rust-bitcoin

Merge rust-bitcoin/rust-bitcoin#6917: addresses: check witness version on spk

b09a931a7ae2b48671a047b90688d7eca92fe4e0 addresses: test witness versions match on spk (satsfy (Renato Britto))
dc1f4248037aeaf6f60958a08cf75a9155542794 addresses: check witness version on script pk (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6908

This returns true, but should return false:

```rs
v0SegwitAddress.matches_script_pubkey(&v1SegwitAddress.script_pubkey())
```

`matches_script_pubkey` is supposed to `return true if the address creates a particular script` (from the doc). However, the SPK contains version number of Segwit, we are not checking for that.

v0 and v1 cannot interoperate:
- v0 address: `bc1q4w46h2at4w46h2at4w46h2at4w46h2at25y74s` spk: `0014abab...ab`
- v1 address: `bc1p4w46h2at4w46h2at4w46h2at4w46h2at5kreae` spk: `5114abab...ab`

The address differs in the 4th character ('q' for v0 and 'p' for v1), which become a different SPK, and each SPK gets a different set of rules applied on them both [on Core](https://github.com/bitcoin/bitcoin/blob/5ca3773414df36b52d6ea6c0a0ae0b1a1ad1f435/src/script/interpreter.cpp#L1927) and [here](https://github.com/rust-bitcoin/rust-bitcoin/blob/676007955240a4d7ece5e7d6a968189f09d81785/primitives/src/script/borrowed.rs#L245-L297). Therefore, the issue needs fixing.


ACKs for top commit:
apoelstra:
ACK b09a931a7ae2b48671a047b90688d7eca92fe4e0; successfully ran local tests


Tree-SHA512: 457a1113caa77a42c4cabd1e48eadfa672bd2de0b38fe7da664de048c8ae33075f422e0a96a10eb652d0b82e420190696acb47099a128e94f21182721eb6aa7e

Merge rust-bitcoin/rust-bitcoin#6902: Automated weekly update to rustc (to nightly-2026-09-19) on master

59c1c374707890c264e959df9d206cfcca33d4c2 Automated update to rustc nightly-2026-09-19 (Update Nightly Rustc Bot)

Pull request description:

Automated update to Cargo.toml workspace metadata by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
tcharding:
ACK 59c1c374707890c264e959df9d206cfcca33d4c2
satsfy:
ACK 59c1c374707890c264e959df9d206cfcca33d4c2


Tree-SHA512: 12c5d7c50f04b7da2ce5183e6d05bf8ce5437a1b8bb59c0c828b3e6f9f1310cf1419b523d9f9d79a972c08dee8dad12a52a1c5929ce2ebc59ed0afbe42150a40

Merge rust-bitcoin/rust-bitcoin#6855: chacha20: Accelerate apply_keystream on aarch64

f51bd42ac00da93c5c327ab2318f1d7b642e3efa chacha20: Accelerate apply_keystream on aarch64 (rustaceanrob)

Pull request description:

Currently we have some SIMD hints using an U32x4 type, but we can improve the performance quite a bit for specific architectures using the intrinsics. The linux kernel and RustCrypto process 4 or 8 blocks on aarch64 using the Neon instructions, which is what this patch introduces. On mobile where most chips are ARM, this should improve p2p v2 performance.

On the heaps of `unsafe`, the intrinsitcs are only guarenteed on chips that support `neon`, which is a compile-time check here.

The implementation is essentially the same as the single block case, with a final transpose step at the end to XOR the state back into the plaintext.

I tried to describe each Neon instruction here and add documentation for anything uninituitive so this can be easily reviewed by LLMs and humans.

The results are very promising, here is the before/after for the `chacha20` bench on my M2:

Before:
```
chacha20/apply_keystream/1024
time: [1.5040 µs 1.5063 µs 1.5091 µs]
thrpt: [647.11 MiB/s 648.34 MiB/s 649.30 MiB/s]

chacha20/apply_keystream/65536
time: [90.822 µs 91.045 µs 91.274 µs]
thrpt: [684.75 MiB/s 686.48 MiB/s 688.16 MiB/s]
```

After:
```
chacha20/apply_keystream/1024
time: [830.96 ns 831.60 ns 832.30 ns]
thrpt: [1.1458 GiB/s 1.1468 GiB/s 1.1477 GiB/s]
change:
time: [−45.658% −44.778% −44.240%] (p = 0.00 < 0.05)
thrpt: [+79.340% +81.087% +84.019%]
Performance has improved.

chacha20/apply_keystream/65536
time: [27.663 µs 27.675 µs 27.690 µs]
thrpt: [2.2042 GiB/s 2.2054 GiB/s 2.2064 GiB/s]
change:
time: [−69.142% −69.046% −68.954%] (p = 0.00 < 0.05)
thrpt: [+222.11% +223.06% +224.07%]
Performance has improved.
```

ref: https://datatracker.ietf.org/doc/html/rfc7539
ref: https://github.com/torvalds/linux/blob/master/lib/crypto/arm64/chacha-neon-core.S

This was originally reported to me by Davidson-Souza


ACKs for top commit:
apoelstra:
ACK f51bd42ac00da93c5c327ab2318f1d7b642e3efa; successfully ran local tests


Tree-SHA512: 1bf4ddffde7c29b307fb471cc585f9d28d5efeaae56b06ce38c8679f22e6ba63fcd88fe692bebfa5e196c329874bcc0a4beaeb6bfb4b019240c1820ca510ca7e

Merge rust-bitcoin/rust-bitcoin#6914: units: Remove Into from Sum impl for amount types

b30099d727998993559b3af10678aa7a5dd24405 units: Remove Into from Sum impl for amount types (Tobin C. Harding)

Pull request description:

Instead of using `<Into<T>>` implement explicitly the set of `Sum` impls that we want.

- `Sum<Amount> for NumOpResult<Amount>`
- `Sum<&'a Amount> for NumOpResult<Amount>`
- `Sum<Self> for NumOpResult<Amount>`
- `Sum<&'a Self> for NumOpResult<Amount>`

And the same set for `SignedAmount`.

Close: #6816


ACKs for top commit:
Kixunil:
ACK b30099d727998993559b3af10678aa7a5dd24405
apoelstra:
ACK b30099d727998993559b3af10678aa7a5dd24405; successfully ran local tests


Tree-SHA512: 8f13feccebf3ca0cd9c07f93ea2293b6753d70f32c98dcb68c302cd7b7ef5a1c54d3cea6491e01418819b6f1bb3aa15db737e39e87c3e151e1b54a7ebe737082

Merge rust-bitcoin/rust-bitcoin#6883: units: Bound input retained by hex parse errors

f0a24190bbd130fbc0fcbfb6d71df2492e256409 Exclude mutant that causes a timeout (Jamil Lambert, PhD)
c3ed3b3a2713492bbe5c2d2584b554a7aec92f55 units: Test hex parse errors bound retained input (Jamil Lambert, PhD)
d797af5c52b1ec3d29a4eb1e68c511166d918292 units: Bound input retained by parse errors (Jamil Lambert, PhD)

Pull request description:

The amount hex constructors pass their input straight to the parser, which stores the string that failed to parse in the error. A long input makes the error allocate and retain all of it, and printing the error repeats the cost.

Truncate the retained input to 80 bytes, longer than any valid input, so only the error context is bounded and the parse itself is unchanged.

Add a regression test.

Exclude a mutant in the new function that causes a timeout.

Closes project-loupe/audit-rust-bitcoin#162
Closes project-loupe/audit-rust-bitcoin#186


ACKs for top commit:
apoelstra:
ACK f0a24190bbd130fbc0fcbfb6d71df2492e256409; successfully ran local tests
tcharding:
ACK f0a24190bbd130fbc0fcbfb6d71df2492e256409


Tree-SHA512: 62e8a19baeb79f559675c11d8c3250a806484246c933c061af72f9ac5bcfa8f76ea2d48bd520bab98033218614749cfee75228a24288b2e1fefaf77542f0ac3b

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

f6c31cbd78e1142d2454ec3fe7979b755c56e12e build(deps): bump actions/labeler from 6.2.0 to 7.0.0 (dependabot[bot])

Pull request description:

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.2.0 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/labeler/releases">actions/labeler's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Migrate to ESM and update dependencies by <a href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/949">actions/labeler#949</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/labeler/compare/v6...v7.0.0">https://github.com/actions/labeler/compare/v6...v7.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/labeler/commit/bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13"><code>bf12e9b</code></a> feat: migrate to ESM and update dependencies (<a href="https://redirect.github.com/actions/labeler/issues/949">#949</a>)</li>
<li>See full diff in <a href="https://github.com/actions/labeler/compare/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e; successfully ran local tests
satsfy:
ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e


Tree-SHA512: c01e93f62f62f0053adf8d6356c4b4766e12f338d8886004cdf4817e74362717807bee30b26b63bf39f1ad59b7586b628631e739606534e11e6215d4dccbf7c1

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

55c3a6f5d46ee147b0aea9abaee585ff22e47897 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot])

Pull request description:

Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 55c3a6f5d46ee147b0aea9abaee585ff22e47897; successfully ran local tests
satsfy:
ACK 55c3a6f5d46ee147b0aea9abaee585ff22e47897


Tree-SHA512: c8ef2a044088d870e6f65e4aa9fff004d26d1fb72af787a3d4663d49fe7a5e8497f89710b35a6ddd8408584189d891330909371d39bd8ec4623d4bf44941dae2

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

7d7e7269e50df6412aab796fd67b59abc94cc4ba build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (dependabot[bot])

Pull request description:

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p>
<blockquote>
<h2>v9.0.0 🌈 Change <code>prune-cache</code> default to <code>false</code></h2>
<h2>Changes</h2>
<p>This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a></p>
<p>Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the &quot;big ones&quot; and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.</p>
<h2>🚨 Breaking changes</h2>
<ul>
<li>Change <code>prune-cache</code> default to <code>false</code> <a href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li>
</ul>
<h2>🐛 Bug fixes</h2>
<ul>
<li>fix: fall back to distribution ID when os-release has no version field <a href="https://github.com/cxzhong"><code>@​cxzhong</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li>
</ul>
<h2>🚀 Enhancements</h2>
<ul>
<li>Speed up version client by partial response reads <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li>
</ul>
<h2>🧰 Maintenance</h2>
<ul>
<li>chore: update known checksums for 0.11.30 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li>
<li>chore: update known checksums for 0.11.29 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li>
</ul>
<h2>📚 Documentation</h2>
<ul>
<li>docs: update version references to v8.3.2 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li>
</ul>
<h2>⬆️ Dependency updates</h2>
<ul>
<li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li>
<li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/astral-sh/setup-uv/commit/c771a70e6277c0a99b617c7a806ffedaca235ff9"><code>c771a70</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/2f537ca87c1ffa233ca2a1b84815388e3e42d845"><code>2f537ca</code></a> chore: update known checksums for 0.11.30 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/2269552d547df6f50e57442326930d30d943afe3"><code>2269552</code></a> Speed up version client by partial response reads (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/47a7f4fb2e900d6c33a5b5f231fa21dbfaeba52f"><code>47a7f4f</code></a> Change <code>prune-cache</code> default to <code>false</code> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/71966eff34a27b0a62ed4b9f6f6e383e071b1bb5"><code>71966ef</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/f12b1f0a84bd6dc2331b36b2bbdbb1d1e617dbcc"><code>f12b1f0</code></a> fix: fall back to distribution ID when os-release has no version field (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84"><code>ecd24dd</code></a> chore: update known checksums for 0.11.29 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/6a191366842ac1502ba6c07e9b5acd5c2d9d8db3"><code>6a19136</code></a> docs: update version references to v8.3.2 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li>
<li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 7d7e7269e50df6412aab796fd67b59abc94cc4ba; successfully ran local tests


Tree-SHA512: 0618eec83ba5925b0fdcb30e6ec5dee7fa1763bca5e1b84b663683342b2c5307c5b8e93f35cac39d9e8b93edd3a726733e2b1aa798c0107a249a728d154c79da

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

2cac6e38036b3c175f0fc1368e231e06abf80817 build(deps): bump github/codeql-action/upload-sarif (dependabot[bot])

Pull request description:

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p>
<blockquote>
<h2>v4.37.3</h2>
<p>No user facing changes.</p>
<h2>v4.37.2</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>v4.37.1</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li>
<li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li>
<li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li>
<li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li>
<li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li>
<li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li>
<li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li>
<li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li>
<li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li>
<li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 2cac6e38036b3c175f0fc1368e231e06abf80817; successfully ran local tests


Tree-SHA512: 2df8a48df0f6bbfd286fe6fc7d9f0ec28a60df05a6665e1e39bba0ffa32711e0e79d2d1634cf2e0ccd5a6645822d83ec483329033e0097f65bcc574da200321d

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

a31e0b0e89778bbbd3d60ebc61c66c99b575a317 build(deps): bump dtolnay/rust-toolchain (dependabot[bot])

Pull request description:

Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de.
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/02cb101ec7c40f2c49e1d9714d64511d8e1b74de"><code>02cb101</code></a> Merge pull request 185 from fufesou/feat/force-non-host</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/b38a663c5df0fd5ac7bb65ded7b02a3f7af3b636"><code>b38a663</code></a> Pass --force-non-host unconditionally</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/a4f61a09a512763ecbf6a72db0464f906f59f011"><code>a4f61a0</code></a> Document rustup non-host opt-in requirement</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/06b350f08c8596edaf3d95d38686ba934fc4a6a7"><code>06b350f</code></a> Support force-non-host toolchains</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/d1031067263f94b142dd6c0ce24c5eb9d02d52a0"><code>d103106</code></a> Predefine branches up to 1.120</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/3ea7b2dde9987cecfa88322de1f09983972fc8e9"><code>3ea7b2d</code></a> Add 1.98.1 patch release</li>
<li>See full diff in <a href="https://github.com/dtolnay/rust-toolchain/compare/6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772...02cb101ec7c40f2c49e1d9714d64511d8e1b74de">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK a31e0b0e89778bbbd3d60ebc61c66c99b575a317; successfully ran local tests


Tree-SHA512: 526c648af02ba919dcd53aac0d930303bd8e344360e703ad04f099a2948a933f107333f7a01d0d6f0a12668568a4abbf393c0c9c2c5bdc35543b04e62b3d185c

units: Remove Into from Sum impl for amount types

Instead of using `<Into<T>>` implement explicitly the set of `Sum`
impls that we want.

- `Sum<Amount> for NumOpResult<Amount>`
- `Sum<&'a Amount> for NumOpResult<Amount>`
- `Sum<Self> for NumOpResult<Amount>`
- `Sum<&'a Self> for NumOpResult<Amount>`

And the same set for `SignedAmount`.

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

0ac85705e849c7a44a730f6f2a41c6f0d069e42b primitives: make transaction and block exact encodable (Nick Johnson)
95b2d374f7a48e30a951722df7e6120b660f0d18 primitives: refactor handrolled witness encoder iterator (Nick Johnson)
50e81ce80404dd1d89557b0f2ea51e765e260eb4 consensus_encoding: add ExactSizeEncoder implementations to iterators (Nick Johnson)

Pull request description:

It is helpful in higher level protocols like PSBT to be able to get the serialized size of a type for things like length prefixes. To expose this on the top of the hierarchy `Block` and `Transaction` types, the lower level iterator needs to support exact size calculations (for stuff like inputs and outputs). A small code change, however, I think this is the first non-constant time exact size implementations due to iterator's dynamic size. I think it is worth it.


ACKs for top commit:
apoelstra:
ACK 0ac85705e849c7a44a730f6f2a41c6f0d069e42b; successfully ran local tests
tcharding:
ACK 0ac85705e849c7a44a730f6f2a41c6f0d069e42b


Tree-SHA512: ad73c908257bc3da58bd27842391fd851e01279dccd79f29bc29034c70854e9eff5d4537ec78eec677584b048b1b44fd7c0d90a866bc90267a26167c1eded6c2

build(deps): bump dtolnay/rust-toolchain

Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de.
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](https://github.com/dtolnay/rust-toolchain/compare/6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772...02cb101ec7c40f2c49e1d9714d64511d8e1b74de)

---
updated-dependencies:
- dependency-name: dtolnay/rust-toolchain
dependency-version: 02cb101ec7c40f2c49e1d9714d64511d8e1b74de
dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 9.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge rust-bitcoin/rust-bitcoin#6907: Automated nightly rustfmt (2026-09-20)

7e89f6b00036a13e1d5793e1b671aee2cc06d1c1 2026-09-20 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK 7e89f6b00036a13e1d5793e1b671aee2cc06d1c1; successfully ran local tests; tolerable
tcharding:
ACK 7e89f6b00036a13e1d5793e1b671aee2cc06d1c1


Tree-SHA512: 0f902c0fc497a9108bfb1fc7cde82b6746077bed7ab480747e597b2fb91fba5f71e275fee1f3bfaed83bde20d798bae04b4f14825bd096e77fc6c8ae0dd17709

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

836624fc736cff9382923ae3b512bf6a17aecc55 chacha20_poly1305: drop Copy from Error (satsfy (Renato Britto))
642d545046f5f48ec26e7d4ef9dc28fd38fdec74 p2p: drop Copy from error types (satsfy (Renato Britto))
8c2e6b1841211cff624d2492276066b8bcc1c0db key_expression: drop Copy from bip32 error types (satsfy (Renato Britto))
61677cc71f0e35d2d6bcf3efcee5f969b634fa00 units: drop Copy from OutOfRangeError (satsfy (Renato Britto))
dae6356f31b717a9dce7bdc71dd0954bd86e07a5 policy: say when an error type derives Copy (satsfy (Renato Britto))

Pull request description:

I'm reviewing every trait in units for 1.0. We try to use `Copy` on rust-bitcoin types, but I claim that the errors should not use it.

The old criteria, "`Copy` if and only if not `non_exhaustive`", demands `Copy` on parse errors such as `ParseIntError`, which hold their input as a String and cannot derive it, and forbids it on `NumOpError`, which `NumOpResult` requires, and also misses important observations made previously in rust-bitcoin's history about the `Copy` trait (read the brief history below).

An error that implements `Copy` cannot later be updated to include, say, a `String`, so every `Copy` put into an error is a public commitment that would require a breaking change later, making it valuable to remove before 1.0. The codebase tends to the minimization of Copy usage on errors already, 30+ changes would be required in units alone to satisfy the existing rule in policy.md atm.

The only exception for using `Copy` are in errors that are a field of a type that derives `Copy`. That situation requires `Copy`, e.g.:
```rs
#[derive(Copy, Clone)]
pub enum NumOpResult<T> {
Valid(T),
Error(NumOpError), // a field of a Copy type, so NumOpError must be Copy
}
```

A brief history of `Copy` trait discussions on rust-bitcoin:

- [#843 PR checklist](https://github.com/rust-bitcoin/rust-bitcoin/issues/843): project adds checklist item for every public type and qualifies with "does not implement traits we could regret (mainly `Copy`, `Eq`, `Ord`, `PartialOrd`)".
- [#1127 Add policy section](https://github.com/rust-bitcoin/rust-bitcoin/pull/1127): "error types should not commit to implementing traits they may not be able to implement in the future, especially `Copy`". Turned into our present "if and only if".
- [#3879 Remove Copy from PushBytesError](https://github.com/rust-bitcoin/rust-bitcoin/pull/3879): "it makes the code less maintainable because we must commit to implementing `Copy`".
- [#4076 Derive Copy for NumOpResult](https://github.com/rust-bitcoin/rust-bitcoin/pull/4076): PR makes `NumOpError` `Copy` because the container needs it. The one exception on our new policy.
- [#6347 units: Clean up the api tests](https://github.com/rust-bitcoin/rust-bitcoin/pull/6347): `Copy` asserted on the `Enums`, errors excluded.


ACKs for top commit:
apoelstra:
ACK 836624fc736cff9382923ae3b512bf6a17aecc55; successfully ran local tests


Tree-SHA512: 3569d75dd11f84b6b9afe1806f2fb61a38d41720eaf5083bab9934019468d1caae3a1a861253b6de5599ad534d2306ba18a8009db9ef042987723afeb9afb95f

Merge rust-bitcoin/rust-bitcoin#6895: ci: add daily cargo audit workflow

961a11d28b0b7dd3cccb6cd67f4e3d65baa169ae ci: add daily cargo audit workflow (satsfy (Renato Britto))
2c714cea4dfd25f990b1e4c9b3aeff79ca140a9f ci: add cargo audit config for expected failures (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6405

We should observe `cargo audit` failures but, right now, we are only aware of issues when dependencies break. This PR runs it automatically every day and creates issues on failure. If you run `cargo audit` on all lockfiles we have on rust-bitcoin, you'll see it is not clean.

A `cargo audit` ran on root folder also cannot capture problems on other `Cargo.lock`, so this job audits every lockfile daily with warnings denied and reports through the CI failure issue tracker. In particular, `bincode` and `bare-metal` deps are ignored in a new audit config, because both unfixable for now.

This PR will be followed up with a [sister PR](https://github.com/rust-bitcoin/rust-bitcoin/pull/6896) fixing the existing `cargo audit` issued detected on issue.

Proof run working as expected on fork: https://github.com/satsfy/rust-bitcoin/actions/runs/35255017846/job/105316408362
Issue created on fork: https://github.com/satsfy/rust-bitcoin/issues/74


ACKs for top commit:
apoelstra:
ACK 961a11d28b0b7dd3cccb6cd67f4e3d65baa169ae; successfully ran local tests


Tree-SHA512: 2d787231890c1062e690f46fe03a3d3352e1c1a94b92c7ce8a04f27fe30579da6b9dbe93b2cbd3249cc11022f832937a6bf2f9fbf1e3f946a4f41ae906646844

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

fe90ee7a2142d6b589604bbc431dbf910675b8d4 addresses: Adjust Address::from_script docs (Mitchell Bagot)
1161a9f4e53253ecb9be1b2363d92bfda55d7c47 Move from_script to Address and drop AddressExt (Mitchell Bagot)

Pull request description:

The Address::from_script method in AddressExt takes an AsRef\<Params> argument. This argument is only used to extract the contained Network. Rather than use the Params type in the signature, which requires a bitcoin dep, the stable Network type should be used directly. With this change, the method can be directly moved to the main Address type. With said move, the extension trait can also be dropped entirely.

Adjust and move AddressExt::from_script to the Address type in addresses. Drop the AddressExt trait.


ACKs for top commit:
apoelstra:
ACK fe90ee7a2142d6b589604bbc431dbf910675b8d4; successfully ran local tests
Kixunil:
ACK fe90ee7a2142d6b589604bbc431dbf910675b8d4


Tree-SHA512: b728a9c010799223704e5cf9097a95cb23ba156beb7efd34b6dcb6c0086df8cbbf08744e91ee500af43529ba8fbb416ebd251f1e5bcf9cda57d2f1a198563d8c

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

a002978d05f88a0864bcb07ed3711999ab92dc22 Improve error messages of `serde` errors (Martin Habovstiak)
30f7aba5ab61a27ab017cfd6dce93751338adb69 Add `FeeRate::from_sat_per_{vb,kvb,kwu}` methods (Martin Habovstiak)
fc1bed37e0bdc3d19b78f26fca0238ea72d939a2 Rename `u32`-taking `FeeRate::from_sat_per_*` (Martin Habovstiak)
861a8d609514423771e96e362b8ed345b27bb7c3 Deduplicate `FeeRate` constants in tests (Martin Habovstiak)
e4e124e87aee47ed637b87932dcddf7a6867c5d4 Remove artificial restriction from `from_per_vb` (Martin Habovstiak)

Pull request description:

This makes various improvements to units - see commits.


ACKs for top commit:
apoelstra:
ACK a002978d05f88a0864bcb07ed3711999ab92dc22; successfully ran local tests


Tree-SHA512: 64978ac0bcc559d1148afc7f3b4683876575d5b2f816c5d3bc0b1dc71a110cdaaad898d5c7897b1ea195d734514f2e999b39417d82f267067fb4ee7a9fa5f511

Merge rust-bitcoin/rust-bitcoin#6899: ci: regenerate Cargo-minimal.lock with rbmt

ff3fdad85edf291d9cf38f796afd8384bd1a154a ci: regenerate Cargo-minimal.lock with rbmt (satsfy (Renato Britto))

Pull request description:

Ref https://github.com/rust-bitcoin/rust-bitcoin/pull/6898#issuecomment-5736433771

`rand` and `jobserver` were pinned with `cargo update --precise` but no `Cargo.toml` has those versions, so `cargo rbmt lock` resolves them back down, out of what was configured.


ACKs for top commit:
apoelstra:
ACK ff3fdad85edf291d9cf38f796afd8384bd1a154a; successfully ran local tests


Tree-SHA512: ff36f37ec7aec6972f5d7c8d5d68b3a4832d6478945683de847e95ab7731f1d27a94e9ad1cc4a7076d94b9d8b373ad9bc7be012b964f57e7fa7bb339a863ffc8

Merge rust-bitcoin/rust-bitcoin#6892: chacha20: Add long data test vector from linux

728634e9f4570ebcd1ae484273a6c2a8b91e803e chacha20: Add long data test vector from linux (rustaceanrob)

Pull request description:

The linux source tree has a chacha20 vector intended to cover their SIMD paths that process 4/8 chacha blocks at once. Add it here so we also have some assurance when implementing multiple block processing.

ref: https://github.com/rust-bitcoin/rust-bitcoin/pull/6855#discussion_r4028247932
ref: https://github.com/torvalds/linux/blob/238650ef6c7c7cca08e032527329424c9fbd70e5/crypto/testmgr.h#L28447


ACKs for top commit:
nyonson:
ACK 728634e9f4570ebcd1ae484273a6c2a8b91e803e
apoelstra:
ACK 728634e9f4570ebcd1ae484273a6c2a8b91e803e; successfully ran local tests


Tree-SHA512: 7e39759d242f6b29bf6724a1202bde921d0b0dfa39e19a368da01418a3d58f11e36feb44a8e6990bbfb8cc5b5c263a1d1093c832a2023bbb24a4bbfb5c3ca0d3

ci: regenerate Cargo-minimal.lock with rbmt

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

b0d240127f78cffa4cfdba72c5b85bcfcd0a0810 units: Test add and sub preserve div-by-zero error (Jamil Lambert, PhD)
0004180290e08500d3833e7289451fdf78b8049a units: Preserve error in NumOpResult add and sub (Jamil Lambert, PhD)

Pull request description:

Adding or subtracting `NumOpResults` replaced any error operand with a fresh overflow error.

Propagate the original error instead of constructing a new overflow error.

Closes project-loupe/audit-rust-bitcoin#167
Closes project-loupe/audit-rust-bitcoin#168


ACKs for top commit:
tcharding:
ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810
Kixunil:
ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810
apoelstra:
ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810; successfully ran local tests


Tree-SHA512: f4f8ae1aaa011842fa0e350a43f1dff3b6fd3a944f971beeae85f6422a4b81d3e8f9c23df9c42ec870a72eeb09f13d16508eb1c977790e7b78147f702640d960

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

6dc79c836479ada95a63b8b971d2c06bc4867715 benches: bump crossbeam-epoch to 0.9.21 (satsfy (Renato Britto))
540ff32d80820031f2b9a4464a6dbdec31bf9494 benched: bump rand to 0.9.5 (satsfy (Renato Britto))
23f7ab9e60ed6410d3e3806a215290aa54edac46 embedded: replace alloc-cortex-m with embedded-alloc (satsfy (Renato Britto))

Pull request description:

Resolve all solvable `cargo audit` errors brought up in https://github.com/rust-bitcoin/rust-bitcoin/issues/6405

This is a sister PR to https://github.com/rust-bitcoin/rust-bitcoin/pull/6895, which ignores 2 other `cargo audit` problems in `.cargo/audit.toml`.

## Commit 1

Per [`embedded-alloc` docs](https://github.com/rust-embedded/embedded-alloc/blob/master/CHANGELOG.md#changed-1):
> The `Heap` struct has been renamed to `LlffHeap` and requires the `llff` feature.

`alloc-cortex-m` was renamed to `embedded-alloc`. The new crate uses the heap through [`critical-section`](https://github.com/rust-embedded/embedded-alloc?tab=readme-ov-file#example) instead of calling `cortex_m::interrupt::free` directly, so the binary must provide an implementation. `cortex-m` includes it behind its [`critical-section-single-core`](https://docs.rs/critical-section/latest/critical_section/#usage-in-no-std-binaries) feature, hence the new direct dependency. `llff` selects the linked list first fit heap, the same `linked_list_allocator` backend `alloc-cortex-m` already used, and `default-features = false` avoids also compiling the [alternative `tlsf` heap](https://github.com/rust-embedded/embedded-alloc?tab=readme-ov-file#features).

## Commit 2

rand 0.9.5 is in the patched range. rand 0.7 has no patch, so jobserver 0.1.18 drops it entirely. See https://rustsec.org/advisories/RUSTSEC-2026-0097.html

## Commit 3

crossbeam-epoch is a transitive dependency of the benchmark harness, not declared in any Cargo.toml. Advisory patched at 0.9.20, so the lockfile bump is the only solution. See https://rustsec.org/advisories/RUSTSEC-2026-0204.html


ACKs for top commit:
tcharding:
ACK 6dc79c836479ada95a63b8b971d2c06bc4867715
apoelstra:
ACK 6dc79c836479ada95a63b8b971d2c06bc4867715; successfully ran local tests


Tree-SHA512: f48ce5449a01ccab5fb32f679813542ac400a662fd73624fbc9d65200edd57f68ad180eacfb7e5f0de7ac8d681c9fc64a1a74b4cd0bfcc6ed0605d3e375c6591