CommitWatch RSS
RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
141commits · 30 days
284commits · 60 days
1150commits · 180 days
2046commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 21 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityp2p: make SendCmpct encode/decode idempotentby yancy · b7c35eff · Jul 16, 2026 · 1 fileMessage 88 · StrongLow 37Details
Commit message · yancy

p2p: make SendCmpct encode/decode idempotent

Normalizing the mode bit makes serialization/deserealiztion _not_
idempotent. That's due to the checksum that's created before
normalization which if serialized again, no longer has the same
checksum. This cases a failure to serialize the same `SendCmpct` which
was received if the mode bit is anything other then 0 or 1.
Furthermore, the spec https://bips.dev/152/ defines only 0
(low-bandwidth mode) or 1 (high-bandwidth mode) so anything other than
0 or 1 is unspecified and should result in an error.

As quoted from spec https://bips.dev/152/:
The first integer SHALL be interpreted as a boolean (and MUST have a
value of either 1 or 0)

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Low 37/100

This change fixes a serialization bug in how the rust-bitcoin library handles a Bitcoin peer-to-peer message called `sendcmpct`. Previously, if a malformed or unusual message arrived with a mode value other than 0 or 1, the library would silently normalize it to true/false. That normalization changed the message bytes, so if the library later tried to re-send the exact message it had received, the message checksum would no longer match, causing a serialization failure. The patch now rejects any mode value other than 0 or 1, matching the BIP 152 specification, and reports a clear decoding error instead of silently altering the data.

AI review queuedUpdate API filesby Mitchell Bagot · e49c6b95 · Jul 16, 2026 · 4 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot files that record which types and functions are publicly visible in the library. No actual source code was changed, and nothing in the commit fixes or introduces a security problem. It is a routine housekeeping change.

Lower-priorityMove error types to error submodulesby Mitchell Bagot · 17c4b76b · Jul 16, 2026 · 3 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Move error types to error submodules

In the crates, all error types should be defined within error submodules
and then re-exported no_inline in the main module. Currently, we have
two error types that do not follow this pattern in units and primitives.

Move error types to error submodules and re-export no_inline.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine code reorganization. It moves existing error types into new 'error' submodules and re-exports them in the same way the project does elsewhere. No behavior changes, no bug fixes, and no security implications are visible.

AI review queuedUpdate API filesby Mitchell Bagot · 7153746e · Jul 16, 2026 · 2 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot files to reflect that a new `extend` method was added to the `Witness` type. The actual code change happened elsewhere, and these files are just machine-generated documentation of the public API surface. There is no security issue visible in this commit itself.

Lower-priorityAdd Extend impl to Witnessby Mitchell Bagot · 8f47aff7 · Jul 16, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add Extend impl to Witness

Per the C-COLLECT API guideline, any collection type that implements
FromIterator should also implement Extend. Since the Witness type
already has the push method, and FromIterator impl, it is clearly
intended to be usable like a collection and should thus also have
Extend.

Add Extend impl to Witness.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit adds a standard Rust trait implementation (Extend) to the Witness type, allowing users to append multiple witness elements at once. It is a routine API completeness change with no security relevance.

Lower-priorityAdd Debug impl to witness::Iterby Mitchell Bagot · 986967f4 · Jul 16, 2026 · 3 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add Debug impl to witness::Iter

The C-DEBUG API guideline recommends that all public types implement
Debug. The witness::Iter type is the only public type in primitives
which does not implement Debug, and thus should have a Debug derive
added to it.

Add derive(Debug) impl to witness::Iter.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit simply adds a standard Debug printing implementation to a public iterator type in a Rust Bitcoin library. It is a routine API-quality improvement with no security relevance.

Security candidateci: upgrade to cargo-rbmt 0.5.3by satsfy (Renato Britto) · 5c865aa6 · Jul 16, 2026 · 10 filesMessage 80 · StrongInformational 15Details
Commit message · satsfy (Renato Britto)

ci: upgrade to cargo-rbmt 0.5.3

Pin the rbmt version in Cargo.toml workspace metadata and install it
from crates.io, replacing the rbmt-version file. The weekly cron jobs
get rbmt through the setup-rbmt action.

The api task does an internal diff check, comparing the public API
against previous commit or PR base branch, failing on any diff for
review.

docsrs was merged into docs upstream, so the matrix keeps a single docs
task which now builds with the docs.rs configuration.

Drop ensure-maintainer-tools.sh, cargo-rbmt handles toolchain
setup itself now.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a routine update to the project's internal continuous-integration tooling. It changes how a helper tool called cargo-rbmt is installed and where its version is recorded, but it does not modify the actual Bitcoin library code or any user-facing behavior. There is no security issue visible in this change.

Security candidatehashes: bump version to 1.1.0by Nick Johnson · bf3f25f4 · Jul 15, 2026 · 9 filesMessage 45 · ThinInformational 15Details
Commit message · Nick Johnson

hashes: bump version to 1.1.0

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine version bump for the bitcoin_hashes crate from 1.0.0 to 1.1.0. It updates dependency references across the workspace, records the release in the changelog, and adjusts deprecation lint allowances in tests. There is no security-relevant code change.

Lower-priorityMake Witness FromIterator infallibleby Mitchell Bagot · d3c9d3a1 · Jul 15, 2026 · 1 fileMessage 58 · ThinLow 47Details
Commit message · Mitchell Bagot

Make Witness FromIterator infallible

The current Witness FromIterator impl uses the WitnessDecoder
internally. This was initially done as a means of reducing the
allocations needed to construct the type. However, for DoS protection,
the WitnessDecoder has various limitations that make it unsuitable for
infallible Witness construction. Instead, the old infallible solution
should be used, but tweaked to remove the previous per-item allocations
from the iterator collection.

Adjust the Witness FromIterator implementation to use a collect and
from_slice call to remove the incorrect function beyond the DoS
protection limits of the WitnessDecoder.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Low 47/100

This commit fixes a bug in how a Bitcoin data type called Witness is built from lists of byte slices. The previous code reused a decoder that has built-in denial-of-service limits, which could cause valid-looking witness lists to fail construction unexpectedly. The change makes the construction straightforward and infallible again, removing the risk that normal inputs hit those limits.

Lower-priorityUse DebugTuple for Builder debugby Mitchell Bagot · 350c583d · Jul 15, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Use DebugTuple for Builder debug

The Builder Debug impl currently calls through to Display which
eventually calls down to Script's Display. For empty scripts, this can
render as a empty string. Per the C-DEBUG-NONEMPTY API guideline, all
Debug impls should always render something, even for conceptually empty
types.

Use DebugTuple in the Builder Debug to render the struct name around
the internal content.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit fixes a minor Rust API guideline compliance issue in how a script builder object is printed for debugging. It changes the debug output so that an empty builder prints 'Builder()' instead of an empty string. There is no security impact.

Lower-priorityfuzz: Fix stale scriptby Tobin C. Harding · cdd2ecd2 · Jul 14, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Tobin C. Harding

fuzz: Fix stale script

As usual the `generate-files.sh` script is stale. Update it using the
contents of `fuzz/Cargo.toml` so that running script produces no changes.

73/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit updates version numbers and commit hashes inside a fuzz-testing shell script that generates GitHub Actions workflow files. It is a routine maintenance change to keep the generated CI configuration in sync with the project's current dependencies. There is no change to the actual Bitcoin library code, no user-facing behavior change, and no security fix.

Lower-priorityio: Bump version to 0.6.0by Tobin C. Harding · 545aeeb2 · Jul 14, 2026 · 5 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

io: Bump version to 0.6.0

In preparation for release add a changelog entry, bump the version
number, and update the lock files.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is purely a release housekeeping change. It bumps the version number of the `bitcoin-io` crate from 0.5.0 to 0.6.0, updates the changelog, and refreshes the lock files so other crates in the project depend on the new version. There are no code changes in this commit itself.

Lower-priorityRefactor Encoder and ExactSizeIterator Option implsby Abeeujah · f723b10a · Jul 14, 2026 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Abeeujah

Refactor Encoder and ExactSizeIterator Option impls

Replace match statements with idiomatic Option combinator methods
to flatten code and improve readability.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a straightforward code cleanup in the Rust Bitcoin library. It replaces a few verbose 'match' statements with shorter, more idiomatic Option helper methods. There is no functional change and no security relevance.

AI review queuedconsensus_encoding: flatten error constructorsby Abeeujah · 0d4a9ddc · Jul 14, 2026 · 2 filesMessage 58 · ThinInformational 15Details
Commit message · Abeeujah

consensus_encoding: flatten error constructors

Refactor deeply nested error type constructors with chained map_err
calls, This improves readability by making each error conversion step
explicit and avoids deeply nested error constructors.

Allow clippy unnecessary_map_on_constructor in place where readability
is preferred over clippy being right.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a pure code-style refactor. It rewrites how error values are built so each wrapping step is on its own line instead of being nested inside a single expression. The actual error values produced and the program's behavior are unchanged. There is no security fix or vulnerability here.

AI review queuedconsensus_encoding: Deduplicate end() error path in decodersby Abeeujah · b30de4d4 · Jul 14, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Abeeujah

consensus_encoding: Deduplicate end() error path in decoders

Both ByteVecDecoder and VecDecoder had identical error handling
patterns in their end methods, structured to check prefix, compare
bytes, return Err with the missing amount. This patch reorders the
logic to compute the missing value first, and early returns when no
bytes are missing.

CompactSizeDecoder end method refactored via pattern matching to
error when either the decoded value is outside the given range
or above the decoded limit.

This reduces the error construction duplication and clarifies the
control flow.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup. It removes duplicated error-handling code in three decoder 'end' methods and rewrites the logic using pattern matching and early returns. There is no change to what errors are produced or when they are produced; the behavior appears identical before and after.

Lower-priorityMake ToU64 privateby Mitchell Bagot · 56b2eff9 · Jul 14, 2026 · 1 fileMessage 51 · ThinInformational 15Details
Commit message · Mitchell Bagot

Make ToU64 private

The ToU64 trait was moved from internals to bitcoin recently. When
moved, it was made public in bitcoin as it was used in the public API
of some of the old consensus code. With that consensus code removed,
the trait should be made private.

Make ToU64 pub(crate).

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit simply changes a Rust helper trait from public to private visibility (pub(crate)). It is a routine API-cleanup change with no security relevance. The trait converts integer sizes to u64 and is no longer needed in any public interface.

Lower-priorityconsensus-encoding: Bump version to 1.1.0by Tobin C. Harding · a94e3ca7 · Jul 14, 2026 · 4 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

consensus-encoding: Bump version to 1.1.0

In preparation for release add a changelog entry, bump the version,
and update the lock files.

This is a post-1.0 release so we need to be careful here team. Please
spend some time reviewing the output of:

`git diff bitcoin-consensus-encoding-1.0.0 consensus_encoding`

With careful eye for API design choices, things that might make
maintenance harder etc.

Thanks

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine version bump for the bitcoin-consensus-encoding crate from 1.0.0 to 1.1.0. It only updates the package version, changelog, and lock files. There are no code changes in this commit, and nothing in the commit itself indicates a security fix or vulnerability.

Security candidaterefactor(bip32): Xpub child tweak apiby Trevor Arjeski · 37191717 · Jul 13, 2026 · 1 fileMessage 80 · StrongInformational 17Details
Commit message · Trevor Arjeski

refactor(bip32): Xpub child tweak api

- Replace ckd_pub_tweak with derive_child_tweak returning XpubChildTweak.
- Remove Xpub::ckd_pub_tweak. Users must use Xpub::derive_child_tweak
and XpubChildTweak instead.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Informational 17/100

This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual cryptographic math and behavior remain the same; only the way callers receive the result has changed. There is no indication this fixes a security bug.

Security candidaterefactor(bip32): rename Xpub and Xpriv derivation methodsby Trevor Arjeski · f8f053fd · Jul 13, 2026 · 2 filesMessage 85 · StrongInformational 18Details
Commit message · Trevor Arjeski

refactor(bip32): rename Xpub and Xpriv derivation methods

- Rename the xpriv and xpub derivation APIs to derive_child and derive_path
- Remove derive_priv, derive_xpriv, derive_pub, derive_xpub, and
ckd_pub. Callers should now use derive_child for single ChildNumber
derivation and derive_path for path derivation.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Informational 18/100

This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability introduced; it is purely a refactoring that may require downstream developers to update their code.

AI review queuedbuild(deps): bump actions/github-script from 8.0.0 to 9.0.0by dependabot[bot] · 5d64b04f · Jul 13, 2026 · 2 filesMessage 93 · StrongInformational 20Details
Commit message · dependabot[bot]

build(deps): bump actions/github-script from 8.0.0 to 9.0.0

Bumps [actions/github-script](https://github.com/actions/github-script) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3)

---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: 9.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 20/100

This is a routine update by Dependabot that bumps the version of a GitHub Actions helper called actions/github-script from version 8.0.0 to 9.0.0 in two workflow files. The workflows only manage issue/label automation after CI runs and do not handle source code, secrets, or release artifacts. There is no indication in the commit that this fixes a security vulnerability.

AI review queuedbuild(deps): bump cargo-bins/cargo-binstall from 1.15.10 to 1.19.1by dependabot[bot] · 784f797e · Jul 13, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump cargo-bins/cargo-binstall from 1.15.10 to 1.19.1

Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.15.10 to 1.19.1.
- [Release notes](https://github.com/cargo-bins/cargo-binstall/releases)
- [Changelog](https://github.com/cargo-bins/cargo-binstall/blob/main/release-plz.toml)
- [Commits](https://github.com/cargo-bins/cargo-binstall/compare/b3f755e95653da9a2d25b99154edfdbd5b356d0a...aaa84a43aec4955a42c5ffc65d258961e39f276e)

---
updated-dependencies:
- dependency-name: cargo-bins/cargo-binstall
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated dependency update by Dependabot. It changes the version of a GitHub Action used to install a Rust tool during automated semver compatibility checks. There is no indication in the commit that this fixes or introduces any security issue.

AI review queuedbuild(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1by dependabot[bot] · 9f63707f · Jul 13, 2026 · 3 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions helper used to save build artifacts in three CI workflow files. There is no indication of a security issue in the project code itself, and the change does not alter how the project handles Bitcoin data, keys, or network messages.

AI review queuedbuild(deps): bump actions/labeler from 6.0.1 to 6.1.0by dependabot[bot] · d858acd1 · Jul 13, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/labeler from 6.0.1 to 6.1.0

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.0.1 to 6.1.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213)

---
updated-dependencies:
- dependency-name: actions/labeler
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions workflow helper (actions/labeler) used to automatically label pull requests. There is no indication of a security issue in the change itself, and no evidence of malicious code in the referenced version.

Security candidatebuild(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1by dependabot[bot] · 21337179 · Jul 13, 2026 · 5 filesMessage 93 · StrongInformational 19Details
Commit message · dependabot[bot]

build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.8 to 8.1.1.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d32b9829c1cb33d45e...5f6978faf089d4d20b00c7766989d076bb2fc7f1)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 8.1.1
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountautomated dependency-update discount
AI analysis · Informational 19/100

This is a routine Dependabot update that bumps a GitHub Actions helper used by automated weekly maintenance workflows to create pull requests. The change only affects internal tooling, not the Rust Bitcoin library code that users rely on. There is no direct evidence of a security vulnerability being fixed or introduced, but any third-party action update carries a small supply-chain risk if the new version were malicious or buggy.

Lower-priorityReplace use of as_str().len() with .len()by Mitchell Bagot · 3952e574 · Jul 13, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Replace use of as_str().len() with .len()

With the new .len() function, the previous .as_str().len() use in the
address tests can now be shortened to a single .len() call instead.

Replace encoded.as_str().len() with encoded.len() in
base58_invalid_payload_length_reports_decoded_size test in address
module.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This is a trivial code cleanup inside a test file. It replaces a slightly longer way of getting a string's length with a shorter, equivalent way. There is no security relevance.