CommitWatch RSS
D
← Developer activityStrong match

dependabot[bot]

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

93 commits7 monitored projects4 candidates0 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to dependabot[bot]A visual map of monitored and externally discovered repositories.Ddeveloper26rust-bitcoin28electrs25Trezor firmware5libwally-core5Passport firmware3COLDCARD firmware1BitBox02 firmware
Monitored evidence

CommitWatch projects

rust-bitcoinRust Bitcoin26 commits4 candidates0 high riskelectrselectrs28 commits0 candidates0 high riskTrezor firmwareTrezor25 commits0 candidates0 high risklibwally-coreElements Project5 commits0 candidates0 high riskPassport firmwareFoundation5 commits0 candidates0 high riskCOLDCARD firmwareCoinkite3 commits0 candidates0 high riskBitBox02 firmwareBitBox1 commits0 candidates0 high risk
External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Informational 15 AI analysisMessage 93 · Strong
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

build(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 in /src/wasm_package

This is an automated dependency update by Dependabot that bumps the JavaScript package fast-uri from version 3.1.4 to 3.1.5 inside the WebAssembly packaging directory. The change only updates version numbers and package hashes in package-l…

d3f6adf0by dependabot[bot]+6−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that bumps the version of a GitHub-owned action used to upload security scan results. It changes one pinned commit hash in a CI workflow file and does not alter any project code, cryptograph…

69e50bb3by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.3 to 2.79.12

This is a routine automated update by Dependabot that bumps a GitHub Actions helper (taiki-e/install-action) used in testing workflows from version 2.79.3 to 2.79.12. It only changes which version of the action is used to install Rust test…

d953dcccby dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 93 · Strong
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

build(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in /src/wasm_package

This is an automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.2 to 3.1.4 inside the WebAssembly packaging directory. It only changes a package-lock.json file and is marked as a development dep…

Dependency version bump of fast-uri (indirect devDependency)No changes to libwally-core native/WASM cryptographic codeNo vendor security advisory or CVE referenced in commit message
c25fc5fdby dependabot[bot]+6−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 76 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Bump pillow from 12.1.1 to 12.3.0 in /misc/q1font

This is a routine automated update by Dependabot that bumps the Python Pillow image-processing library from version 12.1.1 to 12.3.0 inside a small helper tool used only for font generation. The commit itself does not describe any security…

Dependency version bump of an image-processing library with a history of memory-safety bugsNo security claim, CVE reference, or advisory link supplied in commit or referencesChanged component is an auxiliary build-time font tool, not device firmware
bcc2c382by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.62.45 to 2.79.3

This is a routine Dependabot update that bumps a GitHub Actions helper (taiki-e/install-action) used in automated testing workflows to a newer minor version. It does not change the project's actual Bitcoin library code, its dependencies, o…

99e1381bby dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions helper used to download build artifacts in a daily fuzzing workflow. There is no code change to the rust-bitcoin library itself, and no security is…

5099d280by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that bumps the version of a GitHub-provided action used to upload security scan results. It changes only a pinned commit hash in a workflow file and does not alter the project's actual Bitco…

4460fb54by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
ER electrselectrs BitcoinIndexing infrastructureSoftware wallets

Bump log from 0.4.29 to 0.4.33

This is an automated dependency update by Dependabot that bumps the Rust `log` crate from version 0.4.29 to 0.4.33. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication in t…

9175b0f9by dependabot[bot]+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/github-script from 8.0.0 to 9.0.0

This is a routine update by Dependabot that bumps the version of a GitHub Actions helper called actions/github-script from version 8.0.0 to 9.0.0 in two workflow files. The workflows only manage issue/label automation after CI runs and do …

Dependency version bump of a third-party GitHub ActionWorkflows use GITHUB_TOKEN with repository write scopes for issue/label managementNo vendor disclosure of security relevance
5d64b04fby dependabot[bot]+3−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump cargo-bins/cargo-binstall from 1.15.10 to 1.19.1

This is a routine automated dependency update by Dependabot. It changes the version of a GitHub Action used to install a Rust tool during automated semver compatibility checks. There is no indication in the commit that this fixes or introd…

784f797eby dependabot[bot]+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions helper used to save build artifacts in three CI workflow files. There is no indication of a security issue in the project code itself, and the chan…

9f63707fby dependabot[bot]+3−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/labeler from 6.0.1 to 6.1.0

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions workflow helper (actions/labeler) used to automatically label pull requests. There is no indication of a security issue in the change itself, and n…

d858acd1by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1

This is a routine Dependabot update that bumps a GitHub Actions helper used by automated weekly maintenance workflows to create pull requests. The change only affects internal tooling, not the Rust Bitcoin library code that users rely on. …

Third-party GitHub Action version bump in CI/CD workflowsWorkflows use a repository secret (APOELSTRA_CREATE_PR_TOKEN) when creating pull requestsNo vendor security advisory or CVE referenced in commit or supplied materials
21337179by dependabot[bot]+5−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained security scanning helper (the CodeQL upload-sarif action) inside a CI workflow. It does not change the project's actual Bitcoin library code, its public interfaces, or how user …

29bb6aa2by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 5.0.0 to 6.0.2

This is a routine automated update by Dependabot that changes the version of the GitHub Actions 'checkout' tool used by the project's CI workflows from version 5.0.0 to version 6.0.2. It only affects how the repository code is downloaded d…

14a75c38by dependabot[bot]+32−3216 files
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →