RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
147commits · 30 days
304commits · 60 days
1150commits · 180 days
2055commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 40 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6730: primitives: Remove `BlockHashDecoder` from `transaction` moduleby Andrew Poelstra · 793e4712 · Aug 15, 2026 · 6 filesMessage 91 · StrongInformational 20Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6730: primitives: Remove `BlockHashDecoder` from `transaction` module

76c19176514ef42d104ada21a1c47f58e762e7dd Update API files (Mitchell Bagot)
ff712f73840768fd2481d3a0b51890062049d36a primitives: Remove BlockHashDecoder from transaction module (Mitchell Bagot)

Pull request description:

The BlockHash type is present in the primitives::block module. However, the decoder and its associated error type is re-exported in both the transaction and block modules.

Remove BlockHashDecoder and BlockHashDecoderError re-exports from the primitives::transaction module.


ACKs for top commit:
tcharding:
ACK 76c19176514ef42d104ada21a1c47f58e762e7dd
apoelstra:
ACK 76c19176514ef42d104ada21a1c47f58e762e7dd; successfully ran local tests


Tree-SHA512: daf983550fea7219b6c8f9adcb3c96b5d7dd4c9eebead23b3bba97b8e27fb93965d5f37b7ee624744fbf0618f8570ffbc69c9ae1063ad9f971cd2d454ecc5144

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This change is a routine cleanup of the library's public API. It removes two items (BlockHashDecoder and BlockHashDecoderError) that were accidentally re-exported from the wrong module. The actual decoder and error type still exist in the correct block module, so no functionality is removed. There is no security issue here.

Lower-priorityMerge rust-bitcoin/rust-bitcoin#6726: primitives: Go over the API testby Andrew Poelstra · 0fe87ea5 · Aug 14, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6726: primitives: Go over the API test

80e78938eda7e8d42882b463513cc4142e861649 primitives: Add P-ARBITRARY API test (Jamil Lambert, PhD)
7caa759078e412364f15735729031bed004f0e71 primitives: Fix API test (Jamil Lambert)
3f461e4aa754d4e37644a21d0e5423a44703772e primitives: Remove units types from API test (Jamil Lambert, PhD)
65173e093dd8e47f2e1cd308b9f4855cbda3288d Remove redundant alloc feature gates (Jamil Lambert, PhD)

Pull request description:

Remove reexported `units` types since these are tested in the `units` api test. Tidy up the API tests, add missing type and add a P-ARBITRARY test.

Modified version of #6723 with the `units` types removed.


ACKs for top commit:
tcharding:
ACK 80e78938eda7e8d42882b463513cc4142e861649
apoelstra:
ACK 80e78938eda7e8d42882b463513cc4142e861649; successfully ran local tests


Tree-SHA512: 26d6887ee9cd6ccf75e269b37db0247f4b671573be5615d6327f02375f277bb015f056af8f783389dee4ceb179f3f06cdedaac3a0445c3a9406e98e7182ea6d3

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
AI review queuedapi: remove api snapshot filesby satsfy (Renato Britto) · 53ea3d6f · Aug 14, 2026 · 24 filesMessage 68 · AdequateInformational 15Details
Commit message · satsfy (Renato Britto)

api: remove api snapshot files

The api CI task now diffs the generated API against the
base branch, so the committed snapshots no longer serve
as the check. They only produce rebase churn on every api
change, so drop them and ignore the generated location.

contrib/api.sh now points at the generated path and tells
the user how to produce the files when they are missing.

API snapshot was a prerequisite of Check Re-exports job,
so they must be regenerated now. Each re-exports script
implements an api snapshot generation for robustness.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: unusually broad change
AI analysis · Informational 15/100

This commit removes large, automatically-generated API snapshot text files from the rust-bitcoin repository. The snapshots were used to detect accidental changes to the public API, but they caused unnecessary merge conflicts. The project now generates these snapshots on demand during CI instead of storing them in git. This is a repository maintenance and CI workflow change, not a code behavior change, and it has no direct security impact on users of the library.

Lower-priorityMerge rust-bitcoin/rust-bitcoin#6676: units: Add `Div` and `DivAssign` for `NonZero` to `Amount` typesby Andrew Poelstra · 1685e742 · Aug 13, 2026 · 4 filesMessage 100 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6676: units: Add `Div` and `DivAssign` for `NonZero` to `Amount` types

145460bab100ec521fc3903215c55d13da15b75b Update API files (Mitchell Bagot)
caeedc55aab2b0d12a78b797e40c93a409014f8a Add test cases to cover NonZero* div ops (Mitchell Bagot)
ec1a7f3a6938c333dc85a4646461603ec2a5ed5f units: Add Div and DivAssign for NonZero to Amount types (Mitchell Bagot)

Pull request description:

Currently, Amount and SignedAmount can be divided by NonZeroU64/I64, and in both cases yield their original types due to the infallibility of the operation. In order to mirror Amount ops with NumOpResult and \*Assign ops, Div<NonZero*> impls should be included for NumOpResult, and corresponding DivAssign impls should be added for all types.

Add Div<NonZero\*64> for NumOpResult and DivAssign<NonZero*64> for Amount, SignedAmount and NumOpResult.


ACKs for top commit:
tcharding:
ACK 145460bab100ec521fc3903215c55d13da15b75b
apoelstra:
ACK 145460bab100ec521fc3903215c55d13da15b75b; successfully ran local tests


Tree-SHA512: ed746022ba90a118aa5f1e8cd2bdd9039b91606582b2e7af6713082c5a3705ac2c01b3aeb678a4c376ea0d59dff7097c62f0a67f2a03ac786cc3e8f932e70122

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge rust-bitcoin/rust-bitcoin#6689: units: rename locktime height accessors and query methodsby Andrew Poelstra · 8eb2aa3f · Aug 13, 2026 · 11 filesMessage 100 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6689: units: rename locktime height accessors and query methods

16e9a5937fd44d05e71e75b104e1311ab1c24967 api: regenerate locktime rename api (satsfy (Renato Britto))
1608cff53ed5dfd5f099759c8d19f44171aae1e0 units: rename relative LockTime height to block count (satsfy (Renato Britto))
2c2b3583635e10754db9cb4ae55eae9245096108 units: rename NumberOfBlocks height accessors to count (satsfy (Renato Britto))

Pull request description:

The docs use "block count" everywhere, but api still says height.

This is a follow-up to [docs reword](https://github.com/rust-bitcoin/rust-bitcoin/pull/6671#issuecomment-5187855352) in the relative locktime module, incorporating rename suggestions from the review. A relative lock counts blocks elapsed since the UTXO was confirmed, not chain height.

Changes:
- `NumberOfBlocks::from_height` and `to_height` become `from_count` and `to_count`.
- Relative `LockTime::is_block_height` and `is_block_time` become `is_lock_by_block_count` and `is_lock_by_block_time`
- `from_height` becomes `from_block_count`.
- Absolute `LockTime` was touched because it has similar-looking modified names like `is_block_height`. The new `lock_by` infix match was necessary to avoid looking inconsistent.


ACKs for top commit:
tcharding:
ACK 16e9a5937fd44d05e71e75b104e1311ab1c24967
apoelstra:
ACK 16e9a5937fd44d05e71e75b104e1311ab1c24967; successfully ran local tests


Tree-SHA512: 187f475cc5f0ad1e1ba3bbb01ce45d4d44ac3f94da302ed0e2b19d9dd2783b915fb90625ca479ae62f439ede14f5917d8cd54504c99cf84bc12e9b895d3b663e

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge rust-bitcoin/rust-bitcoin#6721: Whitelist mutants in deprecated functionsby Andrew Poelstra · bc779aae · Aug 13, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6721: Whitelist mutants in deprecated functions

0cd1502d045b9bbff7bf1ba0f36ea0a6416449db Whitelist mutants in deprecated functions (Jamil Lambert, PhD)

Pull request description:

New mutants found in deprecated functions. Whitelist all of them.

Closes #6701


ACKs for top commit:
tcharding:
ACK 0cd1502d045b9bbff7bf1ba0f36ea0a6416449db
apoelstra:
ACK 0cd1502d045b9bbff7bf1ba0f36ea0a6416449db; successfully ran local tests


Tree-SHA512: 8065f272e8b55100c31297e7b1fa4d2419567bb96b17b987df7b2370daeb37755380dd133adef948d6725b74c14ba78f0e8508a095b0e7651dc6bf3d911714e9

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge rust-bitcoin/rust-bitcoin#6699: Automated weekly update to cargo-semver-checks (to 0.50.0)by Andrew Poelstra · bb881acd · Aug 13, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6699: Automated weekly update to cargo-semver-checks (to 0.50.0)

508aeea90f9b9a9a2979ec7d06907db696cecda8 Automated update to Github CI to cargo-semver-checks version-0.50.0 (Update cargo-semver-checks Bot)

Pull request description:

Automated update to Github CI workflow `semver-checks.yml` by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK 508aeea90f9b9a9a2979ec7d06907db696cecda8; successfully ran local tests


Tree-SHA512: 2bf800bdee210a6766cb6aaf47d2c86a5f332ac84f0290a3b7a220ddcb8707d9e514e3e3960501ebc9de6d316161079a2006f98c78d081f2888e82171380bf17

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountmerge-commit duplicate discount
Security candidateMerge rust-bitcoin/rust-bitcoin#6719: Release tracking PR: `consensus-encoding 1.2.0`by Andrew Poelstra · 799d662e · Aug 13, 2026 · 6 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6719: Release tracking PR: `consensus-encoding 1.2.0`

919da441746bf220c011fe593bfaf80256071674 consensus_encoding: Bump version to 1.2.0 (Nick Johnson)

Pull request description:

Release the new lower level encoder/decoder driver interfaces. There should only be additions to the API in this release.

I have a [rust-psbt branch](https://git.rust-bitcoin.org/rust-bitcoin/rust-psbt/pulls/208) showing off the new interfaces end to end.


ACKs for top commit:
tcharding:
ACK 919da441746bf220c011fe593bfaf80256071674
apoelstra:
ACK 919da441746bf220c011fe593bfaf80256071674; successfully ran local tests


Tree-SHA512: 8c8a95775db7cc36999986ecea49ba6ec658a0d3844751e992214fa9bd2fc5b66ed117dab12388ec235218c9312fee073a712a08125611c3d5f1fd008d235b30

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Informational 15/100

This commit is a routine version bump for the bitcoin-consensus-encoding crate from 1.1.0 to 1.2.0. It only updates version numbers in lock files, the crate's Cargo.toml, and the changelog. There are no code changes, bug fixes, or security patches in the diff.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6728: primitives: Add links in docs and update encoding trait namesby Andrew Poelstra · 333869c7 · Aug 12, 2026 · 21 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6728: primitives: Add links in docs and update encoding trait names

83cccd77a014d2bc0d9f53e08852a1fc494f19a6 primitives: Replace instances of old encoding trait names (Mitchell Bagot)
0ccb9beaf46733781e017753a406e208cc95f7ac primitives: Add doc links for types (Mitchell Bagot)

Pull request description:

According to the C-LINK API guideline, docs should make use of links to reference functions and types throughout, as this allows users to quickly click-through to the referenced function/type. During this change, the old encoding trait names should be changed so that they can be linked.

Wrap backticked types and functions as links throughout.
Replace old encoding trait names with renamed versions in docs and comments.


ACKs for top commit:
apoelstra:
ACK 83cccd77a014d2bc0d9f53e08852a1fc494f19a6; successfully ran local tests
tcharding:
ACK 83cccd77a014d2bc0d9f53e08852a1fc494f19a6


Tree-SHA512: 8d7016133cafd40493036f320ff7eb578a2c4f024e540eac5c76e92c768480054d2d0551d887cc12650ea31b8cdcf1d5d8dffa07e2f35667d998d969fb038e2f

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a documentation-only cleanup. It turns plain backtick-quoted type names (like `BlockHash`) into clickable Rust doc links (like [`BlockHash`]) and updates references to renamed encoding traits (e.g., `Encodable`/`Decodable` to `Encode`/`Decode`) in comments. No executable code logic was changed.

AI review queuedprimitives: Replace instances of old encoding trait namesby Mitchell Bagot · 83cccd77 · Aug 12, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Replace instances of old encoding trait names

In various places in the documentation and code comments, the old
encoding trait names of Encodable/Decodable are still used. While
adding in links, these can be changed to match the new names of Encode
and Decode.

Replace all instances of Encodable and Decodable with Encode/Decode and
add links to public doc instances of the new trait names.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates documentation and code comments. It renames references to old trait names (Encodable/Decodable) to the new names (Encode/Decode) and adds clickable documentation links. No actual program logic or behavior was changed.

AI review queuedprimitives: Add doc links for typesby Mitchell Bagot · 0ccb9bea · Aug 12, 2026 · 20 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Add doc links for types

According to the C-LINK API guideline, docs should make use of links
to reference functions and types throughout, as this allows users to
quickly click-through to the referenced function/type.

Wrap backticked types and functions as links throughout.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates documentation comments in the rust-bitcoin library. It converts plain backtick-wrapped type and function names into clickable Rust doc links (e.g., changing `Block` to [`Block`]). No executable code, logic, or behavior was changed, so there is no security impact.

Security candidateMerge rust-bitcoin/rust-bitcoin#6711: primitives: Make `ScriptHash` and `WScriptHash` no-allocby Andrew Poelstra · fe0b3eb0 · Aug 12, 2026 · 5 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6711: primitives: Make `ScriptHash` and `WScriptHash` no-alloc

b2386c666d4b34bffb0c5b8f6a8da69663472595 Update API files (Mitchell Bagot)
4312fac4d6972b17c62f0f5c5675874091f5a93a primitives: Make ScriptHash and WScriptHash no-alloc (Mitchell Bagot)

Pull request description:

Currently, the entire primitives::script module is gated on the alloc feature. The ScriptHash and WScriptHash types as they are don't strictly require an allocator, and would permit most of the addresses crate to be no-alloc if they were available without the alloc feature.

Remove alloc feature gating for ScriptHash and WScriptHash by enabling a small script module with only them if the alloc feature is disabled.


ACKs for top commit:
apoelstra:
ACK b2386c666d4b34bffb0c5b8f6a8da69663472595; successfully ran local tests
tcharding:
ACK b2386c666d4b34bffb0c5b8f6a8da69663472595


Tree-SHA512: 01c03dc37dbf3ebbd3a80e0c1d9b68eb94eeb21e02f7c9aedf6f396a33f9fe0bb1299f44247b5ad279b8f36229e0c59512a93f68e9166625761514cc0e60b182

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlmerge-commit duplicate discount
AI analysis · Informational 15/100

This commit is a routine feature-gating refactor. It makes two small hash types (ScriptHash and WScriptHash) available even when the library is compiled without an allocator. It does not change how those types behave, does not fix a bug, and does not alter any security-sensitive logic.

Lower-priorityMerge rust-bitcoin/rust-bitcoin#6679: base58: Drop `decode` functionby Andrew Poelstra · c34cab10 · Aug 12, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6679: base58: Drop `decode` function

af57bd85101763a16fc559de270aaeaabeb8f329 Remove base58::decode function (Mitchell Bagot)
0025122aa01f9d3aa0d89fc33672f973ab34717d Replace uses of decode with decode_check (Mitchell Bagot)

Pull request description:

As part of the stabilisation of base58, the non-checksum functionality is to be removed. On the encoding side, this has already been done with the Base58CkString type, which only includes base58check functionality. For the decoding, the decode function can be removed at any time by in-lining it's logic into the decode_check function.

Inline base58::decode logic into base58::decode_check and remove base58:decode.

Contributes to #6417.


ACKs for top commit:
apoelstra:
ACK af57bd85101763a16fc559de270aaeaabeb8f329; successfully ran local tests
tcharding:
ACK af57bd85101763a16fc559de270aaeaabeb8f329


Tree-SHA512: f58c1c89babcf9d5c4ca8b83ab76ffc11e77a14ac72e6e5552195ea7e4e7b815ed86f7bff46ff1d02862b17c66f6ecfe81c35b09a9220cdf193828542310f7f0

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge rust-bitcoin/rust-bitcoin#6710: units: Implement Neg for Amount and NumOpResultby Andrew Poelstra · 5ffbf728 · Aug 11, 2026 · 5 filesMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6710: units: Implement Neg for Amount and NumOpResult

a531fc205098d9143c5a2d22e359560fca10544b Update API files (Jamil Lambert)
856e8de6cf2e94674f94d5cf22eca1cf394c9a1b units: Implement Neg for Amount and NumOpResult (stringsbuilder)

Pull request description:

Implements `Neg` for `Amount`, returning a `SignedAmount`, and for the `NumOpResult<Amount>` and `NumOpResult<SignedAmount>` result types.

Update API files.

Original work by stringsbuilder in #5875. Cherry picked and reviewer comments addressed.


ACKs for top commit:
apoelstra:
ACK a531fc205098d9143c5a2d22e359560fca10544b; successfully ran local tests
tcharding:
ACK a531fc205098d9143c5a2d22e359560fca10544b


Tree-SHA512: 0147efe4d5e1d7aa1a863ba9eaccf8cca4577502b4c9e51bf34a87b15c620e4dce119af2ab87c642a5db1a2354bae1eaecd2e9f512743bedf85a5424760a078c

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Security candidateMerge rust-bitcoin/rust-bitcoin#6690: consensus_encoding: expose lower level encoder/decoder interfacesby Andrew Poelstra · 76aac6ea · Aug 10, 2026 · 11 filesMessage 100 · StrongInformational 18Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6690: consensus_encoding: expose lower level encoder/decoder interfaces

9d91a6a0bb1e44877e00a3db667ae8d8f1da2009 api: update files (Nick Johnson)
c5bb5fade04716258e6521d4815e781a4ef8a4ab consensus_encoding: expose vec decoder drivers (Nick Johnson)
e5713bdc687e2c52b5097a4a3b1e4b8abe30315c consensus_encoding: add an encoder iterator driver (Nick Johnson)

Pull request description:

From the doc findings in https://github.com/rust-bitcoin/rust-bitcoin/pull/6651, there are only a handful (like, 2.5) of collection-based types in `consensus_encoding` which are tied to the higher level consensus codec `Encode`/`Decode` traits. These two patches expose the internals of the lower-level `Encoder`/`Decoder` traits which is a nice to have in rust-psbt where simple wrappers could then be defined for `PsbtEncode`/`PsbtDecode`.

## Encoding

I first tried to make some sort of `SliceEncoderWith` type following the pattern on the decoding-side, but this gets hairy due to the lifetimes present on the encoding-side. So I turned to `push_decode` and saw how Kixunil used an [iterator pattern there](https://github.com/Kixunil/push_decode/blob/master/src/encoders/iter.rs). I copied that over with a few tweaks and updated `SliceEncoder` to delegate to it.

One question I have here is that the new `IterEncoder` type defensively fuses the input iterator `let mut iter = iter.into_iter().fuse();`. I figure this is best practice, but it is useless for the existing `SliceEncoder` and there might be a performance hit?

The biggest change from `push_decode` is dropping the `I::Item: Into<E>, E: Encoder` bound and instead have an explicit type mapping, `Encoders`, for the type glue. This isn't a huge deal since not exposed to the caller, but it is what connects the `IterEncoder` logic to the existing `SliceEncoder`. But here are the details.

The little wrapper class in action:

```rust
IterEncoder::new(Encoders::new(txs))
```

vs. potentially the `Into` approach with a turbofish:

```rust
IterEncoder::<_, TransactionEncoder>::new(txs.iter())
```

I think to avoid having to add some `From` impl manually to every existing encodable type, we would want some sort of blanket impl. As far as I can tell, the type system can't handle this because of the orphan rule. `From` is external *and* `<T as Encode>::Encoder<'e>` is uncovered, external. We could add a new trait, but that would have the same issues outside of `consensus_encoding`. Maybe I am missing a better pattern for this though.

```rust
impl<'e, T: Encode> From<&'e T> for <T as Encode>::Encoder<'e> {
fn from(t: &'e T) -> Self { t.encoder() }
}
```

## Decoding

The decoding side is simpler on paper since there are no lifetimes to worry about, but I ended up exposing two new types for necessary flexibility: `VecDecoderWith` and `ExactVecDecoderWith`. While the API expands, these all delegate to each other so I don't think a large maintenance burden.

I maintained the use of a `Default` bound like we have on our existing `Decoder` drivers. Recently convinced myself that this is fine: https://github.com/rust-bitcoin/rust-bitcoin/issues/6674.


ACKs for top commit:
apoelstra:
ACK 9d91a6a0bb1e44877e00a3db667ae8d8f1da2009; successfully ran local tests


Tree-SHA512: e8e532139ebbde24c0ee5995d1e13eecce22716d8fe5a7dbe44c6a95e6243a8b47899cbc4c34dd70ebc3fba4d4daa17f7b41ddba8313a5ed970cbfefd9249f8b

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundaryparser or protocol pathmerge-commit duplicate discount
AI analysis · Informational 18/100

This commit is a routine library refactor: it exposes lower-level building blocks for encoding and decoding lists of Bitcoin data, and rewrites existing list encoders/decoders to use those new building blocks. There is no direct security fix or vulnerability being patched. It is an API expansion and internal cleanup in the consensus_encoding crate.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6713: build(deps): bump cargo-bins/cargo-binstall from 1.19.1 to 1.20.0by Andrew Poelstra · 617302d3 · Aug 10, 2026 · 1 fileMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6713: build(deps): bump cargo-bins/cargo-binstall from 1.19.1 to 1.20.0

3fdbd379ed7c29d2a576cc9263582a9933212f90 build(deps): bump cargo-bins/cargo-binstall from 1.19.1 to 1.20.0 (dependabot[bot])

Pull request description:

Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.19.1 to 1.20.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p>
<blockquote>
<h2>v1.20.0</h2>
<p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p>
<h4>In this release:</h4>
<ul>
<li>Fix IPv6 DNS issue for macOS (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2574">#2574</a> <a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2567">#2567</a> <a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2579">#2579</a>)</li>
<li>Add <code>os-name</code> template variable for <code>pkg-url</code> and <code>bin-dir</code> (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2328">#2328</a> <a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2570">#2570</a>)</li>
<li>Remove quad9 dns fallback (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2572">#2572</a>)</li>
</ul>
<h4>Other changes:</h4>
<ul>
<li>Upgrade dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/30b5ca8b54e1dcffd9548bc87ede1531310fdc67"><code>30b5ca8</code></a> release: cargo-binstall v1.20.0 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2583">#2583</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/bdd791de5adfec6407aee16a3b287f12ba0ef2d8"><code>bdd791d</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2565">#2565</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/657ff6595f9080d94bd696e3656fa7f84152adcf"><code>657ff65</code></a> build(deps): bump netdev from 0.43.0 to 0.44.0 in the deps group (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2581">#2581</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/280a9357bf131d957a090c390bf426ed086fa405"><code>280a935</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2580">#2580</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/ad6ae0185bd1663c6fbd1c4efa0c82d8105a5716"><code>ad6ae01</code></a> bugfix: IPv6 DNS issue (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2579">#2579</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/f8810ffa11196f23afb38e6fb64716fbf814ad8f"><code>f8810ff</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2578">#2578</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/f9b4c532b4655a9c9c00a50db9b48b265c32a055"><code>f9b4c53</code></a> Remove quad9 dns fallback (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2572">#2572</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/7884deddd95d515c3701294cf61a8b96cccc123b"><code>7884ded</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2571">#2571</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/1c2b96c2b86875d56caeec7b7ee9980812daf0d9"><code>1c2b96c</code></a> feat: add os-name template variable for pkg-url and bin-dir (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2570">#2570</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/7c6d6446dab5843b9ab70840f15fbad89e729fbd"><code>7c6d644</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2569">#2569</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/cargo-bins/cargo-binstall/compare/aaa84a43aec4955a42c5ffc65d258961e39f276e...30b5ca8b54e1dcffd9548bc87ede1531310fdc67">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cargo-bins/cargo-binstall&package-manager=github_actions&previous-version=1.19.1&new-version=1.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 3fdbd379ed7c29d2a576cc9263582a9933212f90; successfully ran local tests


Tree-SHA512: 8a4ee41d3c68ea93c655aae94ff628076b3041b3f329a88cf9baedc4fae1da648839cee69fbc0d151d61eac39c64585f66cf4e068d30c3f308480e78120705b2

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine update to a GitHub Actions workflow that bumps the version of a helper tool called cargo-binstall from 1.19.1 to 1.20.0. The tool is only used during automated version-compatibility checks in CI and is not part of the actual rust-bitcoin library that users install. There is no indication this update fixes or introduces a security problem in the project itself.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6714: build(deps): bump taiki-e/install-action from 2.81.4 to 2.81.10by Andrew Poelstra · e8250092 · Aug 10, 2026 · 2 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6714: build(deps): bump taiki-e/install-action from 2.81.4 to 2.81.10

a2a3f838bd5fd057cbb92877122acc2d0ecef0fe build(deps): bump taiki-e/install-action from 2.81.4 to 2.81.10 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.81.4 to 2.81.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.81.10</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.1.3.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.159.</p>
</li>
<li>
<p>Update <code>cosign@latest</code> to 3.1.1.</p>
</li>
</ul>
<h2>2.81.9</h2>
<ul>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.123.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.2.</p>
</li>
<li>
<p>Update <code>parse-changelog@latest</code> to 0.6.17.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.52.0.</p>
</li>
<li>
<p>Update <code>gungraun-runner@latest</code> to 0.19.2.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.20.0.</p>
</li>
</ul>
<h2>2.81.8</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.2.</p>
</li>
<li>
<p>Update <code>parse-dockerfile@latest</code> to 0.1.7.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.1.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.1.</p>
</li>
</ul>
<h2>2.81.7</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 45.0.1.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.1.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.45.1.</p>
</li>
<li>
<p>Update <code>rclone@latest</code> to 1.74.3.</p>
</li>
<li>
<p>Update <code>cargo-audit@latest</code> to 0.22.2.</p>
</li>
</ul>
<h2>2.81.6</h2>
<ul>
<li>
<p>Update <code>prek@latest</code> to 0.4.4.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.0.</p>
</li>
</ul>
<h2>2.81.5</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.19.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.85.11] - 2026-08-09</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.2.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.127.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.3.</p>
</li>
<li>
<p>Update <code>osv-scanner@latest</code> to 2.5.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.3.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.112.0.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.10.0.</p>
</li>
</ul>
<h2>[2.85.10] - 2026-08-07</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.2.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.2.7.</p>
</li>
<li>
<p>Update <code>cosign@latest</code> to 3.1.3.</p>
</li>
<li>
<p>Update <code>coreutils@latest</code> to 0.10.0.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.2.0.</p>
</li>
<li>
<p>Update <code>cargo-crap@latest</code> to 0.4.3.</p>
</li>
</ul>
<h2>[2.85.9] - 2026-08-06</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.1.</p>
</li>
<li>
<p>Update <code>wild@latest</code> to 0.10.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.2.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/7a79fe8c3a13344501c80d99cae481c1c9085912"><code>7a79fe8</code></a> Release 2.81.10</li>
<li><a href="https://github.com/taiki-e/install-action/commit/13599f4dab5fc9777c7a29b255a9106d1107ee1d"><code>13599f4</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ee40c2ad7099d51081c7f37b4d3d914a008b8403"><code>ee40c2a</code></a> Update <code>tombi@latest</code> to 1.1.3</li>
<li><a href="https://github.com/taiki-e/install-action/commit/c2336861b9e97b4c0e1b19bc5d8968501d4d3b3f"><code>c233686</code></a> Update <code>release-plz@latest</code> to 0.3.159</li>
<li><a href="https://github.com/taiki-e/install-action/commit/7f72f38ad02c28b2456e65ab89c50a362bb98aaa"><code>7f72f38</code></a> Update mise manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f8c685240840f35b073b629510ed9b7a853227f7"><code>f8c6852</code></a> Update <code>cosign@latest</code> to 3.1.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/fd2f5e3d644b484055ebf4268f474c565f148f25"><code>fd2f5e3</code></a> Release 2.81.9</li>
<li><a href="https://github.com/taiki-e/install-action/commit/537f98ea83c367b35b9810b787d0b2ded00efc1a"><code>537f98e</code></a> Update <code>wasm-bindgen@latest</code> to 0.2.123</li>
<li><a href="https://github.com/taiki-e/install-action/commit/6bf6dde29b365c072c8c9b09b160ba21042e6b1e"><code>6bf6dde</code></a> Update <code>tombi@latest</code> to 1.1.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/c1e16527666111091c11f4145f629c642a3c5aef"><code>c1e1652</code></a> Update release-plz manifest</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/cde8c9e634f4a17bc06b61413ac0ef75450eac46...7a79fe8c3a13344501c80d99cae481c1c9085912">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.81.4&new-version=2.81.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK a2a3f838bd5fd057cbb92877122acc2d0ecef0fe; successfully ran local tests


Tree-SHA512: ad182a3450d8503e5de3c631e221ddb7ea23eaacb55532d14cde4b9235d22eb7f5a4773453ed9d158423271d23c9c8d904ee106802121bc27fd88cfb9c7d701c

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine Dependabot update that changes the version of a third-party GitHub Action used only in automated testing workflows. It does not touch the actual Bitcoin library code, user-facing APIs, or any shipped software. There is no indication this fixes or introduces a security problem.

Security candidateMerge rust-bitcoin/rust-bitcoin#6592: primitives: Update API testby Andrew Poelstra · 0969e567 · Aug 10, 2026 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6592: primitives: Update API test

dec8df68621fab7de6196c10f9324244511fe864 Derive Debug on Decoders struct (Mitchell Bagot)
a3817e069687658ca3ff8333fbce888a08fc9cb7 Add Encoder struct (Mitchell Bagot)
db25c0849cf09d629cab4ea29b10c4ac0f862c47 Add Copy struct for types with Copy (Mitchell Bagot)
57a2fac7573ab6f4b4b0a2c7614ef45859e09afd Extend Debug, Display and serde assertions (Mitchell Bagot)
d12a0235501daca84b6c4e78c7727344771d38e9 Extend structs with new types (Mitchell Bagot)
5cb4b69081880a48599f41601d73bfa7b54006ac Add export tests for opcodes and witness_versions (Mitchell Bagot)
4706c5377403d014887b04ebda2ee233ff8afe2c Split locktime re-export test into absolute and relative (Mitchell Bagot)
1966cd470b989b59d70f7dbd16836ff508597bc8 Add new types to module export tests (Mitchell Bagot)

Pull request description:

The API test is intended to check that types in the crate implement various traits and are available to prevent regressions due to later changes. In practice, it hasn't been kept up to date as additions and changes have been made.


ACKs for top commit:
apoelstra:
ACK dec8df68621fab7de6196c10f9324244511fe864; successfully ran local tests
tcharding:
ACK dec8df68621fab7de6196c10f9324244511fe864


Tree-SHA512: 18a97c589128f9b7fe569a494b15509f103318b54efead3dde31508e30aa7eab03e3aa9688a50841c949c883121b4cfcc336f7f26e47aabe6177c61394250793

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlmerge-commit duplicate discount
AI analysis · Informational 15/100

This commit only updates an internal test file (primitives/tests/api.rs) that checks whether public types implement expected Rust traits and are exported correctly. It adds coverage for new types introduced in earlier development and reorganizes some existing tests. There is no change to production code, no bug fix, and no security-relevant behavior.

Lower-priorityMerge rust-bitcoin/rust-bitcoin#6697: ci: use lockfiles for embedded and cross testsby Andrew Poelstra · 446a94f4 · Aug 9, 2026 · 8 filesMessage 100 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6697: ci: use lockfiles for embedded and cross tests

fb887b196cff2f9a72ce5ef5b11e99ae15686296 ci: setup debug level based on runner debug setting (Nick Johnson)
2f52cac5db12ad37f1314024f9caba322dd26dd8 ci: use a lockfile for cross test (Nick Johnson)
8e0e5dbef6f0756aa2903272933b15ae19e8c63c ci: clean up embedded tests (Nick Johnson)

Pull request description:

Harden the `Embedded` and `Cross` CI jobs.

Last commit is unrelated to the lockfile stuff, and might be too aggressive, but tries to address this annoying thing I noticed recently where `7l` is tacked on to every log line in CI. This is due to the `progress` mode which is more UI focused:

```
[#] Checking for duplicate dependencies...7l
[#] No duplicate dependencies found7l
[b] Checking for cross-package duplicate dependencies...7l
[$] No cross-package duplicate dependencies found7l
[$] Checking for deprecated clippy.toml MSRV settings...7l
[b] No deprecated clippy.toml MSRV settings found7l
[$] Lint task completed successfully7h
```

The idea is that we can re-run jobs in "debug" mode through the UI and get all the noisy logs. But it looks like only admins can re-run jobs, so might not be super useful.

Closes #6696


ACKs for top commit:
satsfy:
reACK fb887b196cff2f9a72ce5ef5b11e99ae15686296
apoelstra:
ACK fb887b196cff2f9a72ce5ef5b11e99ae15686296; successfully ran local tests


Tree-SHA512: 4617bf21716add49cd16e671e9e6521b954fa176e605b9b749e611856fffc4072aa078da0d6ae516025ccbb7a93ac3515c6553574c9b404ecda39747858a224c

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validationmerge-commit duplicate discount
Lower-priorityMerge rust-bitcoin/rust-bitcoin#6700: Automated nightly rustfmt (2026-08-09)by Andrew Poelstra · 9d0e608c · Aug 9, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6700: Automated nightly rustfmt (2026-08-09)

5ee2e346560238a53063ad05a0a7b34a9de349b6 2026-08-09 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK 5ee2e346560238a53063ad05a0a7b34a9de349b6; successfully ran local tests


Tree-SHA512: b35be4bd3e6d1a5880889a61b209b852c848a339c1c0f74cd5f8c87d31c50ef2b736ba3518555436597a35e0662e87c62054e25b03e1c48420fc6c834f6efef3

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge rust-bitcoin/rust-bitcoin#6695: fuzz: fix cargo-fuzz install issue, add bip-434 message targets, clean up scriptsby Andrew Poelstra · 7b8f7065 · Aug 9, 2026 · 7 filesMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6695: fuzz: fix cargo-fuzz install issue, add bip-434 message targets, clean up scripts

eb3ecb81e1163911f5436f59e31649a3048e16b0 fuzz: regenerate fuzz targets, capture new bip434 additions (Nick Johnson)
716f9259e714bd4dbd5bb14f5ae3c12566349454 fuzz: standardize conventions in the 3 fuzz scripts (Nick Johnson)
e665a52ad9bbfab435c1702a89b4f176b312766f fuzz: check for chrt requirement in fuzz.sh (Nick Johnson)
ce91119f8ff8fcfdf902e1fe5b39acde04f2f754 fuzz: use workspace nightly toolchain (Nick Johnson)
9e469e7c04de14c7fe374129a44c90721e93a6bb fuzz: upgrade to cargo-fuzz@0.13.2 (Nick Johnson)
87358ef62502fe96c69ab3a765052a3238fc5475 fuzz: depend on cargo-fuzz to be installed (Nick Johnson)
e438cbba2a4f7352e218363e1e982ce95576dfe4 fuzz: allow manual triggering of fuzz workflow for easier testing (Nick Johnson)

Pull request description:

Fix the cargo-fuzz install issue and standardize a few more things with the fuzz scripts. Also add the new BIP 434 messages while here.

Will be doing a run on my fork remote to verify: https://github.com/nyonson/rust-bitcoin/actions/runs/31201696138/job/92942971443

Closes #6693


ACKs for top commit:
apoelstra:
ACK eb3ecb81e1163911f5436f59e31649a3048e16b0; successfully ran local tests


Tree-SHA512: 933325ee351a796814c5e9cb805188e5c3228d36a080a104690a5ad6420141b06a698ec9a47a1e5782c7859e909f35080ca4ee93613239d0c813c5f0d2d3ef19

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discount
Lower-priority2026-08-09 automated rustfmt nightlyby Fmt Bot · 5ee2e346 · Aug 9, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Fmt Bot

2026-08-09 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityMerge rust-bitcoin/rust-bitcoin#6698: bitcoin: fix changelog and forward port 0.32.xx and 0.32.xxx entriesby Andrew Poelstra · 1f0737db · Aug 8, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6698: bitcoin: fix changelog and forward port 0.32.xx and 0.32.xxx entries

d82888843c2b7af1ba72bc272cd35cef0b890fe1 bitcoin: forwardport 0.32.xx and 0.32.xxx changelog entries (Nick Johnson)
7cd67d0b151f04b30aeeea1e4ef8022394f58b06 bitcion: fix changelog entry order (Nick Johnson)

Pull request description:

Last time I forward port'd some entries, I somehow managed to splice them into the big 0.33.0-beta one, which leads to a very confusing read. First commit fixes that and the second forwardports a few more new releases (this time correctly hopefully).


ACKs for top commit:
apoelstra:
ACK d82888843c2b7af1ba72bc272cd35cef0b890fe1; successfully ran local tests
satsfy:
ACK d82888843c2b7af1ba72bc272cd35cef0b890fe1
tcharding:
ACK d82888843c2b7af1ba72bc272cd35cef0b890fe1


Tree-SHA512: 37eb4338425536b73f25b84ba615c9332b0d576fe9c81ef10a4e707a373906edc7221151e34b5a09edf6fd2a8d3d1f46081cb9af3e33c36987f4181681dbdf78

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountmerge-commit duplicate discount
AI review queuedMerge rust-bitcoin/rust-bitcoin#6694: units: Flatten Error Constructorsby Andrew Poelstra · 622ab209 · Aug 8, 2026 · 6 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6694: units: Flatten Error Constructors

9c43790cc9628606c25eb6cc4bce1b587b699512 units: Flatten nested error constructors (Abeeujah)
51ced9efd4ea23d265d2141565db1cc406dfc180 Allow unnecessary_map_on_constructor lint rule (Abeeujah)

Pull request description:

Refactor nested error constructors with chained `map_err` transformation,
This improves readability by making each error conversion step explicit
and easy to reason about.
- Patch 1: Allows the `unnecessary_map_on_constructor` lint rule.
- Patch 2: Flattens double nested `Err` constructors.


ACKs for top commit:
apoelstra:
ACK 9c43790cc9628606c25eb6cc4bce1b587b699512; successfully ran local tests; kinda code-churny but definitely an improvement


Tree-SHA512: 7102f91027511de2404850f65ef7c6a81aaeafc57db334c7d75293796ae9712691bb4a4951d7e84f212eb23e41c69b3df7fe1821f474d7cc420abf0a1aefbc21

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a code cleanup that rewrites how error values are constructed in the Rust Bitcoin library. It changes nested constructor calls like Err(OuterError(InnerError { ... })) into a flatter style using map_err. There is no functional change to how amounts, locktimes, or hex parsing behave, and no security bug is introduced or fixed.

Lower-priorityMerge rust-bitcoin/rust-bitcoin#6687: base58: Remove pub use of `std` typesby Andrew Poelstra · 236f1da9 · Aug 8, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6687: base58: Remove pub use of `std` types

7e86f6809031ed6d10fd848ece2cebaa3c7f02a3 base58: Remove pub use of std types (Mitchell Bagot)

Pull request description:

The String type is no longer used anywhere in the public API of base58, as the Base58CkString directly constructs &str types. The Vec type, being from std/alloc, shouldn't be pub re-exported.

Remove String re-export and replace Vec re-export with a use import.


ACKs for top commit:
apoelstra:
ACK 7e86f6809031ed6d10fd848ece2cebaa3c7f02a3; successfully ran local tests


Tree-SHA512: 4fa811dadb6308fef95c8edd6fcaf0eb151e4c4a26c92e3d3bcd9c18bd614e88e9345a9974f23e826a9dc55eb6a23b0db1ee8e41f4aa8348a297a08c7d35b0b1

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount