Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…
This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …
This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…
No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…
This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…
This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…
No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…
This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …
This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …
This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …
API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…
This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …
API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …
Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…
cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…
Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…
Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …
No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…
Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…
This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…
Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e; successfully ran local tests satsfy: ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e
This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability. The change only affects internal project workflow automation and does not touch the rust-bitcoin library code that users install.
Security candidateMerge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1by Andrew Poelstra · 328c4ae9 · Sep 21, 2026 · 17 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1
55c3a6f5d46ee147b0aea9abaee585ff22e47897 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot])
Pull request description:
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK 55c3a6f5d46ee147b0aea9abaee585ff22e47897; successfully ran local tests satsfy: ACK 55c3a6f5d46ee147b0aea9abaee585ff22e47897
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege stateboot or update pathdocumentation-only discountautomated dependency-update discountmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There is no indication this introduces a security problem.
AI review queuedMerge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0by Andrew Poelstra · 67600795 · Sep 21, 2026 · 2 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0
7d7e7269e50df6412aab796fd67b59abc94cc4ba build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (dependabot[bot])
Pull request description:
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v9.0.0 🌈 Change <code>prune-cache</code> default to <code>false</code></h2> <h2>Changes</h2> <p>This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a></p> <p>Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.</p> <h2>🚨 Breaking changes</h2> <ul> <li>Change <code>prune-cache</code> default to <code>false</code> <a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>fix: fall back to distribution ID when os-release has no version field <a href="https://github.com/cxzhong"><code>@cxzhong</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li> </ul> <h2>🚀 Enhancements</h2> <ul> <li>Speed up version client by partial response reads <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.11.30 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li> <li>chore: update known checksums for 0.11.29 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v8.3.2 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/c771a70e6277c0a99b617c7a806ffedaca235ff9"><code>c771a70</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/2f537ca87c1ffa233ca2a1b84815388e3e42d845"><code>2f537ca</code></a> chore: update known checksums for 0.11.30 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/2269552d547df6f50e57442326930d30d943afe3"><code>2269552</code></a> Speed up version client by partial response reads (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/47a7f4fb2e900d6c33a5b5f231fa21dbfaeba52f"><code>47a7f4f</code></a> Change <code>prune-cache</code> default to <code>false</code> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/71966eff34a27b0a62ed4b9f6f6e383e071b1bb5"><code>71966ef</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f12b1f0a84bd6dc2331b36b2bbdbb1d1e617dbcc"><code>f12b1f0</code></a> fix: fall back to distribution ID when os-release has no version field (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84"><code>ecd24dd</code></a> chore: update known checksums for 0.11.29 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/6a191366842ac1502ba6c07e9b5acd5c2d9d8db3"><code>6a19136</code></a> docs: update version references to v8.3.2 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK 7d7e7269e50df6412aab796fd67b59abc94cc4ba; successfully ran local tests
This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mention no security fixes; the only breaking change is that cache pruning is now disabled by default, which can increase GitHub Actions cache usage and cost. There is no evidence this affects the security of the rust-bitcoin library or its build outputs.
Security candidateMerge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3by Andrew Poelstra · b51cec63 · Sep 21, 2026 · 1 fileMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK 2cac6e38036b3c175f0fc1368e231e06abf80817; successfully ran local tests
This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch the project's Rust code, dependencies, or build outputs. The upstream release notes state there are no user-facing changes in 4.37.3. There is no indication this introduces or fixes a security issue in rust-bitcoin itself.
AI review queuedMerge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74deby Andrew Poelstra · 90330d15 · Sep 21, 2026 · 4 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de
Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dtolnay/rust-toolchain/commit/02cb101ec7c40f2c49e1d9714d64511d8e1b74de"><code>02cb101</code></a> Merge pull request 185 from fufesou/feat/force-non-host</li> <li><a href="https://github.com/dtolnay/rust-toolchain/commit/b38a663c5df0fd5ac7bb65ded7b02a3f7af3b636"><code>b38a663</code></a> Pass --force-non-host unconditionally</li> <li><a href="https://github.com/dtolnay/rust-toolchain/commit/a4f61a09a512763ecbf6a72db0464f906f59f011"><code>a4f61a0</code></a> Document rustup non-host opt-in requirement</li> <li><a href="https://github.com/dtolnay/rust-toolchain/commit/06b350f08c8596edaf3d95d38686ba934fc4a6a7"><code>06b350f</code></a> Support force-non-host toolchains</li> <li><a href="https://github.com/dtolnay/rust-toolchain/commit/d1031067263f94b142dd6c0ce24c5eb9d02d52a0"><code>d103106</code></a> Predefine branches up to 1.120</li> <li><a href="https://github.com/dtolnay/rust-toolchain/commit/3ea7b2dde9987cecfa88322de1f09983972fc8e9"><code>3ea7b2d</code></a> Add 1.98.1 patch release</li> <li>See full diff in <a href="https://github.com/dtolnay/rust-toolchain/compare/6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772...02cb101ec7c40f2c49e1d9714d64511d8e1b74de">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK a31e0b0e89778bbbd3d60ebc61c66c99b575a317; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin library code that users install or run, and nothing in the commit indicates a security problem.
Security candidateMerge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transactionby Andrew Poelstra · 1a365d53 · Sep 20, 2026 · 8 filesMessage 100 · StrongInformational 20Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction
0ac85705e849c7a44a730f6f2a41c6f0d069e42b primitives: make transaction and block exact encodable (Nick Johnson) 95b2d374f7a48e30a951722df7e6120b660f0d18 primitives: refactor handrolled witness encoder iterator (Nick Johnson) 50e81ce80404dd1d89557b0f2ea51e765e260eb4 consensus_encoding: add ExactSizeEncoder implementations to iterators (Nick Johnson)
Pull request description:
It is helpful in higher level protocols like PSBT to be able to get the serialized size of a type for things like length prefixes. To expose this on the top of the hierarchy `Block` and `Transaction` types, the lower level iterator needs to support exact size calculations (for stuff like inputs and outputs). A small code change, however, I think this is the first non-constant time exact size implementations due to iterator's dynamic size. I think it is worth it.
ACKs for top commit: apoelstra: ACK 0ac85705e849c7a44a730f6f2a41c6f0d069e42b; successfully ran local tests tcharding: ACK 0ac85705e849c7a44a730f6f2a41c6f0d069e42b
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundaryconstant-time or timing behaviorconsensus or confidential-proof validationsigning or wallet pathmerge-commit duplicate discount
AI analysis · Informational 20/100
This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication it addresses a security bug or was triggered by a security report.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it does not change any library code, cryptographic logic, or user-facing behavior of the rust-bitcoin crate itself. There is no indication of a security issue in the diff.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing behavior. There is no indication of a security fix or vulnerability.
AI review queuedbuild(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0by dependabot[bot] · 7d7e7269 · Sep 20, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]
build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the workflow still uses it only to install and run the zizmor security scanner. There is no indication in the commit of any security bug, malicious change, or vulnerability being fixed or introduced.
Security candidateMerge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 cratesby Andrew Poelstra · 457cb9b5 · Sep 20, 2026 · 6 filesMessage 100 · StrongInformational 21Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates
836624fc736cff9382923ae3b512bf6a17aecc55 chacha20_poly1305: drop Copy from Error (satsfy (Renato Britto)) 642d545046f5f48ec26e7d4ef9dc28fd38fdec74 p2p: drop Copy from error types (satsfy (Renato Britto)) 8c2e6b1841211cff624d2492276066b8bcc1c0db key_expression: drop Copy from bip32 error types (satsfy (Renato Britto)) 61677cc71f0e35d2d6bcf3efcee5f969b634fa00 units: drop Copy from OutOfRangeError (satsfy (Renato Britto)) dae6356f31b717a9dce7bdc71dd0954bd86e07a5 policy: say when an error type derives Copy (satsfy (Renato Britto))
Pull request description:
I'm reviewing every trait in units for 1.0. We try to use `Copy` on rust-bitcoin types, but I claim that the errors should not use it.
The old criteria, "`Copy` if and only if not `non_exhaustive`", demands `Copy` on parse errors such as `ParseIntError`, which hold their input as a String and cannot derive it, and forbids it on `NumOpError`, which `NumOpResult` requires, and also misses important observations made previously in rust-bitcoin's history about the `Copy` trait (read the brief history below).
An error that implements `Copy` cannot later be updated to include, say, a `String`, so every `Copy` put into an error is a public commitment that would require a breaking change later, making it valuable to remove before 1.0. The codebase tends to the minimization of Copy usage on errors already, 30+ changes would be required in units alone to satisfy the existing rule in policy.md atm.
The only exception for using `Copy` are in errors that are a field of a type that derives `Copy`. That situation requires `Copy`, e.g.: ```rs #[derive(Copy, Clone)] pub enum NumOpResult<T> { Valid(T), Error(NumOpError), // a field of a Copy type, so NumOpError must be Copy } ```
A brief history of `Copy` trait discussions on rust-bitcoin:
- [#843 PR checklist](https://github.com/rust-bitcoin/rust-bitcoin/issues/843): project adds checklist item for every public type and qualifies with "does not implement traits we could regret (mainly `Copy`, `Eq`, `Ord`, `PartialOrd`)". - [#1127 Add policy section](https://github.com/rust-bitcoin/rust-bitcoin/pull/1127): "error types should not commit to implementing traits they may not be able to implement in the future, especially `Copy`". Turned into our present "if and only if". - [#3879 Remove Copy from PushBytesError](https://github.com/rust-bitcoin/rust-bitcoin/pull/3879): "it makes the code less maintainable because we must commit to implementing `Copy`". - [#4076 Derive Copy for NumOpResult](https://github.com/rust-bitcoin/rust-bitcoin/pull/4076): PR makes `NumOpError` `Copy` because the container needs it. The one exception on our new policy. - [#6347 units: Clean up the api tests](https://github.com/rust-bitcoin/rust-bitcoin/pull/6347): `Copy` asserted on the `Enums`, errors excluded.
ACKs for top commit: apoelstra: ACK 836624fc736cff9382923ae3b512bf6a17aecc55; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
secret or key materialdefensive validationcryptography-sensitive pathmerge-commit duplicate discount
AI analysis · Informational 21/100
This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated silently by the compiler. The team wants to drop it from errors because once an error type promises to be `Copy`, it can never later hold a `String` or other non-copyable data without a breaking change. This is a forward-looking API-cleanup change, not a fix for an active security bug. It also changes some error methods from taking `self` by value to taking `&self`, which is a minor API adjustment.
Security candidateMerge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`by Andrew Poelstra · ed42dabd · Sep 19, 2026 · 4 filesMessage 96 · StrongInformational 18Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`
fe90ee7a2142d6b589604bbc431dbf910675b8d4 addresses: Adjust Address::from_script docs (Mitchell Bagot) 1161a9f4e53253ecb9be1b2363d92bfda55d7c47 Move from_script to Address and drop AddressExt (Mitchell Bagot)
Pull request description:
The Address::from_script method in AddressExt takes an AsRef\<Params> argument. This argument is only used to extract the contained Network. Rather than use the Params type in the signature, which requires a bitcoin dep, the stable Network type should be used directly. With this change, the method can be directly moved to the main Address type. With said move, the extension trait can also be dropped entirely.
Adjust and move AddressExt::from_script to the Address type in addresses. Drop the AddressExt trait.
ACKs for top commit: apoelstra: ACK fe90ee7a2142d6b589604bbc431dbf910675b8d4; successfully ran local tests Kixunil: ACK fe90ee7a2142d6b589604bbc431dbf910675b8d4
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Informational 18/100
This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion logic is copied unchanged, and the old extension trait is removed so users can call the method more naturally. There is no indication this fixes a bug or vulnerability.
AI review queuedMerge rust-bitcoin/rust-bitcoin#6061: Units improvementsby Andrew Poelstra · f9460859 · Sep 19, 2026 · 11 filesMessage 91 · StrongLow 35Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6061: Units improvements
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Low 35/100
This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, and removes an artificial restriction. The changes are mostly additive or renaming; they do not appear to fix a known vulnerability and the commit message does not describe any security issue.
Security candidateMerge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and subby Andrew Poelstra · 5324e59a · Sep 18, 2026 · 1 fileMessage 96 · StrongLow 49Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub
b0d240127f78cffa4cfdba72c5b85bcfcd0a0810 units: Test add and sub preserve div-by-zero error (Jamil Lambert, PhD) 0004180290e08500d3833e7289451fdf78b8049a units: Preserve error in NumOpResult add and sub (Jamil Lambert, PhD)
Pull request description:
Adding or subtracting `NumOpResults` replaced any error operand with a fresh overflow error.
Propagate the original error instead of constructing a new overflow error.
ACKs for top commit: tcharding: ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810 Kixunil: ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810 apoelstra: ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810; successfully ran local tests
This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error with a misleading 'overflow' error. Now it correctly keeps and reports the original error. This is a defensive correctness fix: it prevents error details from being lost, which could hide the true cause of a failure in downstream software.
6dc79c836479ada95a63b8b971d2c06bc4867715 benches: bump crossbeam-epoch to 0.9.21 (satsfy (Renato Britto)) 540ff32d80820031f2b9a4464a6dbdec31bf9494 benched: bump rand to 0.9.5 (satsfy (Renato Britto)) 23f7ab9e60ed6410d3e3806a215290aa54edac46 embedded: replace alloc-cortex-m with embedded-alloc (satsfy (Renato Britto))
Pull request description:
Resolve all solvable `cargo audit` errors brought up in https://github.com/rust-bitcoin/rust-bitcoin/issues/6405
This is a sister PR to https://github.com/rust-bitcoin/rust-bitcoin/pull/6895, which ignores 2 other `cargo audit` problems in `.cargo/audit.toml`.
## Commit 1
Per [`embedded-alloc` docs](https://github.com/rust-embedded/embedded-alloc/blob/master/CHANGELOG.md#changed-1): > The `Heap` struct has been renamed to `LlffHeap` and requires the `llff` feature.
`alloc-cortex-m` was renamed to `embedded-alloc`. The new crate uses the heap through [`critical-section`](https://github.com/rust-embedded/embedded-alloc?tab=readme-ov-file#example) instead of calling `cortex_m::interrupt::free` directly, so the binary must provide an implementation. `cortex-m` includes it behind its [`critical-section-single-core`](https://docs.rs/critical-section/latest/critical_section/#usage-in-no-std-binaries) feature, hence the new direct dependency. `llff` selects the linked list first fit heap, the same `linked_list_allocator` backend `alloc-cortex-m` already used, and `default-features = false` avoids also compiling the [alternative `tlsf` heap](https://github.com/rust-embedded/embedded-alloc?tab=readme-ov-file#features).
## Commit 2
rand 0.9.5 is in the patched range. rand 0.7 has no patch, so jobserver 0.1.18 drops it entirely. See https://rustsec.org/advisories/RUSTSEC-2026-0097.html
## Commit 3
crossbeam-epoch is a transitive dependency of the benchmark harness, not declared in any Cargo.toml. Advisory patched at 0.9.20, so the lockfile bump is the only solution. See https://rustsec.org/advisories/RUSTSEC-2026-0204.html
ACKs for top commit: tcharding: ACK 6dc79c836479ada95a63b8b971d2c06bc4867715 apoelstra: ACK 6dc79c836479ada95a63b8b971d2c06bc4867715; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security scanner warnings (cargo audit) about known issues in the old dependencies. The core rust-bitcoin library code is not directly changed, and the affected code is example/embedded firmware and benchmark tooling rather than production wallet logic.
Security candidateMerge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculationby Andrew Poelstra · 22bbc326 · Sep 18, 2026 · 3 filesMessage 91 · StrongLow 37Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation
914365b43c95aa63568da54acf12edc3fe7b8e9a consensus_encoding: fix bug in the composite encoder's exact size (Nick Johnson)
Pull request description:
The `ExactSizeEncoder::len` contract states that it should return the number of bytes *remaining* in the encoder. However, the composite encoders (e.g. `Encoder2`) return a static, total amount. This fix only returns amounts for non-finished sub-encoders.
nymius found this issue while hacking on rust-psbt.
ACKs for top commit: tcharding: ACK 914365b43c95aa63568da54acf12edc3fe7b8e9a apoelstra: ACK 914365b43c95aa63568da54acf12edc3fe7b8e9a; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundaryconsensus or confidential-proof validationmerge-commit duplicate discount
AI analysis · Low 37/100
This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrectly reporting the total size of all pieces even after some pieces were already processed. The fix makes it only count the pieces that have not yet been processed. The bug could cause callers that rely on len() for buffer sizing or progress checks to over-allocate or misjudge remaining work, but it is a correctness fix rather than a clear-cut security vulnerability.
Security candidateconsensus_encoding: fix bug in the composite encoder's exact sizeby Nick Johnson · 914365b4 · Sep 17, 2026 · 3 filesMessage 73 · AdequateLow 37Details
Commit message · Nick Johnson
consensus_encoding: fix bug in the composite encoder's exact size
The `ExactSizeEncoder::len` contract states that it should return the number of bytes *remaining* in the encoder. However, the composite encoders (e.g. `Encoder2`) return a static, total amount. This fix only returns amounts for non-finished sub-encoders.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
consensus or confidential-proof validation
AI analysis · Low 37/100
This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are left to write. The bug made this method report the total size of all pieces even after some pieces had already been written, which could mislead any code that relies on an accurate remaining-byte count. The fix makes the method only count bytes that have not yet been written.
Security candidateMerge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network typesby Andrew Poelstra · 81032b1a · Sep 17, 2026 · 14 filesMessage 91 · StrongInformational 18Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types
d8146e8a2ccddef2c67dd78eb3141d9b8edc6d4f addresses: Remove From<Network> for AddressParams (Mitchell Bagot) b82c9a5294d4f658bdbb4a4b779167e854d7d789 addresses: Remove From impls with KnownHrp and network types (Mitchell Bagot) a3d4b10e0d0cf4f3421ed2dd6a5c1e22d7b30712 addresses: Replace uses of NetworkKind and Params with AddressParams (Mitchell Bagot) 6ee899e66c9f600187665f5e52c17ab5abb05156 addresses: Replace public uses of Network with AddressParams (Mitchell Bagot) e556084cc77b14fcb456cbd82872dc88cd73c661 addresses: Add AddressParams type (Mitchell Bagot)
Pull request description:
The Network and NetworkKind types are currently used in the public API of the addresses crate. However, while the bitcoin-network-kind crate is 1.0, these types are not really stable the same way as other stable crate types are. Instead, we should aim to remove their use from the public API in favour of a to-be-stable AddressParams type.
Add AddressParams type with const values for current set of networks. Replace all public uses of bitcoin-network-kind types, except for Address::network_kind(), with appropriate AddressParams replacements.
ACKs for top commit: tcharding: ACK d8146e8a2ccddef2c67dd78eb3141d9b8edc6d4f apoelstra: ACK d8146e8a2ccddef2c67dd78eb3141d9b8edc6d4f; successfully ran local tests; hopefully we don't get too many https://github.com/rust-bitcoin/rust-bitcoin/issues/3166 complaints over this
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathsigning or wallet pathmerge-commit duplicate discount
AI analysis · Informational 18/100
This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security vulnerability here; it is a design change to make the address crate's public API more stable.
Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`
d0d2f2ee23959e0a970a90ed6ec3f8d9632af8b1 units: test that Sum keeps the error it was given (satsfy (Renato Britto)) ebbeb23687e5170cf847cd53f3d208acaffdcfc4 units: preserve original err summing NumOpResult (satsfy (Renato Britto))
The Sum impls replaced any error in the iterator with an addition overflow, so, say, a division by zero came out labelled MathOp::Add.
Also need to put `*amount` because a binding must have the same type in all alternatives, amount was a ref not owned while acc was, the compiler complained.
ACKs for top commit: apoelstra: ACK d0d2f2ee23959e0a970a90ed6ec3f8d9632af8b1; successfully ran local tests tcharding: ACK d0d2f2ee23959e0a970a90ed6ec3f8d9632af8b1 Kixunil: ACK d0d2f2ee23959e0a970a90ed6ec3f8d9632af8b1
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetymerge-commit duplicate discount
AI analysis · Low 38/100
This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely report it as an addition overflow. The fix preserves the original error so callers see the true cause of the failure. It is a correctness fix rather than a direct exploit, but misreported errors can mislead downstream code or users about what went wrong.
Note that nightly and stable rustc updates have broken: - https://github.com/rust-bitcoin/rust-bitcoin/actions/workflows/cron-weekly-update-stable.yml - https://github.com/rust-bitcoin/rust-bitcoin/actions/workflows/cron-weekly-update-nightly.yml
Because of `fail-fast`, a broken 0.32.xxx job takes the master and 0.32.xx updates down with it. This PR makes each branch succeed or fail on its own.
The cargo-rbmt install issue this PR originally also addressed was fixed on master by the shared setup-rbmt action, so that part is gone.
ACKs for top commit: apoelstra: ACK d9fef884e81f7686ce667352a1a97ad05826c482; successfully ran local tests tcharding: ACK d9fef884e81f7686ce667352a1a97ad05826c482
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancelled. This is purely a CI reliability/configuration change and does not touch any library code, cryptography, network handling, or user-facing behavior.
`div_by_fee_rate_floor` divided by the sat/kwu rate rounded up, understating the maximum affordable weight. Divide by the sat/MvB rate with a widened intermediate, as done for `div_by_weight_*` in #4675.
Closes project-loupe/audit-rust-bitcoin#81
ACKs for top commit: apoelstra: ACK 1b067e90f3dad98d727edf2c709c96e25925e04b; successfully ran local tests tcharding: ACK 1b067e90f3dad98d727edf2c709c96e25925e04b
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Moderate 62/100
This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per kilo-weight-unit), which could make the result slightly too small, understating the affordable weight. The fix uses a wider intermediate calculation with satoshis per million virtual bytes, matching a previous fix for related functions. It also now properly reports overflow when the result exceeds the maximum representable weight.
The non-human-readable `OutPoint` serializer writes `vout` as `u32::to_le_bytes()`, but the sequence visitor deserialized the field directly as a `u32`. Under a serializer whose integer byte order or width differs from those fixed little-endian bytes (for example bincode's big-endian or varint modes) the roundtrip returns the wrong `vout`, or fails. The map visitor already reads `[u8; 4]` and calls `u32::from_le_bytes`.
Read the `vout` field as `[u8; 4]` and decode it with `u32::from_le_bytes` in the sequence visitor, matching the serializer and the map visitor.
Closes project-loupe/audit-rust-bitcoin#126
ACKs for top commit: apoelstra: ACK 674198e595d8192eeb85703018153b24835957fe; successfully ran local tests tcharding: ACK 674198e595d8192eeb85703018153b24835957fe
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit fixes a serialization bug in how the `OutPoint` type (a Bitcoin transaction output identifier) handles its `vout` number when using non-human-readable serde formats. The code was writing `vout` as fixed little-endian bytes but reading it back as a generic integer, which could corrupt or fail deserialization under formats that use big-endian or variable-length integers. The fix makes the reader match the writer by always decoding four little-endian bytes. A regression test using bincode in big-endian mode was added.
Merge rust-bitcoin/rust-bitcoin#6879: primitives: Fix Witness::get index overflow
ca6bf03d0b41521327e9041104612aaf538ff703 primitives: Test Witness::get index overflow (Jamil Lambert, PhD) fb0bbc1dd77da590f0ab94b166b41dd942a6410e primitives: Fix Witness::get index overflow (Jamil Lambert, PhD)
Pull request description:
`Witness::get` passes a caller-controlled index to `decode_cursor`, which computes `start_of_indices + index * 4` with unchecked arithmetic. A large index such as `usize::MAX / 4 + 1` overflows: with overflow checks off it wraps back to element 0's offset and returns the first element instead of `None`, and with them on it panics.
Use checked arithmetic so an out-of-range index returns `None`.
Closes project-loupe/audit-rust-bitcoin#159
ACKs for top commit: apoelstra: ACK ca6bf03d0b41521327e9041104612aaf538ff703; successfully ran local tests tcharding: ACK ca6bf03d0b41521327e9041104612aaf538ff703 satsfy: tACK ca6bf03d0b41521327e9041104612aaf538ff703
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetymerge-commit duplicate discount
AI analysis · Moderate 51/100
This commit fixes a bug in how the Bitcoin library reads items from a transaction witness. A function called Witness::get takes an index number from the caller and uses it to calculate a memory offset. With a very large index, the arithmetic could overflow, either returning the wrong witness item or causing the program to panic. The fix uses checked arithmetic so that any out-of-range index safely returns None. The bug was found during an external security audit.
AI review queuedMerge rust-bitcoin/rust-bitcoin#6850: Use stacked attributes for feature conjunctionsby Andrew Poelstra · ab7652b3 · Sep 15, 2026 · 3 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6850: Use stacked attributes for feature conjunctions
95395f17876e6ca7458a362ace0f71cb22e60649 primitives: stack feature gates in tx example (satsfy (Renato Britto)) 25b5814a0ab20d27026827e432c0a723746eec95 encoding: stack the feature gates in tests (satsfy (Renato Britto))
Pull request description:
Reading `policy.md` I noticed it says to use stacked attributes rather than `cfg(all(...))` whenever possible [\[1\]](https://github.com/rust-bitcoin/rust-bitcoin/blob/master/docs/policy.md#attributes), but then grepped 7 places in code where this was not the case, including in primitives. One commit per crate.
ACKs for top commit: tcharding: ACK 95395f17876e6ca7458a362ace0f71cb22e60649 apoelstra: ACK 95395f17876e6ca7458a362ace0f71cb22e60649; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathparser or protocol pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a code-style cleanup with no security impact. It changes how Rust conditional-compilation attributes are written, replacing combined `#[cfg(all(...))]` checks with stacked `#[cfg(...)]` attributes, following the project's own documented style policy. No program behavior changes.
Security candidateMerge rust-bitcoin/rust-bitcoin#6881: build(deps): bump cargo-bins/cargo-binstall from 1.20.1 to 1.21.0by Andrew Poelstra · 12a14bdf · Sep 15, 2026 · 1 fileMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6881: build(deps): bump cargo-bins/cargo-binstall from 1.20.1 to 1.21.0
145ce18399b7b4b598953d13261e4201beeda3ef build(deps): bump cargo-bins/cargo-binstall from 1.20.1 to 1.21.0 (dependabot[bot])
Pull request description:
Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.20.1 to 1.21.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p> <blockquote> <h2>v1.21.0</h2> <p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p> <h4>In this release:</h4> <ul> <li>bugfix: honour --version for git or local manifest (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2165">#2165</a> <a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2598">#2598</a></li> <li>Prefer ipv6 for hickory-dns dns resolution (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2595">#2595</a>%</li> </ul> <h4>Other changes:</h4> <ul> <li>Upgrade dependencies</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/ead08b90bd7b2e6d81963fb9cf0b7239f66d5db4"><code>ead08b9</code></a> release: cargo-binstall v1.21.0 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2605">#2605</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/802977a265b5f8825ebef2176db5f5f3edc82280"><code>802977a</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2603">#2603</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/45c74199ecd000df66e6831e4854e43e2210706b"><code>45c7419</code></a> Revert "ci(release-packages): Disable x86_64-apple-darwin" (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2604">#2604</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/1ed4c64e0e8fbfae6e9dabc91a36379fa7dc4916"><code>1ed4c64</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2602">#2602</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/3d9c602cf4a75690ce794b00d847819897b7766a"><code>3d9c602</code></a> fix: honour --version for git or local manifest (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2598">#2598</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/16386d7aec17cb0ec8457ab4df1ae7aac2e74492"><code>16386d7</code></a> ci(release-packages): Disable x86_64-apple-darwin (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2597">#2597</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/44018a4d9c280bea4bd3f908fabe5a0909f89f92"><code>44018a4</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2596">#2596</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/d9924acdd31c88b15c7a896bafd124fd4abcd1f0"><code>d9924ac</code></a> hickory-dns: Prefer ipv6 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2595">#2595</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/910d9e4456ce4b039662d2a02a34ef1d23c3c50c"><code>910d9e4</code></a> build(deps): bump cargo_toml from 0.22.3 to 1.0.0 in the deps group (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2592">#2592</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/cc0ff5705d427f8ef3f3343098bb13d864a7f8e7"><code>cc0ff57</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2591">#2591</a>)</li> <li>See full diff in <a href="https://github.com/cargo-bins/cargo-binstall/compare/732870f031d2fb36309d0deaf36abcc704a7be65...ead08b90bd7b2e6d81963fb9cf0b7239f66d5db4">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK 145ce18399b7b4b598953d13261e4201beeda3ef; successfully ran local tests
This is a routine automated update by Dependabot that changes one line in a GitHub Actions workflow. It bumps the version of cargo-binstall, a helper tool used only during CI checks for semantic versioning. There is no indication this fixes or introduces a security problem in the rust-bitcoin library itself.
• Replaced 7 nested error constructions in key, WIF, ECDSA, and Taproot parsing with chained map_err calls. This makes each conversion easier to follow from the leaf error to the outer wrapper, while preserving exact error values, intentional source-error discarding, and public APIs.
ACKs for top commit: Abeeujah: ACK a1ba025ea356f2753f8d4e297f132ed4c41bf72e apoelstra: ACK a1ba025ea356f2753f8d4e297f132ed4c41bf72e; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit is a code cleanup that rewrites how errors are wrapped in the Bitcoin crypto library. It changes nested error constructors into chained map_err calls but keeps the exact same error values and public behavior. There is no security-relevant change.
