RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue1734AI analyses
183commits · 30 days
403commits · 60 days
1283commits · 180 days
2057commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192613068
Tobin C. Harding40965296063
jrakibi944986068
Nick Johnson18920161059
Andrew Poelstra512035075
Jamil Lambert, PhD1141884061
Fmt Bot311428045
Trevor Arjeski111111069
Shing Him Ng31727056
Ismail Daif22622050
satsfy (Renato Britto)17617066
Martin Habovstiak27527069
Analysis record

Published AI watches

Last scanned 55 minutes ago

Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`

This is a routine API cleanup, not a security fix. The developers removed a shortcut that let programmers create a 'number of blocks' value directly from any u16 number, replacing it with an existing named constructor called from_height. T…

ed5f1b68by Andrew Poelstra+18−358 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update the API text files

This commit only updates two generated API text files that list the public surface of the Rust crate. It removes entries for a `WitnessesEncoder` type, reflecting that the type is no longer part of the public API. There is no source code c…

9c391145by Tobin C. Harding+0−782 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

release bitcoin_hashes 1.2.0

This commit is a routine version bump for the bitcoin_hashes library from version 1.1.0 to 1.2.0. It only updates lock files, the package version number, and the changelog. There is no code change and no security relevance visible in the c…

8899dfd2by Andrew Poelstra+27−224 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityp2p: Move message_filter module errors to error submoduleby Mitchell Bagot · 5f036b49 · Apr 9, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

p2p: Move message_filter module errors to error submodule

At present, some modules in p2p separate error types into submodules
with re-exports while others simply define the error types in the
module. This inconsistency is confusing and makes the docs vary.
All error types for each top-level module should be moved into a
relevant submodule and re-exported without inline docs.

Move error types from message_filter module into error submodule and
re-export.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a pure code reorganization: it moves several error type definitions from the main message_filter file into a new error submodule and re-exports them. There are no functional changes to how the code behaves, no bug fixes, and no security improvements or regressions.

Lower-priorityp2p: Move bip152 module errors to error submoduleby Mitchell Bagot · 1354b545 · Apr 9, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

p2p: Move bip152 module errors to error submodule

At present, some modules in p2p separate error types into submodules
with re-exports while others simply define the error types in the
module. This inconsistency is confusing and makes the docs vary.
All error types for each top-level module should be moved into a
relevant submodule and re-exported without inline docs.

Move error types from bip152 module into error submodule and re-export.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a pure code reorganization: it moves several error type definitions from the main BIP-152 compact blocks module into a new `error` submodule and re-exports them. There are no functional changes to how errors are created, handled, or reported. It is a refactoring change aimed at making the codebase structure more consistent and documentation more uniform.

Lower-priorityp2p: Move merkle_tree module errors to error submoduleby Mitchell Bagot · b61361b4 · Apr 9, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

p2p: Move merkle_tree module errors to error submodule

At present, some modules in p2p separate error types into submodules
with re-exports while others simply define the error types in the
module. This inconsistency is confusing and makes the docs vary.
All error types for each top-level module should be moved into a
relevant submodule and re-exported without inline docs.

Move error types from merkle_tree module into error submodule and
re-export.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a straightforward internal code reorganization. It moves three error types (MerkleBlockDecoderError, PartialMerkleTreeDecoderError, and MerkleBlockError) from the main merkle_tree module into a new error submodule and re-exports them. There is no change to how the code behaves, no bug fix, and no security improvement or regression.

Lower-priorityp2p: Move message_bloom module errors to error submoduleby Mitchell Bagot · e1d4d3d1 · Apr 9, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

p2p: Move message_bloom module errors to error submodule

At present, some modules in p2p separate error types into submodules
with re-exports while others simply define the error types in the
module. This inconsistency is confusing and makes the docs vary.
All error types for each top-level module should be moved into a
relevant submodule and re-exported without inline docs.

Move error types from message_bloom module into error
submodule and re-export.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a straightforward internal code reorganization. It moves three error type definitions for bloom filter network messages into a new 'error' submodule and re-exports them. There is no functional change to how the code behaves, no bug fix, and no security-relevant change.

Lower-priorityp2p: Move message_network module errors to error submoduleby Mitchell Bagot · 54edd5bd · Apr 9, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

p2p: Move message_network module errors to error submodule

At present, some modules in p2p separate error types into submodules
with re-exports while others simply define the error types in the
module. This inconsistency is confusing and makes the docs vary.
All error types for each top-level module should be moved into a
relevant submodule and re-exported without inline docs.

Move error types from message_network module into error submodule and
re-export.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a pure code reorganization: it moves several error type definitions from the main message_network.rs file into a new error submodule and re-exports them. There is no change to how the code behaves, no bug fix, and no security-relevant change.

Lower-priorityp2p: Convert encoders to ExactSizeEncoderby Mitchell Bagot · 9db902fb · Apr 9, 2026 · 2 filesMessage 68 · AdequateInformational 18Details
Commit message · Mitchell Bagot

p2p: Convert encoders to ExactSizeEncoder

For encoders, the use of the encoder_newtype_exact macro allows for the
implementation of the ExactSizeEncoder trait. This provides users with
the ability to determine the encoding length of types without needing
to perform the entire encoding process.

Replace uses of encoder_newtype with encoder_newtype_exact where
possible.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit is a small internal refactoring in the peer-to-peer networking code. It swaps a generic encoder helper macro for an exact-size version so callers can ask 'how many bytes will this produce?' without actually encoding anything. There is no indication this fixes a bug, let alone a security vulnerability.

Security candidatep2p: Implement ExactSizeEncoder for AddrV2Encoderby Mitchell Bagot · cbc14d2a · Apr 9, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

p2p: Implement ExactSizeEncoder for AddrV2Encoder

For encoders, the use of the encoder_newtype_exact macro allows for
the implementation of the ExactSizeEncoder trait. This provides users
with the ability to determine the encoding length of types without
needing to perform the entire encoding process. Since the AddrV2Encoder
can do the necessary calculation in constant time, this trait should
be implemented for it too.

Implement ExactSizeEncoder for AddrV2Encoder.
Add test cases to confirm correct encoding + length calculation for
all types of AddrV2.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
constant-time or timing behavior
AI analysis · Informational 15/100

This commit adds a small performance and convenience feature to a Bitcoin peer-to-peer networking library written in Rust. It lets callers ask up front how many bytes an address encoding will produce, without actually doing the encoding. There is no security bug being fixed here; it is a routine enhancement with new tests.

Security candidatekey: Add From conversions for references for secret key typesby Mitchell Bagot · c55661dd · Apr 9, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

key: Add From conversions for references for secret key types

As with the changes to the from_* functions, there should exist From
impls that take references for all From impls that work on secret key
types. This further simplifies working with the non-Copy secret types.

Add From<&TweakedKeypair> for &Keypair, From<&PrivateKey> for Keypair
and From<&TweakedKeypair> for TweakedPublicKey.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Informational 15/100

This commit adds new Rust conversion helpers (From trait implementations) that let callers pass secret key types by reference instead of by value. It is a routine ergonomic/API improvement and does not change security behavior. The existing logic for deriving public keys from secret keys is unchanged; only the way callers provide the input is made more convenient.

Security candidatekey: Make as_inner pub(super) for secret key typesby Mitchell Bagot · cee439d8 · Apr 9, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

key: Make as_inner pub(super) for secret key types

As part of the long-term goal to remove the need to access the inner
secp types for all key types, the secret keys can now have their
inner accessor functions made pub(super). These functions are still
needed for functionality in the key module, but are no longer
necessary in the bitcoin crate or in the wider ecosystem.

Make as_inner pub(super) on PrivateKey and Keypair.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Informational 15/100

This commit narrows the visibility of two internal accessor methods from public to crate-internal. It is a routine API-cleanup change with no security relevance: it does not fix a bug, change behavior, or address any reported vulnerability.

Security candidatekey: Adjust all from_* functions to take refsby Mitchell Bagot · 0af1a681 · Apr 9, 2026 · 2 filesMessage 68 · AdequateInformational 19Details
Commit message · Mitchell Bagot

key: Adjust all from_* functions to take refs

The secret key types in bitcoin are no longer Copy. Since some
conversions to public key types take the key types by value, this makes
the use of private keys fairly unergonomic. Except where necessary,
conversion constructors for all key types (that is, from_* functions)
should always take references. This can help avoid costly copies.

Change from_keypair on TweakedPublicKey, from_private_key on
CompressedPublicKey and from_secret_bytes on PrivateKey to all take
references instead of values.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive pathsigning or wallet path
AI analysis · Informational 19/100

This commit is a routine ergonomic/API change in the rust-bitcoin library. It changes several key-conversion functions so they accept references instead of taking ownership of private key and keypair values. There is no security bug being fixed and no new vulnerability being introduced; it simply makes the API easier to use after the underlying secret key types stopped being implicitly copyable.

Lower-priorityDeprecate the to_hex implementation on Work and Targetby Mitchell Bagot · 99471959 · Apr 9, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Deprecate the to_hex implementation on Work and Target

Types in stable crates should not include the to_hex function. Since
this type is coming from bitcoin, this may be unintuitive to users.
For now, we'll keep the to_hex functionality on the types using the
bitcoin extension traits, but label them as deprecated.

Deprecate the Work and Target to_hex implementations.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine API cleanup, not a security fix. It marks the `to_hex()` methods on two Bitcoin proof-of-work types (`Work` and `Target`) as deprecated, telling developers to use Rust's standard `format!("{var:x}")` instead. No vulnerability is present or fixed.

Lower-priorityMove Target and Work to unitsby Mitchell Bagot · 498a4bb5 · Apr 9, 2026 · 5 filesMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Move Target and Work to units

With all the prior work complete, the pow types can now be moved to
units. Since units has no hex feature, hex formatting for the U256
(and thus the Target and Work types) is implemented manually.

Move Target and Work to units, using include! to introduce U256.
Move and improve relevant tests to kill mutants.
Fix lint errors to satisfy stricter requirements.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a routine code reorganization: it moves the `Target` and `Work` types (and their shared 256-bit integer helper, `U256`) from the `bitcoin` crate into the lower-level `units` crate. The public API is preserved through re-exports, and the only behavioral change is a new hand-written hex formatter for `U256` because the destination crate does not have a hex-formatting feature. There is no indication this fixes a security bug or introduces a vulnerability.

Lower-priorityUpdate API filesby Mitchell Bagot · 8d1b42af · Apr 9, 2026 · 6 filesMessage 51 · ThinInformational 15Details
Commit message · Mitchell Bagot

Update API files

Following the move of the pow types to units, the api files for
both units and primitives will be out of date.

Update API files for units and primitives.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit is a routine maintenance update. It refreshes generated text files that list the public application programming interface (API) of two Rust library crates after some internal type moves. No program logic, bug fixes, or security-sensitive code changes are present in the diff.

Lower-priorityMove U256 tests to unitsby Mitchell Bagot · e4bcaaa6 · Apr 9, 2026 · 2 filesMessage 71 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Move U256 tests to units

As part of ensuring that the hex parsing on U256 is only needed in
units (to simplify error conversions), the test cases for u256 that
currently rely on the U256Hex trait should be moved to units. This move
also ensures that the type is tested at the most upstream point it is
used, not only in bitcoin, potentially helping to catch bugs earlier.

Move all u256-specific test cases to units.
Remove U256Hex trait from bitcoin.
Fix lint errors in test cases.

71/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a routine code cleanup: it moves test cases for a 256-bit unsigned integer type (U256) from one internal test module to another, closer to where the type is defined. It also removes a test-only helper trait used for parsing hex strings and fixes minor code style warnings. There is no change to the actual library behavior or any security-sensitive logic.

Lower-priorityAdjust pow impls to remove private accessby Mitchell Bagot · ab6e996f · Apr 9, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Adjust pow impls to remove private access

With the move to units, the use of the Target() and Work() constructors
will no longer be possible, and neither will access to the inner U256.
However, since these types retain the to_/from_le_bytes, we can convert
them to the locally include!d U256 to perform the various complex
operations on them.

Convert all functions in TargetExt and WorkExt to use to_/from_le_bytes
instead of directly constructing or accessing the inner U256.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a routine internal refactoring change in the rust-bitcoin library. It replaces direct access to the internal numeric value of Target and Work types with conversions through public byte-array methods, so the library can keep working after those types move to a different crate. There is no user-facing behavior change and no security fix.

Lower-prioritySplit Target and Work in to extension traitsby Mitchell Bagot · 04bc22a6 · Apr 9, 2026 · 3 filesMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Split Target and Work in to extension traits

In order to reduce the move to units to a simple type definition, the
existing logic in bitcoin's pow module needs to be moved into
extension traits.

from_compact is required for the From impl for CompactTarget to Target,
and as such, is retained in the Target impl.
to_compact_lossy is retained as the inverse operation for from_compact.

Introduce TargetExt and WorkExt extension traits and move most struct
content into them.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is a routine internal code reorganization. It moves several helper functions for Bitcoin mining target/work calculations out of the main struct definitions and into Rust 'extension traits' named TargetExt and WorkExt. The actual formulas, checks, and behavior appear unchanged; only the code structure and import paths are modified. There is no indication this fixes a security bug or introduces a vulnerability.

Lower-priorityMove U256 to shared include and use include! in powby Mitchell Bagot · a3a38e7a · Apr 9, 2026 · 2 filesMessage 85 · StrongInformational 15Details
Commit message · Mitchell Bagot

Move U256 to shared include and use include! in pow

As part of stabilising the proof-of-work types, various functionality
needs to be computed in bitcoin without access to the inner type.
Since U256 should not be in the public API, the U256 struct logic
needs to be (at least partially) duplicated. In order to avoid having
multiple direct copies of the same code, we can use the include!
macro with a shared file.

Add include/u256.rs and move U256 struct definition to it. Use
include! to retain the logic in bitcoin's pow module.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is a pure code reorganization: it moves the internal U256 256-bit integer implementation from one file into a shared include file and pulls it back in with Rust's include! macro. No behavior changes, no bug fixes, and no security-relevant changes are visible.

Lower-prioritySplit hex parsing on U256 into a second implby Mitchell Bagot · d1248fa7 · Apr 9, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Split hex parsing on U256 into a second impl

The hex parsing on U256 is only used for the constructors of the Target
and Work types. Since we want to remove the From impls on the hex
errors, we need to remove the usage of them from outside of units.
Since U256 will be a shared module, we need to break out the hex parsing
into a separate impl that we can eventually move into units.

Introduce a second U256 impl and move hex parsing functionality from
U256 into it.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a simple internal code reorganization. It moves some hex-parsing helper functions for a 256-bit unsigned integer (U256) from one place in the file to another, without changing what the code does or how it behaves. There is no security fix or vulnerability here.

Lower-priorityRemove hex_conservative from U256 serdeby Mitchell Bagot · 2830d66e · Apr 9, 2026 · 1 fileMessage 68 · AdequateInformational 16Details
Commit message · Mitchell Bagot

Remove hex_conservative from U256 serde

The serde implementation for U256 relies on hex_conservative features
for the human readable implementation. Since units won't always have
access to the hex_conservative crate, it's better to change the serde
implementation to function without it.

Replace hex parsing to use units::parse_int module instead of
hex_conservative for U256 serde implementation.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 16/100

This commit changes how a 256-bit unsigned integer (U256) is converted to and from human-readable formats like JSON when the optional 'serde' feature is enabled. Previously it used a helper crate called hex_conservative; now it uses parsing code already available in the project's own 'units' module. The goal is to reduce unnecessary dependencies, not to fix a security bug. There is no direct evidence in the commit or supplied references that this fixes a vulnerability.

Lower-prioritybenches: benchmark merkle root computationby jrakibi · cfc75810 · Apr 9, 2026 · 2 filesMessage 60 · AdequateInformational 15Details
Commit message · jrakibi

benches: benchmark merkle root computation

benchmark with consecutive odd and even counts to calculate the
cost of adding the last transaction in the odd case

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only adds a new performance benchmark for calculating Bitcoin merkle tree roots. It does not change any library code, fix bugs, or alter behavior. There is no security relevance.

Lower-priorityExclude aarch64-gated merkle code from mutationby jrakibi · 48e9eacf · Apr 9, 2026 · 1 fileMessage 76 · AdequateInformational 15Details
Commit message · jrakibi

Exclude aarch64-gated merkle code from mutation

the new batched merkle root functions are behind
cfg(target_arch = "aarch64") and are not compiled on the x86_64
CI runner, which cause these mutants to appear

exclude these mutants until x86 SIMD support lands (#5540)

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This change only updates the mutation-testing configuration file. It tells the automated mutation-testing tool to skip testing certain new merkle root functions because they are only compiled for ARM64 (aarch64) processors and the project's CI currently runs on x86_64. There is no change to actual Bitcoin library code, no bug fix, and no security patch.

Lower-priorityprimitives: add test comparing batch and stacked-based merkle rootby jrakibi · e0710c8f · Apr 9, 2026 · 1 fileMessage 75 · AdequateInformational 15Details
Commit message · jrakibi

primitives: add test comparing batch and stacked-based merkle root

compare the old stack-based approach to calculate the merkle root
against the new batched level-by-level approach.

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a new unit test. It does not change any production code, fix a bug, or alter behavior. The test compares two different ways of computing the same merkle root to make sure they produce identical results.

Lower-priorityprimitives: use optimized sha256d for 64-byte in merkle root computationby jrakibi · c15debc6 · Apr 9, 2026 · 1 fileMessage 73 · AdequateInformational 17Details
Commit message · jrakibi

primitives: use optimized sha256d for 64-byte in merkle root computation

currently we are using stack-based approach to calculate the root.
instead of that, we can batch all pairs at each tree level into one
`hash_64_many()` call

we gate this for aarch64 to use the new batched algorithm. We will
widen to support x86 once we add a 2-way SHA-NI implementation.

for no-alloc we will always keep using the old stack-based approach

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 17/100

This commit is a performance optimization for Bitcoin merkle root calculation on ARM 64-bit (aarch64) systems. It replaces a stack-based approach with a batched hashing approach using an optimized SHA256 function. It is not a security fix and does not change behavior for most users; the old code path remains for non-aarch64 and no-alloc builds.

Lower-priorityRe-export locktime encoders and decodersby Tobin C. Harding · 1a274c75 · Apr 8, 2026 · 1 fileMessage 76 · AdequateInformational 16Details
Commit message · Tobin C. Harding

Re-export locktime encoders and decoders

For all `units::foo::Foo` there should exist a `primitives::foo::Foo`
and `bitcoin::foo::Foo`. We forgot about the new locktime encoding
types.

FTR we have issue #5969 to investigate how this happened.

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 16/100

This commit simply makes a few existing locktime-related type names available through an additional public module path. It is a routine API consistency fix with no security relevance.

Lower-priorityRemove public re-exports of old consenus traitsby Tobin C. Harding · 993ba1a7 · Apr 8, 2026 · 1 fileMessage 68 · AdequateInformational 18Details
Commit message · Tobin C. Harding

Remove public re-exports of old consenus traits

In the `absolute` module for some reason we publicly re-export the old
consensus encoding traits. This is unusual and wrong.

Uncovered in discussion between Andrew and Nymius on PR 5965

Remove the public re-export but keep the import statement.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit removes an accidental public re-export of internal Bitcoin data-encoding traits from a module that should not have exposed them. It is a minor API cleanup that slightly reduces the library's public surface area. There is no direct security vulnerability in the code itself, but cleaning up unintended public exports is a defensive hardening practice that prevents future misuse or confusion.