rust-bitcoin

Merge rust-bitcoin/rust-bitcoin#6725: primitives: Add doctest examples

2877a0633d5d94f58803c0eca1b72e0182030981 primitives: Add module doc examples (Mitchell Bagot)
89b13277a1340516904a32a6379b12ed58b734da primitives: Add examples to script::owned methods (Mitchell Bagot)
ecd3a19ca976d8dc8442b3be726710cb80b2fbed primitives: Add examples to Witness methods (Mitchell Bagot)
493ce74e8475a7c70834072196aca6a154d4d140 primitives: Add simple examples to script-adjacent types (Mitchell Bagot)
5ffdd985d1afc3423a24faacbb3d9eb33506ddd9 primitives: Add examples to from_script on script hash types (Mitchell Bagot)
9f4ef91840892faf9e864b72d32d7527cd0ce115 primitives: Remove outdated comment on Header::block_hash (Mitchell Bagot)
75f29146c1d3d0b51525c91d7fbf4ef6744a26e6 primitives: Add examples to block module and methods (Mitchell Bagot)

Pull request description:

Per C-EXAMPLE, every item in a crate is supposed to include an example/doctest. Since many functions in primitives are trivial, providing an example for every method and type is needlessly verbose. However, most modules, types and some methods can benefit from the introduction of examples to clarify quirks and uses of the functionality.

Add doctests examples liberally to modules, types and methods throughout primitives.


ACKs for top commit:
tcharding:
ACK 2877a0633d5d94f58803c0eca1b72e0182030981
apoelstra:
ACK 2877a0633d5d94f58803c0eca1b72e0182030981; successfully ran local tests


Tree-SHA512: f9ee96654e4ba367838ac4014c28194828e267fb3926eacf4cd157b80259b841f5e76aded407258ad9cb0d5440e6e68a7e11bead6b7600535b3b1869cac92227

Merge rust-bitcoin/rust-bitcoin#6680: bitcoin-bip158: Implement BIP 157/158 basic compact block filters

fd5b6a1146c8e692184d6f0bac1c60ed2bf384d6 bip158: Add Official test vectors (Abeeujah)
6616ab4eabdf21f775190ed6267d027bdc5496ba bip158: Implement BIP-0158 basic block filters (Abeeujah)
6767c9b92439a5634d5864dde518db22602a9871 bip158: Add BIP-0157 filter hash types (Abeeujah)

Pull request description:

- Patch 1: Adds BIP 157 filter hash and filter header types.
- Patch 2: Implements construction, validation, serialization, and matching for BIP 158 basic block filters.
- Patch 3: Adds the official BIP 158 test vectors.


ACKs for top commit:
apoelstra:
ACK fd5b6a1146c8e692184d6f0bac1c60ed2bf384d6; successfully ran local tests


Tree-SHA512: fef2228039a5cd148547b003c2bef6ae7b60ba51c89f42e44197d135a43d97c26377189c40db16d0fa7f862ce6a812e6f85145067f5ca01d6f5e6a28133f3ff6

Merge rust-bitcoin/rust-bitcoin#6755: crypto: Extend `EcdsaSighashType` to non-standard values

619e16acbc65593fed9c7d4100bc3d551829c19f crypto: replace EcdsaSighashType derives with manual impls (jrakibi)
baa6ee0e71b871c29aa7b75027c3d3ed4771a144 Add tests for non-standard sighash types (jrakibi)
3fb16c665b4ba562b81ca1df544d7f4136b02010 crypto: Make from_slice accept non-standard sighash types (jrakibi)
50c06af4b3c4274f44ec751bfef06fd987343a08 crypto: extend EcdsaSighashType to accept NonStandard (jrakibi)

Pull request description:

The current segwit v0 sighash API takes `EcdsaSighashType`, which only accepts _standard_ values. This means we cannot compute the correct sighash for _consensus-valid_ transactions that use _non-standard_ sighash type, so verifying their signatures fails.

We extend `EcdsaSighashType` to accept any u8 value (solution proposed by Apoelstra in https://github.com/rust-bitcoin/rust-bitcoin/issues/1657#issuecomment-1456876763).

This is a step to make legacy encoding also take `EcdsaSighashType` instead of u32 to close #1657 (will open a separate PR for it after getting feedback on this one)

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6647 and https://github.com/rust-bitcoin/rust-bitcoin/issues/4133

_This might also address #777_


ACKs for top commit:
apoelstra:
ACK 619e16acbc65593fed9c7d4100bc3d551829c19f; successfully ran local tests


Tree-SHA512: a446767f920c691a9f11774e5a7329036154c1a3d762cf293565a7ac9e3aa7a96bd94a4177b28661aa417334f4d4cd001065c37dfc11c69a2b944425c026c6e3

Merge rust-bitcoin/rust-bitcoin#6729: ci: add corpus based fuzzing

29e579a3bf9be2b444be42a804b0ba9c2ce202b6 ci: report fuzz crashes in the job summary (satsfy (Renato Britto))
22841a84b22a4ea7b21918cf8f9de28b75bcf1de ci: open issue on corpus fuzz failures (satsfy (Renato Britto))
f95f8b2ccb8ceddb90606b137f5812a3f6faa8d8 ci: add corpus based fuzzing (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6511

Adds a new daily workflow that fuzzes every existing target, loading a fuzzing corpus from [qa-assets](https://github.com/rust-bitcoin/qa-assets) repo, and pushes back into the repo the updated fuzzing progress. The current daily fuzz job always starts from an empty corpus, meanwhile, a persisted one starts each run from the deepest coverage reached so far.

No changes are necessary in qa-assets repository. When this is merged, it should auto-start the process there. Tested in my own fork.

This change is orthogonal to existing fuzzing solution because it is in a probatory stage.

Commits:
- First commit is the job.
- Second commit is issue creation based on fuzzing errors is separated so that it is easy to revert in case it becomes cumbersome for any reason.
- Third commit is a script created to report crashes conveniently in the CI job. It reports a hex dump plus repro steps. It is entirely optional but convenient, so I left it isolated at tip.

This is the first PR in a 3- or 4-part series, establishing the base for follow-ups such as: saving every fuzzing error in corpus, then replaying the corpus on PR CI to catch regressions (I'll create issue after I see how this solution behaves). Also, in the motivating issue, we may merge/replace existing daily fuzzing without a corpus if this fuzzing system proves itself.


ACKs for top commit:
apoelstra:
ACK 29e579a3bf9be2b444be42a804b0ba9c2ce202b6; successfully ran local tests


Tree-SHA512: aa4da22f4b9dcb21a402ee0807cc0340062cc0a28da943fa5f124668ff89a639c0ef034b1b9184075ae085e232170ad6e608687aebe91f09bdd01f5548180d9d

Merge rust-bitcoin/rust-bitcoin#6712: addresses: Remove alloc feature gating for most functionality

5faa72888480f524ae5baa448b6c1ded53915175 addresses: Update crate level docs (Mitchell Bagot)
2263383ee489046d999f9a46c225b0d31763fc37 Remove InvalidBase58PayloadLengthError type and Base58Error variant (Mitchell Bagot)
865adaa9e88cc50609338dbf8116a7cf6d606bbe addresses: Remove alloc gating from Address::from_base58_str (Mitchell Bagot)
616ea5901e9b0fd29ade8e42bee118c99438526a addresses: Replace String in error types with InputString (Mitchell Bagot)
41782c749614816a027885135b06a6fa447f16a9 addresses: Remove alloc gating from Address type (Mitchell Bagot)
b13891f0667660c9f8a0ff3449b4d52e1365decb addresses: Remove alloc gating on AddressInner and AddressData (Mitchell Bagot)
5957ca575fcf79c78d173e76ab0b0a1401013317 Make WitnessProgram program field pub(super) (Mitchell Bagot)
16dc35ec99011b711647b3dfa1968ecc21601006 addresses: Remove crate-level alloc gate (Mitchell Bagot)

Pull request description:

During the initial code move into the new crate, the addresses crate was crate-level gated on alloc to simplify the code move. With the move complete, the crate can now be largely ungated to provide no-alloc users with substantial portions of the addresses functionality.

- Patch 1 removes the crate-level alloc gate, replicating the same gating with individual item feature gating.
- Patch 2 makes WitnessProgram progrtam field pub(super) to replace use of program() method later on.
- Patch 3 drops the alloc gating on the inner data of Address, including minor modifications to functionality.
- Patch 4 removes alloc gating from the Address type.
- Patch 5 removes pub String fields from error types, replacing them with pub(super) InputString.
- Patch 6 removes alloc gating from the base58 parse Address constructor.
- Patch 7 removes the unused InvalidBase58PayloadLength error type and variant.
- Patch 8 updates the crate-level docs to reference the new no-alloc functionality.


ACKs for top commit:
apoelstra:
ACK 5faa72888480f524ae5baa448b6c1ded53915175; successfully ran local tests
tcharding:
ACK 5faa72888480f524ae5baa448b6c1ded53915175


Tree-SHA512: b2e0a66d74c2ad068f38cc856cf727dcf3cb7a7e49059c1bdf5d0958de26f8847b2c4b80ef82fe998f90fdcfcd51cf2e9252c4049004a025d44b80a50e3a6588

Merge rust-bitcoin/rust-bitcoin#6649: units: Add support for satisfaction of parent/child transactions

96dc35c3af6e21a4ad05308ab820a16021689669 Update the API text files (Tobin C. Harding)
8c138c48010b3b61db26a65fdef65a07c2f15157 Test parent/child lock-by-time in same block (Tobin C. Harding)
f8f137e209c304b0d9fc1f55058995e986a7c54c Add support for satisfaction of parent/child transactions (Tobin C. Harding)

Pull request description:

This is for relative timelocks. Does not touch absolute timelocks.

We are being overly restrictive by checking chain tip is equal or greater than the utxo mined-at
value (because of `checked_sub`).

If a pair of parent/child transactions hit the mempool together zero-value relative timelocks can
still be satisfied.

In order to support this functionality change the `utxo_mined_at` argument to be an `Option`, with
`None` signifying not-mined-yet. This has a nice advantage of making the arguments harder to mix up.


ACKs for top commit:
apoelstra:
ACK 96dc35c3af6e21a4ad05308ab820a16021689669; successfully ran local tests


Tree-SHA512: 42281c54c59643ea78b528b30c8cd0e92b07c7a35cde61eaf6a920c9a2a749fc52d21a966842c1c5456cd51d001d26f7087878219bd95697ce0f21aa327d0b4d

primitives: Add #[inline] to simple functions

Following the recent additions to primitives, and before the final
release, new simple functions need have #[inline] added to them.

Add #[inline] to simple functions throughout the crate.

Merge rust-bitcoin/rust-bitcoin#6749: primitives: docs fixes

a4c274d68590f5ffbe0e33da89839c8303f40127 Correct ScriptBuf serialization docs (Jamil Lambert, PhD)
7f09d4bd438131941b31dedd7210fa354701ba76 Correct wtxid docs (Jamil Lambert, PhD)
f057e204b1d6e24620095339ce4518b2883313ad Correct hash trait docs (Jamil Lambert, PhD)
3b8f11f1dbaed68152d787d6c52af52760b32529 Clarify returned witness Merkle root (Jamil Lambert, PhD)
7ea38df8aae6cc3ade4d58c8d4f86c8b57a069e5 Link consensus serde module docs (Jamil Lambert, PhD)

Pull request description:

Go through the `primitives` docs and fix anything that seemed wrong.


ACKs for top commit:
tcharding:
ACK a4c274d68590f5ffbe0e33da89839c8303f40127
apoelstra:
ACK a4c274d68590f5ffbe0e33da89839c8303f40127; successfully ran local tests


Tree-SHA512: 37eb215a86d9735eba39f5753ce97d78278441f43765b30988e0f14af5d4bfe26768ac459d385993d5fc3ffb4ec2373730e99a5b4a591fc4873cc2710309f401

Merge rust-bitcoin/rust-bitcoin#6761: Manual bump of dtolnay/rust-toolchain specifying toolchain

4fa6b1c71d34e0121e834b78f486ac9b46f2cf57 ci: pass toolchain input to rust-toolchain action (satsfy (Renato Britto))
06ba6541bca755b6e7088f6a893218d96a9d2ad4 build(deps): update dtolnay/rust-toolchain requirement to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 (dependabot[bot])

Pull request description:

Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6751

The dependabot bump moved `stable` branch pin to `master`, which has no toolchain default and requires it to be specified. The solution here is inspired on Miri CI workflow and another rust.yml job, which already implements the same.


ACKs for top commit:
tcharding:
ACK 4fa6b1c71d34e0121e834b78f486ac9b46f2cf57
apoelstra:
ACK 4fa6b1c71d34e0121e834b78f486ac9b46f2cf57; successfully ran local tests


Tree-SHA512: 02de193e168a639ed9f4f191d3ca10f8d70824e4ae25163fe92475096103da3c4903c99e7cc8dbd21ce4839b5a48a42e57e8dec4edb162c50cdef8f721f217bb

Merge rust-bitcoin/rust-bitcoin#6747: update LLM rules a bit

52d547a7ca250ec795b7a2e9dd757f499527b26d update LLM rules a bit (Andrew Poelstra)

Pull request description:

This weekend has seen a ton of clanker PRs here and in rust-miniscript. Tighten up the LLM rules a bit to try to reduce them.

BTW I had thought we were going to adopt the LLVM LLM policy but now I can't find that discussion anywhere. What happened?


ACKs for top commit:
tcharding:
ACK 52d547a7ca250ec795b7a2e9dd757f499527b26d
apoelstra:
ACK 52d547a7ca250ec795b7a2e9dd757f499527b26d; successfully ran local tests


Tree-SHA512: e7cf194c35805f27e89a5ac96e8bc4a90d7369fe26ec3e650f6c04b2e2268ce26102b03aa023edddc9a6fd065178dd05b66faceaec500f45fbe1f08de058143d

ci: pass toolchain input to rust-toolchain action

The dependabot bump moved stable branch pin to master, which has no
default and requires the toolchain specified. Inspired on miri ci
workflow, which already implements this.

Merge rust-bitcoin/rust-bitcoin#6757: ci: gen PR labels from master instead of fork

000113045370d6dac13f8a91101bc31134278315 ci: gen PR labels from master instead of fork (satsfy (Renato Britto))

Pull request description:

This fixes a CI issue and doubles as a security fix.

The labeler job now fails on every fork PR. This is because, [yesterday](https://github.com/rust-bitcoin/rust-bitcoin/commit/2d138d732b791f7d1a7ef715794f5c2f4fad3b62), CI's `actions/checkout` was updated to v7 and refuses to fetch fork PR code from a `pull_request_target` workflow unless the step opts in with `allow-unsafe-pr-checkout`. IIUC, that was a safety issue because the old job checked out the fork and ran `cargo metadata` on its manifests while holding the base repo's token (known as [pwn-request vulnerability](https://www.endorlabs.com/learn/pwn-request-threat-a-hidden-danger-in-github-actions)).

But from my understanding of this workflow, the fork checkout is not necessary. So I dropped it and, making the problem go away.

One consequence is: if a PR adds a new crate, the PR will not get label `C-<crate>`. Seems acceptable to me.

Btw I see 0.32.xx and 0.32.xxx have this same issue.


ACKs for top commit:
tcharding:
utACK 000113045370d6dac13f8a91101bc31134278315
jamillambert:
ACK 000113045370d6dac13f8a91101bc31134278315
apoelstra:
ACK 000113045370d6dac13f8a91101bc31134278315; successfully ran local tests


Tree-SHA512: 80e918fbf2a595f4724459b64e1d2facf4fc88917dd4681e3e7b9dc93987156cabe3d5ec51b62bad1dd3e638e5f41ccb83b79a1a3d9cd52157c1f8ec3e06200e

Merge rust-bitcoin/rust-bitcoin#6741: units: Add and standardise doc and comment links

0004759e3865caf677c1ecad2f9df5a50f53acfa units: Replace in-line links with tag links (Mitchell Bagot)
d2675c71655e48e1d93617750c8f9ae5106bcd86 Fix blank space in doc link (Mitchell Bagot)
e5ac2a6c5aa641f1cb9bd5b81cda40992db1c1eb units: Add links to docs (Mitchell Bagot)

Pull request description:

The C-LINK docs guideline recommends including links for types and modules throughout the public-facing documentation. Additionally, at least in VSCode, these links can be followed through Ctrl-Click, even when in private code comments. As such, all types and modules should be modified to links to improve both user docs readability, and code navigation.


ACKs for top commit:
satsfy:
ACK 0004759
apoelstra:
ACK 0004759e3865caf677c1ecad2f9df5a50f53acfa; successfully ran local tests
tcharding:
ACK 0004759e3865caf677c1ecad2f9df5a50f53acfa I didn't check all changes in patch 1 because satsfy seems to have been most thorough.


Tree-SHA512: 2e0f265af2f996ef0c62564587882a77418eeb974293f083ad806aa02b530347ada5ae260757838b2e98002a46b896ff348498c404d3b01816352a49e6fd7829

ci: gen PR labels from master instead of fork

The labeler checked out the fork and ran cargo metadata on
its manifests while holding the base repo token, a github
actions security vulnerability called pwn request.

But we don't need the fork checkout to generate labels, this
commit now does it from master.

Merge rust-bitcoin/rust-bitcoin#6732: primitives: Doc links follow-up

54e22747d012e90cc4eaf0d33d0ce9ab40ae6cda Remove link brackets from deprecation note (Mitchell Bagot)
c2754d9a566103127484748ae06c8a53063a3179 Add full stop after Script method docs (Mitchell Bagot)
fb0324399f04b36752b26a5ce335401963a9d5c2 primitives: Replace in-line links with tag links (Mitchell Bagot)

Pull request description:

This is a follow-up to #6728.


ACKs for top commit:
apoelstra:
ACK 54e22747d012e90cc4eaf0d33d0ce9ab40ae6cda; successfully ran local tests


Tree-SHA512: 2574befb511ef68a0ff21b602d8e0d18d3550f1f4b9c55458007224ae2e9504600084747f4fa7cc9576c4df196e76881cebb7f4677c277ba3b89f87521865d31

Merge rust-bitcoin/rust-bitcoin#6750: build(deps): bump taiki-e/install-action from 2.81.10 to 2.82.0

b00197e524ddf3bb7152317cf187a213788c7366 build(deps): bump taiki-e/install-action from 2.81.10 to 2.82.0 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.81.10 to 2.82.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.0</h2>
<ul>
<li>
<p>Support <code>cargo-vet</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1908">#1908</a>, thanks <a href="https://github.com/jakewimmer"><code>@​jakewimmer</code></a>)</p>
</li>
<li>
<p>Support <code>cargo-crap</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1905">#1905</a>, thanks <a href="https://github.com/BartoszCiesla"><code>@​BartoszCiesla</code></a>)</p>
</li>
<li>
<p>Support <code>cargo-leptos</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1903">#1903</a>, thanks <a href="https://github.com/404Simon"><code>@​404Simon</code></a>)</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.103.0.</p>
</li>
<li>
<p>Update <code>cargo-xwin@latest</code> to 0.23.0.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 45.0.2.</p>
</li>
<li>
<p>Update <code>cargo-deny@latest</code> to 0.19.9.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.4.5.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.10.</p>
</li>
</ul>
<h2>2.81.11</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.252.0.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.125.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.21.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.35.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.9.</p>
</li>
<li>
<p>Update <code>jaq@latest</code> to 3.1.0.</p>
</li>
<li>
<p>Update <code>cargo-insta@latest</code> to 1.48.0.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.0.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.86.1] - 2026-08-15</h2>
<ul>
<li>Fix an issue where <code>oxfmt</code> was　accidentally installed as <code>oxfmt-{target}{exe}</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1969">#1969</a>)</li>
</ul>
<h2>[2.86.0] - 2026-08-15</h2>
<ul>
<li>Support <code>oxfmt</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1967">#1967</a>, thanks <a href="https://github.com/rami3l"><code>@​rami3l</code></a>)</li>
</ul>
<h2>[2.85.14] - 2026-08-15</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.4.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.74.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.4.0.</p>
</li>
<li>
<p>Update <code>mdbook-mermaid@latest</code> to 0.17.1.</p>
</li>
<li>
<p>Update <code>cargo-xwin@latest</code> to 0.23.1.</p>
</li>
</ul>
<h2>[2.85.13] - 2026-08-13</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.3.3.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.5.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.113.0.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.4.</p>
</li>
<li>
<p>Update <code>bpf-linker@latest</code> to 0.11.0.</p>
</li>
</ul>
<h2>[2.85.12] - 2026-08-12</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.3.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.256.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/b8cecb83565409bcc297b2df6e77f030b2a468d5"><code>b8cecb8</code></a> Release 2.82.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/981171473775d521e3ae1e0b14c569b51c48651e"><code>9811714</code></a> Update changelog</li>
<li><a href="https://github.com/taiki-e/install-action/commit/e7005464717d3cca03b48509ba65ebbde552e10c"><code>e700546</code></a> Update wasmtime manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/fdfb4a4a7c8af40d72ebb849dac38e8718ea669c"><code>fdfb4a4</code></a> Update mise manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ef03904287f8419ca540ee664cc9227c6d501867"><code>ef03904</code></a> Update martin manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/b6d098313f0ccec3f73270982ba4474205dbd7fd"><code>b6d0983</code></a> Update <code>kingfisher@latest</code> to 1.103.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ebeb9b1a53c2307773f018dca9868b795675e6c5"><code>ebeb9b1</code></a> Update just manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/119edcf29d9a2c67fad2ed58e04242daceb433e5"><code>119edcf</code></a> Update <code>cargo-xwin@latest</code> to 0.23.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/cd319da91ecc8685df284d89c5435723973a5668"><code>cd319da</code></a> Update <code>wasmtime@latest</code> to 45.0.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/4942894b57b5ad6fdcb38216eb1f7df561374b20"><code>4942894</code></a> Update cargo-xwin manifest</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/7a79fe8c3a13344501c80d99cae481c1c9085912...b8cecb83565409bcc297b2df6e77f030b2a468d5">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK b00197e524ddf3bb7152317cf187a213788c7366; successfully ran local tests


Tree-SHA512: b69757c8a6eaaf5a3f42d2aa14912dd7b1db62eb1b551dc4bb99104b5ee4f1198912a041be2e98d0c0f0f4cda57debe56c62e92b5702aab7a56ae32732c30faa

Merge rust-bitcoin/rust-bitcoin#6752: build(deps): bump actions/checkout from 6.0.3 to 7.0.0

2d138d732b791f7d1a7ef715794f5c2f4fad3b62 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (dependabot[bot])

Pull request description:

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li>See full diff in <a href="https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 2d138d732b791f7d1a7ef715794f5c2f4fad3b62; successfully ran local tests


Tree-SHA512: 8f9e0a6c13238ab1d0f2b1895babb8835cf9eaecda576465c12b3da10c428252aa8cc9cfdeb49387165ef0b46aaa15914ef7ecc8262538f13fc98db3b682fe9f

primitives: Add Arbitrary impl for WitnessVersion

Implemented by sampling uniformly from the valid range 0 to 16.

ci: update api snapshot

Merge rust-bitcoin/rust-bitcoin#6746: Automated nightly rustfmt (2026-08-16)

11d946550929e4c471831f3910aeb7e2c39fb22d 2026-08-16 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK 11d946550929e4c471831f3910aeb7e2c39fb22d; successfully ran local tests


Tree-SHA512: b0d9038e6af81f239a4ea5a374ab2e549ccefad90a9279435fff18298ff6e3a3726aa53e6f54f4377b66f9b37351d7bdc11435606ac0ab91fad3fa3212d08691

Merge rust-bitcoin/rust-bitcoin#6731: primitives: Add Arbitrary impl for Opcode

5e54b8555ffd1a40e4e25ba3c675be7f6d492ce1 Update the API text files (Tobin C. Harding)
023a2501706dfc0477c6dbdeb645e11d604b9592 primitives: Add Arbitrary impl for Opcode (Tobin C. Harding)

Pull request description:

Returns a 'arbitrary' opcode, not an 'arbitrary valid' opcode.


ACKs for top commit:
satsfy:
ACK 5e54b8555ffd1a40e4e25ba3c675be7f6d492ce1
apoelstra:
ACK 5e54b8555ffd1a40e4e25ba3c675be7f6d492ce1; successfully ran local tests


Tree-SHA512: e1ea83d556bf9c40406e8ccce1b20fde8cd3308aaeff2f1d34c5b06d71f322f9fdf81310650db7680e3d1be55bee66e2b8a8587767f560428987c815ffeeb066

2026-08-16 automated rustfmt nightly

Merge rust-bitcoin/rust-bitcoin#6738: ci: rename daily fuzz job to 'Fuzz (from scratch)'

bdfe563a73536e33e0318754f4ddd330a7d7beb8 ci: rename daily fuzz job to 'Fuzz (from scratch)' (satsfy (Renato Britto))

Pull request description:

There was a legacy fuzz job named 'Fuzz' like the current master's daily fuzzing job. The actions page lists the two workflows as 'Fuzz'.

I propose we rename to `Fuzz (from scratch)` because https://github.com/rust-bitcoin/rust-bitcoin/pull/6729 will introduce yet another job called `Fuzz (corpus)`.

The change here is optional and not related to #6729 per se, so it is a separate PR.


ACKs for top commit:
apoelstra:
ACK bdfe563a73536e33e0318754f4ddd330a7d7beb8; successfully ran local tests; yeah this seems worthwhile regardless


Tree-SHA512: 4558205319d4d5c300133511669b9393f2f1dfea47646661682cf2ac015661083e0462177efb85a56feac70c805a7e5eadb4610e6424f860af7b5deaacb251af

Merge rust-bitcoin/rust-bitcoin#6734: units: Prevent panic when parsing non-ASCII target and work hex

bd7d8653c2600bf4cff6361823d67c5c6cab994f units: Prevent panic when parsing non-ASCII target and work hex (questfever)

Pull request description:

## Summary

Prevent `Target` and `Work` hex parsing from panicking on certain non-ASCII UTF-8 inputs.

Add a regression test verifying that invalid non-ASCII hex input is returned as an error.

## Details

The U256 hex parser uses `str::len()`, which returns the UTF-8 byte length, to calculate the boundary between its high and low halves:

```rust
let high_len = s.len() - 32;
let high_s = &s[..high_len];
let low_s = &s[high_len..];
```


For an input such as:

`é0000000000000000000000000000000`


the string contains 32 characters but 33 bytes. This makes `high_len == 1`, which falls inside the two-byte UTF-8 encoding of `é`.

Slicing the string at that offset therefore panics.


This path is reachable through the public `Target::{from_hex, from_unprefixed_hex}` and `Work::{from_hex, from_unprefixed_hex}` APIs. Invalid hexadecimal input should produce an error rather than panic.


The parser now rejects non-ASCII input before splitting the string.


## Testing

- Added a regression test for the non-ASCII input above.
- Ran cargo test -p bitcoin-units --all-features.


ACKs for top commit:
apoelstra:
ACK bd7d8653c2600bf4cff6361823d67c5c6cab994f; successfully ran local tests


Tree-SHA512: 9e579ee9cafd889cd8b386e114636df08acfafef3eef74d7cd92d5dd165d653352f1eba5f5d1312fa253f036477da900bf26a3b951a795623ba7422f69445c7c

Merge rust-bitcoin/rust-bitcoin#6724: units: Add Arbitrary impls for Work and Target

c09fb76201d6df6b96d85fadb3d2f31683539248 Update the API text files (Tobin C. Harding)
ec8c149aedfbe8907a28f3aaf4161ceae75aa2b5 units: Add Arbitrary impls for Work and Target (Tobin C. Harding)

Pull request description:

Missing these two, patch em in.


ACKs for top commit:
apoelstra:
ACK c09fb76201d6df6b96d85fadb3d2f31683539248; successfully ran local tests


Tree-SHA512: b119763c1e42f0f98218a71216c2841a98e8a90b48e32234da6e13b65505338f7ca51fd6c70cd02eb97454657029e6db3b2640deb8229ecba0bf90bc35902d18