RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
141commits · 30 days
284commits · 60 days
1150commits · 180 days
2046commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 52 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityAdd TapLeafHash to encoding fuzzingby Mitchell Bagot · e15b0ad1 · Jul 28, 2026 · 4 filesMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add TapLeafHash to encoding fuzzing

With the introduction of a new encoding type, the comparison and
roundtrip fuzz targets need to be updated.

Add TapLeafHash to compare_consensus_encoding and encoding roundtrip
fuzz targets.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit only adds a new fuzz test for an existing data type (TapLeafHash). It does not change any production code, fix a bug, or alter behavior. There is no security issue here.

Security candidatetaproot-primitives: Implement encoding traits for TapLeafHashby Mitchell Bagot · b2ab0896 · Jul 28, 2026 · 2 filesMessage 73 · AdequateInformational 17Details
Commit message · Mitchell Bagot

taproot-primitives: Implement encoding traits for TapLeafHash

The TapLeafHash type in taproot-primitives, is consensus encoded in
PSBT. As such, it needs to have encoding trait implementations.

Add encoder and decoder for TapLeafHash and implement Encode and Decode
on the hash type.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Informational 17/100

This commit adds standard data-encoding support for a Bitcoin Taproot hash type (TapLeafHash) so it can be properly serialized and deserialized in PSBT data. There is no indication of a security bug being fixed; it appears to be a missing-feature addition.

AI review queuedAdd encoding dep to taproot-primitivesby Mitchell Bagot · a291c3a2 · Jul 28, 2026 · 4 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add encoding dep to taproot-primitives

As a first step to introducing encoding for the hash types in
taproot-primitives, the encoding dependency needs to be added to the
crate.

Add consensus_encoding dependency to taproot-primitives.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit simply adds a new internal software building block (a Rust crate dependency called bitcoin-consensus-encoding) to another internal crate (taproot-primitives). It updates package lists and feature flags so the new dependency can be used in future work, but it does not change any actual logic, data handling, or security behavior. There is nothing here that directly fixes or introduces a vulnerability.

Lower-prioritybitcoin: Extern taproot-primitives crateby Mitchell Bagot · 5eb8867f · Jul 28, 2026 · 1 fileMessage 45 · ThinInformational 16Details
Commit message · Mitchell Bagot

bitcoin: Extern taproot-primitives crate

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 16/100

This commit adds a single line re-exporting a new Rust crate called taproot_primitives from the main bitcoin crate. It is a routine dependency wiring change with no visible security implications in the diff itself.

AI review queuedUpdate API filesby Mitchell Bagot · d166d57e · Jul 28, 2026 · 2 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files that record which Rust traits are implemented for the library's types. The actual code change (adding or removing trait bounds on equality comparisons for a Block type) is not present in the diff; only the auto-generated documentation of the public API surface changed. There is no executable code modification, no bug fix, and no security-relevant behavior change visible here.

Lower-priorityAdd test case for block comparisonby Mitchell Bagot · 458e6b3a · Jul 28, 2026 · 1 fileMessage 78 · AdequateInformational 12Details
Commit message · Mitchell Bagot

Add test case for block comparison

To demonstrate the previous patch fix, a new test case that constructs
identical blocks in different manners and compares them should be
included. This both demonstrates the bug, and prevents regressions if
the equivalence logic is changed in the future.

Add block test case that checks equality of identical blocks
constructed in different ways.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 12/100

This commit only adds a new automated test to the project. It does not change any production code. The test demonstrates that two equivalent Bitcoin blocks—one with a cached witness root and one without—compare as equal. It is a regression test for a bug fixed in an earlier patch, not a security fix itself.

Lower-priorityReplace Block PartialEq/Eq derive with manual implby Mitchell Bagot · 106563b8 · Jul 28, 2026 · 1 fileMessage 95 · StrongLow 43Details
Commit message · Mitchell Bagot

Replace Block PartialEq/Eq derive with manual impl

The PartialEq/Eq derive on Block results in incorrect equality
comparisons depending on the method of construction due to the
witness_root cache. Instead, equality for Block should be implemented
manually, comparing the header and transaction lists only.

Replace PartialEq/Eq derive with manual implementations that correctly
compare only the header and transaction lists.
Add test to kill mutants.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Low 43/100

This commit fixes a bug in how Bitcoin 'Block' objects are compared for equality. The old code automatically compared every internal field, including a cached 'witness_root' value that can be missing or different depending on how the block was built. That meant two blocks with the same header and transactions could incorrectly look different, or two blocks with different cached values could look the same. The fix manually compares only the header and the list of transactions, which is the correct definition of block equality. It also adds tests to prevent the bug from returning.

Lower-priorityp2p: Add BIP434 to `NetworkMessage`by rustaceanrob · e1cbf080 · Jul 27, 2026 · 4 filesMessage 76 · AdequateInformational 20Details
Commit message · rustaceanrob

p2p: Add BIP434 to `NetworkMessage`

Adds support for `feature` messages and bumps the protocol version.

ref: https://github.com/bitcoin/bips/blob/master/bip-0434.md

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 20/100

This commit adds support in the rust-bitcoin P2P library for a new Bitcoin network message type called `feature`, defined by BIP 434. It also bumps the default protocol version from 70016 to 70017. This is a feature addition rather than a bug fix; there is no direct evidence in the commit that it fixes a security vulnerability. The main security consideration is that any new network message decoder could introduce parsing bugs, but the diff itself only wires up an existing `Feature` type and does not show the decoder implementation.

Lower-priorityp2p: Add BIP434 moduleby rustaceanrob · 622bd341 · Jul 27, 2026 · 2 filesMessage 59 · ThinInformational 15Details
Commit message · rustaceanrob

p2p: Add BIP434 module

This is a new way to advertise support of features without implicit
support via the protocol version.

ref: https://github.com/bitcoin/bips/blob/master/bip-0434.md#feature-message

59/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit adds a new, optional module implementing a Bitcoin protocol feature called BIP-434. It lets Bitcoin nodes advertise which new features they support during peer-to-peer handshake messages. The code only adds message parsing and serialization helpers; it does not change existing behavior or fix any reported problem. There is no indication this is a security patch.

AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 69e50bb3 · Jul 27, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.35.5 to 4.36.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/9e0d7b8d25671d64c341c19c0152d693099fb5ba...7211b7c8077ea37d8641b6271f6a365a22a5fbfa)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps the version of a GitHub-owned action used to upload security scan results. It changes one pinned commit hash in a CI workflow file and does not alter any project code, cryptographic logic, or user-facing behavior. There is no indication this introduces or fixes a security vulnerability in the rust-bitcoin library itself.

AI review queuedbuild(deps): bump taiki-e/install-action from 2.79.3 to 2.79.12by dependabot[bot] · d953dccc · Jul 27, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.79.3 to 2.79.12

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.3 to 2.79.12.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/65851e10cd6c377f11a60e600abc07cb08643468...6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.79.12
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps a GitHub Actions helper (taiki-e/install-action) used in testing workflows from version 2.79.3 to 2.79.12. It only changes which version of the action is used to install Rust testing tools in CI. There is no indication this fixes or introduces a security issue in the rust-bitcoin library itself.

AI review queuedUpdate API filesby Mitchell Bagot · a487f942 · Jul 27, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated text files that list the public API of the crate. The change records that the Opcode type now implements the Hash trait, which is a normal, additive feature addition. There is no code change, no bug fix, and no security relevance visible in the diff.

Lower-priorityAdd Hash derive to Opcodeby Mitchell Bagot · 58e13052 · Jul 27, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Add Hash derive to Opcode

The Opcode type implements all of the common traits except for Display,
Ord and PartialOrd. The Ord traits are excluded due to no natural
ordering and Display due to the current instability in the display
format. However Hash has no such restrictions and should be included.

Add Hash derive to Opcode.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit simply adds the standard Rust Hash trait to the Opcode type, allowing Opcode values to be used as keys in hash maps and sets. There is no security-relevant change: it does not alter existing behavior, add new functionality that processes untrusted data, or fix any vulnerability.

Lower-priorityAdjust test to cover WitnessVersion fmt traitsby Mitchell Bagot · eed88a61 · Jul 27, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Adjust test to cover WitnessVersion fmt traits

With the new fmt traits on WitnessVersion, tests must be added or
modified to cover the new mutants.

Rename witness_version_display test to witness_version_fmt and include
cases for all format traits.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only changes test code. It renames a test and adds extra checks to make sure a Bitcoin data type (WitnessVersion) prints correctly in different number formats (decimal, hexadecimal, octal, binary). There is no change to production code and no security issue.

AI review queuedUpdate API filesby Mitchell Bagot · 85943c5a · Jul 27, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files to reflect that a Rust formatting trait was added for a Bitcoin witness-version type. There is no code change, no bug fix, and no security relevance visible in the diff.

Lower-priorityAdd fmt traits for WitnessVersionby Mitchell Bagot · 305affb0 · Jul 27, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add fmt traits for WitnessVersion

Per the C-NUM-FMT guideline, number types should have Octal, Binary and
Hex formatting. Just as with the block::Version and
transaction::Version types, the WitnessVersion type should also include
these trait impls.
Opcode specifically is excluded as its stringify functionality is still
unclear.

Add {Lower,Upper}Hex, Binary, and Octal trait impls to WitnessVersion.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit adds standard Rust formatting traits (LowerHex, UpperHex, Binary, Octal) to the WitnessVersion type, which is a small API ergonomics improvement. There is no security relevance in the diff itself.

Lower-priorityMove address module to single file in crateby Mitchell Bagot · af312700 · Jul 27, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Move address module to single file in crate

The address::error module is now just a re-export for errors in the
addresses crate. It can be trivially inlined into the now much smaller
address module. With the smaller size of the address module, it can now
be moved to an address.rs file in the crate root.

Move address::error submodule inline in the parent address module.
Move address module subdirectory to address.rs file in crate root.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a simple code reorganization: it moves the address module from a directory (address/mod.rs plus address/error.rs) into a single file (address.rs) and inlines the small error re-export module. No behavior changes, no security fixes, and no new functionality were introduced.

AI review queuedaddresses: Add pub externsby Mitchell Bagot · b734eec7 · Jul 27, 2026 · 1 fileMessage 58 · ThinInformational 15Details
Commit message · Mitchell Bagot

addresses: Add pub externs

If a dependency crate has types appearing in the public api of a crate,
that crate should be pub extern'd.

Add pub externs for all crates with types in the public api.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit is a routine Rust packaging change. It makes several internal dependency crates (base58, bech32, crypto, network, primitives, serde) publicly visible to users of the 'addresses' crate so that types from those crates can be used cleanly in the public API. There is no bug fix, behavior change, or security patch here.

Lower-priorityFix lint errors in addresses crateby Mitchell Bagot · 7cade829 · Jul 27, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Fix lint errors in addresses crate

After the major move of types to addresses, various lint errors now
appear due to stricter lint requirements.

Adjust docs and code to resolve all lint errors in addresses.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit only fixes code style and documentation warnings (lint errors) in the addresses crate. It changes how some Rust patterns are written, adds missing documentation comments, and adjusts test code formatting. There is no change to program behavior or security.

Lower-priorityMove address types to addressesby Mitchell Bagot · 889f5657 · Jul 27, 2026 · 8 filesMessage 68 · AdequateInformational 18Details
Commit message · Mitchell Bagot

Move address types to addresses

With the previous changes made, all of the address and error types can
now be moved to the addresses crate.

Move all address types to addresses and re-export in bitcoin.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit is a large internal code reorganization in the rust-bitcoin project. It moves Bitcoin address types, parsing logic, and error types from the main `bitcoin` crate into a new `addresses` sub-crate, then re-exports them so existing users of the `bitcoin` crate see the same public API. There is no indication this fixes a security bug or introduces a vulnerability; it is a structural refactoring.

Security candidateSplit Address into an extension traitby Mitchell Bagot · c900fa8c · Jul 27, 2026 · 3 filesMessage 73 · AdequateInformational 18Details
Commit message · Mitchell Bagot

Split Address into an extension trait

The Address::from_script function relies on Params in the function
signature. Since Params can't be moved to addresses or primitives, this
function should be left behind in an extension trait for now.

Introduce AddressExt extension trait and move minimal functionality
from Address into it.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 18/100

This commit is a routine code reorganization in the rust-bitcoin library. It moves the `Address::from_script` method out of the main `Address` type into a new 'extension trait' called `AddressExt`. The actual logic of the function is copied unchanged. This is a design change to resolve a dependency issue (the `Params` type cannot be moved into a lower-level crate), not a security fix.

Lower-priorityRemove all uses of extension traits from Addressby Mitchell Bagot · 16366bc2 · Jul 27, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Remove all uses of extension traits from Address

The functions in Address currently use BuilderExt functions to simplify
their implementations. Since the underlying functionality already
exists in primitives, we can remove the dependence on bitcoin
functionality by adjusting the impls.

Remove all uses of BuilderExt from Address functions.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a small internal code cleanup in the rust-bitcoin library. It changes how Bitcoin addresses are built for certain SegWit-compatible pay-to-script-hash addresses, replacing one internal helper method with a direct opcode call. There is no indication this fixes a security bug or changes user-visible behavior.

Lower-priorityChange ScriptBuf::default to call ScriptBuf::newby Mitchell Bagot · 92b08c5c · Jul 27, 2026 · 1 fileMessage 68 · AdequateInformational 19Details
Commit message · Mitchell Bagot

Change ScriptBuf::default to call ScriptBuf::new

According to C-CTOR, for types that implement Default and have a new
constructor, the two should have the same behaviour. While ScriptBuf
already satisfies this, regressions can be prevented by implementing
Default by calling new, rather than repeating the logic.

Adjust ScriptBuf Default impl to call through to ScriptBuf::new.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This is a tiny internal code-quality change. It makes the default empty-script constructor reuse the existing `new()` method instead of duplicating the same one-line logic. There is no security bug being fixed and no behavior change for users.

Security candidateci: update cargo-rbmt ever month instead of weekby Nick Johnson · 778018e1 · Jul 27, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · Nick Johnson

ci: update cargo-rbmt ever month instead of week

The week updates have been too noisy with the rbmt churn, hoping the
monthly schedule gives us a poke if we fall behind, but isn't noisy.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit simply renames a GitHub Actions workflow file and changes its schedule from weekly to monthly. It is a routine CI maintenance change with no security relevance.

Lower-prioritybitcoin: seal WorkExtby Nick Johnson · 73efa990 · Jul 26, 2026 · 1 fileMessage 51 · ThinInformational 20Details
Commit message · Nick Johnson

bitcoin: seal WorkExt

An un-sealed WorkExt exposes a non-additive feature. With the `std`
feature is enabled, a function is added without a default implementation.
Sealing the trait since it is not designed for consumers to implement.
This also makes it additive.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
AI analysis · Informational 20/100

This commit seals a small helper trait called WorkExt so that outside users of the library can no longer implement it themselves. Before the change, enabling the optional `std` feature silently added a new method (log2) to the trait without a fallback, which could break any downstream code that had implemented the trait. The fix prevents that breakage and makes the library's feature setup more predictable, but it is a breaking API change rather than a traditional security vulnerability.