rust-bitcoin

bip152: validate prefill count before allocating short IDs

Reject excessive prefill indexes before allocating the short ID vector.

Signed-off-by: racequite <quiterace@gmail.com>

bip152: test excessive prefill indexes

Verify that invalid prefill counts return InvalidPrefill instead of panicking.

Signed-off-by: racequite <quiterace@gmail.com>

Merge rust-bitcoin/rust-bitcoin#6758: primitives: Implement `Arbitrary` for `WitnessVersion`

32435bed989bd908ba63afab067d5076ccfc9b24 ci: update api snapshot (satsfy (Renato Britto))
aedb91a5a223f0aa02bce7b09b74a64524b7e83e primitives: Add Arbitrary impl for WitnessVersion (satsfy (Renato Britto))

Pull request description:

Inspired on similar change for `Opcode`, on https://github.com/rust-bitcoin/rust-bitcoin/pull/6731. Nearly every primitive implements `Arbitrary` except `WitnessVersion`. This PR adds an implementation that samples uniformly over the valid 0 to 16 range. The goal is API completeness for primitives 1.0.0.

This PR does only `WitnessVersion` because it resembles `Opcode`, but one could argue that `PushBytes`/`PushBytesBuf`, of `primitives`, could also implement `Arbitrary`.


ACKs for top commit:
apoelstra:
ACK 32435bed989bd908ba63afab067d5076ccfc9b24; successfully ran local tests


Tree-SHA512: 52439d81e288516c13eed829bc341013fa528c66a27205e33b2f5ecdacf675970765bd8f0e68cdef7bb9a5ef6231d3e1e2874d3c93044d5dc8cc63ea56141ded

Merge rust-bitcoin/rust-bitcoin#6798: bump yanked secp256k1 version to 0.33.0

935d8eb86e904b3d4ef26ec8ca1ae543daacc914 deps: bump secp256k1 to 0.33.0 (satsfy (Renato Britto))

Pull request description:

The 0.32.0-beta line was yanked from crates.io when 0.33.0 was released.

Also `XOnlyPublicKey::serialize` was deprecated for `to_byte_array` and `secp256k1::Keypair::from_seckey_byte_array` became
`from_secret_bytes`.


ACKs for top commit:
apoelstra:
ACK 935d8eb86e904b3d4ef26ec8ca1ae543daacc914; successfully ran local tests


Tree-SHA512: 62221a72567082200a5f710898bfdd187e553859f496653bd6e86e64c0ca1e2476381637101e7b1507d72071f8aca079f94976ad1bb89211150723f716310e51

Merge rust-bitcoin/rust-bitcoin#6790: Implement Rem<NonZero{I,U}64> for {Signed}Amount

7ceb9f04cf33161590d9f8137dd606e2e23d498e Implement Rem<NonZero{I,U}64> for {Signed}Amount (Martin Habovstiak)
60e21d58adab5dec6fd83be1c997fa03b833c1bd Rename `amount/result.rs` to `amount/ops.rs` (Martin Habovstiak)

Pull request description:

`Rem` and `RemAssign` were already implemented for `u64` and `i64` and we also had `Div` and `DivAssign` for `NonZeroU64` and `NonZeroI64` but `Rem{Assign}` for `NonZero{U,I}64` were missing. This PR adds them along with a little cleanup.


ACKs for top commit:
apoelstra:
ACK 7ceb9f04cf33161590d9f8137dd606e2e23d498e; successfully ran local tests. LGTM. But lol that even stdlib's "nonzero" types are unusable without adding unreachable panic paths.


Tree-SHA512: c1c9513f6620ea4cc966be91e2529e790db17692c1c7d5d0360c8feb35392cd75d64255017ae2662f3ee6146d03198b98bf10d9b97dc1c47939a636d07465ea3

deps: bump secp256k1 to 0.33.0

The 0.32.0-beta line was yanked from crates.io when 0.33.0 was
released.

XOnlyPublicKey::serialize was deprecated for to_byte_array.
secp256k1::Keypair::from_seckey_byte_array became
`from_secret_bytes`.

ci: fail prepare job on bad nigthly version read

The Prepare job was succeeding despite preparation failure
because of a yanked crate. It produced an empty
nightly_version that would cause downstream ASAN job to
fail at toolchain selection.

Configure rust shell to bash to make it pipefail when
that cargo metadata errors. Pass -e to jq so a missing
field is an error too.

Merge rust-bitcoin/rust-bitcoin#6737: ci: cache cargo install metadata in daily fuzz

29c7375393ea216c697506cf0962ac3fef62c9c2 ci: cache cargo install metadata in daily fuzz (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6727
Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6634
Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6783

[Fuzz job has been failing](https://github.com/rust-bitcoin/rust-bitcoin/actions/workflows/cron-daily-fuzz.yml). The cache did not save `.crates.toml` and `.crates2.json`. When cache hits, the rbmt install failed with error 'binary already exists in destination' because `cargo install` goes to write and finds files already sitting there with no database entry.

To ensure this fix is effective immediately, the key has been migrated to 'v2', entirely independent.

Tested in fork, first I ran this to generate cache: https://github.com/satsfy/rust-bitcoin/actions/runs/31741126469
Then I ran this, which leverages cache successfully: https://github.com/satsfy/rust-bitcoin/actions/runs/31741756971/job/94586598887#step:4:21, and the install log says "Ignored package `cargo-rbmt v0.4.1`" (upstream's current).

Why `.crates2.json`"? [Read this](https://doc.rust-lang.org/cargo/guide/cargo-home.html#caching-the-cargo-home-in-ci). We only needed these 2 folder to save state.


ACKs for top commit:
tcharding:
ACK 29c7375393ea216c697506cf0962ac3fef62c9c2
apoelstra:
ACK 29c7375393ea216c697506cf0962ac3fef62c9c2; successfully ran local tests


Tree-SHA512: c1311e6978586f41d862826eccf0fd7d5321e939d51dc544f579990fa31800cf1afd4bc3bd505f814f32d23b15d411d2227926c544f30d045e492e923716070e

Merge rust-bitcoin/rust-bitcoin#6785: build(deps): bump taiki-e/install-action from 2.82.4 to 2.82.5

3856bf4f19d67a70c9224c48c6750a940f089b81 build(deps): bump taiki-e/install-action from 2.82.4 to 2.82.5 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.4 to 2.82.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.5</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 46.0.1.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.126.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.6.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.14.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.1.0.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.86.8] - 2026-08-26</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.1.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.258.0.</p>
</li>
<li>
<p>Update <code>oxfmt@latest</code> to 1.80.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.12.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 2.0.0.</p>
</li>
<li>
<p>Update <code>cargo-zigbuild@latest</code> to 0.23.2.</p>
</li>
</ul>
<h2>[2.86.7] - 2026-08-24</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.4.1.</p>
</li>
<li>
<p>Update <code>rafn@latest</code> to 0.1.5.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.22.0.</p>
</li>
</ul>
<h2>[2.86.6] - 2026-08-23</h2>
<ul>
<li>
<p>Update <code>dprint@latest</code> to 0.56.1.</p>
</li>
<li>
<p>Update <code>cargo-lambda@latest</code> to 1.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.10.</p>
</li>
</ul>
<h2>[2.86.5] - 2026-08-21</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.4.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.257.1.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.36.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/bffeee26d4db9be238a4ea78d8826604ebcb594d"><code>bffeee2</code></a> Release 2.82.5</li>
<li><a href="https://github.com/taiki-e/install-action/commit/5bafa69e5add729bd5cc9c0646ed12e1af612c99"><code>5bafa69</code></a> ci: Test GitHub-hosted ubuntu 26.04 runners</li>
<li><a href="https://github.com/taiki-e/install-action/commit/e7b7497213f2263bcf738032dcc69fd4c14b1813"><code>e7b7497</code></a> Update wasmtime manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/e9838983e85b61bb8ceb03c66a676d5a37507462"><code>e983898</code></a> Update <code>wasmtime@latest</code> to 46.0.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/0cd66872025ce95e85d8831011a3d60693cb5b06"><code>0cd6687</code></a> Update <code>wasm-bindgen@latest</code> to 0.2.126</li>
<li><a href="https://github.com/taiki-e/install-action/commit/151275d7b873bc8f076b2e0addaaf908740405ca"><code>151275d</code></a> Update <code>vacuum@latest</code> to 0.29.6</li>
<li><a href="https://github.com/taiki-e/install-action/commit/1a104bfb141e3d8faadbdc6c3306789dd461f1c9"><code>1a104bf</code></a> Update syft manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/edab3a363f10f8d5af8efc8633ad982b899bfbde"><code>edab3a3</code></a> Update <code>mise@latest</code> to 2026.6.14</li>
<li><a href="https://github.com/taiki-e/install-action/commit/46c1ccf9e1e2e709f19c2846fb39337b5045c0f6"><code>46c1ccf</code></a> Update <code>cargo-rdme@latest</code> to 2.1.0</li>
<li>See full diff in <a href="https://github.com/taiki-e/install-action/compare/682e7d9e49c5e653d371fc6adbda67653461378a...bffeee26d4db9be238a4ea78d8826604ebcb594d">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
satsfy:
ACK 3856bf4f19d67a70c9224c48c6750a940f089b81
apoelstra:
ACK 3856bf4f19d67a70c9224c48c6750a940f089b81; successfully ran local tests


Tree-SHA512: 117f94e2df1b5717a2aa99f94d0d65701d1debe7ac5b6344f4b944bf64a145b569755b75652f57a98ea4ebc02530e4e32ed2499c4ad2e04eb8c4bdd64c510872

Merge rust-bitcoin/rust-bitcoin#6769: fuzz: add custom mutators for checksum-gated targets

0270be4617f42c097268a1973a72010fc503c90c fuzz: document custom mutators (Erick Cestari)
3a7a526fafd647fd68a08e0c80532f9b561121b4 fuzz: add a mutator for address strings (Erick Cestari)
e2bd7bca6b66da2107ec2a8cfe483565272b96cd fuzz: mutate the v1 network message roundtrip target (Erick Cestari)
22cf577c2f5802d928c427a0c2a0a849ef21b3da fuzz: add a mutator for the v1 p2p message frame (Erick Cestari)
6c009d85536d1eed9dd775cba67b2c69a3e4eeac fuzz: add scaffolding for custom mutators (Erick Cestari)
f58c6ee85ebe70108b9e1bf4f03d74f2c72676aa fuzz: fix the address roundtrip assertion (Erick Cestari)

Pull request description:

Five fuzz targets sit behind a checksum and never reach the parser inside: any
mutation invalidates the envelope, so the whole budget goes on rejected inputs.

Adds two custom mutators under `fuzz/src/mutate/`:

- `p2p_frame` confines mutation to a v1 message payload and rewrites the length
and checksum around it
- `address` decodes an address, mutates the witness program or hash, and
re-encodes

Also fixes a latent bug in the address targets roundtrip assertion: an
all-uppercase bech32 address parses but `Display` writes lowercase, so the
assertion fired on the first valid address a mutator produced.

Written with LLM assistance (Claude Opus 5).

More fuzz magic :)


ACKs for top commit:
apoelstra:
ACK 0270be4617f42c097268a1973a72010fc503c90c; successfully ran local tests


Tree-SHA512: 55402ad77daf06d47010ac32c78cddcbc5953f82bfb1fe7ba6fa2a29e5932af10e01950d4f1bc03c2723f15575c4c1a63c8ea895ada367d25e3256885ee32597

Merge rust-bitcoin/rust-bitcoin#6759: primitives: Add `Arbitrary` for `PushBytes` & `PushBytesBuf`

0b188fdf498d748ef409618a8867b58ca8c64da3 Update API files (Mitchell Bagot)
c4fcf8da716b79bdddfb394aca3d5df13424d2e9 primitives: Add Arbitrary for PushBytesBuf (Mitchell Bagot)
963d04e6735077863d232b4df5b7ffa48d62f7d1 primitives: Add Arbitrary impl for PushBytes (Mitchell Bagot)

Pull request description:

Most types in primitives have Arbitrary implementations, aside from those that have only recently been moved there. Like the Script types, the PushBytes types should also have arbitrary implementations.

Add Arbitrary implementation for PushBytes and PushBytesBuf.


ACKs for top commit:
apoelstra:
ACK 0b188fdf498d748ef409618a8867b58ca8c64da3; successfully ran local tests
satsfy:
ACK 0b188fdf498d748ef409618a8867b58ca8c64da3


Tree-SHA512: 6274795f63e763376c3703c9a7cfc4945acb476086f46d214af1685b77aa934d797948a6c6034e2e2abb69b7b366faf440e2835e127fdbc05215e0e3ea889ba2

Merge rust-bitcoin/rust-bitcoin#6748: Capitalize Bitcoin protocol references in docs

2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963 Capitalize Bitcoin protocol references (Jamil Lambert, PhD)
77054a4f9113d1a0d5f2f61c3279c36701960a21 Hyphenate rust-bitcoin (Jamil Lambert, PhD)
cbedca4543c24a5ac41abeffb2e307b4eac92921 Standardize Bitcoin network naming in docs (Jamil Lambert, PhD)

Pull request description:

Bitcoin should have a capital `B` when referring to the protocol, network, or software. And lower case `b` when referring to the currency.

Correct all of the docs so that the capitalization is consistent. Including a couple of other minor adjacent corrections.

Standardize docs to `Bitcoin {network}`.


ACKs for top commit:
tcharding:
ACK 2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963
apoelstra:
ACK 2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963; successfully ran local tests


Tree-SHA512: 453d72987c6d1fb0e7e86cda6f66ea60e596fbf801a3b5374e661d66a838e6b20c949adab9d362c277cc1957cec96c9613b3c953677a7103231264c1e668a579

Merge rust-bitcoin/rust-bitcoin#6765: addresses: Remove all non-`Infallible` `From` impls on error types

ad74b7d44ffe562ec1089e615db196873daa4954 addresses: Remove all non-Infallible From impls on errors (Mitchell Bagot)
d0891037ca87d2bfb69f194aaeb350156d434fdc Replace uses of From on addresses errors (Mitchell Bagot)

Pull request description:

Currently, addresses has From impls on various errors, for various errors. While addresses is not near 1.0, such From impls represent a public API commitment and should be removed.

Remove all uses of error conversion From impls for addresses errors and remove the relevant From impls.


ACKs for top commit:
apoelstra:
ACK ad74b7d44ffe562ec1089e615db196873daa4954; successfully ran local tests
tcharding:
ACK ad74b7d44ffe562ec1089e615db196873daa4954


Tree-SHA512: b32502658cfc258b0997b1118adfe57c90f7d77c6306d5a1722541102fa471b139d3aed9223584985c8996905db4df9a5b03bc173e2490567eeb6c2d0292df50

Merge rust-bitcoin/rust-bitcoin#6778: ci: pin dependabot to Sunday 16:00 America/Chicago

ccc129aad10661b93407fd98896b38981954d991 ci: pin dependabot to Sunday 16:00 America/Chicago (satsfy (Renato Britto))

Pull request description:

Per apoelstra's ask on https://github.com/rust-bitcoin/rust-bitcoin/pull/6773#issuecomment-5395628053. Pinned to 16:00 at Austin city time which is the same as `America/Chicago`, the official IANA timezone name.

Dependabot used to run at [random moments](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#interval).


ACKs for top commit:
tcharding:
ACK ccc129aad10661b93407fd98896b38981954d991
apoelstra:
ACK ccc129aad10661b93407fd98896b38981954d991; successfully ran local tests


Tree-SHA512: 0be0461b03f979e4c63bd48546f70b2f7cca970dd5f6aa176138e477bd35160c271c18bcc2888bc360dcc7b80c94f602bff5a68f74b5263979a965e4685ad6c6

Merge rust-bitcoin/rust-bitcoin#6773: build(deps): bump actions/cache from 5.0.5 to 6.1.0

3b21f967867b2e78ab5fc7e5a6d7d981a9549e72 build(deps): bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot])

Pull request description:

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed and merged.</li>
<li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version number.</li>
<li>Approve the run to publish the new version and update the major tags for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li>
<li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li>
<li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li>
<li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li>
<li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li>
<li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li>
<li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li>
<li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li>
<li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li>
<li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li>
<li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 3b21f967867b2e78ab5fc7e5a6d7d981a9549e72; successfully ran local tests
satsfy:
ACK 3b21f967867b2e78ab5fc7e5a6d7d981a9549e72


Tree-SHA512: 7d32885b0c0a7b99fe8693dec176fc5f70d6ba8e294e1ffbaad3239b0fe37b4ec02a7ad4dcfe21d7017d50b29305ad24607364c6b6c32a411f44ac0d457da4d2

Merge rust-bitcoin/rust-bitcoin#6774: build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1

1d848840a0c231fb3881da98b07042122314b51d build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 (dependabot[bot])

Pull request description:

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/download-artifact/releases">actions/download-artifact's releases</a>.</em></p>
<blockquote>
<h2>v8.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for CJK characters in the artifact name by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/471">actions/download-artifact#471</a></li>
<li>Add a regression test for artifact name + content-type mismatches by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/472">actions/download-artifact#472</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v8...v8.0.1">https://github.com/actions/download-artifact/compare/v8...v8.0.1</a></p>
<h2>v8.0.0</h2>
<h2>v8 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.</p>
</blockquote>
<blockquote>
<p>[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).</p>
</blockquote>
<h3>Direct downloads</h3>
<p>To support direct uploads in <code>actions/upload-artifact</code>, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the <code>Content-Type</code> header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new <code>skip-decompress</code> parameter to <code>true</code>.</p>
<h3>Enforced checks (breaking)</h3>
<p>A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the <code>digest-mismatch</code> parameter. To be secure by default, we are now defaulting the behavior to <code>error</code> which will fail the workflow run.</p>
<h3>ESM</h3>
<p>To support new versions of the @actions/* packages, we've upgraded the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Don't attempt to un-zip non-zipped downloads by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/460">actions/download-artifact#460</a></li>
<li>Add a setting to specify what to do on hash mismatch and default it to <code>error</code> by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/461">actions/download-artifact#461</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v7...v8.0.0">https://github.com/actions/download-artifact/compare/v7...v8.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/download-artifact/commit/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"><code>3e5f45b</code></a> Add regression tests for CJK characters (<a href="https://redirect.github.com/actions/download-artifact/issues/471">#471</a>)</li>
<li><a href="https://github.com/actions/download-artifact/commit/e6d03f67377d4412c7aa56a8e2e4988e6ec479dd"><code>e6d03f6</code></a> Add a regression test for artifact name + content-type mismatches (<a href="https://redirect.github.com/actions/download-artifact/issues/472">#472</a>)</li>
<li><a href="https://github.com/actions/download-artifact/commit/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3"><code>70fc10c</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/461">#461</a> from actions/danwkennedy/digest-mismatch-behavior</li>
<li><a href="https://github.com/actions/download-artifact/commit/f258da9a506b755b84a09a531814700b86ccfc62"><code>f258da9</code></a> Add change docs</li>
<li><a href="https://github.com/actions/download-artifact/commit/ccc058e5fbb0bb2352213eaec3491e117cbc4a5c"><code>ccc058e</code></a> Fix linting issues</li>
<li><a href="https://github.com/actions/download-artifact/commit/bd7976ba57ecea96e6f3df575eb922d11a12a9fd"><code>bd7976b</code></a> Add a setting to specify what to do on hash mismatch and default it to <code>error</code></li>
<li><a href="https://github.com/actions/download-artifact/commit/ac21fcf45e0aaee541c0f7030558bdad38d77d6c"><code>ac21fcf</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/460">#460</a> from actions/danwkennedy/download-no-unzip</li>
<li><a href="https://github.com/actions/download-artifact/commit/15999bff51058bc7c19b50ebbba518eaef7c26c0"><code>15999bf</code></a> Add note about package bumps</li>
<li><a href="https://github.com/actions/download-artifact/commit/974686ed5098c7f9c9289ec946b9058e496a2561"><code>974686e</code></a> Bump the version to <code>v8</code> and add release notes</li>
<li><a href="https://github.com/actions/download-artifact/commit/fbe48b1d2756394be4cd4358ed3bc1343b330e75"><code>fbe48b1</code></a> Update test names to make it clearer what they do</li>
<li>Additional commits viewable in <a href="https://github.com/actions/download-artifact/compare/v7...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 1d848840a0c231fb3881da98b07042122314b51d; successfully ran local tests


Tree-SHA512: 4bc6d5a95cee7c75aebcb92bc36c39b34c2b05948b2e6c36b679b812321076e3501191fb21d4641604e9366c25d05e4ff82a282d834fdff569395e50c6aa108c

Merge rust-bitcoin/rust-bitcoin#6775: build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1

5c0d27359e798a2f75388ca0723b74208f336c48 build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1 (dependabot[bot])

Pull request description:

Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.20.0 to 1.20.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p>
<blockquote>
<h2>v1.20.1</h2>
<p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p>
<h4>In this release:</h4>
<ul>
<li>Upgrade dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/732870f031d2fb36309d0deaf36abcc704a7be65"><code>732870f</code></a> release: cargo-binstall v1.20.1 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2590">#2590</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/84c209e6313ba472763c1b34615f03c41e7413dd"><code>84c209e</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2586">#2586</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/9e9fc4635d22c94c113187350872d6916c005474"><code>9e9fc46</code></a> build(deps): bump the deps group with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2589">#2589</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/a387173c6f65daf8c665f747f297385a6a8c68f9"><code>a387173</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2588">#2588</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/733bffce578000b64507ac3d683a61c2b605c21d"><code>733bffc</code></a> build(deps): bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2587">#2587</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/252c5e70a6eae3a9de06b610159a568eaf705055"><code>252c5e7</code></a> build(deps): bump the deps group across 1 directory with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2585">#2585</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/1d2ff7ce3f67fe46c45478d09d1670c1f1b100dc"><code>1d2ff7c</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2584">#2584</a>)</li>
<li>See full diff in <a href="https://github.com/cargo-bins/cargo-binstall/compare/30b5ca8b54e1dcffd9548bc87ede1531310fdc67...732870f031d2fb36309d0deaf36abcc704a7be65">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 5c0d27359e798a2f75388ca0723b74208f336c48; successfully ran local tests
satsfy:
ACK 5c0d27359e798a2f75388ca0723b74208f336c48


Tree-SHA512: a21a2398906184633fbc534cb48b4d2c5b1de7351f5ac991bba31c6080e51e13f15ff64b29a94e3c7aadd9b15d8fbbe315bed741569b9d6b37c48410cb11c5ef

Merge rust-bitcoin/rust-bitcoin#6776: build(deps): bump actions/checkout from 6.0.2 to 7.0.0

25ab130b9bea1579030e735880046577ccad0faa build(deps): bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot])

Pull request description:

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 25ab130b9bea1579030e735880046577ccad0faa; successfully ran local tests
satsfy:
ACK 25ab130b9bea1579030e735880046577ccad0faa


Tree-SHA512: c3e4906f6a150a030f5db08c7da667459982d0e4cb9e605d19f489cd50526705fad58a07dbfd87a8cec6a5b79eb3ce1bb1fa59bbc117fe680852b0dc76821518

Merge rust-bitcoin/rust-bitcoin#6777: build(deps): bump taiki-e/install-action from 2.82.0 to 2.82.4

24c8df4787d21eedb5570545980a68301d81751c build(deps): bump taiki-e/install-action from 2.82.0 to 2.82.4 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.0 to 2.82.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.4</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.11.24.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.13.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.54.0.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.1.</p>
</li>
</ul>
<h2>2.82.3</h2>
<ul>
<li>
<p>Update <code>zizmor@latest</code> to 1.26.1.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 46.0.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.5.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.12.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.104.0.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.35.5.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.138.</p>
</li>
<li>
<p>Update <code>cargo-crap@latest</code> to 0.3.0.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.20.1.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.0.1.</p>
</li>
</ul>
<h2>2.82.2</h2>
<ul>
<li>
<p>Update <code>xh@latest</code> to 0.26.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.23.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.2.</p>
</li>
<li>
<p>Update <code>sccache@latest</code> to 0.16.0.</p>
</li>
</ul>
<h2>2.82.1</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.4.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.22.</p>
</li>
<li>
<p>Update <code>osv-scanner@latest</code> to 2.4.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.11.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.11.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.86.6] - 2026-08-23</h2>
<ul>
<li>
<p>Update <code>dprint@latest</code> to 0.56.1.</p>
</li>
<li>
<p>Update <code>cargo-lambda@latest</code> to 1.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.10.</p>
</li>
</ul>
<h2>[2.86.5] - 2026-08-21</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.4.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.257.1.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.36.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.10.</p>
</li>
<li>
<p>Update <code>cargo-dinghy@latest</code> to 0.8.6.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.0.</p>
</li>
</ul>
<h2>[2.86.4] - 2026-08-20</h2>
<ul>
<li>
<p>Update <code>oxfmt@latest</code> to 1.79.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.8.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.14.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.56.0.</p>
</li>
<li>
<p>Update <code>cargo-about@latest</code> to 0.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.9.</p>
</li>
</ul>
<h2>[2.86.3] - 2026-08-18</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/682e7d9e49c5e653d371fc6adbda67653461378a"><code>682e7d9</code></a> Release 2.82.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/88e83503037db61d4f066a4d9cb32e6fc06b70c2"><code>88e8350</code></a> Update wasmtime manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/cf0e00b44cf05faddafcc8082c6c2366e2a02380"><code>cf0e00b</code></a> Update wasm-bindgen manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/a130ea674166df9065f363cbb53f1f2bc4a6298c"><code>a130ea6</code></a> Update vacuum manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/0bdcc65dc21d0ae46842dc5ad063d69ce8991365"><code>0bdcc65</code></a> Update <code>uv@latest</code> to 0.11.24</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3f52215559b820ee57b68e3fa9b38f6cd205e9c8"><code>3f52215</code></a> Update <code>mise@latest</code> to 2026.6.13</li>
<li><a href="https://github.com/taiki-e/install-action/commit/294a073b0ebe66401c699c21b98e9ecb5a6da735"><code>294a073</code></a> Update <code>just@latest</code> to 1.54.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f9bf24932b3cbfe7ae26b5addcd257989e14ec4d"><code>f9bf249</code></a> Update cargo-rdme manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/98288d38cbfc5fa065ff61c6971d50dc3ba7d408"><code>98288d3</code></a> Update <code>biome@latest</code> to 2.5.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3"><code>ace6ebe</code></a> Release 2.82.3</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/b8cecb83565409bcc297b2df6e77f030b2a468d5...682e7d9e49c5e653d371fc6adbda67653461378a">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 24c8df4787d21eedb5570545980a68301d81751c; successfully ran local tests
satsfy:
ACK 24c8df4787d21eedb5570545980a68301d81751c


Tree-SHA512: e31af029eeff4bf1e9abcc8f73725d2e7fb87972d38039311252650e40af103d130dd7d16c6947b1333f7f77e5ce30ac6b6908017c34e7597c1f57d69b4c49e4

Merge rust-bitcoin/rust-bitcoin#6770: Automated nightly rustfmt (2026-08-23)

a12b14c5ca7f8e89350051eb7e0231d9eae36f32 2026-08-23 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
tcharding:
ACK a12b14c5ca7f8e89350051eb7e0231d9eae36f32
apoelstra:
ACK a12b14c5ca7f8e89350051eb7e0231d9eae36f32; successfully ran local tests


Tree-SHA512: 9a6d9bc03126e4185e5fe281c60985fc2906799523edd6cfda09f7c5941d17b520e7e9f2dce194ae4c99a3af5614606824494f818e7a62850b6adc641bad8244

Merge rust-bitcoin/rust-bitcoin#6768: units: Add `#[inline]` to simple functions

75c1d648bc3ac9e65b222ef6a56332b304e41815 units: Add #[inline] to simple functions (Mitchell Bagot)

Pull request description:

Where functions merely delegate to other functions, or only perform trivial operations, they should be annotated with #[inline] to nudge the compiler towards improving performance by inlining them. Before the final 1.0 release, any remaining simple functions should be tagged with the #[inline] attribute.

Add #[inline] to trivial functions in all modules.


ACKs for top commit:
apoelstra:
ACK 75c1d648bc3ac9e65b222ef6a56332b304e41815; successfully ran local tests
tcharding:
ACK 75c1d648bc3ac9e65b222ef6a56332b304e41815


Tree-SHA512: e0434a8523cd097ddeddd626e68497310c8efb8c3c071d37d066dc16dd5a0a701876abde78bfdac515cdd5edd75cc383685d2a8b43293a35fa2aca789a32b301

Merge rust-bitcoin/rust-bitcoin#6766: bitcoin: make legacy sighash takes `EcdsaSighashType`

7cffa4621b1a8ccb2219848fd9a8c576fe4de20c bitcoin: make legacy sighash takes `EcdsaSighashType` (jrakibi)

Pull request description:

Currently the legacy sighash API takes a u32 for sighash type.
Now that `EcdsaSighashType` can also represent non-standard values, we can change it to take EcdsaSighashType instead.

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/1657


ACKs for top commit:
apoelstra:
ACK 7cffa4621b1a8ccb2219848fd9a8c576fe4de20c; successfully ran local tests
tcharding:
ACK 7cffa4621b1a8ccb2219848fd9a8c576fe4de20c


Tree-SHA512: cd7482de41dc3d88a348fd269821d656aec00c74eda3caea1eb114d4aa0ab673c9d6f286e16db5d592360c89b3c1acad757544d13e93dd7ba8776de7476909f1

Merge rust-bitcoin/rust-bitcoin#6762: primitives: Flatten error constructors

c772cb1b52f575c6d4b9566440c18faa143e0c13 primitives: Flatten error constructors (Mitchell Bagot)

Pull request description:

Typically speaking, nested error construction yields code that's not very readable. Instead, we can make use of map_err to repeatedly wrap inner error types to produce the final error types as needed.

Flatten nested error constructors in primitives to use repeated map_err calls.

Contributes to #6539


ACKs for top commit:
tcharding:
ACK c772cb1b52f575c6d4b9566440c18faa143e0c13
apoelstra:
ACK c772cb1b52f575c6d4b9566440c18faa143e0c13; successfully ran local tests


Tree-SHA512: c00645798ca9dd602c54b735a6d282e0964c46634fd813b6942a3e6ae8d940958391226ecf95aa8f2a6346251072c80bd4b49e2394ff5c09a9071210be349192

Merge rust-bitcoin/rust-bitcoin#6740: base58: Flatten nested error constructors

03a18ca29565937d4753e0132d9b1009524e682a base58: Flatten nested error constructors (Shallom Micah Bawa)

Pull request description:

Part of #6539.

Refactor nested error constructors in `base58` with chained `map_err` transformations, so each error conversion step reads leaf-to-outer in semantic order. No behavior change.


ACKs for top commit:
Abeeujah:
ACK 03a18ca29565937d4753e0132d9b1009524e682a ; Successfully ran local tests
tcharding:
ACK 03a18ca29565937d4753e0132d9b1009524e682a
apoelstra:
ACK 03a18ca29565937d4753e0132d9b1009524e682a; successfully ran local tests


Tree-SHA512: 88b03c68d2787f8aabb8a54e7d9fb159018e1ef259b40c004772c7d7b8665068fa45a38a913f16b9bf164e6010f56476c58d299eb8f097100b3645c67ad77e6a

ci: pin dependabot to Sunday 16:00 America/Chicago