it at the start of the buffer. That produced a corrupted block, the hash check failed, every retry failed, and the firmware update aborted. The fix makes retries request the whole first block again from the beginning. There is no evidence this bug was exploitable by an attacker; it appears to be a reliability defect that could brick or stall legitimate updates, especially over Bluetooth on the T3W1 model.", "author": "tychovrahe", "commit_message": "fix(core/bootloader): keep the full block length for block-0 retries\n\nBlock 0 is the only block fetched in two requests: an initial\nIMAGE_INIT_CHUNK_SIZE prefetch so the headers can be validated, then the\nremainder. `chunk_requested` was serving three roles at once -- request size,\nexpected buffer fill, and the amount still owed on `remaining` -- and after the\nheader prefetch it holds only the remainder.\n\nA retry then asked for that remainder from offset 0. The size check compared\n`chunk_size` against `chunk_requested + read_offset`, i.e. the remainder against\nitself, so it passed and `on_chunk` received a truncated block: the first\n`chunk_limit - IMAGE_INIT_CHUNK_SIZE` bytes sitting at buffer offset 0. The hash\nthen necessarily mismatched, so the retry budget burned down and the upload\naborted. Block-0 retries could never succeed -- on T3W1 that is a 256 KB block,\nwhere a transient BLE error is most likely.\n\nReplace `chunk_requested` with `chunk_expected`: the bytes the buffer must hold\nfor the chunk to be complete, i.e. the whole block. It is the only field of its\nkind left -- every request is derived from it, `remaining` is decremented by what\nactually arrived, and `read_offset` goes back to being purely a buffer write\noffset. The retry re-fetches the whole block from its start, and the size check\ncompares against what the buffer must actually hold.\n\nNo behavioural change on the success path: the bytes asked for at each request\nsite are the same as before, and what the old check computed is exactly what\n`chunk_expected` now holds.\n\nAlongside, in the same code: the image-size validation becomes an early guard in\n`run_image_upload`, which is what guarantees a full init chunk to prefetch;\n`confirmed` folds into `headers_parsed`, both having been set at the same point;\nand the result dispatch becomes a switch.\n\nThe same bug is in wf_firmware_update.c on main; this fix is written against the\nextracted engine but applies there unchanged.\n\n[no changelog]\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>", "message_quality_score": 85, "message_quality_label": "Strong", "message_quality_flags": [], "url": "https://commitwatch.org/watch/trezor-firmware/dc937ba29ae04bbccfa3a1c6467d1372640f3b0e/"}, {"sha": "caab7d9eedb0250a5da5101f2c158833a07bd678", "project": "Trezor firmware", "vendor": "Trezor", "title": "refactor(core/bootloader): separate image upload and image checks", "committed_at": "2026-09-18T11:37:21+00:00", "severity": "informational", "risk_score": 12, "summary": "This commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c, while keeping the firmware-specific checks (signatures, versions, user confirmation, per-chunk hash checks) in wf_firmware_update.c. There is no direct evidence in the diff that this change fixes or introduces a security vulnerability; it appears to be a structural refactor to make the upload code reusable for other image types in the future.", "author": "tychovrahe", "commit_message": "refactor(core/bootloader): separate image upload and image checks\n\n[no changelog]", "message_quality_score": 62, "message_quality_label": "Adequate", "message_quality_flags": ["No meaningful explanatory body"], "url": "https://commitwatch.org/watch/trezor-firmware/caab7d9eedb0250a5da5101f2c158833a07bd678/"}]}