rust-bitcoin

Merge rust-bitcoin/rust-bitcoin#6882: build(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2

35095071907110087cceb7038264861b421e4adc build(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.11 to 2.83.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.83.2</h2>
<ul>
<li>
<p>Update <code>parse-dockerfile@latest</code> to 0.1.8.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.5.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.56.0.</p>
</li>
<li>
<p>Update <code>gungraun-runner@latest</code> to 0.19.4.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.4.1.</p>
</li>
</ul>
<h2>2.83.1</h2>
<ul>
<li>
<p>Update <code>rclone@latest</code> to 1.74.4.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.4.</p>
</li>
<li>
<p>Update <code>cargo-deny@latest</code> to 0.20.2.</p>
</li>
</ul>
<h2>2.83.0</h2>
<ul>
<li>
<p>Support <code>cargo-about</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1924">#1924</a>, thanks <a href="https://github.com/ruffsl"><code>@​ruffsl</code></a>)</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.28.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.12.0.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.106.0.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.3.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.87.12] - 2026-09-12</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.2.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.259.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.13.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.165.</p>
</li>
<li>
<p>Update <code>protoc-gen-connect-openapi@latest</code> to 0.27.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.5.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.144.</p>
</li>
</ul>
<h2>[2.87.11] - 2026-09-11</h2>
<ul>
<li>
<p>Update <code>biome@latest</code> to 2.5.13.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.12.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.4.</p>
</li>
<li>
<p>Update <code>kache@latest</code> to 0.19.0.</p>
</li>
</ul>
<h2>[2.87.10] - 2026-09-10</h2>
<ul>
<li>
<p>Update <code>zizmor@latest</code> to 1.30.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.11.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.4.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.164.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.3.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/43aecc8d72668fbcfe75c31400bc4f890f1c5853"><code>43aecc8</code></a> Release 2.83.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/fca47892c74f4dffa1e86ad93eca31cf898c2541"><code>fca4789</code></a> Update prek manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/b41cc1f9ab348b9db341d8597853df93b08652f0"><code>b41cc1f</code></a> Update <code>parse-dockerfile@latest</code> to 0.1.8</li>
<li><a href="https://github.com/taiki-e/install-action/commit/8d866f8ca86db77044d7d29639e24660d0b37b88"><code>8d866f8</code></a> Update <code>mise@latest</code> to 2026.7.5</li>
<li><a href="https://github.com/taiki-e/install-action/commit/7ebe462223a33af951eed3c3ab1f754ddf2992e2"><code>7ebe462</code></a> Update <code>just@latest</code> to 1.56.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/01ab5633b01b19988c158b5366d64947fd6cacce"><code>01ab563</code></a> Update <code>gungraun-runner@latest</code> to 0.19.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f164a682e7e0033cf72f1d5722d079fe82275c1e"><code>f164a68</code></a> Update <code>cargo-neat@latest</code> to 0.4.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/2ca9b94c269419b7b0c711c09d0b21c4e1d51145"><code>2ca9b94</code></a> Release 2.83.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/8598f86981150fb7f6511798af658bbf80a8ea46"><code>8598f86</code></a> Update parse-dockerfile manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/76cfe4de2d710e12bae93580164f20dff9fd96e9"><code>76cfe4d</code></a> Update <code>rclone@latest</code> to 1.74.4</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/5ebac0d9522d786674368e47e92963ba13f2c376...43aecc8d72668fbcfe75c31400bc4f890f1c5853">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 35095071907110087cceb7038264861b421e4adc; successfully ran local tests
satsfy:
ACK 35095071907110087cceb7038264861b421e4adc


Tree-SHA512: 70f4da27a773a65a8bf99852311817d79ef38d4c3eb3cfb4288ef2646e02367a7dbaceac844f969cea2bb75a6535af431c7b17f628a53a9bd2f8d74ec3fbdd62

Merge rust-bitcoin/rust-bitcoin#6878: Automated nightly rustfmt (2026-09-13)

909e1f23f829afd9d5475c3744995e5229b05e04 2026-09-13 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK 909e1f23f829afd9d5475c3744995e5229b05e04; successfully ran local tests
satsfy:
ACK 909e1f23f829afd9d5475c3744995e5229b05e04


Tree-SHA512: 0237f0a909bab93b60bae3f1ace465d76c0084198bd4ef3bb4f1033276881260e7a7393ca94de6fb949c4a75d40f41e60a2616f99a8e3aa4e23b2f5a4ec9eae6

Merge rust-bitcoin/rust-bitcoin#6867: consensus_encoding: Flatten remaining error constructors

234f39fd8de288bd607a47ed34ee8377f31f0351 consensus_encoding: Flatten remaining error constructors (Gaurav Chaudhary)

Pull request description:

Contributes to #6539.

Follow up on #6546 by flattening 14 remaining nested error constructions in consensus_encoding. Chained map_err calls make each conversion read from the leaf error outward, improving readability while preserving behavior and public APIs.

Crate tests, feature checks, and repository lint pass.


ACKs for top commit:
apoelstra:
ACK 234f39fd8de288bd607a47ed34ee8377f31f0351; successfully ran local tests


Tree-SHA512: 54e2b0421412c07fe2a60a4557b790f3e010897bec9d0a878e1e8b48674b2525c6ceafdb2751e9d6f4d867f30ec9e4b1f7ded65e07bea5cc28074288ed6291c6

build(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.11 to 2.83.2.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/5ebac0d9522d786674368e47e92963ba13f2c376...43aecc8d72668fbcfe75c31400bc4f890f1c5853)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.83.2
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge rust-bitcoin/rust-bitcoin#6851: units: Remove amount parsing limit

76a18b1c104e9f1fe2a839364b7b015910241ee4 units: Remove amount parsing limit (Tobin C. Harding)

Pull request description:

The limit is somewhat arbitrary. It was introduced as a DoS protection. This sort of attack vector is not really our concern.

Fix: #6828


ACKs for top commit:
apoelstra:
ACK 76a18b1c104e9f1fe2a839364b7b015910241ee4; successfully ran local tests
Kixunil:
ACK 76a18b1c104e9f1fe2a839364b7b015910241ee4


Tree-SHA512: 5ba260435f7018b1eef2ecf3fc6a66543d7514c3d7e65542e834522537fef4f3801f1868c70311f0c4bc508c2e8f8f91fe16a92bea918d2fc468f6e525933dfe

Merge rust-bitcoin/rust-bitcoin#6843: Release tracking PR: `internals 0.7.0`

d3767a2ceea27d20f1f49c0cd9df97df8a6ca605 internals: Bump version to 0.7.0 (Tobin C. Harding)

Pull request description:

In preparation for release add a changelog entry, bump the version number, and update the lock files.


ACKs for top commit:
apoelstra:
ACK d3767a2ceea27d20f1f49c0cd9df97df8a6ca605; successfully ran local tests


Tree-SHA512: 7e3183be5b4e3cd36e979226253881a343976243fa8d9050b22745bf188fa53b6c21770459a103acbb6875faa494334e4273d3232c77022819c60f5384040a5d

Merge rust-bitcoin/rust-bitcoin#6871: Remove uses of `Index` on `secp256k1::SecretKey`

72d03eb1cec3daf26290fd0913140915d03ce1b2 Remove uses of Index on secp256k1::SecretKey (Mitchell Bagot)

Pull request description:

The Index impl on secp256k1::SecretKey is considered upstream to be something we want to remove. In preparation for that, we should replace relevant uses of that trait with equivalent as_secret_bytes() calls.

Remove uses of the Index trait on the secp256k1::SecretKey.


ACKs for top commit:
apoelstra:
ACK 72d03eb1cec3daf26290fd0913140915d03ce1b2; successfully ran local tests


Tree-SHA512: d9f692403791c3a075a1fd2cc98fe3a62bebf6a7dcc58c8b93fbf62207e576c16fd304d9462156910fbef2ab113ae9d0f3631b9babd4129390445cfdb568b6c7

Merge rust-bitcoin/rust-bitcoin#6858: base58: saturate the reserve len multiplication

898da6ed12fcef49180d4b622d1a0a4dd5850f3d base58: saturate the reserve len multiplication (satsfy (Renato Britto))

Pull request description:

Use a `saturating_mul()` to handle overflows on `encoded_reserve_len`.

Didn't think this was worth a test because of the input needed to overflow this isn't allocatable on 64-bit and debug already catches it, so this is just fixing the release wrap.

Per https://github.com/project-loupe/audit-rust-bitcoin/issues/60

_This finding was discovered by [Project Loupe](https://github.com/project-loupe/loupe)._


ACKs for top commit:
apoelstra:
ACK 898da6ed12fcef49180d4b622d1a0a4dd5850f3d; successfully ran local tests


Tree-SHA512: 399b3e503a800de672ce8661b014d9ea2b60081ea427701542736f1e511167195a9c38415fe028edfe556d5f7961566f52580fa61c2941abe0a1d96a3e490779

Merge rust-bitcoin/rust-bitcoin#6874: p2p: fix ServiceFlags BitXor semantics

7d883da4013e5f787b30ce6844ecb20f562fa52e p2p: fix ServiceFlags BitXor semantics (wangjingshuiku)

Pull request description:

Fix `ServiceFlags` bitwise XOR implementations to perform actual XOR instead of delegating to `remove`.

`remove` uses `&= !other`, so reusing it for `BitXor` made toggling an unset flag a no-op. For example, `ServiceFlags::NONE ^ ServiceFlags::WITNESS` incorrectly returned `ServiceFlags::NONE`.

Implement `BitXor` and `BitXorAssign` directly using `^`, and add regression coverage for toggling both unset and set service flags.


ACKs for top commit:
apoelstra:
ACK 7d883da4013e5f787b30ce6844ecb20f562fa52e; successfully ran local tests


Tree-SHA512: f90258fc76651b6474609d3c2478b412c460754fbd02c3bee58cc3c09e46065c4be52ac5bd66c593a71f02fead779f75f6e2bb5ca378b0768b0340edb9ab9dbc

Merge rust-bitcoin/rust-bitcoin#6856: hashes: Fix Hkdf::expand panic

9e71cce17be751cabd63f58eee27b9250ba80e9b hashes: Test Hkdf::expand at maximum output length (Jamil Lambert, PhD)
c61576fea722b164abd6aa230bf34f514078eda4 hashes: Fix Hkdf::expand panic at max length (Jamil Lambert, PhD)

Pull request description:

Hkdf::expand accepts an output buffer up to the RFC-5869 maximum of 255 * T::Hash::LEN bytes, but the per-block counter was a u8. At the maximum length the counter reaches 255 on the final block and the subsequent counter += 1 overflows.

Replace the u8 counter with a for loop which cannot overflow.

Closes project-loupe/audit-rust-bitcoin#5


ACKs for top commit:
satsfy:
tACK 9e71cce17be751cabd63f58eee27b9250ba80e9b
tcharding:
ACK 9e71cce17be751cabd63f58eee27b9250ba80e9b
apoelstra:
ACK 9e71cce17be751cabd63f58eee27b9250ba80e9b; successfully ran local tests


Tree-SHA512: 07838b649685d88d334dd05216ddbc11ba0f52a0a3e40f40bc52f5b55d75bd68d5ee14ffc666314d4bafd1013bae52b3598300b47095ab851fb33aabaa07d516

Merge rust-bitcoin/rust-bitcoin#6847: Manual weekly update to rustc (to nightly-2026-09-05) on master

d69e1768d77d6bb8fb6f42cad8956d096674c5d5 crypto: reformat with new rustfmt (satsfy (Renato Britto))
5259213e3b44afebe4c389644dcaa9aed9934b6e fuzz: drop the single element loop (satsfy (Renato Britto))
b4bec57170dda6e100600f86d26b3ef26134f704 p2p: remove else block, return early on conn err (satsfy (Renato Britto))
e04ef36d845b072214d08af4e4d5e90640680539 hashes: allow empty_enums for typestate markers (satsfy (Renato Britto))
2f03a216b4e83734e0a2c5c1e59754e10009dd6e hashes: mark deprecation on cpufeatures macro (satsfy (Renato Britto))
0dc4994d8d36b8994b0fa09bf0a74839d5707f8d units: use NonZero operands directly (satsfy (Renato Britto))
6698dc881ddb3c3382d233d730f046aa457ddae9 Automated update to rustc nightly-2026-09-05 (Update Nightly Rustc Bot)

Pull request description:

Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6833

Required many changes:
- units: drop `.get()` on NonZero operands
- hashes: allow `deprecated` on cpufeatures modules
- workspace: allow `empty_enums` for typestate markers
- p2p: let-else early return in example
- fuzz: unroll single element loop
- crypto: reformat with new nightly rustfmt


ACKs for top commit:
apoelstra:
ACK d69e1768d77d6bb8fb6f42cad8956d096674c5d5; successfully ran local tests
tcharding:
ACK d69e1768d77d6bb8fb6f42cad8956d096674c5d5


Tree-SHA512: 9200ea32bb5b3775a6ca9a5c604de503a68ed01feef3806ca6e18b9e4a426e34ac2de265f6ffad53b6921cd6514ae62e2c5cbf28afba0ffb7cef0b2a218091a6

internals: Escape control chars in parse errors

InputString rendered input verbatim in its cannot_parse and
unknown_variant Display helpers, allowing control characters
(e.g. newlines) into error output and enabling log injection.

Escape the input with escape_debug.

Assisted-by: Claude Opus 4.8

Merge rust-bitcoin/rust-bitcoin#6845: ci: install rbmt from crates.io in replay job

bfc3703872c07560c3ed442a2bedb756596a3817 ci: install rbmt from crates.io in replay job (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6838

The newly added `replay-crash-store` job of corpus fuzzing installed `cargo-rbmt` from version of an outdated file `rbmt-version` file that doesn't exist anymore. Pull info from `Cargo.toml` `rbmt.version`. 100% my mistake here.


ACKs for top commit:
tcharding:
ACK bfc3703872c07560c3ed442a2bedb756596a3817
apoelstra:
ACK bfc3703872c07560c3ed442a2bedb756596a3817; successfully ran local tests


Tree-SHA512: 3767090700ebf85e058acdae1fb741db2a26444ff404ea3f3036dddef58fb4a84412687b56ebf3b5f0e1a58621393782e2e7d1a6af8f84bc633cc6ab29351bd9

Merge rust-bitcoin/rust-bitcoin#4675: Units improvements

f80747556c8c3e0abaa28585e11cc55f36d056cf Add test for `FeeRate::from_per_kvb` (Martin Habovstiak)
3c71e5361e1d53291ae118986578d42e74c72b15 Make infallible fns actually infallible (Martin Habovstiak)
d022dfaddf5de82029ce4911b30aaf046ec60088 Improve the precision of `div_by_weight_*` (Martin Habovstiak)
00f5be2b6757f737bd46da7d29e1644122bad998 Add `to_msat` conversion method to amount types (Martin Habovstiak)
7db4f2b33cd4adcc9846188127e7cef3545f333e Fix documentation of `checked_{div,rem}` (Martin Habovstiak)
3b29ac5b7fd4e81eb679f50f2be04e3664a189b2 Update the doc of amounts (Martin Habovstiak)
116ade8aaa5a0d952985efc02d371a9d87d31303 Improve the warning on float amount methods (Martin Habovstiak)
adc8c5f7704470f16766af1d260feeee0bf663e5 Fix stale comment about precision (Martin Habovstiak)
e86502cc494acd6b68efc52988cc8c862cc8990d Improve the documentation of `units` (Martin Habovstiak)
25ae539b6b1ffe854d44b3ca0a337299928d0f80 De-clutter the example in `units` (Martin Habovstiak)

Pull request description:

Various improvements that fell out of my review of `units` crate. My review is not over yet, but I need a break, so I'm at least publishing this for review. (Feel free to review, I'll just make another PR if I find more.)

These are just documentation improvements. See individual commits for details.


ACKs for top commit:
tcharding:
ACK f80747556c8c3e0abaa28585e11cc55f36d056cf
apoelstra:
ACK f80747556c8c3e0abaa28585e11cc55f36d056cf; successfully ran local tests


Tree-SHA512: 5266890a9bab7bccf274b40c40146fcbd4e6beb736ff9f160f2b767f75f04b7b94ae8f0dc24f0586b35511d3483d5018e01378c05cf6db29968670f182762239

hashes: Fix Hkdf::expand panic at max length

Hkdf::expand accepts an output buffer up to the RFC-5869 maximum of
255 * T::Hash::LEN bytes, but the u8 counter overflows when incremented
past the final block at that max length.

Replace the u8 counter with a for loop which cannot overflow.

Assisted-by: Claude Opus 4.8

crypto: reformat with new rustfmt

hashes: mark deprecation on cpufeatures macro

The macro expands to u8::max_value(), deprecated on new nightly.

p2p: remove else block, return early on conn err

Merge rust-bitcoin/rust-bitcoin#6836: bitcoin: move tests reading `tests/data` out of `src`

b4068f4ccdfca76160893252f50c90385c815a16 p2p: move merkle_tree tests to tests/ (satsfy (Renato Britto))
a0285f0094c45870fcded03be7bddf5ac97c5c10 bitcoin: move sighash tests to tests/ (satsfy (Renato Britto))
546c31d40f6c53a3489a41d70453d235afe7efe2 bitcoin: move taproot test to tests/ (satsfy (Renato Britto))
2c248d2cae77495c2e224f8029e22aec3bf3161f bitcoin: move bip158 test to tests/ (satsfy (Renato Britto))
2dcd5ab3bc085b5231becc42f05eeadc1d05aa3e bitcoin: move block test to tests/ (satsfy (Renato Britto))
8725bffa9e012aaabd31f95bad6d024b1707e952 bitcoin: move transaction test to tests/ (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6509
Inspired on https://github.com/rust-bitcoin/rust-bitcoin/pull/6311

We have test data in `<crate>/tests/data`. Folder `tests/` are excluded when publishing (`exclude = ["tests"]`). The problem is that some `<crate>/src/<test code>.rs` used macros like `include_str!()` or `include_bytes!()` importing data that gets excluded in published code, so the published unit tests would not compile.

This PR moves all data-based tests to folder `tests/`.

One friction point is: `tests/` only see public api from crate. So if a test imported from `tests/` using crate internal non-pub code, we would need to either add some way to access it or inline. I inlined some test vectors to cover these tests and kept them in crate code (only the first `keyPathSpending` vector of `bip341_tests.json` because `common_cache` and `taproot_cache` are private).

Note on commits: I separated them by move for ease of review. I don't like that we have so many, but its the tradeoff.


ACKs for top commit:
apoelstra:
ACK b4068f4ccdfca76160893252f50c90385c815a16; successfully ran local tests
tcharding:
ACK b4068f4ccdfca76160893252f50c90385c815a16


Tree-SHA512: 7744138905453022c06cd58ef6357537fb0e27e018932b15653caeacaa6bf10a8517d3c949ac1a72d5743e24567190727178ff28bf41c5b19b8b08666db1e3da

Merge rust-bitcoin/rust-bitcoin#6840: build(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11

798bf10704183049839e7ff5c69e63876001aacb build(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.7 to 2.82.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.11</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.253.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.27.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.2.</p>
</li>
<li>
<p>Update <code>mdbook@latest</code> to 0.5.4.</p>
</li>
</ul>
<h2>2.82.10</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.2.0.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.140.</p>
</li>
</ul>
<h2>2.82.9</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.9.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.4.8.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.37.0.</p>
</li>
<li>
<p>Update <code>cargo-leptos@latest</code> to 0.3.7.</p>
</li>
</ul>
<h2>2.82.8</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.8.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.26.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.48.0.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.72.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.7.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.4.6.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.0.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.55.1.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.2.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.87.7] - 2026-09-06</h2>
<ul>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.128.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.10.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.2.</p>
</li>
<li>
<p>Update <code>rclone@latest</code> to 1.75.1.</p>
</li>
</ul>
<h2>[2.87.6] - 2026-09-05</h2>
<ul>
<li>
<p>Update <code>rafn@latest</code> to 0.1.6.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.11.3.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.57.1.</p>
</li>
<li>
<p>Update <code>convco@latest</code> to 0.7.2.</p>
</li>
</ul>
<h2>[2.87.5] - 2026-09-04</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.30.3.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.9.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.50.1.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.1.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.161.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.5.2.</p>
</li>
<li>
<p>Update <code>oxfmt@latest</code> to 1.81.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.1.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/5ebac0d9522d786674368e47e92963ba13f2c376"><code>5ebac0d</code></a> Release 2.82.11</li>
<li><a href="https://github.com/taiki-e/install-action/commit/0ef1b06f246983bfc9b14d94cff7855d90529e46"><code>0ef1b06</code></a> Update <code>wasm-tools@latest</code> to 1.253.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/78ce37c0ce7da0b633b3ee9a800d18e6d4fb11e7"><code>78ce37c</code></a> Update <code>mise@latest</code> to 2026.7.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/080cc5c6de6a4709eb3c099c56ad225fa3db5492"><code>080cc5c</code></a> Update wasm-tools manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/c870c7a1dbaa5d99671937765392df21151c7808"><code>c870c7a</code></a> Update <code>uv@latest</code> to 0.11.27</li>
<li><a href="https://github.com/taiki-e/install-action/commit/dcc765d42b0daa9842059edfb11fda14143027e2"><code>dcc765d</code></a> Update <code>mise@latest</code> to 2026.7.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/98fa0bac11003b6f1143fd1634b47d42624003b2"><code>98fa0ba</code></a> Update <code>mdbook@latest</code> to 0.5.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/544756b7938b454b9339922116f9f21301cc8169"><code>544756b</code></a> Update martin manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/116765984988a711571bdb8292667a67de89b08e"><code>1167659</code></a> Update kingfisher manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ca5e0a7228a263c12320511f1b10890972a12bbc"><code>ca5e0a7</code></a> Update biome manifest</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/16b05812d776ae1dfaabc8277e421fb6d2506419...5ebac0d9522d786674368e47e92963ba13f2c376">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 798bf10704183049839e7ff5c69e63876001aacb; successfully ran local tests


Tree-SHA512: 120a52a92c5990d13ff7f1405f3c9903ad30dfc09eac870ae763aca8b0544a5a13db729f304d604ab089d6edab9eecf5fba5a419a6fca2f6efe1e6077690f896

Merge rust-bitcoin/rust-bitcoin#6841: build(deps): bump actions/labeler from 6.1.0 to 6.2.0

cf7dd14007d4293a0026a5f278d082339ea0ef67 build(deps): bump actions/labeler from 6.1.0 to 6.2.0 (dependabot[bot])

Pull request description:

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.1.0 to 6.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/labeler/releases">actions/labeler's releases</a>.</em></p>
<blockquote>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Improve PR number validation and warning messages in input handling by <a href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/939">actions/labeler#939</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/943">actions/labeler#943</a></li>
<li>Bump <code>@​typescript-eslint/eslint-plugin</code> from 8.59.1 to 8.61.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/942">actions/labeler#942</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/labeler/compare/v6.1.0...v6.2.0">https://github.com/actions/labeler/compare/v6.1.0...v6.2.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/labeler/commit/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d"><code>b8dd2d9</code></a> Bump <code>@​typescript-eslint/eslint-plugin</code> from 8.59.1 to 8.61.1 (<a href="https://redirect.github.com/actions/labeler/issues/942">#942</a>)</li>
<li><a href="https://github.com/actions/labeler/commit/53affe8ca4150876fc7eb7d268d3a1f74511a244"><code>53affe8</code></a> Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...</li>
<li><a href="https://github.com/actions/labeler/commit/f612d9ad188e81643862c2de70f57fbb1d17abd1"><code>f612d9a</code></a> Fix: Improve PR number validation and warning messages in input handling (<a href="https://redirect.github.com/actions/labeler/issues/939">#939</a>)</li>
<li>See full diff in <a href="https://github.com/actions/labeler/compare/f27b608878404679385c85cfa523b85ccb86e213...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK cf7dd14007d4293a0026a5f278d082339ea0ef67; successfully ran local tests


Tree-SHA512: 61338f586014ef0098437e9c2d99c7e49eae9bd3f4397976ddc507c393e6f5405397badfa8f8022ec8b300feb2c8b7685de9863f3db5116b3f9a573c66deedf5

Merge rust-bitcoin/rust-bitcoin#6839: build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2

2427fa6add1a172cc87ba57eef70dfae8ca9bb62 build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (dependabot[bot])

Pull request description:

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p>
<blockquote>
<h2>v8.3.2 🌈 update known checksums for 0.11.28</h2>
<h2>Changes</h2>
<p>Just a maintenance release</p>
<h2>🧰 Maintenance</h2>
<ul>
<li>chore: update known checksums for 0.11.28 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/947">#947</a>)</li>
</ul>
<h2>📚 Documentation</h2>
<ul>
<li>docs: update version references to v8.3.1 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/946">#946</a>)</li>
</ul>
<h2>⬆️ Dependency updates</h2>
<ul>
<li>chore: roll up Dependabot updates <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/948">#948</a>)</li>
</ul>
<h2>v8.3.1 🌈 update known checksums for 0.11.27</h2>
<h2>Changes</h2>
<p>Just a maintenance release</p>
<h2>🧰 Maintenance</h2>
<ul>
<li>Change update-docs PR labels from 'update-docs' to 'documentation' <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/945">#945</a>)</li>
<li>chore: update known checksums for 0.11.27 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/944">#944</a>)</li>
</ul>
<h2>📚 Documentation</h2>
<ul>
<li>docs: update version references to v8.3.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/939">#939</a>)</li>
</ul>
<h2>v8.3.0 🌈 Support uv.lock as a version-file source</h2>
<h2>Changes</h2>
<p>Thanks to <a href="https://github.com/somaz94"><code>@​somaz94</code></a> you can now use the pinned version of uv itself in <code>uv.lock</code>. It gets picked up automatically.
If you have pinned another version of uv in your <code>uv.lock</code> you can use the inputs <code>version</code> or <code>version-source</code> to override this.</p>
<h2>🐛 Bug fixes</h2>
<ul>
<li>Strip environment markers from detected uv dependency pins <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/938">#938</a>)</li>
<li>Fix cache keys for Python version ranges <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/937">#937</a>)</li>
<li>fix: use BUILD_ID as backup for determining os version <a href="https://github.com/hgaiser"><code>@​hgaiser</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/912">#912</a>)</li>
</ul>
<h2>🚀 Enhancements</h2>
<ul>
<li>feat: support uv.lock as a version-file source <a href="https://github.com/somaz94"><code>@​somaz94</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/918">#918</a>)</li>
</ul>
<h2>🧰 Maintenance</h2>
<ul>
<li>ci: call docs update workflow from release <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/933">#933</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/astral-sh/setup-uv/commit/11f9893b081a58869d3b5fccaea48c9e9e46f990"><code>11f9893</code></a> chore: roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/948">#948</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/f79855603231e1609d02bec6956bd0e05cbc46b5"><code>f798556</code></a> docs: update version references to v8.3.1 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/946">#946</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/e80544d808267c93733c3fd1e2c8c65e0c8707d6"><code>e80544d</code></a> chore: update known checksums for 0.11.28 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/947">#947</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/f98e06938123ccabd21905ea5d0069192241f9f1"><code>f98e069</code></a> Change update-docs PR labels from 'update-docs' to 'documentation' (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/945">#945</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/cd462639a967553a16241af35461402a96978d48"><code>cd46263</code></a> chore: update known checksums for 0.11.27 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/944">#944</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/11245c7e122cd1c2297e8115d1e43fe1570f6270"><code>11245c7</code></a> docs: update version references to v8.3.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/939">#939</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/d31148d669074a8d0a63714ba94f3201e7020bc3"><code>d31148d</code></a> Strip environment markers from detected uv dependency pins (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/938">#938</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/17c398959b4611a88929fabb5c563a8e43a0ff60"><code>17c3989</code></a> Fix cache keys for Python version ranges (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/937">#937</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/3cc3c11fdf511cab39136b7c946d973d4ad0df20"><code>3cc3c11</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/936">#936</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/9225f843d7a9f80a757cf25ef48901fda69ba4bc"><code>9225f84</code></a> chore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/924">#924</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...11f9893b081a58869d3b5fccaea48c9e9e46f990">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 2427fa6add1a172cc87ba57eef70dfae8ca9bb62; successfully ran local tests


Tree-SHA512: ba14136987c13466b40e0c5a83ac137f2f5191fe67d846091eab3828c64bf23978be12a933dcb941edbfeca4054625522947797947facbcaa3a114f1f672f235

Merge rust-bitcoin/rust-bitcoin#6842: build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0

8d5a2f95cfd5e0517aff9ca8d0737dbdccff1b67 build(deps): bump github/codeql-action/upload-sarif (dependabot[bot])

Pull request description:

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p>
<blockquote>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>v4.36.3</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a> from github/update-v4.37.0-c7c896d71</li>
<li><a href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a> Add changenote for <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li>
<li><a href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a> Update changelog for v4.37.0</li>
<li><a href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a> from github/update-bundle/codeql-bundle-v2.26.0</li>
<li><a href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a> Add changelog note</li>
<li><a href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a> Update default bundle to codeql-bundle-v2.26.0</li>
<li><a href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a> from github/mbg/repo-props/config-file-shorthands</li>
<li><a href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a> Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...</li>
<li><a href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a> Thread <code>ActionState</code> to <code>initConfig</code></li>
<li><a href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a> Mark some <code>status-report</code> imports as <code>type</code>-only to avoid circular dependencies</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 8d5a2f95cfd5e0517aff9ca8d0737dbdccff1b67; successfully ran local tests


Tree-SHA512: b1ef20d84cdbf207e6b322dfc23a2d5148514d07d84fa7f0eaa764c90ae883313bcc026c3f0e0275e4da7310f8411feabeb7c6d5c1a0554fcc1df43b6e9531e2

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump actions/labeler from 6.1.0 to 6.2.0

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/f27b608878404679385c85cfa523b85ccb86e213...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d)

---
updated-dependencies:
- dependency-name: actions/labeler
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>