RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
141commits · 30 days
284commits · 60 days
1150commits · 180 days
2046commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 22 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityfuzz: fold fuzz-util.sh into generate-bins.shby Nick Johnson · b41211de · Jul 26, 2026 · 2 filesMessage 55 · ThinInformational 15Details
Commit message · Nick Johnson

fuzz: fold fuzz-util.sh into generate-bins.sh

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit is a simple housekeeping change for the project's fuzz-testing scripts. It removes a small helper file (fuzz-util.sh) and copies its functions directly into another script (generate-bins.sh). There is no change to the actual Bitcoin library code, no change to how the software handles data, and no security fix or vulnerability introduced.

Lower-priorityfuzz: fold cycle.sh script into fuzz.shby Nick Johnson · a673433b · Jul 26, 2026 · 3 filesMessage 55 · ThinInformational 15Details
Commit message · Nick Johnson

fuzz: fold cycle.sh script into fuzz.sh

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit is a routine cleanup of the project's fuzz-testing shell scripts. It merges the old cycle.sh script into fuzz.sh and adds a -cycle command-line flag. There is no change to the actual Bitcoin library code, no bug fix, and no security patch.

Lower-priorityfuzz: detach fuzz.sh from fuzz-util.sh, use cargo-fuzz insteadby Nick Johnson · 351903c5 · Jul 26, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Nick Johnson

fuzz: detach fuzz.sh from fuzz-util.sh, use cargo-fuzz instead

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit refactors a fuzz-testing shell script to stop using a local helper file and instead use the standard 'cargo-fuzz' tool directly. It is a build/test tooling change with no apparent effect on the security of the actual Bitcoin library code.

Security candidateci: disable fail-fast in weekly toolchain update matrixby satsfy (Renato Britto) · d9fef884 · Jul 26, 2026 · 2 filesMessage 77 · AdequateInformational 15Details
Commit message · satsfy (Renato Britto)

ci: disable fail-fast in weekly toolchain update matrix

A broken 0.32.xxx job takes the master and 0.32.xx updates down with
it. Let each branch succeed or fail on its own.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit changes two GitHub Actions workflow files so that if one branch's automated toolchain update job fails, the other branches' jobs keep running instead of all being cancelled. It is a pure CI reliability/configuration tweak with no product code changes and no security relevance.

Lower-priority2026-07-26 automated rustfmt nightlyby Fmt Bot · e4dc1996 · Jul 26, 2026 · 3 filesMessage 45 · ThinInformational 15Details
Commit message · Fmt Bot

2026-07-26 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is an automated code-formatting commit from rustfmt. It only changes whitespace, reorders imports, and breaks a long line. There are no functional changes and no security implications.

Lower-priorityAutomated update to Github CI to cargo-semver-checks version-0.49.0by Update cargo-semver-checks Bot · ac2a1b1d · Jul 25, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Update cargo-semver-checks Bot

Automated update to Github CI to cargo-semver-checks version-0.49.0

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit simply bumps the version number of a third-party CI linting tool (cargo-semver-checks) used in GitHub Actions from 0.48.0 to 0.49.0. It changes one line in a workflow configuration file and has no effect on the actual Bitcoin library code, runtime behavior, or security of the software.

AI review queuedprimitives: update API filesby Nick Johnson · 2706ed4e · Jul 24, 2026 · 3 filesMessage 35 · OpaqueInformational 15Details
Commit message · Nick Johnson

primitives: update API files

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files to reflect recent changes in public function signatures. It does not change any source code, fix bugs, or alter program behavior. There is no security relevance.

Lower-priorityci: move github label script under the github directoryby Nick Johnson · de0a0970 · Jul 24, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · Nick Johnson

ci: move github label script under the github directory

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit simply moves a helper shell script from one folder (contrib/) to another (.github/) and updates the path used by a GitHub Actions workflow. It does not change any project code, cryptographic logic, or how the software behaves for users. There is no security issue here.

Lower-priorityci: add a CI labeller workflow to handle labeling PRs from all branchesby Nick Johnson · 0290e6b0 · Jul 24, 2026 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · Nick Johnson

ci: add a CI labeller workflow to handle labeling PRs from all branches

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit adds a new GitHub Actions workflow that automatically adds or removes an 'API diff' label on pull requests after CI finishes. It is a defensive security improvement: it separates the labeling step from the main CI workflow and runs with minimal permissions, following GitHub's own guidance for safely handling pull requests from external branches. There is no indication of a vulnerability being introduced or fixed.

AI review queuedUse generic arguments for functionsby Mitchell Bagot · e887140a · Jul 23, 2026 · 4 filesMessage 68 · AdequateInformational 18Details
Commit message · Mitchell Bagot

Use generic arguments for functions

While most of primitives uses generic arguments where useful, there
are a couple of functions which can be adjusted to use generics to
specify argument requirements.

Adjust Block::compute_*_root and *MerkleNode::calculate_root functions
to use generics in place of slices and types.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a routine API cleanup: it makes a few Bitcoin merkle-root functions accept a broader range of input types (generic iterators and borrowed transactions) instead of only slices or exact iterator types. There is no security bug being fixed and no behavior change for callers that already used the old API. The tests were updated only to remove unnecessary `.into_iter()` calls.

Lower-priorityRemove .clone() call in check_witness_commitmentby Mitchell Bagot · 3983cd3f · Jul 23, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Remove .clone() call in check_witness_commitment

In Block::check_witness_commitment, clone is used to clone the first
transaction in the block. However, this transaction is only used in
ways that need a ref. Thus, the clone can be replaced by ref access.

Replace transaction clone with taking a ref in check_witness_commitment.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a minor code cleanup that removes an unnecessary copy of the first transaction in a Bitcoin block validation routine. It does not change behavior, fix a bug, or address any security issue.

Lower-prioritytaproot-primitives: Enable crypto featuresby Mitchell Bagot · 8101f23d · Jul 23, 2026 · 1 fileMessage 68 · AdequateInformational 12Details
Commit message · Mitchell Bagot

taproot-primitives: Enable crypto features

The crypto dep of taproot-primitives is currently used with no features.
While no features are currently required for the limited use of crypto
in the crate, this may change, so the features of crypto should be
enabled based on the features of taproot-primitives.

Add feature enabling on crypto for all taproot-primitives features.y

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 12/100

This is a small Cargo.toml configuration change that forwards feature flags from the taproot-primitives crate to its internal bitcoin-crypto dependency. It does not change any executable code, fix a bug, or alter behavior under current feature usage. The commit is framed as a future-proofing measure, not a security fix.

Lower-prioritycontrib: remove old test scripts stale referencesby satsfy (Renato Britto) · 069ff853 · Jul 22, 2026 · 5 filesMessage 78 · AdequateInformational 15Details
Commit message · satsfy (Renato Britto)

contrib: remove old test scripts stale references

The labeler config, gitignore, and label generator still reference
dep_test, run_task.sh, extra_tests.sh, and test_vars.sh, leftovers
from before cargo-rbmt.

Drop the dead entries and delete test_vars.sh, inlining the
CRATES list into test-miri.sh.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a routine cleanup of leftover references to old test scripts in configuration files. It removes stale entries from a GitHub labeler config, .gitignore, and a label generator, deletes an unused helper script, and inlines its only useful content into another script. There is no security-relevant change.

Lower-priorityprimitives: Document check_witness_commitmentby Tobin C. Harding · c150fd94 · Jul 22, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Tobin C. Harding

primitives: Document check_witness_commitment

Document the return type/value and the its later usage.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only adds documentation comments to an existing Rust function. It explains what the function returns and how that return value can be reused. No code behavior was changed, so there is no security impact.

Lower-priorityfuzz: move rustflag handing into fuzz.shby Nick Johnson · 82c5ac0f · Jul 22, 2026 · 2 filesMessage 55 · ThinInformational 15Details
Commit message · Nick Johnson

fuzz: move rustflag handing into fuzz.sh

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit is a routine cleanup of the project's internal fuzz-testing scripts. It moves the logic that sets special compiler flags for fuzzing from the GitHub Actions workflow file into the fuzz.sh shell script. There is no change to the actual Bitcoin library code, no change to how user-facing software behaves, and no security fix or vulnerability introduced.

Lower-priorityfuzz: update the generate-files script to only discover and manage binsby Nick Johnson · f9deb1c0 · Jul 22, 2026 · 2 filesMessage 60 · AdequateInformational 15Details
Commit message · Nick Johnson

fuzz: update the generate-files script to only discover and manage bins

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit is a routine maintenance change to the project's fuzz-testing build script. It changes how the list of fuzz test programs is generated and written into a configuration file, but it does not alter the actual Bitcoin library code, fix a bug, or change any behavior that end users or network participants would see. There is no security issue here.

Lower-priorityfuzz: rename generate files scriptby Nick Johnson · 97f9d5a0 · Jul 22, 2026 · 4 filesMessage 70 · AdequateInformational 15Details
Commit message · Nick Johnson

fuzz: rename generate files script

The script only manages the `[[bin]]` sections in the manifest now.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit simply renames a fuzz-testing helper script from `generate-files.sh` to `generate-bins.sh` and updates the comments and README that reference it. The script's behavior is unchanged. There is no effect on the actual Bitcoin library code or on security.

Lower-priorityci: detach fuzz cron from bin generationby Nick Johnson · c93aedc1 · Jul 22, 2026 · 2 filesMessage 90 · StrongInformational 15Details
Commit message · Nick Johnson

ci: detach fuzz cron from bin generation

Fuzz targets are run across a fix number of jobs (shards) instead of a
job per target. There shouldn't be performance issues since each target
is only run for a handful of minutes. It might make it a little more
difficult to debug target failures, but the tradeoff is the github
workflow no longer needs to be generated by a script.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit is a maintenance-only change to the project's automated fuzz testing setup. It switches the daily fuzzing workflow from generating one GitHub Actions job per fuzz target to running targets across a fixed set of 16 shared jobs. It removes the script that generated the workflow file and deletes a verification step that checked every target ran. There is no change to the actual Bitcoin library code, no user-facing behavior change, and no security fix or vulnerability introduced.

Lower-priorityunits: Fix off-by-one error in satisfied by heightby Tobin C. Harding · 6707389f · Jul 22, 2026 · 2 filesMessage 91 · StrongModerate 64Details
Commit message · Tobin C. Harding

units: Fix off-by-one error in satisfied by height

In #6384 we fixed an off-by-one error in the satisfied by time logic.
I swear I checked the satisfied by height code at that time but
apparently not. While reviewing #6581 I saw the same bug.

The problem is we both +1 to height _and_ use `<=`. Either of these on
its own is correct since we know the next block has height one higher
and the check is 'lower than the height of the next block'.

The unit boundary test was wrong too.

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Moderate 64/100

This commit fixes an off-by-one error in how the rust-bitcoin library decides whether a Bitcoin transaction's height-based locktime is satisfied. Because the code both added 1 to the current chain tip height and used a 'less than or equal to' comparison, it considered a locktime satisfied one block too early. A transaction that should only be spendable after block 101 could have been treated as spendable once block 100 was the chain tip. The same kind of bug was also present in relative height locktime checks. The fix removes the extra +1 and switches to a strict 'less than' comparison for absolute height locks, and removes the +1 for relative height locks.

Security candidatecrypto: Bump version to 0.3.0by Tobin C. Harding · 1c118339 · Jul 22, 2026 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

crypto: Bump version to 0.3.0

In preparation for release add a changelog entry, bump the version
number, and update the lock files.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine release preparation: it bumps the version number of the `bitcoin-crypto` crate from 0.2.0 to 0.3.0, updates the changelog, and adjusts dependency references in related crates' configuration files and lock files. There are no code changes, bug fixes, or security patches in the diff.

AI review queuedUpdate API filesby Mitchell Bagot · fd897c4c · Jul 21, 2026 · 2 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API text files to reflect that a Rust trait now requires an internal 'sealed' marker. It is a documentation or API-snapshot update with no code changes and no security relevance.

Lower-prioritySeal PushBytesErrorReportby Mitchell Bagot · 26ec3fc2 · Jul 21, 2026 · 1 fileMessage 48 · ThinInformational 18Details
Commit message · Mitchell Bagot

Seal PushBytesErrorReport

The PushBytesErrorReport trait is intended to provide an accessor for
the input length during a push bytes construction failure. Since this
should only be defined for the PushBytesError and Infallible, it
should be sealed.

Seal PushBytesErrorReport.

48/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context! Too few words to establish purpose
AI analysis · Informational 18/100

This commit seals a Rust trait called PushBytesErrorReport so that only two specific internal types can implement it. Sealing prevents outside code from implementing the trait, which reduces the chance that a future change accidentally breaks compatibility or introduces unexpected behavior. It is a defensive hardening change, not a fix for an active security bug.

Lower-priorityAdd test case to prevent regressions to Witness FromIteratorby Mitchell Bagot · a6751a59 · Jul 21, 2026 · 1 fileMessage 95 · StrongInformational 12Details
Commit message · Mitchell Bagot

Add test case to prevent regressions to Witness FromIterator

Following the fix in the previous patch, a simple test case should be
introduced to prevent future changes from introducing regressions on
the extreme length iter edge cases.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 12/100

This commit only adds a new automated test. It does not change any production code. The test checks that building a Witness from a very long iterator (over 4 million empty byte slices) does not accidentally drop elements. It is a regression test following an earlier fix, not a security patch itself.

Lower-priorityRename taproot-primitives package directory to taproot_primitivesby Nick Johnson · c59e2710 · Jul 20, 2026 · 8 filesMessage 65 · AdequateInformational 15Details
Commit message · Nick Johnson

Rename taproot-primitives package directory to taproot_primitives

Follows rust convention and the convention of this workspace, should not
effect consumers.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit simply renames a folder from taproot-primitives to taproot_primitives to match Rust naming conventions. It does not change any code behavior, fix a bug, or address a security issue. All references to the folder path in workspace and package configuration files are updated consistently.

AI review queuedbuild(deps): bump taiki-e/install-action from 2.62.45 to 2.79.3by dependabot[bot] · 99e1381b · Jul 20, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.62.45 to 2.79.3

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.62.45 to 2.79.3.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/81ee1d48d9194cdcab880cbdc7d36e87d39874cb...65851e10cd6c377f11a60e600abc07cb08643468)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.79.3
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine Dependabot update that bumps a GitHub Actions helper (taiki-e/install-action) used in automated testing workflows to a newer minor version. It does not change the project's actual Bitcoin library code, its dependencies, or how user funds or data are handled. There is no security-relevant change visible in the commit.