RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
141commits · 30 days
284commits · 60 days
1150commits · 180 days
2046commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 50 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedbuild(deps): bump actions/download-artifact from 7.0.0 to 8.0.1by dependabot[bot] · 5099d280 · Jul 20, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions helper used to download build artifacts in a daily fuzzing workflow. There is no code change to the rust-bitcoin library itself, and no security issue is indicated in the commit or supplied references.

AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 4460fb54 · Jul 20, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.35.5
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps the version of a GitHub-provided action used to upload security scan results. It changes only a pinned commit hash in a workflow file and does not alter the project's actual Bitcoin library code or introduce any vulnerability.

AI review queuedUpdate API filesby Mitchell Bagot · 32d0a893 · Jul 20, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files to remove a constant named GENESIS_PREVIOUS_BLOCK_HASH from the public API listing. It does not change any actual Rust source code, so it cannot introduce or fix a security vulnerability on its own.

Lower-priorityDrop WitnessCommitment::GENESIS_PREVIOUS_BLOCK_HASHby Mitchell Bagot · 1150ac54 · Jul 20, 2026 · 1 fileMessage 63 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Drop WitnessCommitment::GENESIS_PREVIOUS_BLOCK_HASH

The GENESIS_PREVIOUS_BLOCK_HASH const on WitnessCommitment doesn't
appear to have a use, and is likely copied from the BlockHash type.
As such, it should be removed before the 1.0.

Remove WitnessCommitment::GENESIS_PREVIOUS_BLOCK_HASH const.

63/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit simply removes an unused public constant from the WitnessCommitment type. It is a routine cleanup with no security implications.

AI review queuedUpdate API filesby Mitchell Bagot · b90596f6 · Jul 20, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot files that list the names of public types and functions. It renames error types like TryFromError to InvalidWitnessVersionError and FromStrError to ParseWitnessVersionError in those snapshots. There is no actual code change, no bug fix, and no security impact in this commit itself.

Lower-priorityRename witness_version errorsby Mitchell Bagot · bfe55b7b · Jul 20, 2026 · 3 filesMessage 58 · ThinInformational 15Details
Commit message · Mitchell Bagot

Rename witness_version errors

The error types in the new primitives::witness_version module follow the
traits that they are used within, FromStr and TryFrom. This differs from
other such errors. These should be renamed to more closely align with
existing naming patterns.

Rename FromStrError to ParseWitnessVersionError and TryFromError to
InvalidWitnessVersionError.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a simple renaming of error types in the rust-bitcoin library. It changes names like FromStrError to ParseWitnessVersionError and TryFromError to InvalidWitnessVersionError to match existing naming conventions. There is no change to program logic, no bug fix, and no security relevance.

Lower-priorityunits: Serialize Option<T> via combinatorsby Abeeujah · f9299127 · Jul 19, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Abeeujah

units: Serialize Option<T> via combinators

Transform and serialize the Option using chained combinators, this
removes the explicit match statement, utilizes idiomatic Rust patterns
and makes the serialization a concise expression.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine code cleanup in the rust-bitcoin library. It rewrites how optional amounts and fee rates are converted for JSON/serialization output to use more idiomatic Rust chaining (`.map(...).serialize(s)`) instead of explicit `match` blocks. There is no change to the actual serialized data or to security behavior.

AI review queuedunits: Flatten nested checked_ops methodsby Abeeujah · 99f3721d · Jul 18, 2026 · 4 filesMessage 68 · AdequateInformational 19Details
Commit message · Abeeujah

units: Flatten nested checked_ops methods

Use let-else statements in place of nested and doubly nested match
blocks which was added as a workaround to `Option::map` not being
available in `const` functions for MSRV `1.74.0`.

This improves legibility, early returns on error and eliminates
no-op `None => None` arms.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit is a straightforward code cleanup in the rust-bitcoin library. It replaces deeply nested match blocks with newer, cleaner Rust syntax (let-else statements) inside safe arithmetic helper functions. The actual behavior of the code—checking for overflow and returning None on error—does not change. There is no security vulnerability being fixed here.

Lower-priorityRemove githooksby Nick Johnson · e1fd9839 · Jul 17, 2026 · 5 filesMessage 41 · ThinInformational 15Details
Commit message · Nick Johnson

Remove githooks

I believe at this point most maintainers are using jujutsu, not making
use of the hooks. Dropping them for one less thing to maintain.

41/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context! Too few words to establish purpose
AI analysis · Informational 15/100

This commit simply deletes the project's optional Git hooks and the documentation and helper scripts that installed them. Git hooks are local developer convenience scripts that run on your own machine when you commit or merge code. Removing them does not change any shipped code, network behavior, or cryptographic logic, and it does not create a security vulnerability.

Lower-priorityci: clean up cross with more recent versionby Nick Johnson · 9342d9df · Jul 17, 2026 · 3 filesMessage 90 · StrongInformational 15Details
Commit message · Nick Johnson

ci: clean up cross with more recent version

Updating to something within the last 3 years cleans up the issue the
old version had with fuzz dependencies. We could also exclude the
bitcoin-fuzz crate from the cross test, but in any case we need a
newwer version of cross.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit updates the project's continuous integration (CI) setup for cross-compilation testing. It removes a custom Docker image and configuration, and instead installs a specific newer version of the 'cross' tool directly from its GitHub repository. There is no change to the actual Bitcoin library code that users run.

Lower-priorityunits: update api test conventionsby Nick Johnson · 045b82a7 · Jul 17, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · Nick Johnson

units: update api test conventions

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a routine cleanup of test code in the rust-bitcoin project's `units` crate. It renames test functions, reorganizes them, and adds clearer comments linking them to Rust API guideline conventions. There is no change to the actual library code that users depend on, and nothing in the commit suggests a security fix or vulnerability.

Lower-priorityprimitives: update API test conventionsby Nick Johnson · 75340f51 · Jul 17, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · Nick Johnson

primitives: update API test conventions

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a routine cleanup of test code in the rust-bitcoin project. It renames test functions, adds comments, and reorganizes API surface tests to follow project conventions. There is no change to the actual library code that handles Bitcoin data, so it cannot introduce a security vulnerability or fix one.

Lower-priorityhashes: update api test conventionsby Nick Johnson · baf4ec0f · Jul 17, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · Nick Johnson

hashes: update api test conventions

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only renames and reorganizes test code in a single API test file. It adds compile-time checks that certain public types implement standard Rust traits like Debug, Send, Sync, serde, and Arbitrary. There is no change to production code, no bug fix, and no security relevance.

Lower-priorityio: update API tests to new conventionsby Nick Johnson · 480b5da1 · Jul 17, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · Nick Johnson

io: update API tests to new conventions

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only renames test functions and updates comments in a single Rust test file. It makes no changes to actual library code, behavior, or security-sensitive logic.

Lower-prioritydocs: add P-* policy sections to policy docby Nick Johnson · 06d5381d · Jul 17, 2026 · 1 fileMessage 82 · StrongInformational 15Details
Commit message · Nick Johnson

docs: add P-* policy sections to policy doc

Referring to these in the package api.rs tests.

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only edits a documentation file (docs/policy.md). It adds coding guidelines and a table of contents for the project. There are no code changes, no bug fixes, and no security-related modifications.

Lower-prioritynetwork: extend api test conventionsby Nick Johnson · 11c27e6b · Jul 17, 2026 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Nick Johnson

network: extend api test conventions

* Rename tests after their rust guideline (e.g. `c_good_err_display`).
* Add an internal policy test (`p_*`) to ensure Arbitrary is implemented.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only renames existing test functions and adds one new internal policy test to verify that a public type implements the Arbitrary trait when the optional 'arbitrary' feature is enabled. It does not change any production code, cryptographic logic, network handling, or security behavior.

Lower-priorityconsensus_encoding: update API test to follow conventionsby Nick Johnson · 21e26dd1 · Jul 17, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Nick Johnson

consensus_encoding: update API test to follow conventions

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only renames and recomments test functions in a single Rust test file. It does not change any production code, library behavior, or security-sensitive logic. There is no security issue here.

Lower-priorityci: remove github release workflowby Nick Johnson · 3a0618ae · Jul 17, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Nick Johnson

ci: remove github release workflow

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit simply deletes a GitHub Actions workflow file that automatically created GitHub releases when new version tags were pushed. It is a routine CI/infrastructure change with no code changes and no apparent security relevance.

Lower-priorityAdd `impl Clone for Box<{custom DST}>`by Martin Habovstiak · 9b738a5f · Jul 17, 2026 · 5 filesMessage 78 · AdequateInformational 18Details
Commit message · Martin Habovstiak

Add `impl Clone for Box<{custom DST}>`

`Script<T>` and `PushBytes` are unsized types wrapping `[u8]`. The standard
library only provides `Clone for Box<T>` where `T: Clone + Sized`, so
`Box<Script<T>>` and `Box<PushBytes>` were missing `Clone` implementations.

Add manual `impl<T> Clone for Box<Script<T>>` and `impl Clone for
Box<PushBytes>` that clone the underlying bytes and wrap them in new boxed
values via `from_boxed_bytes` / `from_boxed_slice_unchecked`.

Also add the corresponding `Box<{Script variant}>` and `Box<PushBytes>` fields
to the API test's `Clone` struct (guarded by `#[cfg(feature = "alloc")]`) so
that these impls are covered by the compile-time API surface tests.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 18/100

This commit adds the ability to clone boxed versions of two custom unsized byte-wrapping types used in Bitcoin scripts. Before this change, code that tried to clone a Box<Script> or Box<PushBytes> would fail to compile. The change is a normal API completeness fix and does not appear to fix any memory-safety bug or security vulnerability.

AI review queuedprimitives: Remove todoby Tobin C. Harding · e62e553d · Jul 17, 2026 · 1 fileMessage 23 · OpaqueInformational 15Details
Commit message · Tobin C. Harding

primitives: Remove todo

Just remove it and document that state machine code is often verbose.

23/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body! Contains work-in-progress language
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes a code comment. It replaces a developer TODO note with a short explanation that the code is verbose because it implements a state machine. No code behavior, logic, or security properties changed.

Security candidateprimitives: Bump version to 0.103.0by Tobin C. Harding · 5612224d · Jul 17, 2026 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

primitives: Bump version to 0.103.0

In preparation for release add a changelog entry, bump the version,
and update the lock files.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine release preparation: it bumps the version number of the `bitcoin-primitives` crate from 0.102.0 to 0.103.0, updates related dependency declarations in other crates, refreshes lock files, and adds a changelog entry. There are no code logic changes and no security fix or vulnerability introduced in the diff itself.

Lower-prioritybitcoin: Depend on encoding 1.1.0by Tobin C. Harding · c719de4c · Jul 17, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

bitcoin: Depend on encoding 1.1.0

The `bitcoin` crate uses the `hex` feature of `encoding` which only
came out in `1.1.0` so we need to explicitly depend on that version.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a routine dependency version bump in a Rust package manifest. The bitcoin crate was already using a feature ('hex') from its internal encoding crate, but the manifest only required version 1.0.0. Since that feature was added in version 1.1.0, the requirement is being corrected to 1.1.0. There is no security-relevant code change here.

Lower-priorityAutomated update to rustc stable-1.97.1by Update Stable Rustc Bot · 41258026 · Jul 17, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Update Stable Rustc Bot

Automated update to rustc stable-1.97.1

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is a routine automated update that changes the pinned stable Rust compiler version in the project's configuration file from 1.96.0 to 1.97.1. It does not modify any source code, dependencies, or security-sensitive settings. There is no indication of a security fix or vulnerability.

Lower-priorityfuzz: update to target 0.32.102by yancy · d75c8544 · Jul 16, 2026 · 3 filesMessage 55 · ThinInformational 15Details
Commit message · yancy

fuzz: update to target 0.32.102

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit is a routine dependency update for the project's fuzz testing setup. It bumps the version of the 'bitcoin' crate used in fuzz tests from 0.32.101 to 0.32.102 and updates the corresponding lock files. There are no code changes to the library itself, and nothing in the commit suggests a security fix or vulnerability.

Lower-prioritytest: V1NetworkMessage sendcmpct should be either 1 or 0by Abeeujah · e99b8e4f · Jul 16, 2026 · 1 fileMessage 87 · StrongInformational 12Details
Commit message · Abeeujah

test: V1NetworkMessage sendcmpct should be either 1 or 0

Add a test that if the mode bit of the sendcmpct should fail if not 1 or
0.

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 12/100

This commit only adds a new unit test. It does not change any production code, so it cannot by itself introduce or fix a security vulnerability. The test verifies that an invalid 'sendcmpct' network message (with a mode byte other than 0 or 1) is rejected during decoding. If the underlying code already rejects such messages, the test merely documents that behavior. If it did not, the test would fail and the vulnerability would remain unfixed.