RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue2070AI analyses
183commits · 30 days
400commits · 60 days
1283commits · 180 days
2053commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192640068
Tobin C. Harding40965409063
jrakibi944994068
Nick Johnson18920189059
Andrew Poelstra512051075
Jamil Lambert, PhD11418114061
Fmt Bot311431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
satsfy (Renato Britto)17617066
Martin Habovstiak27527069
Analysis record

Published AI watches

Last scanned 42 minutes ago

Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`

This is a routine API cleanup, not a security fix. The developers removed a shortcut that let programmers create a 'number of blocks' value directly from any u16 number, replacing it with an existing named constructor called from_height. T…

ed5f1b68by Andrew Poelstra+18−358 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update the API text files

This commit only updates two generated API text files that list the public surface of the Rust crate. It removes entries for a `WitnessesEncoder` type, reflecting that the type is no longer part of the public API. There is no source code c…

9c391145by Tobin C. Harding+0−782 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

release bitcoin_hashes 1.2.0

This commit is a routine version bump for the bitcoin_hashes library from version 1.1.0 to 1.2.0. It only updates lock files, the package version number, and the changelog. There is no code change and no security relevance visible in the c…

8899dfd2by Andrew Poelstra+27−224 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityApply the reorder_imports formatting ruleby Ismail Daif · 02742197 · Mar 25, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Ismail Daif

Apply the reorder_imports formatting rule

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a purely cosmetic code-formatting change. It reorders three import statements in a single Rust source file so they appear alphabetically, with no functional effect on the program.

AI review queuedRun the formatterby busayo-OD · 8241722b · Mar 25, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · busayo-OD

Run the formatter

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely cosmetic: it reorders two crate re-exports (base58 and base64) in a source file to satisfy the project's code formatter. There is no functional change, no bug fix, and no security relevance.

Lower-priorityprimitives: add missing modules to api_can_use_modules_from_crate_rootby busayo-OD · bbb2b472 · Mar 25, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · busayo-OD

primitives: add missing modules to api_can_use_modules_from_crate_root

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only updates an internal Rust test file to include additional module names in a list of crate-root modules. It does not change any actual library code, behavior, or security-sensitive logic. There is no apparent security relevance.

Lower-priorityprimitives: add encoder/decoder types to api.rsby busayo-OD · 330e7f37 · Mar 25, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · busayo-OD

primitives: add encoder/decoder types to api.rs

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds new test cases to a public API surface test file. It imports recently-added encoder/decoder types from several modules to ensure they are reachable by users of the library. There is no code change to the library itself, no bug fix, and no security-related content.

Lower-priorityconsensus_encoding: add api.rs to test public API surfaceby busayo-OD · 40f49ecd · Mar 25, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · busayo-OD

consensus_encoding: add api.rs to test public API surface

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds a new test file that checks the public API surface of the consensus_encoding crate. It only imports types, checks that they implement common traits like Debug, Clone, Default, Send, and Sync, and verifies that Debug output is non-empty. There is no change to production code or security-sensitive logic.

AI review queuedUpdate API filesby jrakibi · 32220e6b · Mar 25, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · jrakibi

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API listing files (text snapshots of public functions) to include a newly added public function. It does not change any actual source code, behavior, or fix any problem. There is no security relevance.

Security candidatehashes: Add test for `hash_64_many`by jrakibi · c5954fe4 · Mar 25, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · jrakibi

hashes: Add test for `hash_64_many`

test block counts 0 through 32
this allows our test to go through all SIMD distpatch paths we have:

- 1 block: software path
- 2 blocks: 2-way
- 3 blocks: 2-way + last block software
- 4 blocks: 2-way for now, (4-way once we add it)
- 8 blocks: 2-way for now (8-way once we add it)
- ... and so on up to 32

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit only adds a new automated test for an existing function called hash_64_many. It does not change any production code, fix a bug, or alter behavior. There is no security issue here.

Security candidateAdd SHA256 midstate conversion to Midstateby Jamil Lambert, PhD · e3ead07c · Mar 25, 2026 · 3 filesMessage 68 · AdequateInformational 19Details
Commit message · Jamil Lambert, PhD

Add SHA256 midstate conversion to Midstate

C-CONV-SPECIFIC states "Conversions should live with the more specific
of the involved types".

Add SHA256 midstate to engine conversion to the more specific
`Midstate`.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 19/100

This commit simply moves an existing SHA256 midstate-to-engine conversion from one place in the code to another. The actual logic is unchanged; it is a code-organization refactor following a Rust API design guideline. There is no security fix or vulnerability here.

AI review queuedUpdate api filesby Jamil Lambert, PhD · c3e89fb7 · Mar 25, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Jamil Lambert, PhD

Update api files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files to include a newly added public function, `Midstate::to_engine`. It does not change any source code, fix a bug, or alter program behavior. There is no security relevance visible in the commit itself.

Security candidateRun the formatterby Jamil Lambert, PhD · 35e8b9ad · Mar 25, 2026 · 6 filesMessage 55 · ThinInformational 15Details
Commit message · Jamil Lambert, PhD

Run the formatter

Done after the changes so that the previous patch diff more clearly
shows the code move.

55/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body✓ Explains rationale or failure mode
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is purely a code formatting cleanup. It removes blank lines, reorders some import/module declarations, and collapses a few trivial function bodies onto one line. There are no functional changes to how the software behaves, and no security implications.

AI review queuedprimitives: Update API filesby Mitchell Bagot · 78443e30 · Mar 25, 2026 · 2 filesMessage 35 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

primitives: Update API files

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot files that list what types and functions are publicly available in the library. It adds entries for a new Signet-related script type that was already introduced elsewhere in the codebase. There is no actual code change, no bug fix, and no security relevance visible in the diff.

Lower-priorityAdd SignetBlockScript/Buf for signet challenge scriptsby Mitchell Bagot · 456425ca · Mar 25, 2026 · 7 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add SignetBlockScript/Buf for signet challenge scripts

Custom signets require a challenge script (or block script). But our
new script types do not provide a tag for that. Currently we are using
WitnessScriptBuf, which has the correct typing, but is sematically
unclear.

Add SignetBlockScript and SignetBlockScriptBuf script types to
represent challenge witness scripts for custom signets.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a straightforward code-quality improvement in the rust-bitcoin library. It introduces new type names (SignetBlockScript and SignetBlockScriptBuf) to represent signet challenge scripts more clearly, replacing the previous use of WitnessScript types. There is no security bug being fixed here and no behavior change that would affect users' funds or network safety.

AI review queuedUpdate API text filesby Bortlesboat · 12627ed3 · Mar 25, 2026 · 9 filesMessage 28 · OpaqueInformational 15Details
Commit message · Bortlesboat

Update API text files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API text files that list the public interface of the Rust Bitcoin crates. The changes reflect newly added standard Rust trait implementations (From<Infallible>) for various error types. These are not code changes and do not alter runtime behavior, so there is no security impact.

AI review queuedImplement From<Infallible> for all public error typesby Andrew Barnes · c425a0cf · Mar 25, 2026 · 10 filesMessage 81 · StrongInformational 19Details
Commit message · Andrew Barnes

Implement From<Infallible> for all public error types

Add From<Infallible> implementations for 31 public error types
across the consensus_encoding, primitives, and units crates. Each
impl is placed directly below its type declaration. For hidden
error types, the impl is placed below the inner type declaration.

Closes: #5767

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathparser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit adds standard Rust trait implementations that let the library's error types be automatically converted from an 'impossible' error type (Infallible). It is a routine API-ergonomics improvement with no security relevance: Infallible can never actually be produced at runtime, so these conversions can never be triggered by an attacker.

Security candidateChange sign_message::sign to take &PrivateKeyby Mitchell Bagot · d9efc06e · Mar 25, 2026 · 2 filesMessage 90 · StrongInformational 18Details
Commit message · Mitchell Bagot

Change sign_message::sign to take &PrivateKey

The sign_message::sign function in bitcoin currently takes a
secp256k1::SecretKey. In order to move away from using secp types in
the api, this should instead be a PrivateKey. Further, since we hope to
remove Copy from PrivateKey, APIs should be designed to take references
where possible.

Introduce raw_ecdsa_sign_recoverable to PrivateKey.
Change sign_message::sign to take &PrivateKey instead of SecretKey.
Adjust test cases accordingly.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 18/100

This commit is a routine API refactor in the rust-bitcoin library. It changes the message-signing function so it accepts a higher-level PrivateKey reference instead of a low-level secp256k1 secret key, and moves the underlying signing logic into a new PrivateKey method. There is no indication this fixes a security bug; it is a design cleanup to hide internal cryptographic types from users and prepare for future API changes.

AI review queuedRun the formatterby Mitchell Bagot · bf983044 · Mar 25, 2026 · 5 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Run the formatter

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup. It removes blank lines, collapses a struct literal onto one line, reorders re-exports and module declarations, and adds a blank line between imports. There is no functional change and no security relevance.

Lower-priorityCI: Add formatting jobby Tobin C. Harding · cf39b401 · Mar 25, 2026 · 2 filesMessage 63 · AdequateInformational 15Details
Commit message · Tobin C. Harding

CI: Add formatting job

Add a `fmt --check` job. As discussed in PR 5866 lets have a job and
a policy that PRs with red fmt jobs can merge if they get past
Andrew's CI. This will encourage most devs to format their PRs without
forcing everyone to install the nightly toolchain.

63/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds a code-formatting check to the project's continuous integration (CI) pipeline and updates the contributor guide to explain the formatting policy. It does not change any production code, cryptographic logic, network handling, or data parsing. There is no security issue here.

Lower-priorityFix code comment so formatter doesn't munge itby Tobin C. Harding · 20a65b49 · Mar 25, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Fix code comment so formatter doesn't munge it

Make the code comment more ugly than it is but less than the formatter
will make it.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit only rearranges code comments in a test file to prevent an automated code formatter from reformatting them awkwardly. No program logic, behavior, or security-sensitive code was changed.

AI review queuedRun the formatterby Tobin C. Harding · 88fdfcef · Mar 25, 2026 · 5 filesMessage 28 · OpaqueInformational 15Details
Commit message · Tobin C. Harding

Run the formatter

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only runs an automated code formatter. It reorders imports, removes blank lines, and collapses some struct literals onto single lines. There are no functional code changes and no security relevance.

Security candidateci: upgrade cargo-rbmtby Nick Johnson · 78348b4a · Mar 24, 2026 · 33 filesMessage 78 · AdequateInformational 15Details
Commit message · Nick Johnson

ci: upgrade cargo-rbmt

This version of cargo-rbmt dropped the "with" and "without" feature set
generating keys for the test matrix. Replicating the important sets with
the exact_features key and depending on the random sets for the rest. I
didn't bother to add the "arbitrary" feature to the exact_feature sets
since it doesn't seem critical.

78/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit is a routine maintenance update to the project's automated testing setup. It upgrades an internal tool called cargo-rbmt and moves its configuration from separate files into each crate's Cargo.toml package metadata. It also changes how nightly and stable Rust compiler versions are tracked, storing them in the workspace Cargo.toml instead of separate version files. There are no changes to the actual Bitcoin library code that users depend on, and no security-relevant behavior is modified.

Lower-priorityRemove rustdocs from pub extern crate re-exportsby Jamil Lambert, PhD · 95b1cd21 · Mar 24, 2026 · 4 filesMessage 68 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Remove rustdocs from pub extern crate re-exports

The docs are not rendered and are inconsistently applied across the
repo.

Remove all docs from pub extern crate re-exports.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only removes documentation comments from public crate re-exports. It does not change any executable code, APIs, or behavior. There is no security relevance.

AI review queuedUpdate API filesby busayo-OD · 5976a31e · Mar 24, 2026 · 5 filesMessage 28 · OpaqueInformational 15Details
Commit message · busayo-OD

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files. It removes lines that list certain error-conversion functions from the public API surface, but it does not change any actual Rust source code, logic, or behavior. There is no security-relevant change visible in the diff.

AI review queuedRemove From<SubError> for Error implsby busayo-OD · 39c6e225 · Mar 24, 2026 · 7 filesMessage 45 · ThinInformational 17Details
Commit message · busayo-OD

Remove From<SubError> for Error impls

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit removes automatic conversion traits (From implementations) that let sub-errors be silently turned into parent errors. It replaces them with explicit error wrapping at each call site. This is a code-quality and API-clarity change, not a security fix. There is no evidence in the commit message or diff that it addresses a vulnerability, exploit, or bug that could affect users.

AI review queuedRun the formatterby Mitchell Bagot · 1b962b50 · Mar 24, 2026 · 5 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Run the formatter

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup. It removes blank lines, reorders imports, and lets an automated formatter rewrap a few lines. There are no functional changes to how the software behaves, and nothing in the diff suggests a security fix or vulnerability.

Lower-priorityp2p: Fix ExactSizeEncoder impl on CommandStringEncoderby Mitchell Bagot · 1ab6fe25 · Mar 24, 2026 · 1 fileMessage 73 · AdequateLow 26Details
Commit message · Mitchell Bagot

p2p: Fix ExactSizeEncoder impl on CommandStringEncoder

The ExactSizeEncoder trait is supposed to return the size of the
remaining data in the encoder. That is, as chunks are encoded and
returned to the caller, .len() should decrease, eventually reaching 0.
The ExactSizeEncoder impl for CommandStringEncoder uses a hard-coded
length, preventing this behaviour.

Change ExactSizeEncoder impl on CommandStringEncoder to call through
to the inner ArrayEncoder impl.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 26/100

This commit fixes a small but real bug in a Bitcoin peer-to-peer networking library written in Rust. A helper object that encodes message command names (like "version") was incorrectly reporting that it always had 12 bytes left to send, even after some bytes had already been consumed. The fix makes it report the actual remaining length. The bug could mislead callers that rely on the remaining-length promise, but the commit does not show a direct path to stealing funds or remote code execution.