RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue1033AI analyses
188commits · 30 days
404commits · 60 days
1283commits · 180 days
2063commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192359068
Tobin C. Harding40965156063
jrakibi944963068
Nick Johnson18920112059
Andrew Poelstra512035075
Jamil Lambert, PhD1141849061
Fmt Bot311422045
Trevor Arjeski111111069
Shing Him Ng31724056
Ismail Daif22612050
satsfy (Renato Britto)17612066
Martin Habovstiak27512069
Analysis record

Published AI watches

Last scanned 56 minutes ago

Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`

This is a routine API cleanup, not a security fix. The developers removed a shortcut that let programmers create a 'number of blocks' value directly from any u16 number, replacing it with an existing named constructor called from_height. T…

ed5f1b68by Andrew Poelstra+18−358 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update the API text files

This commit only updates two generated API text files that list the public surface of the Rust crate. It removes entries for a `WitnessesEncoder` type, reflecting that the type is no longer part of the public API. There is no source code c…

9c391145by Tobin C. Harding+0−782 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

release bitcoin_hashes 1.2.0

This commit is a routine version bump for the bitcoin_hashes library from version 1.1.0 to 1.2.0. It only updates lock files, the package version number, and the changelog. There is no code change and no security relevance visible in the c…

8899dfd2by Andrew Poelstra+27−224 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedconsensus_encoding: Update API filesby Mitchell Bagot · dae7e7da · Jun 8, 2026 · 3 filesMessage 35 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

consensus_encoding: Update API files

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot files (text listings of public functions) for the consensus_encoding crate. It adds entries for three new public functions that decode data using an explicit decoder type. There is no source code change, no bug fix, and no security relevance visible in the diff.

AI review queuedconsensus_encoding: Add decode_from_*_with functionsby Mitchell Bagot · ec439600 · Jun 8, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

consensus_encoding: Add decode_from_*_with functions

Currently, users of the old encoding traits can call functions to
decode many types (like Vec<u8> or u64) from byte slices. With the new
encoding/decoding traits, there exists no convenient method for users
to decode types without a dedicated Decode impl.

Introduce decode_from_*_with variant functions that are generic on
Decoder + Default instead of Decode.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds new public helper functions to a Rust Bitcoin encoding library. The functions let callers decode data using a decoder type directly, rather than only through types that implement a specific trait. It is a pure API convenience addition and does not change existing behavior or fix any bug.

Lower-priorityio: Introduce decode_from_read_with functionby Mitchell Bagot · dc95b41e · Jun 8, 2026 · 1 fileMessage 58 · ThinTriage 0Details
Commit message · Mitchell Bagot

io: Introduce decode_from_read_with function

Currently, users of the old encoding traits can call functions like
reader.read_compact_size. With the new encoding/decoding traits, there
exists no convenient method for users to interact with bitcoin io
readers with decoders that don't have a dedicated Decode implementer.

Introduce decode_from_read_with variant function that is generic on
Decoder + Default instead of Decode.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Security candidatetaproot: Remove From<&Signature> for SerializedSignatureby Mitchell Bagot · 3af1119f · Jun 7, 2026 · 1 fileMessage 78 · AdequateInformational 17Details
Commit message · Mitchell Bagot

taproot: Remove From<&Signature> for SerializedSignature

The From<&'a Signature> for SerializedSignature impl functions by
derefing the signature and then serializing it. The presence of the
trait implies that SerializedSignature is some sort of reference to
the signature, when it is instead a type owning its own data.

Remove From<&Signature> impl from taproot::SerializedSignature.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarycryptography-sensitive path
AI analysis · Informational 17/100

This commit removes a convenience conversion that let users turn a borrowed Taproot signature into an owned, serialized byte form. The change is API-cleanup: the old trait made it look like the serialized form was just a view of the original signature, when it actually copies/owns the bytes. There is no direct security bug fixed here, but removing the misleading conversion reduces the chance that future callers misunderstand ownership and accidentally clone or mishandle signature data.

Lower-priority2026-06-07 automated rustfmt nightlyby Fmt Bot · f34abf02 · Jun 7, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · Fmt Bot

2026-06-07 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidateBump key-expression crate versionby Mitchell Bagot · c1fbe98c · Jun 6, 2026 · 5 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Bump key-expression crate version

With the bip32 module moved, the key-expression crate should now have
a new version release before the next bitcoin release.

Bump key-expression version number to 0.1.0.
Update changelog.
Adjust bitcoin manifest to match new version number.
Update lock files.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
secret or key material
AI analysis · Informational 15/100

This commit is purely a housekeeping release step. It bumps the version number of the bitcoin-key-expression crate from 0.0.0 to 0.1.0, updates the changelog, and adjusts the main bitcoin package and lock files to match. There are no code changes, bug fixes, or security patches in the diff.

Lower-priorityAutomated update to Github CI to cargo-semver-checks version-0.48.0by Update cargo-semver-checks Bot · 443700c8 · Jun 6, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Update cargo-semver-checks Bot

Automated update to Github CI to cargo-semver-checks version-0.48.0

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Security candidateAdd From<Infallible> to sighash errorsby Mitchell Bagot · d8d8c334 · Jun 5, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Add From<Infallible> to sighash errors

In order to facilitate use in generics, all error types should have a
From<Infallible> implementation.

Add From<Infallible> to all sighash error types.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit adds standard Rust trait implementations that allow certain Bitcoin signature-hash error types to be created from the Infallible type. Infallible is a type that can never actually exist, so these conversions can never be invoked at runtime. The change is purely an ergonomic improvement for generic programming and has no security relevance.

Security candidateMake sighash error fields privateby Mitchell Bagot · 1d583d6f · Jun 5, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Make sighash error fields private

The sighash error types in crypto currently all have pub fields. This
prevents any future changes to their structure after a 1.0 and is not
required for any functionality.

Make all inner fields in sighash errors pub(super) or pub(crate).

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit reduces the visibility of internal fields on three error types in the crypto/sighash module from public to crate-internal. It is a routine API-hardening change to preserve future flexibility before a 1.0 stable release. There is no security vulnerability here.

Lower-priorityAutomated update to rustc stable-1.96.0by Update Stable Rustc Bot · 65f76a7d · Jun 5, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Update Stable Rustc Bot

Automated update to rustc stable-1.96.0

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityp2p: error on `CommandString` interior null bytesby yancy · 1e371352 · Jun 4, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · yancy

p2p: error on `CommandString` interior null bytes

Add an invariant that a `CommandString` cannot have a null byte
preceding a non null byte as part of the command string.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityImplement fmt::LowerHex and fmt::UpperHex for Witnessby Henry Romp · 9bd17308 · Jun 4, 2026 · 2 filesMessage 91 · StrongTriage 0Details
Commit message · Henry Romp

Implement fmt::LowerHex and fmt::UpperHex for Witness

The Witness type can be constructed from a hex string via from_hex but
provides no way to render itself back to hex. Other types in primitives
expose hex rendering through fmt::LowerHex (the to_hex functions were
deprecated in favour of it), so Witness should follow the same
convention.

Implement fmt::LowerHex and fmt::UpperHex for Witness by delegating to
the existing HexPrimitive helper, which formats the consensus encoding
as hex. Add tests covering empty and non-empty witnesses for both cases
and record the new trait impls in the public API surface.

See #6314

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Lower-prioritybitcoin: port 0.32.x changelog entries to masterby Nick Johnson · 347ee51a · Jun 3, 2026 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · Nick Johnson

bitcoin: port 0.32.x changelog entries to master

Co-authored-by: Tobin C. Harding <me@tobin.cc>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
Security candidateFixup changelog links and follow new policyby Nick Johnson · ef718dcc · Jun 3, 2026 · 14 filesMessage 68 · AdequateInformational 15Details
Commit message · Nick Johnson

Fixup changelog links and follow new policy

* Fixup off-by-one error in `bitcoin` links.
* bip158 does not have any tags yet.
* Not adding links for 0.32.x tags, the diff compare gets a little
wonky as the branch drifts further from master.
* `internals` and `units` have some inconsistent tag formatting.

Drop all links which are not helpful compares. Links to a single tag
are not all the helpful and niether is comparing to the beginning of time.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive pathdocumentation-only discount
AI analysis · Informational 15/100

This commit only edits changelog files. It fixes Markdown link formatting, corrects a few typoed pull request numbers, updates release heading levels, and adjusts version compare links. No program code was changed, so it cannot introduce or fix a security vulnerability in the software itself.

Security candidatecrypto: Gate all usage of hex-conservative behind hex featureby Mitchell Bagot · 745f4fe4 · Jun 3, 2026 · 6 filesMessage 73 · AdequateInformational 19Details
Commit message · Mitchell Bagot

crypto: Gate all usage of hex-conservative behind hex feature

Typically, all of the crates upstream of bitcoin have a hex feature
that gates the usage and inclusion of the hex-conservative crate.
Since the crypto crate functionality was crudely pulled from bitcoin,
this feature was not present but instead baked in as part of the
default functionality.

Introduce a hex feature which gates hex 1.1.0.
Add hex feature gates as necessary for existing functionality.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 19/100

This commit reorganizes how an optional hex-encoding helper library is enabled in the bitcoin-crypto crate. It makes the hex-conservative dependency optional and gated behind a new 'hex' feature, instead of being included by default. The main bitcoin crate explicitly enables this feature, so end-user behavior is unchanged. This is a build/configuration cleanup, not a fix for an exploitable vulnerability.

AI review queuedUpdate API filesby Mitchell Bagot · 633a99f9 · Jun 3, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates a generated text file that lists the public API surface of the crate. It adds entries for new public types and functions (a hex encoding/decoding error type and helper functions). There is no actual code change, no bug fix, and no security relevance visible in the diff.

AI review queuedconsensus_encoding: Add hex decoding functionby Mitchell Bagot · 7aa85ed6 · Jun 3, 2026 · 4 filesMessage 68 · AdequateInformational 17Details
Commit message · Mitchell Bagot

consensus_encoding: Add hex decoding function

Building on the iter decoding functionality, the use of the hex feature
can also provide a decode_from_hex function that allows users to
directly decode a hex &str to a type, without working via a heap vec
and using decode_from_slice.

Introduce decode_from_hex for decoding hex &str to decode types without
heap allocations.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit adds a new public helper function that lets users decode Bitcoin consensus data directly from a hexadecimal string, without needing to allocate a temporary byte vector. It is a pure feature addition: it introduces a new error type, exports the function under a feature flag, and includes unit tests. There is no indication in the commit that it fixes a security bug or that the change itself creates one.

Lower-priorityconsensus_encoding: Add hex encoding helpersby Mitchell Bagot · 5306ead4 · Jun 3, 2026 · 4 filesMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

consensus_encoding: Add hex encoding helpers

By pairing hex 1.1 with the existing EncoderByteIter, it's trivial to
introduce hex encoding support into consensus encoding. This simplifies
hex encoding for consensus objects for downstream users.

Add drain_to_hex and encode_to_hex for encoding objects to hex String.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityprimitives: Move block test to testsby Tobin C. Harding · 0601cea6 · Jun 3, 2026 · 2 filesMessage 78 · AdequateTriage 0Details
Commit message · Tobin C. Harding

primitives: Move block test to tests

This test uses the `include_bytes!` macro to include data from a file
that lives in `tests` but we exclude that directory when publishing.
Resulting in published source code having broken unit tests.

Move the test to `tests/`.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityClean up stale duplicate dep overridesby Nick Johnson · 136b37e7 · Jun 2, 2026 · 4 filesMessage 45 · ThinTriage 0Details
Commit message · Nick Johnson

Clean up stale duplicate dep overrides

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityprimitives: Avoid allocating claimed size when decoding witness lengthby jrakibi · df76d348 · Jun 2, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · jrakibi

primitives: Avoid allocating claimed size when decoding witness length

Avoid allocating the claimed size when decoding witness length.

It's currently possible to claim a length and have the decoder
reserve up to `MAX_VECTOR_ALLOCATE` before any data bytes have
arrived, just from reading the length prefix.

Instead, we can reserve only the prefix, and let the buffer grow incrementally
as bytes arrive.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Security candidateCI: Fix nightly toolchain update to mention weeklyby Tobin C. Harding · a7778aac · Jun 2, 2026 · 1 fileMessage 77 · AdequateInformational 15Details
Commit message · Tobin C. Harding

CI: Fix nightly toolchain update to mention weekly

This job runs weekly not daily. Update the branch name and PR title.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit only fixes wording in an automated GitHub Actions workflow. It changes the pull request title and branch name from 'daily' to 'weekly' because the job actually runs once a week, not once a day. There is no code change, no security fix, and no vulnerability.

AI review queuedconsensus_encoding: Use crate alias in test codeby Tobin C. Harding · 79867081 · Jun 2, 2026 · 5 filesMessage 70 · AdequateInformational 15Details
Commit message · Tobin C. Harding

consensus_encoding: Use crate alias in test code

`bitcoin_consensus_encoding` is one hell of a mouthful. Add an alias
to `encoding`.

Test code only.

Run the formatter

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only renames a long crate name to a shorter alias inside test files. It does not change any real program code, behavior, or security properties. There is no security issue here.

Security candidateDestructure error types in source implsby Mitchell Bagot · 8b03bf95 · Jun 1, 2026 · 30 filesMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Destructure error types in source impls

In the source impls of error types, we previously decided to use
explicit impls to try to prevent changes in the error type from
introducing errors. However, impls that simply return None do not help
to solve this issue.

Add a complete error type destructure to all None source impls to catch
future error shape changes.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a code-quality maintenance change. It adds pattern-matching destructuring inside Rust error-type 'source' methods that previously just returned 'None'. The goal is to make the compiler warn future maintainers if the shape of an error type changes, so they remember to update the source() implementation. It does not change runtime behavior, fix a bug, or close a security vulnerability.

Lower-priorityRemove double allocation from ScriptBuf::from_hex_prefixedby Mitchell Bagot · da2a8e45 · Jun 1, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Remove double allocation from ScriptBuf::from_hex_prefixed

The ScriptBuf::from_hex_prefixed essentially takes a hex string and
consensus decodes to a ScriptBuf object. Currently it requires two
allocations to do so as the hex is decoded to a byte vec and then
copied into an owned buffer on the type. By using the HexPrimitive
iterator, this can be avoided.

Remove decode_to_vec allocation from ScriptBuf::from_hex_prefixed.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context