Rust Electrum server that indexes Bitcoin Core data for wallet queries.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 641 seen0 candidatesCompleteFeb 6 → Jun 615 seen0 candidatesCompleteJun 6 → Jul 64 seen0 candidatesCompleteJul 6 → Aug 55 seen0 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 29 minutes ago
This commit is a routine version bump from 0.11.1 to 0.12.0 in the project's package metadata files. It changes only the version number strings in Cargo.toml and Cargo.lock. There is no code change, no bug fix, and no security-related cont…
37501cc4by Roman Zeyde+2−22 filesThis commit only adds a new section to the RELEASE-NOTES.md file describing version 0.12.0. It lists user-visible changes such as a new indexing dependency, API fixes, a new SECURITY.md file, and routine dependency updates. No program code…
6c763137by Roman Zeyde+8−01 fileThis is an automated patch by Dependabot that updates the 'log' programming library from version 0.4.33 to 0.4.34. The change only updates a version number and cryptographic checksum in the project's dependency lock file. There is no indic…
264e8cb8by dependabot[bot]+2−21 fileThis commit only adds a SECURITY.md file to the project. It is a documentation-only change that explains the project's security policy and how to report vulnerabilities. No code was changed, and no security vulnerability was fixed or intro…
da1860e6by Roman Zeyde+14−01 fileThis is a routine automated patch by Dependabot that updates a single Rust dependency, crossbeam-channel, from version 0.5.15 to 0.5.16. The change only modifies the recorded version and cryptographic checksum in the project's lock file. T…
00b85822by dependabot[bot]+2−21 fileThis is an automated dependency update by Dependabot that bumps the serde_json library from version 1.0.150 to 1.0.151. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication …
b69f1a57by dependabot[bot]+2−21 fileThis commit only updates user-facing documentation and a helper shell script for an upcoming release. It changes wording in setup guides, replaces old example output with newer version numbers, and switches the default database directory i…
9cd09afaby Roman Zeyde+62−1176 filesThis is an automated dependency update by Dependabot that bumps the Rust `log` crate from version 0.4.29 to 0.4.33. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication in t…
9175b0f9by dependabot[bot]+2−21 fileThis commit simply updates the version of Bitcoin Core used in the project's automated testing environment from a release candidate (31.0rc2) to the final stable release (31.1). It is a routine CI/infrastructure maintenance change with no …
eed01b98by Roman Zeyde+4−41 fileThis commit only updates a single line in the installation documentation, changing the recommended minimum version of Bitcoin Core from 0.21+ to 31.0+. There is no code change, no bug fix, and no security patch in the diff itself.
c0a4b3faby Roman Zeyde+1−11 fileThis commit is a routine feature update. It upgrades a dependency called bindex from version 0.1.1 to 0.1.2 and changes the code to pass a configurable REST server URL into the indexing component. There is no indication in the commit that …
1255a377by Roman Zeyde+6−53 filesThis commit fixes broken documentation links. It changes three Markdown links from an incorrect anchor name (binaries.md#cnative-os-packages) to the correct one (binaries.md#native-os-packages). There is no code change and no security rele…
31c3fc5bby haoshengzhen+3−32 filesThis is an automated dependency update by Dependabot that bumps the serde_json library from version 1.0.149 to 1.0.150. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication …
ca254cb5by dependabot[bot]+2−21 fileThis is a routine automated dependency update by Dependabot, bumping the Rust 'bytes' library from version 1.11.0 to 1.11.1. Only the Cargo.lock file changed. There is no indication in the commit of any security fix, bug fix, or behavior c…
d889624fby dependabot[bot]+2−21 fileThis is a routine dependency update by Dependabot that upgrades the jsonrpc library used by the electrs Bitcoin server from version 0.18.0 to 0.20.1. The change also removes an older copy of the base64 library from the dependency tree. Dep…
acf4b98dby dependabot[bot]+6−122 filesThis is a large refactoring commit that replaces electrs's custom Bitcoin indexing, chain tracking, P2P networking, and RocksDB storage code with a new external library called `bindex`. It removes thousands of lines of in-house code (index…
0fe14fdfby Roman Zeyde+450−282724 filesThis is an automated patch by Dependabot that updates the 'bitcoin' Rust library used by the electrs project from version 0.32.8 to 0.32.9. Only version and checksum numbers changed in the dependency list; no project source code was modifi…
32e5944aby dependabot[bot]+3−32 filesThis is a routine automated dependency update by Dependabot that bumps the 'rayon' Rust library from version 1.11.0 to 1.12.0. The change only updates version numbers in the project's package manifest and lock file. There is no indication …
d81dc35aby dependabot[bot]+3−32 filesThis commit simply removes a previously added feature: support for Unix domain sockets. It reverts the code back to using only standard TCP network sockets. There is no indication in the commit itself that this is a security fix, and the c…
c134d64dby Roman Zeyde+29−18410 filesThis commit adds support for Unix domain sockets to the electrs Bitcoin Electrum server. The main security benefit is that administrators can use filesystem permissions to control which local users or processes can connect, instead of rely…
898e57dcby Martin Habovstiak+184−2910 filesExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
37501cc4 · Sep 13, 2026 · 2 filesInformational 15Release 0.12.0
Why it was queuedThis commit is a routine version bump from 0.11.1 to 0.12.0 in the project's package metadata files. It changes only the version number strings in Cargo.toml and Cargo.lock. There is no code change, no bug fix, and no security-related content in the diff.
6c763137 · Sep 13, 2026 · 1 fileInformational 15Add 0.12.0 changelog
Why it was queuedThis commit only adds a new section to the RELEASE-NOTES.md file describing version 0.12.0. It lists user-visible changes such as a new indexing dependency, API fixes, a new SECURITY.md file, and routine dependency updates. No program code was changed, so this commit by itself cannot introduce, fix, or exploit a security vulnerability.
264e8cb8 · Aug 31, 2026 · 1 fileInformational 15Bump log from 0.4.33 to 0.4.34
Bumps [log](https://github.com/rust-lang/log) from 0.4.33 to 0.4.34.
- [Release notes](https://github.com/rust-lang/log/releases)
- [Changelog](https://github.com/rust-lang/log/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/log/compare/0.4.33...0.4.34)
---
updated-dependencies:
- dependency-name: log
dependency-version: 0.4.34
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is an automated patch by Dependabot that updates the 'log' programming library from version 0.4.33 to 0.4.34. The change only updates a version number and cryptographic checksum in the project's dependency lock file. There is no indication of a security fix or vulnerability in the commit itself, and no security references were provided.
da1860e6 · Aug 29, 2026 · 1 fileInformational 15Add SECURITY.md
Why it was queuedThis commit only adds a SECURITY.md file to the project. It is a documentation-only change that explains the project's security policy and how to report vulnerabilities. No code was changed, and no security vulnerability was fixed or introduced.
00b85822 · Jul 20, 2026 · 1 fileInformational 15Bump crossbeam-channel from 0.5.15 to 0.5.16
Bumps [crossbeam-channel](https://github.com/crossbeam-rs/crossbeam) from 0.5.15 to 0.5.16.
- [Release notes](https://github.com/crossbeam-rs/crossbeam/releases)
- [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/main/CHANGELOG.md)
- [Commits](https://github.com/crossbeam-rs/crossbeam/compare/crossbeam-channel-0.5.15...crossbeam-channel-0.5.16)
---
updated-dependencies:
- dependency-name: crossbeam-channel
dependency-version: 0.5.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine automated patch by Dependabot that updates a single Rust dependency, crossbeam-channel, from version 0.5.15 to 0.5.16. The change only modifies the recorded version and cryptographic checksum in the project's lock file. There is no indication in the commit itself that this update fixes a security vulnerability.
b69f1a57 · Jul 20, 2026 · 1 fileInformational 15Bump serde_json from 1.0.150 to 1.0.151
Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.150 to 1.0.151.
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.150...v1.0.151)
---
updated-dependencies:
- dependency-name: serde_json
dependency-version: 1.0.151
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is an automated dependency update by Dependabot that bumps the serde_json library from version 1.0.150 to 1.0.151. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication in the commit itself that this fixes a security issue, and no security references were provided.
9175b0f9 · Jul 18, 2026 · 1 fileInformational 15Bump log from 0.4.29 to 0.4.33
Bumps [log](https://github.com/rust-lang/log) from 0.4.29 to 0.4.33.
- [Release notes](https://github.com/rust-lang/log/releases)
- [Changelog](https://github.com/rust-lang/log/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/log/compare/0.4.29...0.4.33)
---
updated-dependencies:
- dependency-name: log
dependency-version: 0.4.33
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is an automated dependency update by Dependabot that bumps the Rust `log` crate from version 0.4.29 to 0.4.33. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication in the commit of any security fix or vulnerability being addressed, and the `log` crate is a widely-used, stable logging utility. This appears to be a routine maintenance patch with no direct security relevance.
c0a4b3fa · Jul 18, 2026 · 1 fileInformational 15Require latest bitcoind
Why it was queuedThis commit only updates a single line in the installation documentation, changing the recommended minimum version of Bitcoin Core from 0.21+ to 31.0+. There is no code change, no bug fix, and no security patch in the diff itself.
ca254cb5 · Jun 16, 2026 · 1 fileInformational 15Bump serde_json from 1.0.149 to 1.0.150
Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.149 to 1.0.150.
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150)
---
updated-dependencies:
- dependency-name: serde_json
dependency-version: 1.0.150
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is an automated dependency update by Dependabot that bumps the serde_json library from version 1.0.149 to 1.0.150. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication in the commit itself that this fixes a security issue, and no security references were provided.
d889624f · Jun 16, 2026 · 1 fileInformational 15Bump bytes from 1.11.0 to 1.11.1
Bumps [bytes](https://github.com/tokio-rs/bytes) from 1.11.0 to 1.11.1.
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tokio-rs/bytes/compare/v1.11.0...v1.11.1)
---
updated-dependencies:
- dependency-name: bytes
dependency-version: 1.11.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine automated dependency update by Dependabot, bumping the Rust 'bytes' library from version 1.11.0 to 1.11.1. Only the Cargo.lock file changed. There is no indication in the commit of any security fix, bug fix, or behavior change in electrs itself.
acf4b98d · Jun 15, 2026 · 2 filesLow 25Bump jsonrpc from 0.18.0 to 0.20.1
Bumps [jsonrpc](https://github.com/rust-bitcoin/corepc) from 0.18.0 to 0.20.1.
- [Commits](https://github.com/rust-bitcoin/corepc/commits/jsonrpc-0.20.1)
---
updated-dependencies:
- dependency-name: jsonrpc
dependency-version: 0.20.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine dependency update by Dependabot that upgrades the jsonrpc library used by the electrs Bitcoin server from version 0.18.0 to 0.20.1. The change also removes an older copy of the base64 library from the dependency tree. Dependency updates can sometimes fix security bugs, but the commit message itself does not say this update fixes any vulnerability, and no security advisory was provided.
0fe14fdf · May 31, 2026 · 24 filesLow 32Switch to `bindex`
Why it was queuedThis is a large refactoring commit that replaces electrs's custom Bitcoin indexing, chain tracking, P2P networking, and RocksDB storage code with a new external library called `bindex`. It removes thousands of lines of in-house code (indexing, chain state, P2P connection, RocksDB wrapper, transaction cache) and switches RPC communication from the `bitcoincore-rpc` crate to direct `jsonrpc` calls. The change is architectural, not a targeted security fix. There is no mention of a vulnerability, CVE, or security issue in the commit message or diff.
32e5944a · May 30, 2026 · 2 filesInformational 15Bump bitcoin from 0.32.8 to 0.32.9
Bumps [bitcoin](https://github.com/rust-bitcoin/rust-bitcoin) from 0.32.8 to 0.32.9.
- [Release notes](https://github.com/rust-bitcoin/rust-bitcoin/releases)
- [Changelog](https://github.com/rust-bitcoin/rust-bitcoin/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-bitcoin/rust-bitcoin/compare/bitcoin-0.32.8...bitcoin-0.32.9)
---
updated-dependencies:
- dependency-name: bitcoin
dependency-version: 0.32.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is an automated patch by Dependabot that updates the 'bitcoin' Rust library used by the electrs project from version 0.32.8 to 0.32.9. Only version and checksum numbers changed in the dependency list; no project source code was modified. There is no information in the commit or supplied references indicating this update fixes a security problem, so it appears to be a routine maintenance bump.
d81dc35a · May 10, 2026 · 2 filesInformational 15Bump rayon from 1.11.0 to 1.12.0
Bumps [rayon](https://github.com/rayon-rs/rayon) from 1.11.0 to 1.12.0.
- [Changelog](https://github.com/rayon-rs/rayon/blob/main/RELEASES.md)
- [Commits](https://github.com/rayon-rs/rayon/compare/rayon-core-v1.11.0...rayon-core-v1.12.0)
---
updated-dependencies:
- dependency-name: rayon
dependency-version: 1.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine automated dependency update by Dependabot that bumps the 'rayon' Rust library from version 1.11.0 to 1.12.0. The change only updates version numbers in the project's package manifest and lock file. There is no indication in the commit itself that this update fixes a security problem.
fb1013af · Apr 23, 2026 · 1 fileInformational 15Bump rand from 0.8.5 to 0.8.6
Bumps [rand](https://github.com/rust-random/rand) from 0.8.5 to 0.8.6.
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.6/CHANGELOG.md)
- [Commits](https://github.com/rust-random/rand/compare/0.8.5...0.8.6)
---
updated-dependencies:
- dependency-name: rand
dependency-version: 0.8.6
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine automated dependency update by Dependabot, bumping the Rust 'rand' crate from version 0.8.5 to 0.8.6 in the project's lock file. There is no indication in the commit itself that this update fixes a security issue or changes any project code. It is a normal maintenance patch.
bad9dfdc · Apr 23, 2026 · 1 fileInformational 15Fix clippy comment
Why it was queuedThis is a one-line code cleanup that removes an unnecessary `.into_iter()` call. It does not change what the program does, only makes the code slightly simpler and silences a Clippy lint warning. There is no security relevance.
ca542016 · Apr 6, 2026 · 2 filesInformational 15Bump bitcoin_slices from 0.10.0 to 0.11.0
Bumps [bitcoin_slices](https://github.com/RCasatta/bitcoin_slices) from 0.10.0 to 0.11.0.
- [Commits](https://github.com/RCasatta/bitcoin_slices/commits)
---
updated-dependencies:
- dependency-name: bitcoin_slices
dependency-version: 0.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine dependency version bump by Dependabot, updating the bitcoin_slices library from version 0.10.0 to 0.11.0. Only the version number and cryptographic checksum changed in the project's package files. There is no indication in the commit itself of any security fix or vulnerability.
22db4c64 · Apr 6, 2026 · 1 fileInformational 15Test bitcoind 31.0rc2
Why it was queuedThis commit simply updates the CI Docker file to test against a newer release candidate of Bitcoin Core (31.0rc2) instead of the older 29.0 stable release. There is no security-relevant code change in the electrs project itself.
f223bd57 · Apr 6, 2026 · 1 fileInformational 15Bump signal-hook from 0.4.3 to 0.4.4
Bumps [signal-hook](https://github.com/vorner/signal-hook) from 0.4.3 to 0.4.4.
- [Changelog](https://github.com/vorner/signal-hook/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vorner/signal-hook/compare/v0.4.3...v0.4.4)
---
updated-dependencies:
- dependency-name: signal-hook
dependency-version: 0.4.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine automated patch by Dependabot that updates the signal-hook library from version 0.4.3 to 0.4.4 in the project's dependency lock file. There is no indication in the commit itself that this update fixes a security problem. It is a normal maintenance change.
0bcb9798 · Feb 23, 2026 · 2 filesInformational 15Bump tempfile from 3.24.0 to 3.25.0
Bumps [tempfile](https://github.com/Stebalien/tempfile) from 3.24.0 to 3.25.0.
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Stebalien/tempfile/commits)
---
updated-dependencies:
- dependency-name: tempfile
dependency-version: 3.25.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine automated dependency update by Dependabot, bumping the Rust crate `tempfile` from version 3.24.0 to 3.25.0. The change only affects version numbers and checksums in the project's dependency files. There is no indication in the commit itself that this fixes a security issue, and no security advisory was supplied.
945e7e6a · Feb 22, 2026 · 2 filesInformational 10Bump ctrlc from 3.5.1 to 3.5.2
Bumps [ctrlc](https://github.com/Detegr/rust-ctrlc) from 3.5.1 to 3.5.2.
- [Release notes](https://github.com/Detegr/rust-ctrlc/releases)
- [Commits](https://github.com/Detegr/rust-ctrlc/compare/3.5.1...3.5.2)
---
updated-dependencies:
- dependency-name: ctrlc
dependency-version: 3.5.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is an automated dependency update by Dependabot that bumps the `ctrlc` crate (used only on Windows builds) from version 3.5.1 to 3.5.2, along with its indirect dependencies `libc` and `nix`. There is no indication in the commit or supplied references that this fixes a security issue. It appears to be a routine patch-level maintenance update.
35216c6d · Feb 22, 2026 · 3 filesInformational 15Release 0.11.1
Why it was queuedThis commit is a routine version bump for the electrs project from version 0.11.0 to 0.11.1. It only changes the version number in two files and adds a short release note describing minor improvements and dependency updates. There is no code change that fixes or introduces a security issue.
4752f5bd · Feb 11, 2026 · 1 fileInformational 15Bump signal-hook from 0.4.1 to 0.4.3
Bumps [signal-hook](https://github.com/vorner/signal-hook) from 0.4.1 to 0.4.3.
- [Changelog](https://github.com/vorner/signal-hook/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vorner/signal-hook/compare/v0.4.1...v0.4.3)
---
updated-dependencies:
- dependency-name: signal-hook
dependency-version: 0.4.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine automated dependency update by Dependabot, bumping the signal-hook library from version 0.4.1 to 0.4.3. The change only updates a version number and cryptographic checksum in the project's lock file. There is no indication in the commit itself that this fixes a security vulnerability.
e693d703 · Jan 13, 2026 · 1 fileInformational 15Bump serde_json from 1.0.148 to 1.0.149
Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.148 to 1.0.149.
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.148...v1.0.149)
---
updated-dependencies:
- dependency-name: serde_json
dependency-version: 1.0.149
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
This is an automated dependency update by Dependabot that bumps the serde_json library from version 1.0.148 to 1.0.149. The only changed file is Cargo.lock, which records the exact version of a Rust dependency. There is no indication in the commit that this fixes a security issue, and no security-relevant code changes are present.
28a2c459 · Jan 3, 2026 · 2 filesInformational 15Bump signal-hook from 0.3.18 to 0.4.1
Bumps [signal-hook](https://github.com/vorner/signal-hook) from 0.3.18 to 0.4.1.
- [Changelog](https://github.com/vorner/signal-hook/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vorner/signal-hook/compare/v0.3.18...v0.4.1)
---
updated-dependencies:
- dependency-name: signal-hook
dependency-version: 0.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
This is a routine dependency version bump by an automated bot. It updates the signal-hook library from version 0.3.18 to 0.4.1 in the project's package manifest and lock file. There is no indication in the commit that this fixes a security vulnerability.