RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue1033AI analyses
184commits · 30 days
403commits · 60 days
1283commits · 180 days
2062commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192359068
Tobin C. Harding40965156063
jrakibi944963068
Nick Johnson18920112059
Andrew Poelstra512035075
Jamil Lambert, PhD1141849061
Fmt Bot311422045
Trevor Arjeski111111069
Shing Him Ng31724056
Ismail Daif22612050
satsfy (Renato Britto)17612066
Martin Habovstiak27512069
Analysis record

Published AI watches

Last scanned 1 minute ago

Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`

This is a routine API cleanup, not a security fix. The developers removed a shortcut that let programmers create a 'number of blocks' value directly from any u16 number, replacing it with an existing named constructor called from_height. T…

ed5f1b68by Andrew Poelstra+18−358 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update the API text files

This commit only updates two generated API text files that list the public surface of the Rust crate. It removes entries for a `WitnessesEncoder` type, reflecting that the type is no longer part of the public API. There is no source code c…

9c391145by Tobin C. Harding+0−782 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

release bitcoin_hashes 1.2.0

This commit is a routine version bump for the bitcoin_hashes library from version 1.1.0 to 1.2.0. It only updates lock files, the package version number, and the changelog. There is no code change and no security relevance visible in the c…

8899dfd2by Andrew Poelstra+27−224 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityp2p: calculate v1 checksum on original payloadby Nick Johnson · 7fed10c5 · May 15, 2026 · 1 fileMessage 90 · StrongModerate 62Details
Commit message · Nick Johnson

p2p: calculate v1 checksum on original payload

A differential fuzz test found a malformed v1 message which *passed*
its checksum validation due to the checksum being calculated on a
re-encoded payload instead of the raw payload bytes. Due to wiggle room
in the p2p spec, re-encoded payloads can differ from the raw bytes which
results in a different checksum.

This change calculates the checksum on the fly agianst the raw payload
bytes to avoid the ambiguity.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Moderate 62/100

This commit fixes a bug in how Bitcoin peer-to-peer network messages are validated. The software was checking message checksums against a re-encoded version of the message payload rather than the original bytes received over the network. Because the protocol allows some wiggle room in encoding, a re-encoded payload can have a different checksum than the original raw bytes. This meant a malformed message could pass checksum validation when it should have been rejected. The fix computes the checksum directly from the raw bytes as they arrive, removing that ambiguity.

Lower-priorityp2p: Add `sendtxrcncl` to network messagesby rustaceanrob · f0be3481 · May 15, 2026 · 3 filesMessage 68 · AdequateTriage 0Details
Commit message · rustaceanrob

p2p: Add `sendtxrcncl` to network messages

`sendtxrcncl` has not been assigned a v2 shortID.

ref: https://github.com/bitcoin/bitcoin/blob/master/src/net.cpp#L920

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Lower-priorityp2p: Add erlay message moduleby rustaceanrob · 87b49795 · May 15, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · rustaceanrob

p2p: Add erlay message module

Although full erlay support has not been implemented, Bitcoin Core nodes
can still advertise support for erlay as a configuration option. We
should support decoding this message.

The version is private as anything besides version one is nonsense.

ref: https://github.com/bitcoin/bitcoin/blob/master/src/net_processing.cpp#L3736

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-priorityfuzz: Add `hashes_arbitrary_json` targetby Ismail Daif · 1f54f16d · May 15, 2026 · 3 filesMessage 45 · ThinInformational 15Details
Commit message · Ismail Daif

fuzz: Add `hashes_arbitrary_json` target

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit adds a new automated fuzz-testing target for the project's hash types. It does not change any production code, fix a bug, or alter behavior visible to users. It is purely a testing/infrastructure addition.

Lower-priorityfuzz: Fix `hashes_json` roundtrip checkby Ismail Daif · 3f63e995 · May 15, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · Ismail Daif

fuzz: Fix `hashes_json` roundtrip check

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit fixes a fuzz test (an automated correctness test) in the rust-bitcoin project. The test previously compared raw input bytes to re-serialized JSON bytes, which can fail for harmless reasons like whitespace or key ordering. The fix compares the parsed Rust data structures instead, which is the correct way to verify round-trip behavior. This is a test-only change and does not affect any production code or user-facing behavior.

Security candidatehashes: Add `Arbitrary` impl for `Hmac`by Ismail Daif · 3715b605 · May 15, 2026 · 2 filesMessage 45 · ThinInformational 16Details
Commit message · Ismail Daif

hashes: Add `Arbitrary` impl for `Hmac`

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 16/100

This commit adds a standard trait implementation that lets the Hmac type be used with property-testing tools. It is a routine feature addition, not a security fix or vulnerability.

Lower-priorityUse collect_seq when serializing Vec<T>by Abeeujah · 3e1e00ce · May 14, 2026 · 4 filesMessage 68 · AdequateTriage 0Details
Commit message · Abeeujah

Use collect_seq when serializing Vec<T>

Prefer `collect_seq` implementation over the serialize_seq and the
manual loop `serialize_element` call to serialize all elements in
the vector.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityfuzz: Remove allocations in roundtrip targetsby Mitchell Bagot · 953ef384 · May 14, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

fuzz: Remove allocations in roundtrip targets

The roundtrip fuzz targets rely on functions in lib.rs that decode,
encode and decode again. In this process, a Vec allocation is made
as an intermediate step to hold the encoded object. Since the encoded
data is ignored, this allocation can instead be replaced by a direct
push of the encoder chunks into the decoder.

Replace Vec allocation with direct writes from encoder to decoder in
roundtrip fuzz targets.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit is a performance improvement for internal fuzz testing code. It removes an unnecessary memory allocation when testing that data can be encoded and decoded correctly. There is no security vulnerability or fix here.

Security candidateReplace as_inner accessor on XOnlyPublicKey with to_innerby Mitchell Bagot · 0cb19c0c · May 13, 2026 · 1 fileMessage 73 · AdequateInformational 18Details
Commit message · Mitchell Bagot

Replace as_inner accessor on XOnlyPublicKey with to_inner

Access to the inner types for the key wrappers should be uniform.
Specifically, for the public Copy types, inner access should be by
value. To achieve this XOnlyPublicKey::as_inner must be removed.

Remove XOnlyPublicKey::as_inner.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 18/100

This commit is a routine API cleanup in the rust-bitcoin crypto library. It removes a method called as_inner that returned a reference to the underlying key data, and replaces internal uses with to_inner, which returns the key by value. The underlying key type is small and cheap to copy, so this is a consistency improvement, not a security fix. There is no indication this change addresses a vulnerability.

Security candidateMake to_inner on public key types pub(super)by Mitchell Bagot · 1d95006d · May 13, 2026 · 2 filesMessage 68 · AdequateInformational 23Details
Commit message · Mitchell Bagot

Make to_inner on public key types pub(super)

The to_inner function was introduced as a stop-gap to eliminate the
public access to inner secp types on the public key types. Now that
the key types have been adjusted such that inner access is no longer
needed outside of crypto, these conversion methods can be made private.

Make to_inner on all public key types pub(super).

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 23/100

This commit narrows the visibility of internal helper methods named to_inner on Bitcoin public-key types. Previously any outside code could call these methods to extract the raw underlying secp256k1 key objects; now only code inside the same module can do so. This is a defensive encapsulation change that reduces the public API surface and makes future misuse or accidental exposure of internal cryptographic details less likely. It is not a fix for an active vulnerability.

Security candidatehashes: capitalize hash algorithm namesby jrakibi · 3263f1ec · May 12, 2026 · 14 filesMessage 45 · ThinInformational 15Details
Commit message · jrakibi

hashes: capitalize hash algorithm names

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit only changes the capitalization of hash algorithm names in comments and documentation strings (for example, 'sha256' becomes 'SHA256' and 'sha256d' becomes 'SHA256d'). No program logic, code behavior, or security properties were modified.

Security candidatehashes: Fix doc typosby jrakibi · d25913a5 · May 12, 2026 · 7 filesMessage 43 · ThinInformational 15Details
Commit message · jrakibi

hashes: Fix doc typos

- Add missing full stop
- Capitalize first words in doc comments

43/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit only fixes typos and formatting in documentation comments and test file comments. No code behavior changes.

Lower-prioritytaproot-primitives: Remove crypto depby Mitchell Bagot · 9eb2ba68 · May 12, 2026 · 3 filesMessage 45 · ThinTriage 0Details
Commit message · Mitchell Bagot

taproot-primitives: Remove crypto dep

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidateMove from_key_and_merkle_root to extension traitby Mitchell Bagot · bbe0a0b1 · May 12, 2026 · 3 filesMessage 68 · AdequateInformational 18Details
Commit message · Mitchell Bagot

Move from_key_and_merkle_root to extension trait

The from_key_and_merkle_root method on the TapTweakHash type is the
only part of the taproot-primitives crate that causes a dependency on
the crypto crate. By moving this back to bitcoin, we can remove the
dependency on crypto, allows these types to stabilise in primitives
without waiting on crypto to stabilise.

Move from_key_and_merkle_root to new extension trait TapTweakHashExt in
bitcoin.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 18/100

This commit is a routine code reorganization. It moves one function, `from_key_and_merkle_root`, out of a low-level crate (`taproot-primitives`) and into a higher-level crate (`bitcoin`) as an 'extension trait.' The goal is to remove an internal dependency so the low-level crate can stabilize sooner. The actual computation performed by the function is unchanged.

Lower-priorityhashes: Add commented out dyn compatible testby Tobin C. Harding · 43757fcd · May 12, 2026 · 1 fileMessage 78 · AdequateTriage 0Details
Commit message · Tobin C. Harding

hashes: Add commented out dyn compatible test

C-OBJECT is about object safety. None of the `hashes` traits are
object safe. Add a commented out test so I (and no-one else) has to
look at this again.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityhashes: Remove unnecessary cloneby Tobin C. Harding · bf33c3b4 · May 12, 2026 · 1 fileMessage 70 · AdequateTriage 0Details
Commit message · Tobin C. Harding

hashes: Remove unnecessary clone

No need to clone. The `State` struct is `Copy` because all fields are
`Copy` (I _think_).

We could remove the local var all together but what ever.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Lower-priorityhashes: Grab point release changelogsby Tobin C. Harding · cb7f6252 · May 12, 2026 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · Tobin C. Harding

hashes: Grab point release changelogs

Two trivial changelogs were missing, grab them.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI review queuedp2p: Remove `bitcoin` dependencyby rustaceanrob · 3a46e0a6 · May 11, 2026 · 4 filesMessage 58 · ThinInformational 15Details
Commit message · rustaceanrob

p2p: Remove `bitcoin` dependency

`hex` is brought in from `primitives` as it is an unconditional
dependency. `arbitrary` is brought in from `primitives` as opposed to
`bitcoin`. `primitives` and `encoding` need `alloc`. One doc line is updated.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine internal refactoring commit in the rust-bitcoin project. It removes a direct dependency on the main 'bitcoin' crate from the smaller 'p2p' (peer-to-peer messages) crate and instead pulls in the needed features from more focused sub-crates. The only code change is updating a documentation example to use a different decoding function. There is no security-relevant change visible in the diff.

AI review queuedUse stacked attributes over #[cfg(all(...))]by Mitchell Bagot · f5c09645 · May 11, 2026 · 2 filesMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Use stacked attributes over #[cfg(all(...))]

Per our policy, feature gates should use stacked attributes instead
of #[cfg(all(...))]. Presumably due to changes at the same time as
this policy was introduced, there remain a few uses of the old style
in primitives.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a purely cosmetic code-style change. It rewrites some Rust feature-gate conditions from one allowed syntax to another preferred syntax, with no change to which features enable which code. There is no security relevance.

AI review queuedMove deserialize tests to primitivesby Mitchell Bagot · c26faf9c · May 11, 2026 · 5 filesMessage 90 · StrongInformational 15Details
Commit message · Mitchell Bagot

Move deserialize tests to primitives

In bitcoin, there are various tests that only have a dependency on
bitcoin due to the deserialize/serialize functions on the old encoding
traits. Changing these to use consensus_encoding allows them to be
trivially moved to primitives.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply moves existing unit tests from one internal crate to another and rewrites them to use a newer encoding API. No production code behavior changes, and no security bug is fixed or introduced.

Lower-priorityFix lint errorsby Mitchell Bagot · 8fbcd6d0 · May 11, 2026 · 2 filesMessage 61 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Fix lint errors

In the process of moving the tests in the previous commit, the stricter
lint requirements for the leaf crates has introduced some lint errors
that should be fixed.

61/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Mentions testing or verification
AI review queuedMove tests to upstream cratesby Mitchell Bagot · 20825743 · May 11, 2026 · 7 filesMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Move tests to upstream crates

Test cases for Outpoint, Version, CompactTarget and Sequence have been
left in bitcoin even following their moves to primitives and units. In
order to keep tests close to the corresponding types, the tests should
be moved to the upstream leaf crates.

Move tests to units and primitives alongside their corresponding types.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply moves existing unit tests from one crate to another within the same project. No production code behavior is changed, so it has no security impact on users of the library.

Lower-prioritybitcoin: Remove duplicate exact_size_iteratorby Mitchell Bagot · 05ea88e4 · May 10, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

bitcoin: Remove duplicate exact_size_iterator

The exact_size_iterator test for Witness exists in primitives. A near
identical test has also been left behind in bitcoin. Since tests in
upstream crates are preferred to those in downstream, the test in
bitcoin can be removed.

Remove exact_sized_iterator test from bitcoin::witness tests.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityMove network tests to network crateby Mitchell Bagot · 8adefed5 · May 10, 2026 · 2 filesMessage 78 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Move network tests to network crate

During the smashing of the network crate, most tests were moved to the
network crate, leaving an empty unit tests module. To complete this
move, this empty unit tests module should be removed and the final
test file network.rs moved to the network crate.

Move network.rs test file to network crate.
Remove empty unit tests module in bitcoin::network.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityAdd errors to doc comment in from_hex of array_newtypeby Mitchell Bagot · 07179138 · May 10, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Add errors to doc comment in from_hex of array_newtype

The impl_array_newtype_stringify macro needs to be used across crates,
including those with stricter lint requirements. To this end, all
public methods introduced by the macro must include an errors section
in the doc comment.

Add errors to doc comment of from_hex function in
impl_array_newtype_stringify macro.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context