RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue2070AI analyses
181commits · 30 days
400commits · 60 days
1283commits · 180 days
2052commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192640068
Tobin C. Harding40965409063
jrakibi944994068
Nick Johnson18920189059
Andrew Poelstra512051075
Jamil Lambert, PhD11418114061
Fmt Bot311431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
satsfy (Renato Britto)17617066
Martin Habovstiak27527069
Analysis record

Published AI watches

Last scanned 27 minutes ago

Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`

This is a routine API cleanup, not a security fix. The developers removed a shortcut that let programmers create a 'number of blocks' value directly from any u16 number, replacing it with an existing named constructor called from_height. T…

ed5f1b68by Andrew Poelstra+18−358 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update the API text files

This commit only updates two generated API text files that list the public surface of the Rust crate. It removes entries for a `WitnessesEncoder` type, reflecting that the type is no longer part of the public API. There is no source code c…

9c391145by Tobin C. Harding+0−782 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

release bitcoin_hashes 1.2.0

This commit is a routine version bump for the bitcoin_hashes library from version 1.1.0 to 1.2.0. It only updates lock files, the package version number, and the changelog. There is no code change and no security relevance visible in the c…

8899dfd2by Andrew Poelstra+27−224 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityprimitives: Remove FromHex from test codeby Tobin C. Harding · 30ee49d6 · Mar 9, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Tobin C. Harding

primitives: Remove FromHex from test code

There are some remaining usages of the unstable `FromHex` trait, lets
remove them in favour of the stable decoding functions.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only changes internal test code in the rust-bitcoin library. It replaces an unstable developer-only helper trait with a stable equivalent for converting hexadecimal strings into byte arrays. There is no change to production code, no user-facing behavior change, and no security fix.

AI review queuedprimitives: Use ArrayRefEncoderby Tobin C. Harding · 736adeb9 · Mar 9, 2026 · 2 filesMessage 58 · ThinInformational 15Details
Commit message · Tobin C. Harding

primitives: Use ArrayRefEncoder

No need to copy the hash type when encoding the `TxMerkleNode` or
the `WitnessMerkleNode`.

Use `ArrayRefEncoder` as we do for the other hash types. Props to
claude for noticing this while chugging through some other changes
for me. I did the changes manually though.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a small internal code cleanup in the rust-bitcoin library. It changes how two hash-like types (transaction merkle node and witness merkle node) are encoded so that they reference existing data instead of making a copy. There is no security issue here—it's a performance/maintainability improvement that makes the code consistent with how other hash types are already encoded.

AI review queuedapi: update consensus_encoding traitsby Nick Johnson · 798195df · Mar 9, 2026 · 3 filesMessage 35 · OpaqueInformational 15Details
Commit message · Nick Johnson

api: update consensus_encoding traits

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API text files that list which Rust traits (like Clone and Debug) are implemented by various types in the bitcoin_consensus_encoding crate. No actual source code, logic, or behavior changed. It is a documentation/maintenance update for the public API snapshot, not a security fix.

AI review queuedconsensus_encoding: add common trait implementationsby Nick Johnson · a7519267 · Mar 9, 2026 · 4 filesMessage 85 · StrongInformational 19Details
Commit message · Nick Johnson

consensus_encoding: add common trait implementations

Following API guidelines C-COMMON-TRAITS, adding Debug and Clone
implementations where we can to encoders and decoders.

A lot of the common traits, including PartialEq, Hash, Ord, Display,
Default, and Copy don't have semantic value for the stateful encoders
and decoders. For example, comparing two encoders with PartialEq would
be comparing a buffer and a cursor, not a logical value.

The composite decoders do not implement Clone because it would require a
Clone bound on the intermediate A::Output types, which seems too
constraining.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit adds standard Rust helper traits (Debug for printing, Clone for copying) to the library's byte encoders and decoders. It also adds a few new unit tests. There is no security fix or vulnerability here; it is a routine API-quality improvement.

Security candidatekeys: Remove rng argument from Keypair::generateby Mitchell Bagot · 37c7a197 · Mar 9, 2026 · 1 fileMessage 73 · AdequateInformational 19Details
Commit message · Mitchell Bagot

keys: Remove rng argument from Keypair::generate

The Keypair::generate function follows the signature of the underlying
secp library, in that it takes a rand generator. The existing
PrivateKey generate instead constructs the rand generator internally,
hiding the extra complexity from the user to provide a cleaner
interface.

Remove rng argument from Keypair::generate and adjust call sites
accordingly.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
entropy or randomnesssigning boundarycryptography-sensitive path
AI analysis · Informational 19/100

This is a routine API cleanup, not a security fix. The change removes the requirement for callers to supply their own random number generator when creating a new keypair. Instead, the function now creates the generator internally, matching how the related PrivateKey API already works. There is no vulnerability here; it is a convenience and consistency change.

Lower-priorityUpdate the API text filesby Tobin C. Harding · 648e6cda · Mar 9, 2026 · 2 filesMessage 45 · ThinInformational 15Details
Commit message · Tobin C. Harding

Update the API text files

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates generated text files that list the public API surface of the Rust Bitcoin library. No actual source code, logic, or behavior changed. The files record that the `Block` type now carries a validation-state marker (`Unchecked`/`Checked`) and that some error types were added, but these are documentation artifacts, not a security patch.

Lower-priorityImplement fmt traits for Blockby Tobin C. Harding · 1fd0056d · Mar 9, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Implement fmt traits for Block

Only parse `Block<Unchecked>` but allow fmt'ing both checked and
unchecked. Done using consensus encoding logic the same as we do for
`Header`.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit adds ordinary string formatting and hex parsing support for the Block type in a Rust Bitcoin library. It is a routine feature addition with no security relevance visible in the code or commit message.

Lower-priorityLoosen trait bounds on HexPrimitive trait implsby Tobin C. Harding · 86ff577a · Mar 9, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · Tobin C. Harding

Loosen trait bounds on HexPrimitive trait impls

Currently the `HexPrimitive` has trait bounds on the struct `Decodable
+ Encodable` and these bounds are also on the `fmt` trait impls. It is
not necessary to be able to decode an object in order to `fmt` it.

Loosen the trait bounds so that we only need `Encodable` for `fmt`'ing
and `Decodable` for parsing.

(This is needed so that the `Block<Checked>` type can be `fmt`'ed when
it intentionally does not implement decoding.)

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is a routine code cleanup. It relaxes unnecessary requirements on an internal helper type so that formatting a value as hexadecimal no longer requires the value to also be decodable. There is no security issue here.

Lower-priorityAdd tag to Block decodableby Tobin C. Harding · 9efb7e9b · Mar 9, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Add tag to Block decodable

Just to make it more obvious that we only implement `Decodable` for
unchecked blocks.

The `Unchecked` tag is the default. Syntax only, no logic change.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a purely cosmetic code change. A developer added the word 'Unchecked' to an existing implementation line to make it clearer that this code path does not validate block contents. No program behavior, security checks, or logic were changed.

Lower-prioritybitcoin: Do not inline block errorsby Tobin C. Harding · 871ad5bb · Mar 9, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

bitcoin: Do not inline block errors

Convention is to use `no_inline` when re-exporting error types. Fix
the re-exports from the `bitcoin::block` module.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a cosmetic documentation-only change. It moves two error types from an inline re-export list to a separate non-inline re-export list, matching the project's existing style convention. There is no functional code change and no security impact.

Lower-prioritybitcoin: Put inline types above no_inline typesby Tobin C. Harding · 7e303c97 · Mar 9, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

bitcoin: Put inline types above no_inline types

The `no_inline` stuff is a bit haphazard across the repo; as part of
an effort to nail it down put the error stuff below the other types.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit simply reorders two lines of Rust documentation import attributes. It moves an error type re-export to appear after inline type re-exports, with no functional code change. There is no security relevance.

AI review queuedImprove From<Infallible> impls to the hex_codec errorsby Tobin C. Harding · 5508596d · Mar 9, 2026 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Improve From<Infallible> impls to the hex_codec errors

Policy is to implement `From<Infallible>` for all error types.

Add missing impls, move the existing one to the 'right' place (right
by codebase convention), and import `Infallible`.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a routine code-quality change in a Rust Bitcoin library. It adds and reorganizes implementations of `From<Infallible>` for certain hex-decoding error types. `Infallible` is a Rust type that can never actually be produced, so these conversions are only useful for making the type system happy and have no security impact.

Lower-priorityRefactor dummy_block function in unit testby Tobin C. Harding · 195eb526 · Mar 9, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Refactor dummy_block function in unit test

In preparation for further testing pull the dummy block creation out
into a function.

Refactor slightly the names and also the assertion so its in got, want
order.

No test coverage change.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a harmless code cleanup inside the project's test suite. It moves the creation of a fake Bitcoin block into a reusable helper function and renames a few variables. There is no change to the actual library code that users rely on, and no security implications.

Lower-priorityUse write_err in Display for error typeby Tobin C. Harding · 12e6e161 · Mar 9, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Use write_err in Display for error type

As is customary use the `write_err` macro instead of calling
`fmt::Display` on the inner error.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a tiny code-quality change in how an error message is formatted. It replaces a debug-style error display with a more conventional human-readable error message. There is no security issue visible in the commit.

Lower-priorityprimitives: Group and document option hex depsby Tobin C. Harding · 5b0dfd9e · Mar 9, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Tobin C. Harding

primitives: Group and document option hex deps

Because I got confused just now group the optional hex deps and
comment that they are not typically used directly.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is purely a housekeeping change in a Rust package configuration file. It reorders three optional dependency lines and adds a comment explaining that two of them are not meant to be used directly. There is no code change, no behavior change, and no security relevance.

AI review queuedprimitives: Return reference to inner error in sourceby Tobin C. Harding · 73d30231 · Mar 9, 2026 · 2 filesMessage 73 · AdequateInformational 17Details
Commit message · Tobin C. Harding

primitives: Return reference to inner error in source

Each call to `source` for a stack of nested errors adds a layer. To
tie this all together `source` should return the layer below it i.e.,
the inner error not call through to `source` itself.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit fixes a small bug in how Rust error chains are reported for two Bitcoin parsing error types. Previously, when asking 'what caused this error?', the code accidentally skipped past the immediate cause and returned the next level up. Now it correctly returns the immediate inner error. This is a correctness fix for error reporting and does not directly create a security vulnerability or allow attacks.

Lower-priorityunits: Allow too_many_lines in test functionby Tobin C. Harding · 88a22c07 · Mar 9, 2026 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Tobin C. Harding

units: Allow too_many_lines in test function

Although the lint is likely correct just shoosh it for now because it
is one line before the threshold until the formatter runs with this
weeks nightly toolchain update.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit adds a single Rust lint-suppression attribute to a test function so that the Clippy 'too_many_lines' warning is silenced. It does not change any runtime code, behavior, or security properties. It is purely a developer-experience change to keep CI passing after a toolchain update.

Lower-priorityFix blockdata module re-export docsby Mitchell Bagot · ef1b580a · Mar 9, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Fix blockdata module re-export docs

The module re-exports in bitcoin::blockdata currently have incorrect
docs due to missing #[doc(inline)] and incorrect use of /// comments.

Introduce #[doc(inline)] where appropriate.
Replace incorrect uses of doc comments with standard comments.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit only fixes how documentation appears for re-exported Rust modules. It changes some doc comments to regular comments and adds markers that control whether documentation is shown inline. There is no change to actual program logic, data handling, or security behavior.

AI review queuedconsensus_encoding: Add tests for CompactSizeDecoder limit handlingby Mitchell Bagot · c7592569 · Mar 7, 2026 · 1 fileMessage 83 · StrongInformational 14Details
Commit message · Mitchell Bagot

consensus_encoding: Add tests for CompactSizeDecoder limit handling

The CompactSizeDecoder can enforce a limit on the valid values to
decode through the new or new_with_limit constructors. At present,
there are no tests to validate this functionality at the boundary
values.

Introduce tests to check limit handling at the boundaries for both
the new and new_with_limit constructors.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validationparser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 14/100

This commit only adds new unit tests for an existing feature. It does not change any production code, fix a bug, or alter behavior. The tests verify that a decoder correctly accepts values at or below its configured limit and rejects values above it. There is no security issue here.

Lower-priorityp2p: Implement `encoding` traits for `AddrPayload`by rustaceanrob · e07314ee · Mar 7, 2026 · 1 fileMessage 50 · ThinInformational 16Details
Commit message · rustaceanrob

p2p: Implement `encoding` traits for `AddrPayload`

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 16/100

This commit adds standard encoding and decoding support for the Bitcoin P2P `addr` message payload (a list of network addresses). It is a routine feature addition that lets the library serialize and deserialize this message type. There is no indication in the commit that it fixes a security bug or introduces a vulnerability.

Lower-priorityp2p: Implement `encoding` traits for `AddrV1Message`by rustaceanrob · 3d3fd2ee · Mar 7, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · rustaceanrob

p2p: Implement `encoding` traits for `AddrV1Message`

Pre-work for `AddrPayload`

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds new serialization/deserialization code for an existing Bitcoin peer-to-peer message type (AddrV1Message). It is a straightforward refactoring that implements the project's newer 'encoding' traits for a struct that already had older consensus encoding support. There is no indication of a security bug being fixed or introduced.

Lower-priorityp2p: Introduce an `AddrV1Message`by rustaceanrob · 5376aa06 · Mar 7, 2026 · 2 filesMessage 66 · AdequateInformational 15Details
Commit message · rustaceanrob

p2p: Introduce an `AddrV1Message`

Current `AddrPayload` messages use a tuple to carry the time and network
address. Firstly, it's annoying to have an un-named `u32` in the tuple.
Secondly, a wrapper type makes it easier to implement `encoding` traits.
This introduces a newtype and uses it throughout the crate.

ref: https://en.bitcoin.it/wiki/Protocol_documentation#Network_address

66/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup in the peer-to-peer networking module. It replaces an unnamed pair of values (a timestamp number and a network address) with a clearly named wrapper type called AddrV1Message. There is no change to security behavior, no bug fix, and no externally visible protocol change.

Security candidateCreate an empty key-expression crateby Mitchell Bagot · a44409cb · Mar 7, 2026 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Create an empty key-expression crate

In preparation for crate smashing the bip32 module and associated
functionality, create an empty crate.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
secret or key material
AI analysis · Informational 15/100

This commit creates a brand-new, empty placeholder crate named 'bitcoin-key-expression' inside the rust-bitcoin workspace. It contains no code, no logic, and no changes to existing behavior. It is purely a structural preparation step for future development.

Security candidateChange XOnlyPublicKey::to_public_key to take selfby Mitchell Bagot · 2046efc9 · Mar 7, 2026 · 1 fileMessage 68 · AdequateInformational 20Details
Commit message · Mitchell Bagot

Change XOnlyPublicKey::to_public_key to take self

As a Copy type, conversions from XOnlyPublicKey to other types are
generally expected to take self by value, not by reference. In the case
of to_public_key, this also aligns with the clippy lint. Since the
performance cost is likely to be negligible after accounting for
compiler optimisation, the extra mess to take by reference can be
removed.

Change XOnlyPublicKey::to_public_key to take self by value instead of
by reference.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 20/100

This commit is a routine API cleanup, not a security fix. It changes one function so it takes its input by value instead of by reference, matching normal Rust conventions for small copyable types. There is no bug being fixed and no security relevance stated.

Security candidateAdd parity argument to XOnlyPublicKey::from_secpby Mitchell Bagot · c74bf550 · Mar 7, 2026 · 1 fileMessage 68 · AdequateInformational 19Details
Commit message · Mitchell Bagot

Add parity argument to XOnlyPublicKey::from_secp

The XOnlyPublicKey from_secp constructor is the main method of creating
XOnlyPublicKey objects. At the moment, many places where it is used are
followed by a subsequent with_parity() call.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 19/100

This commit is a small API cleanup in a Rust Bitcoin library. It changes one constructor so callers must provide a 'parity' value directly instead of setting it afterward. Existing callers are updated to preserve the same behavior as before. There is no indication this fixes a security bug or changes any security-relevant behavior.