RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2313 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

532security candidates511second-pass queue2206AI analyses
130commits · 30 days
248commits · 60 days
1102commits · 180 days
2011commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
510Strong · 80–100
1085Adequate · 60–79
567Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Andrew Poelstra23179157290
Mitchell Bagot649193645068
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Martin Habovstiak30628068
Ismail Daif22622050
Analysis record

Published AI watches

Last scanned 25 minutes ago

Moderate 62 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6954: units: serialize unsigned amounts as u64

This commit fixes a mismatch in how unsigned Bitcoin amounts were serialized versus deserialized when using certain compact binary formats. Previously, an unsigned amount (like 100 satoshis) was written as a signed number, which caused for…

Data integrity bug: serialized values decode to different numeric values in varint binary formatsRange-check failure: Amount::MAX and large values near the cap fail deserialization after round-tripSerde serialize/deserialize hint mismatch for unsigned amount types
295c9d8aby Andrew Poelstra+66−112 files
No security note in commit
Low 25 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6955: key_expression: preserve master-key invariants in Xpub Arbitrary

This change fixes a bug in test-only code that generates random fake Bitcoin extended public keys (xpubs). Previously, when generating a master xpub (depth 0), the code could pick random values for the parent fingerprint and child number, …

BIP32 master-key invariant violation in generated test dataEncode/decode round-trip failure for generated master xpubsFix aligns Xpub::arbitrary with existing Xpriv::arbitrary behavior
4116ecc6by Andrew Poelstra+35−31 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6947: build(deps): bump cargo-bins/cargo-binstall from 1.21.0 to 1.21.1

This commit updates the version of a helper tool (cargo-binstall) used only inside GitHub Actions automation. It is a routine dependency bump by Dependabot and does not change any code that ships to users. There is no indication of a secur…

c1be49cbby Andrew Poelstra+2−22 files
No security note in commit
High 70 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6919: Sanitize serde size hints before allocating

This commit fixes a denial-of-service weakness in how the library deserializes lists of Bitcoin data (witnesses, amounts, fee rates) from untrusted input. Before the fix, a few bytes of attacker-controlled data could claim a list would con…

Untrusted serde size hint fed directly into Vec::with_capacityPotential memory exhaustion / OOM kill from small malicious inputDenial-of-service vector in deserialization paths
55ddbc0cby Andrew Poelstra+88−105 files
Vendor flagged security relevance
Moderate 60 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6945: bitcoin: handle OP_CODESEPARATOR in legacy

This commit fixes how the Rust Bitcoin library calculates old-style (legacy) transaction signatures when the spending script contains a special opcode called OP_CODESEPARATOR. Previously the library did not handle this opcode at all, which…

Protocol correctness fix for legacy sighash serializationOP_CODESEPARATOR handling added to match Bitcoin Core consensus behaviorPreviously omitted test vectors restored, indicating prior non-compliance
5b815281by Andrew Poelstra+600−3093 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6948: build(deps): bump taiki-e/install-action from 2.83.2 to 2.85.4

This is a routine update by Dependabot to the version of a third-party GitHub Action used in the project's automated testing workflows. The change only affects internal continuous integration (CI) scripts, not the actual Bitcoin library co…

d1431904by Andrew Poelstra+2−22 files
No security note in commit
Low 33 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6946: Fix integer overflow in `get_array`

This commit fixes a small but real bug in a Rust helper that reads fixed-size chunks from a data slice. The helper was supposed to safely return 'nothing' when asked to read past the end of the data, but it accidentally added two numbers t…

Integer overflow in bounds-checking helperContract violation: method documented to return None on out-of-bounds access could panic insteadDebug-build panic (denial of service) possible
c6e80843by Andrew Poelstra+2−11 file
Vendor flagged security relevance
Moderate 62 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Fix integer overflow in `get_array`

This commit fixes a bug in a Rust helper method called `get_array`, which is meant to safely read a fixed-size chunk from a slice and return nothing if the requested range is out of bounds. The bug was that the code added the caller's offs…

Integer overflow in bounds calculationPotential panic due to violated internal length expectationCaller-controlled arithmetic used for memory access bounds
56fb1287by Martin Habovstiak+2−11 file
Vendor flagged security relevance
High 71 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6915: primitives: Fix `Witness` handling of oversized items

This commit fixes a bug in how the Rust Bitcoin library counts and compares transaction witness data when a witness contains an oversized item. Previously, several functions relied on an iterator that silently skips oversized items, causin…

Inconsistent serialization/iterator behavior for oversized witness itemswtxid collision risk between transactions differing only in oversized witness bytesIncorrect witness equality for oversized single-item stacks
e1ed5884by Andrew Poelstra+106−273 files
Vendor flagged security relevance
Informational 19 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6922: Use `try_fold` instead of `fold` in `Sum` impl

This is a code-quality and performance improvement, not a security fix. It changes how the library adds up lists of Bitcoin amounts so that it stops early once an overflow is detected, rather than continuing to process the rest of the list…

No security-relevant signal in commit message or diffRefactor preserves overflow-checking behavior (short-circuits instead of continuing)New API method `NumOpResult::from_result` is a pure inverse of existing `into_result`
86e4d5daby Andrew Poelstra+60−562 files
No security note in commit
Moderate 52 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6893: units: Reject malformed amount strings

This update fixes a bug in how the library reads Bitcoin amount strings like '1.5 BTC'. Previously, certain malformed inputs such as '.', '._', '1_', '1_.0', and '1._0' were incorrectly accepted and treated as valid amounts (often zero), i…

Input validation bypass in amount parserMalformed strings silently parsed as zero or ordinary amountsUnderscore separator placement not enforced
fcb14622by Andrew Poelstra+88−343 files
Vendor flagged security relevance
Low 48 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6921: units: fix div_by_fee_rate_ceil precision

This commit fixes a rounding bug in how the rust-bitcoin library calculates the minimum transaction weight needed to pay a given fee at a given fee rate. The old code rounded the fee rate up too early, which could produce a weight slightly…

Incorrect fee-weight calculation due to premature integer roundingPotential transaction fee shortfall when using div_by_fee_rate_ceilOverflow protection added for Amount::MAX * 4_000_000 intermediate value
b31212e0by Andrew Poelstra+38−82 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6898: Release tracking PR: `consensus-encoding 1.3.0`

This is a routine release-management commit that bumps the version number of the `bitcoin-consensus-encoding` crate from 1.2.0 to 1.3.0 and updates lock files accordingly. It contains no code changes that fix or introduce a security issue.…

0cfc7908by Andrew Poelstra+37−349 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityImprove test coverage of CompactTargetby Jamil Lambert, PhD · 899846ca · Jan 26, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Improve test coverage of CompactTarget

Add tests to increase the test coverage of pow.rs to 100%

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds new unit tests for the CompactTarget type. It does not change any production code, fix bugs, or alter behavior. There is no security relevance.

AI review queuedprimitives: reject transactions with 0 outputsby jrakibi · 15a947be · Jan 25, 2026 · 2 filesMessage 86 · StrongLow 47Details
Commit message · jrakibi

primitives: reject transactions with 0 outputs

Transactions must have at least one output.

This is another syntactic check that doesn't depend on any context,
and the last one on this list https://github.com/rust-bitcoin/rust-bitcoin/issues/5383#issuecomment-3646014920.
We add validation to reject transactions with empty outputs during decoding.

Two existing tests that created transactions with no outputs are ignored
and will be fixed in the next commit.

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 47/100

This commit adds a rule to reject Bitcoin transactions that have no outputs when they are decoded. In Bitcoin, every valid transaction must send bitcoin somewhere, so a transaction with zero outputs is invalid. The change prevents the library from accepting or processing such malformed transactions, which could otherwise lead to inconsistent behavior compared to Bitcoin Core and other nodes.

AI review queuedprimitives: fix tests that created txs with no outputsby jrakibi · 32fefd70 · Jan 25, 2026 · 2 filesMessage 83 · StrongInformational 15Details
Commit message · jrakibi

primitives: fix tests that created txs with no outputs

Update `decode_zero_inputs` and `block_decode` tests to include a
valid output, as transactions with no outputs are now rejected

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates two internal unit tests so they create transactions that have at least one output. The change is a test-only follow-up after the library started rejecting transactions with no outputs. There is no change to production code, no security fix, and no vulnerability being patched.

Lower-priority2026-01-25 automated rustfmt nightlyby Fmt Bot · 4b2cdaa1 · Jan 25, 2026 · 12 filesMessage 45 · ThinInformational 15Details
Commit message · Fmt Bot

2026-01-25 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is a routine automated code-formatting commit. It only changes whitespace, line breaks, import order, and other stylistic details across a dozen files. No program logic, security checks, or behavior were altered.

Lower-priorityunits: Remove old encoding test casesby Mitchell Bagot · 133cf323 · Jan 24, 2026 · 3 filesMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

units: Remove old encoding test cases

The test cases for encoding/decoding of Sequence, BlockHeight and
BlockTime are no longer required for coverage with the introduction
of the encoding test module.

Remove redundant unit tests for encoding/decoding of Sequence,
BlockHeight and BlockTime.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit simply deletes redundant unit tests for encoding and decoding of Sequence, BlockHeight, and BlockTime. It does not change any production code, so it cannot introduce a security vulnerability or fix one. The remaining error-handling tests still exercise the encoding feature.

Lower-priorityunits: Add tests for encodable/decodable typesby Mitchell Bagot · b78a8806 · Jan 24, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

units: Add tests for encodable/decodable types

While some of the encodable and decodable types in units have tests
to cover the encoding and decoding behaviour, the code is largely
repeated across the types. It better lives in a distinct test file.

Introduce tests/encoding.rs which covers decoding and encoding
behaviour for all Encodable/Decodable types.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a new test file that checks whether various Bitcoin data types can be correctly encoded to bytes and decoded back again. It does not change any production code, so it cannot introduce a security vulnerability or fix one.

Lower-priorityclippy: modify config fileby Tobin C. Harding · 791476fc · Jan 23, 2026 · 1 fileMessage 58 · ThinInformational 15Details
Commit message · Tobin C. Harding

clippy: modify config file

Modify clippy config file to configure clippy to understand a couple
of domain specific terms. Without this the linter flags these as
requiring backticks thinking they are Rust identifiers.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only changes the project's Clippy linter configuration file. It removes some general settings and tells the linter that 'SegWit' and 'OpenSSL' are valid terms in documentation so it won't nag about missing backticks. There is no code change and no security impact.

AI review queuedp2p: Allow too many argsby Tobin C. Harding · b997f142 · Jan 23, 2026 · 1 fileMessage 38 · OpaqueInformational 15Details
Commit message · Tobin C. Harding

p2p: Allow too many args

For now just shoosh the linter.

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit adds a single Rust lint suppression comment to silence a Clippy warning about a function having too many arguments. It does not change any executable code, behavior, or data flow. There is no security relevance.

Security candidateCI: Use the new cargo rbmt toolby Tobin C. Harding · 7810f3a2 · Jan 23, 2026 · 48 filesMessage 90 · StrongInformational 15Details
Commit message · Tobin C. Harding

CI: Use the new cargo rbmt tool

Use the mad new `cargo rbmt` tool for CI. Note that for `bitcoin` the
`extra_tests.sh` test are rolled into `rbmt.toml` now that running
without default args is supported.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine update to the project's automated testing setup. It replaces a set of shell scripts with a new Rust tool called `cargo rbmt` for running tests and lints in CI. There are no changes to the actual Bitcoin library code that users interact with, and no security issue is evident.

Security candidatehashes: Allow too many argsby Tobin C. Harding · 58495710 · Jan 23, 2026 · 3 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

hashes: Allow too many args

These are private crypto functions, just shoosh the linter.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit only adds Clippy lint-suppression attributes (`#[allow(clippy::too_many_arguments)]`) to three internal cryptographic helper functions in the `rust-bitcoin` hashes crate. It does not change any executable code, logic, or public API. There is no security relevance: it simply tells the Rust linter to stop warning that these functions have many parameters.

Lower-priorityp2p: Implement `encoding` traits for `GetBlocks/HeadersMessage`by rustaceanrob · 8476d6fb · Jan 23, 2026 · 1 fileMessage 73 · AdequateInformational 12Details
Commit message · rustaceanrob

p2p: Implement `encoding` traits for `GetBlocks/HeadersMessage`

This is a rare case where this can be macro-ized, but I think the extra
pain of code duplication makes this easier to read than a macro.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 12/100

This commit adds new ways to encode and decode two Bitcoin peer-to-peer network messages, `GetBlocks` and `GetHeaders`. It does not change the existing encoding logic; it only introduces an alternative implementation using newer internal traits. There is no indication this fixes a security bug or introduces a vulnerability.

Lower-priorityunits: Extend test coverage of amount typesby Mitchell Bagot · 76864db3 · Jan 23, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

units: Extend test coverage of amount types

The Amount and SignedAmount types have various functions that are not
covered by existing tests, including to_btc, display_dynamic,
checked_mul/div and div_by_weight.

Extend test coverage of amount types.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds new unit tests for existing Bitcoin amount types. It does not change any production code, fix bugs, or alter behavior. There is no security relevance.

Lower-priorityImprove test coverage for WitnessMerkleNodeby Jamil Lambert, PhD · 0dbce2bd · Jan 22, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Improve test coverage for WitnessMerkleNode

Add tests to increase the test coverage to 100% for witness_merkle_node.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds new unit tests for an existing Bitcoin hash type. It does not change any production code, so it cannot introduce or fix a security vulnerability on its own.

Lower-priorityImprove test coverage in hash_typesby Jamil Lambert, PhD · 329c2ac4 · Jan 22, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Improve test coverage in hash_types

Add a test to increase the test coverage to 100% for hash_types.
Excluding serde.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a new unit test to verify that different ways of reading a transaction hash (Txid) return the same underlying bytes. It does not change any production code, APIs, or behavior. There is no security relevance.

AI review queuedImprove test coverage for TxMerkleNodeby Jamil Lambert, PhD · 5fb07d04 · Jan 22, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Improve test coverage for TxMerkleNode

Add two tests to increase the test coverage to 100% for
transaction_merkle_node.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds two new unit tests for the TxMerkleNode type. It does not change any production code, fix a bug, or alter behavior. There is no security relevance.

Lower-priorityImprove test coverage for block_hashby Jamil Lambert, PhD · 7766f03a · Jan 22, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Improve test coverage for block_hash

Add two tests to increase the test coverage to 100% for block_hash.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds two new automated tests for the block hash decoder. It does not change any production code, so it cannot introduce or fix a security vulnerability on its own.

Lower-priorityMake test dummy txid hex a constby Jamil Lambert, PhD · 70f441fd · Jan 22, 2026 · 1 fileMessage 82 · StrongInformational 15Details
Commit message · Jamil Lambert, PhD

Make test dummy txid hex a const

Make the existing dummy txid a constant so that it can be used in
additional tests.

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a minor internal test cleanup. It moves a hard-coded dummy transaction ID string used only in unit tests into a constant so it can be reused in future tests. There is no change to production code, no security fix, and no user-facing behavior change.

Lower-priorityadd aarch64 cross testing (needed for ARM SHA acceleration)by jrakibi · baaab030 · Jan 22, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · jrakibi

add aarch64 cross testing (needed for ARM SHA acceleration)

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only changes the project's GitHub Actions CI configuration to add automated cross-compilation testing for the aarch64 (64-bit ARM) Linux target, alongside the existing s390x target. It does not modify any library code, cryptographic logic, or user-facing behavior. There is no security issue here.

Lower-priorityp2p: Implement `encoding` traits for `Reject`by rustaceanrob · 73b14429 · Jan 22, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · rustaceanrob

p2p: Implement `encoding` traits for `Reject`

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds new serialization/deserialization code for the Bitcoin P2P 'reject' message using the project's newer encoding framework. It is a routine refactor/migration of an existing message type to a new encoder/decoder API. There is no indication in the commit or supplied references that this fixes a security bug, vulnerability, or crash.

Lower-priorityp2p: Implement `encoding` traits for `RejectReason`by rustaceanrob · 8c230783 · Jan 22, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · rustaceanrob

p2p: Implement `encoding` traits for `RejectReason`

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds new encoding/decoding machinery for the RejectReason type used in Bitcoin peer-to-peer messages. It does not change existing behavior or fix any known bug; it is a routine feature addition that makes the type work with a newer internal encoding framework. There is no indication of a security issue.

Lower-priorityp2p: Implement `encoding` traits for `BlockTransactionsRequest`by rustaceanrob · b34d8825 · Jan 22, 2026 · 1 fileMessage 65 · AdequateInformational 12Details
Commit message · rustaceanrob

p2p: Implement `encoding` traits for `BlockTransactionsRequest`

Straightforward implementation with the introduction of `Offset`

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 12/100

This commit adds new encoding and decoding machinery for a Bitcoin peer-to-peer message type (BlockTransactionsRequest). It is a routine feature addition that mirrors an existing implementation and does not appear to fix or introduce a security problem on its own.

AI review queuedbip152: Add an `Offset` wrapper typeby rustaceanrob · 940602f0 · Jan 22, 2026 · 2 filesMessage 90 · StrongLow 36Details
Commit message · rustaceanrob

bip152: Add an `Offset` wrapper type

When implementing `encoding` with a list of items it's nice to have
`Encodable` implemented for the item that will go into the
`SliceEncoder` to avoid prep steps. I also think this type should be
revamped.

For one, having struct initialization available for this type allows for
creating completely invalid states that result in panics. This is shown
by a test that literally asserts creating the struct results in a panic
when trying to serialize it later. A simple case that is not currently
tested is when the user passes an unsorted vector in the initialization
and later tries to encode this type. I introduce two constructors here
that make it clear the client should sort the list themselves, or allow
the sort to happen on construction. The encoding functions here were
doing an immense amount of logic, which I think should be pushed out to
a designated method call.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI analysis · Low 36/100

This commit refactors how Bitcoin compact-block transaction indexes are stored and encoded. It replaces a public Vec<u64> field with a private Vec<Offset> field and adds constructors that require callers to provide sorted indices. The change removes a documented panic during serialization when u64::MAX was used, and moves overflow detection from encoding time to a new indices() accessor. It is a defensive hardening patch rather than a clear-cut vulnerability fix, because the previous panic required a caller to deliberately construct an invalid object and then serialize it.

AI review queuedAdjust error re-export doc inliningby Mitchell Bagot · 9209abdf · Jan 21, 2026 · 3 filesMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Adjust error re-export doc inlining

Error re-exports in bitcoin and primitives should use #[doc(no_inline)]
to ensure that pure re-export types are rendered as re-exports and not
defined types of the module in docs.

Use #[doc(no_inline)] for BlockHashDecoderError in primitives and
PushBytesError, ParseTransactionError, and ParseOutPointError in
bitcoin.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes how Rust documentation is generated for certain error types. It switches some re-exports from being shown as if they were defined in the current module to being shown as re-exports from another module. There is no change to actual code behavior, no security fix, and no vulnerability.

Lower-priorityp2p: add v1 header decoderby yancy · 10c68edb · Jan 20, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · yancy

p2p: add v1 header decoder

Allow decoding a p2p network message header.

The header can then be read using the consensus_encoding crate:

```
let V1MessageHeader {command, ..} =
decode_from_read_unbuffered::<V1MessageHeader, _>(&mut r).unwrap()
```

Update p2p/src/message.rs

Co-authored-by: Mitchell Bagot <packof14eggies@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit adds a new decoder for Bitcoin peer-to-peer network message headers in the rust-bitcoin library. It is a straightforward feature addition that exposes a way to parse v1 message headers using the existing consensus encoding framework. There is no indication of a security bug, fix, or vulnerability.

Lower-priorityp2p: Implement `encoding` traits for `FilterLoad`by rustaceanrob · 89bfc055 · Jan 20, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · rustaceanrob

p2p: Implement `encoding` traits for `FilterLoad`

Another low-sakes encoding implementation building on the previous
commit.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit adds a new way to encode and decode the Bitcoin 'filterload' P2P network message using a new internal encoding framework. It is a routine refactor that mirrors how other message types were already handled. There is no indication of a security bug being fixed or introduced.