RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
141commits · 30 days
284commits · 60 days
1150commits · 180 days
2046commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 50 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateAdd try_push to Buffer traitby Mitchell Bagot · aafb6065 · Jul 8, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add try_push to Buffer trait

As part of the introduction of no-alloc encoding, the Buffer trait will
need a push function that can fail gracefully when it overflows. The
simplest solution is to introduce a try_push function that is infallible
for Vec and calls through to try_push on ArrayVec.

Add try_push function to Buffer trait.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
memory safety
AI analysis · Informational 15/100

This commit adds a new `try_push` method to an internal `Buffer` trait used during Base58 encoding. It is a straightforward, additive change that lets encoding code gracefully handle a full fixed-size buffer in no-allocation builds. There is no bug fix, no behavior change to existing code paths, and no security issue visible in the diff.

Lower-prioritySplit format_iter into encode_to_bufferby Mitchell Bagot · f85780de · Jul 8, 2026 · 1 fileMessage 58 · ThinInformational 18Details
Commit message · Mitchell Bagot

Split format_iter into encode_to_buffer

As part of the no-alloc encoding, a fallible method for encoding data
to an ArrayVec will be needed. Rather than duplicate the logic, the
existing format_iter can be split into an encode_to_buffer that writes
to a backing Buffer (Vec or ArrayVec) and then re-written to dump that
local backing buffer to the fmt::Write instance.

Introduce encode_to_buffer fallible function for encoding a u8 iter to
a Buffer instance and rewrite format_iter to use it.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit refactors base58 encoding so the same encoding logic can be reused with a fixed-size, no-allocation buffer (ArrayVec) as well as the existing heap buffer (Vec). It removes several `#[cfg(feature = "alloc")]` guards from shared constants and traits, and introduces a fallible `encode_to_buffer` helper. The change is a code-cleanup/refactoring step toward supporting no-alloc environments; it does not by itself fix a reported security bug.

Lower-priorityAdd Base58CkString typeby Mitchell Bagot · 5adcab52 · Jul 8, 2026 · 2 filesMessage 51 · ThinInformational 15Details
Commit message · Mitchell Bagot

Add Base58CkString type

With the previous changes to the Buffer and new encode_to_buffer
function, a stack-based type Base58CkString for encoding can now be
trivially defined. As with the existing logic, this type encodes in
either an ArrayVec, or a Vec depending on the feature gating and
provides simple conversions to strings and ascii byte buffers.

Introduce Base58CkString type that provides alloc/no-alloc base58check
encoding.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit adds a new type, Base58CkString, for encoding Bitcoin-style base58check strings. It is a routine feature addition that makes encoding work both with and without memory allocation. There is no indication of a security bug or fix.

Lower-priorityRemove push from Bufferby Mitchell Bagot · c768df58 · Jul 8, 2026 · 1 fileMessage 51 · ThinInformational 15Details
Commit message · Mitchell Bagot

Remove push from Buffer

With the change to encode_to_buffer/format_iter to use the fallible
try_push, the infallible push is no longer needed on the Buffer trait.

Remove push function from Buffer trait.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine internal cleanup in the rust-bitcoin library's base58 module. It removes an unused 'push' method from a private helper trait called Buffer, because the code now uses a fallible 'try_push' method instead. There is no security-relevant change: no behavior is altered, no bug is fixed, and no vulnerability is introduced or removed.

AI review queuedUpdate API filesby Mitchell Bagot · 77cf6dc5 · Jul 8, 2026 · 2 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API listing files (text snapshots of public functions/types). It adds lines describing two new public methods on script types. There is no source code change, no bug fix, and no security relevance visible in the diff.

Lower-priorityMove script_hash and wscript_hash to primitivesby Mitchell Bagot · 9c15fd0c · Jul 8, 2026 · 4 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Move script_hash and wscript_hash to primitives

The script_hash and wscript_hash functions in Script extension traits
currently function the same as the W/ScriptHash::from_script
constructors. Until recently, these could not be moved as the
prerequisite functionality and types had yet to be moved. With the
recent moves of functionality to primitives, these can now be moved.

Move script_hash and wscript_hash to primitives on the base types.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine internal code reorganization. It moves two helper methods, `script_hash` and `wscript_hash`, from one Rust module to another within the same project. The methods still do exactly the same thing—compute the same Bitcoin script hashes—and are still called the same way. There is no change to security behavior, no bug fix, and no vulnerability.

Lower-priorityAdd default_rpc_port method to NetworkExt traitby jaoleal · dd81148a · Jul 7, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · jaoleal

Add default_rpc_port method to NetworkExt trait

Add a `default_rpc_port` method to `NetworkExt`, mirroring the existing
`default_p2p_port` method but for the JSON-RPC interface values.

Includes unit tests following the same pattern as `default_p2p_port`.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit adds a simple helper function that returns the default Bitcoin JSON-RPC port number for each supported network (Bitcoin mainnet, Signet, Testnet versions, and Regtest). It is purely additive: it exposes no new network service, changes no existing behavior, and contains no input parsing, cryptography, or memory-unsafe code. There is no security issue here.

Lower-priorityAdd newline after heading on new_witness_program_uncheckedby Mitchell Bagot · 682f1989 · Jul 7, 2026 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add newline after heading on new_witness_program_unchecked

Function doccomments should always have a blank line between the first
heading line and any subsequent comment content. While the
new_witness_program_unchecked functions are not public, they might as
well be adjusted to suit this standard.

Add newline under the heading lines of each instance of
new_witness_program_unchecked.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only adds blank lines inside documentation comments for three internal helper functions. It changes no executable code, no APIs, and no behavior, so it has no security relevance.

Lower-priorityAdd comments to new_witness_program_unchecked about duplicatesby Mitchell Bagot · fd8b0879 · Jul 7, 2026 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add comments to new_witness_program_unchecked about duplicates

The new_witness_program_unchecked is currently duplicated three times
in addresses, bitcoin and primitives. Since there may be changes needed
to any of the three, comments should be added to remind future devs of
the need to keep the three in sync.

Add comment to each new_witness_program_unchecked instance to keep them
in sync.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only adds plain-text comments to three copies of the same internal helper function, reminding future developers that the copies should be kept in sync. No code behavior was changed, so it has no security effect on its own.

Lower-priorityRemove doccomments from ScriptPubKeyBufExt fn implsby Mitchell Bagot · 1b5efc4d · Jul 7, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Remove doccomments from ScriptPubKeyBufExt fn impls

The doccomments on the function implementations of ScriptPubKeyBufExt
do not do anything. The docs are rendered from the doccomments on the
trait definition itself. Those on the impl should be removed.

Remove doccomments from ScriptPubKeyBufExt functions in the impl block.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only removes five documentation comments from the implementation of a Rust trait. The actual code behavior does not change; only the source-code comments are deleted because the documentation is already rendered from the trait definition. There is no security relevance.

Lower-priorityscript: make new_p2wsh available on hashable scriptsby weifanglab · 57e55036 · Jul 7, 2026 · 2 filesMessage 65 · AdequateInformational 15Details
Commit message · weifanglab

script: make new_p2wsh available on hashable scripts

Signed-off-by: weifanglab <weifanglab@outlook.com>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates two public API listing files (text snapshots of the crate's public interface). It widens which script types can call a helper that builds a Pay-to-Witness-Script-Hash output. There is no code change, no bug fix, and no security behavior change visible in the diff.

Lower-priorityscript: make new_p2wsh available on hashable scriptsby weifanglab · 5d339e84 · Jul 7, 2026 · 2 filesMessage 65 · AdequateInformational 15Details
Commit message · weifanglab

script: make new_p2wsh available on hashable scripts

Signed-off-by: weifanglab <weifanglab@outlook.com>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a small API change in a Bitcoin library written in Rust. It moves a helper function that creates P2WSH (pay-to-witness-script-hash) output scripts so it can be used on more script types. There is no indication this fixes a security bug or introduces a vulnerability; it appears to be a routine feature/cleanup change.

Lower-priorityconsensus_encoding: Add crate level doc for decode_from_hexby Tobin C. Harding · a29f4adb · Jul 7, 2026 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Tobin C. Harding

consensus_encoding: Add crate level doc for decode_from_hex

Missing from the list of crate level docs - add it.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a pure documentation update. It adds one missing bullet point to the crate-level documentation list, describing a function that already existed. No code behavior changed.

Lower-priorityAdd gitignore for Cargo.lock.backupby Tobin C. Harding · 38f46d82 · Jul 7, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Add gitignore for Cargo.lock.backup

Created by `cargo rbmt`, lets just ignore it.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit adds one line to the project's .gitignore file so that backup files named Cargo.lock.backup are ignored by Git. It is a routine housekeeping change with no security relevance.

AI review queuedapi: regenerate api snapshotsby satsfy (Renato Britto) · 42f8ddb2 · Jul 7, 2026 · 2 filesMessage 35 · OpaqueInformational 15Details
Commit message · satsfy (Renato Britto)

api: regenerate api snapshots

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates automatically-generated API snapshot text files. The snapshots now show that some error and I/O types are reported as coming from Rust's `core` library instead of the `std` library. This is a documentation/test-artifact change with no functional code modification and no security relevance.

Lower-priorityunits: refactor variable initialization locationby satsfy (Renato Britto) · cf6c1a52 · Jul 7, 2026 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · satsfy (Renato Britto)

units: refactor variable initialization location

Prevents an unneeded late initialization lint error.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This is a minor code cleanup in the rust-bitcoin library. It moves where a variable is first given a value so that the Rust compiler stops warning about unnecessary late initialization. There is no change to program behavior, no bug fix, and no security relevance.

Lower-priorityAutomated update to rustc nightly-2026-07-02by Update Nightly Rustc Bot · 30334cbe · Jul 7, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Update Nightly Rustc Bot

Automated update to rustc nightly-2026-07-02

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is a routine automated update that changes the pinned Rust nightly compiler version in the project's configuration file from one recent nightly to another. There is no code change, no bug fix, and no security-relevant content.

Lower-priorityci: add bitcoin_hashes and bitcoin-network-kind to SEMVER_HARD_FAIL_CRATESby jrakibi · 30d8c6c6 · Jul 6, 2026 · 1 fileMessage 85 · StrongInformational 15Details
Commit message · jrakibi

ci: add bitcoin_hashes and bitcoin-network-kind to SEMVER_HARD_FAIL_CRATES

Currently only bitcoin-consensus-encoding is listed as a hard-fail crate.
bitcoin_hashes and bitcoin-network-kind are 1.0 too, so add them to
SEMVER_HARD_FAIL_CRATES.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only changes a CI script that lists which Rust crates must follow strict semantic-versioning rules. It adds two already-released 1.0 crates to the hard-fail list so future pull requests will fail automated checks if they accidentally break backward compatibility. There is no change to library code, no bug fix, and no security relevance.

Lower-priorityci: Scan bitcoin-network-kind for semver breaksby jrakibi · f4efe62a · Jul 6, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · jrakibi

ci: Scan bitcoin-network-kind for semver breaks

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds a new Rust package (bitcoin-network-kind) to an existing CI script that checks for accidental breaking changes in public APIs. It does not change any library code, runtime behavior, or security-sensitive logic. There is no security issue here.

Lower-priorityAdjust Script::witness_version doccommentby Mitchell Bagot · 73f19ddf · Jul 6, 2026 · 1 fileMessage 58 · ThinInformational 15Details
Commit message · Mitchell Bagot

Adjust Script::witness_version doccomment

The doccomment for witness_version starts with "Returns witness version
of the script, if any, assuming the script is a scriptPubkey". The
"assuming" clause can be dropped since the type system now enforces
that this is either a scriptPubKey or a redeemScript.

Remove "assuming the script is a scriptPubkey" from
Script::witness_version docs.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only changes a documentation comment for a Rust function. It removes the phrase 'assuming the script is a scriptPubkey' because the code's type system now guarantees the script type. No code behavior was altered, so there is no security impact.

AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 29bb6aa2 · Jul 6, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.35.2 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...68bde559dea0fdcac2102bfdf6230c5f70eb485e)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.35.4
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine patch-version update of a GitHub-maintained security scanning helper (the CodeQL upload-sarif action) inside a CI workflow. It does not change the project's actual Bitcoin library code, its public interfaces, or how user funds or data are handled. There is no indication this commit fixes or introduces a security vulnerability.

Security candidatebuild(deps): bump actions/checkout from 5.0.0 to 6.0.2by dependabot[bot] · 14a75c38 · Jul 6, 2026 · 16 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/checkout from 5.0.0 to 6.0.2

Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountautomated dependency-update discount
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the version of the GitHub Actions 'checkout' tool used by the project's CI workflows from version 5.0.0 to version 6.0.2. It only affects how the repository code is downloaded during automated testing and release tasks. There is no indication of a security vulnerability being fixed or introduced, and no project source code is changed.

AI review queuedbuild(deps): bump ncipollo/release-action from 1.20.0 to 1.21.0by dependabot[bot] · 5c75b6da · Jul 6, 2026 · 1 fileMessage 93 · StrongInformational 13Details
Commit message · dependabot[bot]

build(deps): bump ncipollo/release-action from 1.20.0 to 1.21.0

Bumps [ncipollo/release-action](https://github.com/ncipollo/release-action) from 1.20.0 to 1.21.0.
- [Release notes](https://github.com/ncipollo/release-action/releases)
- [Commits](https://github.com/ncipollo/release-action/compare/b7eabc95ff50cbeeedec83973935c8f306dfcd0b...339a81892b84b4eeb0f6e744e4574d79d0d9b8dd)

---
updated-dependencies:
- dependency-name: ncipollo/release-action
dependency-version: 1.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 13/100

This is a routine update by Dependabot to the GitHub Action used for creating releases. It changes the pinned version of ncipollo/release-action from 1.20.0 to 1.21.0 in the project's release workflow. There is no direct evidence in the commit or supplied references that this update fixes a security vulnerability or introduces one. It is a normal dependency maintenance change.

AI review queuedbuild(deps): bump astral-sh/setup-uv from 7.1.2 to 8.1.0by dependabot[bot] · fab2fabb · Jul 6, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump astral-sh/setup-uv from 7.1.2 to 8.1.0

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.1.2 to 8.1.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41...08807647e7069bb48b6ef5acd8ec9567f424441b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new version is a major release of the setup-uv action, but the commit itself only updates the pinned commit hash and keeps the same major-version comment. There is no indication in the commit that this fixes a security vulnerability or introduces malicious behavior.

AI review queuedbuild(deps): bump actions/cache from 5.0.0 to 5.0.5by dependabot[bot] · a22ae9a8 · Jul 6, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/cache from 5.0.0 to 5.0.5

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.0 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf0...27d5ce7f107fe9357f9df03efb73ab90386fccae)

---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps the version of a GitHub Actions caching tool used only in a daily fuzzing workflow. There is no code change to the rust-bitcoin library itself, and nothing in the commit indicates a security problem.