RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue488AI analyses
191commits · 30 days
405commits · 60 days
1283commits · 180 days
2069commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192200068
Tobin C. Harding4096569063
jrakibi944949068
Nick Johnson1892026059
Andrew Poelstra512020075
Jamil Lambert, PhD1141819061
Fmt Bot311414045
Trevor Arjeski111111069
Shing Him Ng3179056
Ismail Daif2266050
satsfy (Renato Britto)1767066
Martin Habovstiak2756069
Analysis record

Published AI watches

Last scanned 51 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

base58ck: Bump version to 0.5.0

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes,…

8479b56eby Tobin C. Harding+22−168 files
No security note in commit
Informational 20 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Rename Error to DecodeCheckError

This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no chan…

b0eba4c0by Mitchell Bagot+45−395 files
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add sha256::Midstate::SHA256_IV constant

This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than al…

dc21841bby Andrew Poelstra+39−143 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add several methods to sha256::Midstate for computing them in const contexts

This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature …

7d8f06d2by Andrew Poelstra+80−72 files
No security note in commit
Informational 20 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: make Sequence inner field private

This commit makes a single internal number field private in a Rust Bitcoin library type called Sequence. It is an API-cleanup change to follow Rust naming conventions (C-STRUCT-PRIVATE). It does not fix a memory corruption bug, a cryptogra…

No security signal: this is an API-encapsulation refactorNo validation or serialization logic changedNo unsafe code, no cryptographic operations modified
30f280daby satsfy (Renato Britto)+9−96 files
No security note in commit
Informational 17 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

taproot-primitives: Implement encoding traits for TapLeafHash

This commit adds standard data-encoding support for a Bitcoin Taproot hash type (TapLeafHash) so it can be properly serialized and deserialized in PSBT data. There is no indication of a security bug being fixed; it appears to be a missing-…

No security-relevant signal in commit message or diffChange is a feature addition (encoding trait implementations)No bounds-checking, memory-safety, or cryptographic flaws evident in diff
b2ab0896by Mitchell Bagot+59−12 files
No security note in commit
Informational 18 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Split Address into an extension trait

This commit is a routine code reorganization in the rust-bitcoin library. It moves the `Address::from_script` method out of the main `Address` type into a new 'extension trait' called `AddressExt`. The actual logic of the function is copie…

c900fa8cby Mitchell Bagot+35−263 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: update cargo-rbmt ever month instead of week

This commit simply renames a GitHub Actions workflow file and changes its schedule from weekly to monthly. It is a routine CI maintenance change with no security relevance.

778018e1by Nick Johnson+46−461 file
No security note in commit
Informational 18 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Use generic arguments for functions

This commit is a routine API cleanup: it makes a few Bitcoin merkle-root functions accept a broader range of input types (generic iterators and borrowed transactions) instead of only slices or exact iterator types. There is no security bug…

e887140aby Mitchell Bagot+26−184 files
No security note in commit
Informational 19 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: Flatten nested checked_ops methods

This commit is a straightforward code cleanup in the rust-bitcoin library. It replaces deeply nested match blocks with newer, cleaner Rust syntax (let-else statements) inside safe arithmetic helper functions. The actual behavior of the cod…

99f3721dby Abeeujah+53−1274 files
No security note in commit
Informational 15 AI analysisMessage 23 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

primitives: Remove todo

This commit only changes a code comment. It replaces a developer TODO note with a short explanation that the code is verbose because it implements a state machine. No code behavior, logic, or security properties changed.

e62e553dby Tobin C. Harding+1−11 file
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedbuild(deps): bump actions/github-script from 8.0.0 to 9.0.0by dependabot[bot] · 5d64b04f · Jul 13, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump actions/github-script from 8.0.0 to 9.0.0

Bumps [actions/github-script](https://github.com/actions/github-script) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3)

---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: 9.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump cargo-bins/cargo-binstall from 1.15.10 to 1.19.1by dependabot[bot] · 784f797e · Jul 13, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump cargo-bins/cargo-binstall from 1.15.10 to 1.19.1

Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.15.10 to 1.19.1.
- [Release notes](https://github.com/cargo-bins/cargo-binstall/releases)
- [Changelog](https://github.com/cargo-bins/cargo-binstall/blob/main/release-plz.toml)
- [Commits](https://github.com/cargo-bins/cargo-binstall/compare/b3f755e95653da9a2d25b99154edfdbd5b356d0a...aaa84a43aec4955a42c5ffc65d258961e39f276e)

---
updated-dependencies:
- dependency-name: cargo-bins/cargo-binstall
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1by dependabot[bot] · 9f63707f · Jul 13, 2026 · 3 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump actions/labeler from 6.0.1 to 6.1.0by dependabot[bot] · d858acd1 · Jul 13, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump actions/labeler from 6.0.1 to 6.1.0

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.0.1 to 6.1.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213)

---
updated-dependencies:
- dependency-name: actions/labeler
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
Security candidatebuild(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1by dependabot[bot] · 21337179 · Jul 13, 2026 · 5 filesMessage 93 · StrongInformational 19Details
Commit message · dependabot[bot]

build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.8 to 8.1.1.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d32b9829c1cb33d45e...5f6978faf089d4d20b00c7766989d076bb2fc7f1)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 8.1.1
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountautomated dependency-update discount
AI analysis · Informational 19/100

This is a routine Dependabot update that bumps a GitHub Actions helper used by automated weekly maintenance workflows to create pull requests. The change only affects internal tooling, not the Rust Bitcoin library code that users rely on. There is no direct evidence of a security vulnerability being fixed or introduced, but any third-party action update carries a small supply-chain risk if the new version were malicious or buggy.

Lower-priorityReplace use of as_str().len() with .len()by Mitchell Bagot · 3952e574 · Jul 13, 2026 · 1 fileMessage 78 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Replace use of as_str().len() with .len()

With the new .len() function, the previous .as_str().len() use in the
address tests can now be shortened to a single .len() call instead.

Replace encoded.as_str().len() with encoded.len() in
base58_invalid_payload_length_reports_decoded_size test in address
module.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityAdd len and is_empty to Base58CkStringby Mitchell Bagot · dcb7558b · Jul 13, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Add len and is_empty to Base58CkString

The Base58CkString type is essentially treated like a string in some
cases. While users can cast to a &str with as_str, it is convenient to
instead provide len and is_empty functions for the user.

Add len and is_empty methods to the Base58CkString type.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Security candidateinternals: Bump version to 0.6.0by Tobin C. Harding · aed7a9ce · Jul 13, 2026 · 16 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

internals: Bump version to 0.6.0

In preparation for release add a changelog, bump the version, and
update the lock files.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine version bump for the internal 'bitcoin-internals' crate from 0.5.0 to 0.6.0. It updates version numbers across package manifests and lock files, and adds a changelog describing API cleanups and small improvements. There is no code change that fixes a security bug or introduces a vulnerability.

Lower-priority2026-07-12 automated rustfmt nightlyby Fmt Bot · 20300fc7 · Jul 12, 2026 · 5 filesMessage 45 · ThinTriage 0Details
Commit message · Fmt Bot

2026-07-12 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidateci: update LTS branches for toolchain and kani cronsby Nick Johnson · 183197ab · Jul 10, 2026 · 3 filesMessage 62 · AdequateInformational 15Details
Commit message · Nick Johnson

ci: update LTS branches for toolchain and kani crons

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit only changes three GitHub Actions workflow files that control scheduled CI jobs. It updates the list of long-term support (LTS) branches used by automated cron jobs, replacing one branch name with two placeholder-looking names ('0.32.xxx' and '0.32.xx'). There are no changes to the Rust Bitcoin library code, no bug fixes, and no security-related modifications.

AI review queuedUpdate API filesby Mitchell Bagot · dc2418b3 · Jul 10, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
Lower-priorityMove builder script functions to primitivesby Mitchell Bagot · 16e93cac · Jul 10, 2026 · 4 filesMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Move builder script functions to primitives

The builder function on ScriptExt and ScriptBufExt provides a shorthand
way to get a builder for a script type. With the Builder type moved to
primitives, this function can now also be moved.

Move builder functions from ScriptExt and ScriptBufExt to Script<T> and
ScriptBuf<T> respectively.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI review queuedReplace uses of Encoder2 with prefixed encodersby Mitchell Bagot · b6c5adb3 · Jul 10, 2026 · 11 filesMessage 68 · AdequateInformational 17Details
Commit message · Mitchell Bagot

Replace uses of Encoder2 with prefixed encoders

Throughout the code, there are myriad instances of
Encoder2<CompactSizeEncoder, Bytes/SliceEncoder> used to encode a length
prefixed element vector or byte slice. With the new prefixed encoders
these can all be replaced with the PrefixedBytes/SliceEncoder types.

Replace uses of Encoder2<CompactSizeEncoder, Bytes/SliceEncoder> with
the corresponding PrefixedBytes/SliceEncoder type.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit is a straightforward internal cleanup in the rust-bitcoin library. It replaces verbose pairs of encoders (a length counter plus a raw slice/bytes encoder) with new combined 'prefixed' encoder types that do the same job. There is no change to the actual bytes produced on the wire, no new behavior exposed to users, and no indication of a security bug being fixed.

AI review queuedUpdate API filesby Mitchell Bagot · 7119794f · Jul 10, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
Lower-priorityAdd tests to cover the new length prefixed encodersby Mitchell Bagot · 68702c8d · Jul 10, 2026 · 1 fileMessage 95 · StrongTriage 0Details
Commit message · Mitchell Bagot

Add tests to cover the new length prefixed encoders

In order to cover mutants in the new PrefixedBytesEncoder and
PrefixedSliceEncoders, new tests will be needed. These also
help to prevent regressions if changes are made later.

Introduce tests to cover the new Prefixed encoder functionality.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Lower-priorityAdd new prefixed encoders for BytesEncoder and SliceEncoderby Mitchell Bagot · 8cf6b291 · Jul 10, 2026 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Add new prefixed encoders for BytesEncoder and SliceEncoder

The SliceEncoder and BytesEncoder types both encode variable length
slices of data without a length prefix. Currently, the code suggests
using Encoder2 for length prefixes, but this bloats types and encoder
initialisation for a common use-case. Instead, we should provide
encoders that automatically calculate and encode the length prefix as
a compact size.

Introduce PrefixedBytesEncoder and PrefixedSliceEncoder types that
mirror BytesEncoder and SliceEncoder but include length prefixes.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityunits: Remove incorrect code commentby Tobin C. Harding · 980ccfd5 · Jul 10, 2026 · 1 fileMessage 88 · StrongTriage 0Details
Commit message · Tobin C. Harding

units: Remove incorrect code comment

In #6384 we change `<=` to `<`. While reviewing I thought this change
was incorrect at the time. After deeper consideration I see my confusion.

However the code comment added in the linked PR is definitely
incorrect and contradicts the rustdoc comments on the function.

`time` is the MTP of the chain tip. This is what the rustdocs say and
it is also what is stated in `validation.cpp` in Core:

// BIP113 requires that time-locked transactions have nLockTime set to
// less than the median time of the previous block they're contained in.
// When the next block is created its previous block will be the current
// chain tip, so we use that to calculate the median time passed to
// IsFinalTx().
const int64_t nBlockTime{active_chain_tip.GetMedianTimePast()};

return IsFinalTx(tx, nBlockHeight, nBlockTime);

`IsFinalTx` contains the equivalent lock time check that
`is_satisfied_by` calculates. This is exactly why we changed to use
`<` to match that function:

```
bool IsFinalTx(const CTransaction &tx, int nBlockHeight, int64_t nBlockTime)
{
if (tx.nLockTime == 0)
return true;
if ((int64_t)tx.nLockTime < ((int64_t)tx.nLockTime < LOCKTIME_THRESHOLD ? (int64_t)nBlockHeight : nBlockTime))
return true;
```

Remove the code comment.

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Lower-priorityunits: Fix changelog 0.5.0 linkby Tobin C. Harding · da7ae89d · Jul 9, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Tobin C. Harding

units: Fix changelog 0.5.0 link

Fix typo in link.

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Security candidateRemove hex dep from internalsby Tobin C. Harding · bd0d4bc0 · Jul 9, 2026 · 8 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Remove hex dep from internals

The `hex` dep is no longer used in `internals` (since #6339).

Remove it.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit simply removes an unused software dependency (the hex-conservative crate) from the internals sub-package and updates related package configuration files. It is a routine cleanup change with no security relevance.

Security candidatedocs: root readme cleanupby Nick Johnson · efeab943 · Jul 8, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Nick Johnson

docs: root readme cleanup

* PSBT has moved to the rust-psbt crate.
* The CI badges are not helpful when viewed from things like crates.io,
we have detection jobs now for maintainers for stuff like kani.
* Update deprecated library json rpc library.
* Update changelog links to work from anywhere. Also add missing crates.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing boundarydocumentation-only discount
AI analysis · Informational 15/100

This commit only edits the project's README.md file. It removes outdated CI badges, updates the recommended JSON-RPC client library, fixes changelog links, and adds missing crates to the changelog list. No code, build scripts, or cryptographic logic was changed, so it has no direct security impact on users of the library.

Lower-prioritydocs: update LTS versions and expand on policyby Nick Johnson · d704b494 · Jul 8, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Nick Johnson

docs: update LTS versions and expand on policy

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Security candidateReplace external uses of base58 encoding with Base58CkStringby Mitchell Bagot · 7f5fbd13 · Jul 8, 2026 · 3 filesMessage 73 · AdequateInformational 17Details
Commit message · Mitchell Bagot

Replace external uses of base58 encoding with Base58CkString

Before the old encoding functions can be removed, all uses from outside
the crate need to be replaced with the equivalent calls from the new
Base58CkString type.

Replace all uses of encode_check and encode_check_to_fmt with equivalent
Base58CkString uses.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 17/100

This commit is a routine internal code cleanup in the rust-bitcoin project. It swaps old base58 encoding helper functions for a new equivalent type, Base58CkString, in three source files. There is no indication from the commit itself that this fixes a security bug; it appears to be part of a refactoring to remove deprecated functions.

Lower-priorityRemove unused old encoding functionsby Mitchell Bagot · de3554c5 · Jul 8, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Remove unused old encoding functions

With the introduction of the Base58CkString type, the old encoding
functions can now be completely removed.

Remove encode, encode_check and encode_check_to_fmt, alongside the
accompanying private functions.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityGate alloc-only decoding errorsby Mitchell Bagot · 67925869 · Jul 8, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Gate alloc-only decoding errors

The errors used for decoding are currently alloc-only, but are exported
even for no-alloc builds. These should be gated the same as the
functionality that uses them.

Gate Error, IncorrectChecksumError, TooShortError and
InvalidCharacterError behind alloc.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI review queuedAdjust crate level docsby Mitchell Bagot · 30a6f1c5 · Jul 8, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Adjust crate level docs

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message