CommitWatch RSS
RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
148commits · 30 days
304commits · 60 days
1150commits · 180 days
2055commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 29 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedbuild(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11by dependabot[bot] · 798bf107 · Sep 6, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.7 to 2.82.11.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/16b05812d776ae1dfaabc8277e421fb6d2506419...5ebac0d9522d786674368e47e92963ba13f2c376)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.82.11
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is an automated update by Dependabot that bumps a third-party GitHub Action used in the project's CI workflows from version 2.82.7 to 2.82.11. The action installs developer tools during automated testing. There is no indication in the commit that this fixes a security issue, and the change only affects internal build/test automation, not the published Rust Bitcoin library code.

AI review queuedbuild(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2by dependabot[bot] · 2427fa6a · Sep 6, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...11f9893b081a58869d3b5fccaea48c9e9e46f990)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.3.2
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The action is referenced by a fixed commit hash (a 'pin'), which is a security best practice. There is no indication in the commit that this fixes a security problem; it is a normal dependency bump.

Security candidateMerge rust-bitcoin/rust-bitcoin#6837: Automated nightly rustfmt (2026-09-06)by Andrew Poelstra · 3a9f9241 · Sep 6, 2026 · 1 fileMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6837: Automated nightly rustfmt (2026-09-06)

ccc22407b925a92b618d4d2fa334664bb56f9f6c 2026-09-06 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK ccc22407b925a92b618d4d2fa334664bb56f9f6c; successfully ran local tests


Tree-SHA512: e348d095b703e89556c3aa66bbec2fc842b4f77f8bd5045c9502ec2c754bdff3c6029b634a2aa97dcde9557684580e21ecde77d381fb9610b75a9e32233e6d8e

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlmerge-commit duplicate discount
AI analysis · Informational 15/100

This is an automated code-formatting commit. It only changes how two import lines and one function are written, with no effect on what the program actually does. There is no security relevance.

Security candidateMerge rust-bitcoin/rust-bitcoin#6819: Remove panics from `LegacyPublicKey::from_str`by Andrew Poelstra · 03eb46e4 · Sep 5, 2026 · 1 fileMessage 91 · StrongLow 27Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6819: Remove panics from `LegacyPublicKey::from_str`

e9eebc4a49e32d157f1372c8f895243fba7cda4d Remove panics from `LegacyPublicKey::from_str` (Martin Habovstiak)

Pull request description:

While the implementation was correct the lack of panics was not obvious from the code. This rewrites it to be completely panic-free.


ACKs for top commit:
apoelstra:
ACK e9eebc4a49e32d157f1372c8f895243fba7cda4d; successfully ran local tests


Tree-SHA512: 353cf2043d059f2e120bd49eb88c83d0a3cde451a805f9f34bafd0bdc1641ffc17b4e000e1be9ff817a740fe48f3456598ec85e3941481a81ca0c6b6e66bfe5c

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathmerge-commit duplicate discount
AI analysis · Low 27/100

This change refactors how a Bitcoin public key is parsed from a text string so that the code no longer relies on 'this should never happen' assumptions that could trigger a program crash. The old code only accepted two exact string lengths and used an internal 'unreachable' panic for any other length error. The new code tries the two valid lengths directly and returns a proper error instead of panicking. It is a defensive hardening fix rather than a confirmed exploitable vulnerability.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6715: internals: migrate the `u256` type from the include system to the internals packageby Andrew Poelstra · 9fb8d3fa · Sep 4, 2026 · 18 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6715: internals: migrate the `u256` type from the include system to the internals package

230c95aad69f343cef54654f0b03a6a71ea60f1b internals: move unused test dependencies to dev-dependencies (Nick Johnson)
f1b63f2b9c79e71fe07c93bd93252ae49946c5fd internals: migrate the u256 from include to internals (Nick Johnson)
4707d00d70c43796debcc89187f0b0587da46113 ci: fail if bitcoin-internals is exposed in public api (Nick Johnson)

Pull request description:

With `cargo-rbmt@0.5.*` is merged in #6547, `cargo-rbmt`'s api check can now enforce that a "private" dependency does not leak out of a crate's exposed API. With this enforcement, we can move over the `u256` type from the `include/` system into the standard `internals` package.

The third commit is not directly related, but noticed that `internals` appeared to be needlessly leaking dependencies.

Part of the #6458 effort.


ACKs for top commit:
tcharding:
ACK 230c95aad69f343cef54654f0b03a6a71ea60f1b
apoelstra:
ACK 230c95aad69f343cef54654f0b03a6a71ea60f1b; successfully ran local tests


Tree-SHA512: 71d30bf1f15767efaa6b67d66f3e8fd3cee2c2931d6ad4bfeb8f638b54be5667ca279f8654b67834ceb6ac95f9c1044a3aa7c98d1a78ffc16fdf293a8edffc97

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit is a routine internal code reorganization. It moves a 256-bit unsigned integer helper type (U256) from a duplicated file that was copy-pasted into multiple crates into a single shared internal crate. It also cleans up some test-only dependencies. There is no security-relevant behavior change visible in the diff.

Security candidateMerge rust-bitcoin/rust-bitcoin#6688: crypto: Remove `alloc` gating from `WifKey` methodsby Andrew Poelstra · 3f85c8b2 · Sep 4, 2026 · 2 filesMessage 91 · StrongInformational 19Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6688: crypto: Remove `alloc` gating from `WifKey` methods

b3f8712f932d101d2b3eae5ea44e585f63bb3a60 Remove FromWifError::InvalidBase58PayloadLength and inner error (Mitchell Bagot)
e09f6582dd41b9a8229d1b61bb955f652f1cfa98 Remove alloc gating from WifKey::from_wif and FromStr (Mitchell Bagot)
20039ae24c721493fee9ef6139df089272e99eb9 Remove alloc gate from WifKey::fmt_wif (Mitchell Bagot)

Pull request description:

With the new base58 no-alloc functionality, the WifKey fmt_wif and from_wif functions can be made no-alloc. This allows users without alloc to parse and write out WIF keys if needed and removes the last of the major alloc parts in the key module. Those that remain directly rely on alloc/std types.

- Patch 1 removes the alloc requirement for fmt_wif.
- Patch 2 removes the alloc requirement for from_wif.
- Patch 3 removes the unused error type InvalidBase58PayloadLengthError and variant from FromWifError.


ACKs for top commit:
apoelstra:
ACK b3f8712f932d101d2b3eae5ea44e585f63bb3a60; successfully ran local tests


Tree-SHA512: 01b67b3f8c59d8645025de3c3fc9811c988498340926fe1ed164f6edbb9a119ab7d7deff602290708869b0f3b1167ebfe18807f46abdd5fc46250dbaf935aeeb

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathmerge-commit duplicate discount
AI analysis · Informational 19/100

This change lets a Bitcoin key-handling library work in environments without a memory allocator by removing an unnecessary requirement that memory allocation be available for certain WIF (Wallet Import Format) key operations. It also removes an unused error type. There is no direct security vulnerability being fixed; it is a feature-portability improvement.

Security candidateMerge rust-bitcoin/rust-bitcoin#6812: units: Separate mathematical operation and failure mode in `NumOpError`by Andrew Poelstra · 5897ef1b · Sep 4, 2026 · 6 filesMessage 96 · StrongInformational 19Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6812: units: Separate mathematical operation and failure mode in `NumOpError`

eb8cbe95d92df9249e936172bdd966cdbc3b57a8 units: Replace NumOpError internals with MathErrorKind (Mitchell Bagot)
d6822db9072576dfd5f53ba5f47473f7be5b00c1 units: Remove assumption that div cannot overflow (Tobin C. Harding)

Pull request description:

This is a replacement of #6772, attempting to implement the NumOpErrorType, as suggested in https://github.com/rust-bitcoin/rust-bitcoin/pull/6772#issuecomment-5395337886.

Adjust docs, MathOp and NumOpError to remove the assumption that div cannot overflow.
Introduce NumOpErrorType to separate failure mode from attempted mathematical operation.

Original work by: Tobin C. Harding \<me@tobin.cc>

Closes #4672


ACKs for top commit:
apoelstra:
ACK eb8cbe95d92df9249e936172bdd966cdbc3b57a8; successfully ran local tests


Tree-SHA512: a312cf7ba1752e3231626aab73dfcd3e5b7f54ff6e4d6803d56a64f34f2c1ecfd44c32a5f1f3a97df82a9229d619d537f4fd6eb731d03912cdfb668b37605cb3

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetysigning or wallet pathmerge-commit duplicate discount
AI analysis · Informational 19/100

This is a code-quality refactor in the rust-bitcoin library. It renames and restructures how arithmetic errors (overflow, divide-by-zero, remainder-by-zero) are reported, so callers can tell what specifically went wrong. It does not change the actual safety checks—overflows and divisions by zero were already caught before this change. The patch also fixes a minor behavior quirk where combining an error result with a valid value would overwrite the original error type; now the original error is preserved.

Security candidateMerge rust-bitcoin/rust-bitcoin#6346: Make `Keypair::as_inner` privateby Andrew Poelstra · 6c617d9c · Sep 3, 2026 · 2 filesMessage 91 · StrongInformational 18Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6346: Make `Keypair::as_inner` private

4cc9cda8bbb82982529aed62afe15a85aaffbd8c Make Keypair::as_inner private (Mitchell Bagot)

Pull request description:

Keypair::as_inner is currently only used to implement TapTweak. Since TapTweak exists in taproot-primitives and cannot be in crypto, it must be modified to manually serialize/deserialize to get the secp type rather than using as_inner.

Replace Keypair::as_inner use in TapTweak with Keypair::from_key_parts and make as_inner pub(super).


ACKs for top commit:
tcharding:
ACK 4cc9cda8bbb82982529aed62afe15a85aaffbd8c
apoelstra:
ACK 4cc9cda8bbb82982529aed62afe15a85aaffbd8c; successfully ran local tests


Tree-SHA512: 0674b3e11a731757a170cc3e6c158df81162d001b19a10ccb14c5bf5b630c2a25c8bcd855448b434d666853a7e6fe9cd9465d36c8878dfb0ee23ffc64b38721c

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathmerge-commit duplicate discount
AI analysis · Informational 18/100

This change narrows the visibility of an internal helper method (`Keypair::as_inner`) from public to crate-only, and rewrites the Taproot key tweaking code to build a low-level secp256k1 keypair from serialized parts instead of relying on that helper. It is a defensive API-hardening patch: it reduces the public API surface so external callers cannot directly obtain the underlying secp256k1 keypair, which could make future misuse or information-leak bugs less likely. The rewritten path uses an `unsafe` block, but the surrounding code argues it is safe because the parts come from an already-valid keypair and parity is checked. There is no direct vulnerability being fixed here, and no disclosed security incident.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6736: benches: fix encoding use, add CI check, and standardize on criterionby Andrew Poelstra · 06ea6476 · Sep 3, 2026 · 10 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6736: benches: fix encoding use, add CI check, and standardize on criterion

a71766b7feafa1c563253074eab71d12cb17b26b benches: migrate last old benchmark and consolidate on criterion only (Nick Johnson)
6618875711cb4cad5e6a162c8219e03fb78131d4 benches: add criterion to CI, update out of date benches (Nick Johnson)

Pull request description:

Extends jrakibi's work in #6735. First commit cleans up the stale code in `benches` and adds the `benches` package to CI to prevent drift in the future. Second commit migrates the only other type of benchmark in the repository to `benches` to simplify the patterns.


ACKs for top commit:
apoelstra:
ACK a71766b7feafa1c563253074eab71d12cb17b26b; successfully ran local tests


Tree-SHA512: 3874c0007255ce0f8431264af1baa95d2c3c61da78298a87d169195695247e297aaafb3acb5910072d897f7fa227467aeb8d8ec87298229ed2c13fe11d7a773c

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This change is purely a cleanup of benchmark code. It moves the last remaining old-style benchmark into a shared benchmark package, switches the project to use the standard Criterion benchmarking library, and adds a CI check so benchmarks stay buildable. No user-facing code, cryptographic logic, or network behavior is changed.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6811: ci: add corpus fuzzing crash storeby Andrew Poelstra · 86e705f0 · Sep 3, 2026 · 5 filesMessage 100 · StrongInformational 14Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6811: ci: add corpus fuzzing crash store

e2a6f4bfd56b0657bb2da53946d88fdd387ba5f0 ci: report job summary for store replay crashes (satsfy (Renato Britto))
7b27d482f8e242d579a54a9751a4ef750421945e ci: fix crash artifacts never reaching the store (satsfy (Renato Britto))
9911d236ace906e8380cf6677f766a8b73c9867a fuzz: cap the crash store at 10k inputs (satsfy (Renato Britto))
257dd39debc6e893c32b16fea64111a5c9143d02 ci: add fuzz crash store (satsfy (Renato Britto))
99a6ffe724d54049f3dfbccd4815c44aeb99717a fuzz: unify target rustflags in one place (satsfy (Renato Britto))

Pull request description:

Fixes the issue I mentioned on https://github.com/rust-bitcoin/rust-bitcoin/issues/6784 and https://github.com/rust-bitcoin/rust-bitcoin/issues/6813.

Every time a crash happens, corpus fuzzing reports it and forgets. The issue gets automatically closed and CI would forget a problem ever existed. The error may or may not be re-encountered in the future.

This PR makes found errors persistent on a crash store. Every fuzzing error gets saved there. At the end corpus fuzzing daily run, after qa-assets corpora was updated, it replays the crash store.

This gives us 3 properties:
1. errors are not lost;
2. corpus fuzzing will not pass while an error still exists in the codebase and;
3. the normal fuzzing workflow keeps running uninterrupted (because any job that previously failed, moved the error to crash store so it will fuzz again now just fine).

Also unified the fuzz flags so because they were replicated in multiple scripts.

After these changes prove to work well on production, I'll put up the final change: run crash store on every PR. An automatic fuzz regression check.


ACKs for top commit:
apoelstra:
ACK e2a6f4bfd56b0657bb2da53946d88fdd387ba5f0; successfully ran local tests


Tree-SHA512: adb7b6719567ae257ac6dea427e097578fc028784c9aba00708d23f6d441faeac9bd7eaa911ac45f1bc11155d6b6d519e8cb5a319eabcf17621a1551d9b2de96

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 14/100

This commit is a CI (Continuous Integration) improvement for the project's fuzz testing pipeline. It adds a persistent 'crash store' so that fuzzing crashes are saved and later replayed to catch regressions. It does not change the actual Bitcoin library code, does not fix a security bug, and does not introduce a vulnerability. It is purely an infrastructure change to make fuzz testing more reliable.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6789: fuzz: fix p2p commands master and 0.32 divergenceby Andrew Poelstra · dc929f3b · Sep 3, 2026 · 1 fileMessage 100 · StrongInformational 18Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6789: fuzz: fix p2p commands master and 0.32 divergence

77923a0cb5f49ed1807067028a9cd87a68df2c78 fuzz: add regression tests for master-only p2p commands (satsfy (Renato Britto))
b38bcaaf7fd4ea7b71f3ecb7f025e7dc206719fa fuzz: run the compare_consensus_encoding tests (satsfy (Renato Britto))
1dd0a4b57cf5ec53d632988630e14dbec6f3625d fuzz: skip master exclusive V1NetworkMessage commands (satsfy (Renato Britto))

Pull request description:

Fixes https://github.com/rust-bitcoin/rust-bitcoin/issues/6784 (issue closed automatically but shouldn't have, I'll follow up with a PR for that).

The `compare_consensus_encoding` target panics when 0.32 decodes something master rejects. Bitcoin 0.32 stores unknown commands as `NetworkMessage::Unknown` without parsing, never fail. Master decodes `sendtxrcncl` and `feature` typed and rejects empty payloads.

Commits:
1. Skip the comparison for those two, keyed on the command in the V1 header
2. Gated the test module on `test` alone because `cfg(all(test, fuzzing))` could never run (optional, I may have misunderstood here).
3. Make both crash inputs into regression tests


ACKs for top commit:
apoelstra:
ACK 77923a0cb5f49ed1807067028a9cd87a68df2c78; successfully ran local tests


Tree-SHA512: 738bc34909d0523e74adc9702dbc68c42b2623cb3391d5cba4023382eec734bbcc16067e90753911e5121138772efd3aaf1cf4f338bb60b42874c2aecbce44ef

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 18/100

This is a fuzz-test-only fix. It changes a test harness so it skips comparing two newer Bitcoin P2P network commands ('feature' and 'sendtxrcncl') between the current master code and an older 0.32 release. The older release stores unknown commands as raw data, while the newer code parses and can reject them. The fix prevents the fuzz test from panicking on this expected difference. It does not change any production library code.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6814: fuzz: delete stale `hashes_0_32_cbor` targetby Andrew Poelstra · 4f61264d · Sep 2, 2026 · 4 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6814: fuzz: delete stale `hashes_0_32_cbor` target

b384c8fd5707b8977372ff4728245440d86ae59e fuzz: delete hashes_0_32_cbor target (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6813

As https://github.com/rust-bitcoin/rust-bitcoin/issues/6813#issuecomment-5493237551 says:
> The fuzz failure here is "real" but it's a 0.32.x that we deleted on master in https://github.com/rust-bitcoin/rust-bitcoin/pull/2803 because it was triggering false positives.
>
> We should just delete the test.

Corpus job crashes because `serde_cbor` accepts various encodings for the same input, producing false positives.

The current hashes crate deleted this test long ago. Drop the unused `serde_cbor` dependency.

Branches 0.32.xx and 0.32.xxx don't have fuzz targets so the problem is not applicable there.


ACKs for top commit:
apoelstra:
ACK b384c8fd5707b8977372ff4728245440d86ae59e; successfully ran local tests


Tree-SHA512: 644c2bdace7e70b17d42a9bf70491c1fedd3881e270a1bd0da12664a38a067ba074dc0ba7e18fd3837304a601ef501cc72719871d5c86b4a279e65c2bf651028

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit removes an old fuzzing test that was producing false alarms. The test checked that data could be decoded and re-encoded by an old library (serde_cbor) and get the exact same bytes back, but that library has multiple valid ways to encode the same thing, so the test was unreliable. There is no security vulnerability being fixed here—just cleanup of a stale test and its unused dependency.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6767: primitives: Add #[inline] to simple functionsby Andrew Poelstra · ff93b704 · Sep 2, 2026 · 17 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6767: primitives: Add #[inline] to simple functions

0df86b2bdfef6e9619d26eef031bb7b04d513ff2 primitives: Add #[inline] to simple functions (Mitchell Bagot)

Pull request description:

Following the recent additions to primitives, and before the final release, new simple functions need have #[inline] added to them.

Add #[inline] to simple functions throughout the crate.


ACKs for top commit:
apoelstra:
ACK 0df86b2bdfef6e9619d26eef031bb7b04d513ff2; successfully ran local tests
tcharding:
ACK 0df86b2bdfef6e9619d26eef031bb7b04d513ff2
Kixunil:
ACK 0df86b2bdfef6e9619d26eef031bb7b04d513ff2


Tree-SHA512: c3e8ad4fc7a32e27117b5787c7fb05de73a0d281b65a286d1f4bf046f3da72e7fbff67095bd9db716725d90bc3934e0c7f757bbfc7d209c960dfe328f50fdd84

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds the Rust compiler hint #[inline] to many small, simple functions in the primitives crate. It does not change any logic, data handling, or security behavior. It is a performance and code-quality change, not a security fix or vulnerability.

Security candidateMerge rust-bitcoin/rust-bitcoin#6805: crypto: Add NonStandardSighashType wrapperby Andrew Poelstra · d9135782 · Sep 1, 2026 · 2 filesMessage 100 · StrongInformational 19Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6805: crypto: Add NonStandardSighashType wrapper

1c4a09ba6e218100fd620b3f3dff4f56c5ee1b2c crypto: Derive PartialEq, Eq and Hash for EcdsaSighashType (jrakibi)
54210869336f3cbb7fd00c3a1aa2e51ba58d762e crypto: Add `NonStandardSighashType` wrapper (jrakibi)

Pull request description:

Currently a value in the `NonStandard` variant can be anything, including a standard value, which makes the enum redundant (eg. EcdsaSighashType::All and EcdsaSighashType::NonStandard(0x01)).

Instead we can change the `NonStandard` variant to hold a type with private inner `u32`, so that `EcdsaSighashType::NonStandard` **_cannot_** represent a standard sighash type.

Users who need a non-standard sighash type can use `EcdsaSighashType::from_consensus`.

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6795


ACKs for top commit:
apoelstra:
ACK 1c4a09ba6e218100fd620b3f3dff4f56c5ee1b2c; successfully ran local tests; nice!


Tree-SHA512: 54eca2ee0fa3caa43952bb56f602be7b11d3ecd233f1add850fee6d3a84be78d24e087e428d4e0f5d79260fec4996616f9470b3b0bd0accea8e642585a8d9ecf

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathmerge-commit duplicate discount
AI analysis · Informational 19/100

This change is a code-quality and type-safety improvement, not a security fix. It replaces a raw number in the 'NonStandard' sighash variant with a dedicated wrapper type so that the variant can only hold genuinely non-standard values. This prevents accidental misuse where a standard sighash type could be represented both as a normal enum variant and as a 'NonStandard' number, but it does not close an exploitable vulnerability on its own.

Security candidateMerge rust-bitcoin/rust-bitcoin#6806: Remove `test_` prefix from testsby Andrew Poelstra · 23a7aa1f · Sep 1, 2026 · 10 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6806: Remove `test_` prefix from tests

f338de73ee0db4a8725d176625ae09512fb29353 Remove test_ prefix from tests (Mitchell Bagot)

Pull request description:

Some tests in the repo have a test_ prefix in their names. Initially this began to prevent conflicts with function names in the super namespace, but was applied inconsistently. Further, this pattern is not idiomatic, and should instead be removed entirely.

Remove test_ prefix from all test names, using super:: to reference parent module names where necessary.

Closes #6794


ACKs for top commit:
apoelstra:
ACK f338de73ee0db4a8725d176625ae09512fb29353; successfully ran local tests


Tree-SHA512: 5d4c5e9630f33fceef02972c93f13878391b805fe82a184dfae6fb13dff008f70ce9b50069b88c08ae62493cc527ef92d8e7b07a96e759f0e814e4dbc73fa656

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathsigning or wallet pathmerge-commit duplicate discount
AI analysis · Informational 15/100

This commit is a pure code cleanup: it renames test functions to remove the 'test_' prefix and adjusts how those tests reference parent module items. There is no change to production code, no security fix, and no vulnerability introduced.

Security candidateunits: Replace NumOpError internals with MathErrorKindby Mitchell Bagot · eb8cbe95 · Sep 1, 2026 · 6 filesMessage 78 · AdequateInformational 19Details
Commit message · Mitchell Bagot

units: Replace NumOpError internals with MathErrorKind

The NumOpResult doesn't have a way to distinguish the cause of an error
from the operation that was performed. Some operations can have
multiple failure modes, such as division (div-by-zero vs overflow on
signed values). Rather than clutter the operation type, a new error kind
type which captures the failure mode should be introduced. Where a failure
mode applies to multiple operation types (e.g. overflow), the existing
MathOp is wrapped.

Introduce MathErrorKind to replace MathOp private field of NumOpError,
adjusting constructors as needed.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
memory safetysigning or wallet path
AI analysis · Informational 19/100

This commit is a code-quality refactor inside the rust-bitcoin library's 'units' crate. It changes how arithmetic errors (overflow, divide-by-zero, remainder-by-zero) are described internally, making error messages more specific and preserving the original error when combining error values. It does not add or remove any security checks; it only re-labels the existing checked-math failures.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6781: base58: Use `div_ceil` for reserve length calculationby Andrew Poelstra · be2b26d8 · Aug 31, 2026 · 1 fileMessage 100 · StrongLow 46Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6781: base58: Use `div_ceil` for reserve length calculation

196c27161d1e6e4d76b4be5978a7c45a864c96a6 Add regression test for reserve length calculation (Mitchell Bagot)
5b3cc125fdb6d015e0ddf14306dd7810a9110552 base58: Use div_ceil for reserve length calculation (Mitchell Bagot)

Pull request description:

When determining the size needed for an encoding buffer, the code currently uses an approximation by multiplying the payload length by 1.37. However, as this is done with integer operations, the value is rounded down, which for some payload lengths (namely 94), the encoding can panic due to an undersized buffer.

Use div_ceil for reserve length calculation to prevent panic on 94 byte encode.


ACKs for top commit:
satsfy:
tACK 196c27161d1e6e4d76b4be5978a7c45a864c96a6
tcharding:
ACK 196c27161d1e6e4d76b4be5978a7c45a864c96a6
apoelstra:
ACK 196c27161d1e6e4d76b4be5978a7c45a864c96a6; successfully ran local tests


Tree-SHA512: d0e737115211799874efecb1229885ddefae941a9132df3e19ea1f40f6c0c0c5238d42224a194b215e9657cb649b80c8511e4540029b5499a6f70cd254f71866

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Low 46/100

This commit fixes a bug in the base58 encoding function used for Bitcoin-style addresses. When encoding certain payload sizes (specifically 94 bytes), the program could panic because it reserved a buffer that was slightly too small. The fix rounds the buffer-size calculation up instead of down, preventing the crash. The commit also adds a regression test using a 90-byte payload with checksum (which triggers the same rounding edge case).

AI review queuedMerge rust-bitcoin/rust-bitcoin#6803: build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7by Andrew Poelstra · 9a0a1d3f · Aug 31, 2026 · 2 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6803: build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7

11e5f5fe97bcc36406a7ab4a7c96997ab7c4522f build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.5 to 2.82.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.7</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.1.6.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.105.0.</p>
</li>
<li>
<p>Update <code>gungraun-runner@latest</code> to 0.19.3.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.8.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.55.1.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.36.0.</p>
</li>
</ul>
<h2>2.82.6</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.7.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.25.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.46.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.55.0.</p>
</li>
<li>
<p>Update <code>cargo-auditable@latest</code> to 0.7.5.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.87.2] - 2026-08-30</h2>
<ul>
<li>
<p>Update <code>typos@latest</code> to 1.50.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.0.</p>
</li>
<li>
<p>Update <code>shfmt@latest</code> to 3.14.0.</p>
</li>
</ul>
<h2>[2.87.1] - 2026-08-29</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.7.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.49.1.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.51.1.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.5.0.</p>
</li>
<li>
<p>Update <code>d2@latest</code> to 0.8.2.</p>
</li>
<li>
<p>Update <code>cargo-zigbuild@latest</code> to 0.23.3.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.2.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.11.</p>
</li>
</ul>
<h2>[2.87.0] - 2026-08-27</h2>
<ul>
<li>
<p>Support <code>kache</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1980">#1980</a>, thanks <a href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a>)</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.30.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.6.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.14.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.11.2.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/16b05812d776ae1dfaabc8277e421fb6d2506419"><code>16b0581</code></a> Release 2.82.7</li>
<li><a href="https://github.com/taiki-e/install-action/commit/68c845308d9b56d38e797c62e48eddfe1b4ba94f"><code>68c8453</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/8532697fda4ee37ccd65901e90d87a785c45d7bd"><code>8532697</code></a> Update trivy manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/2959f9e73b89d18f2d72d0aa55ed797e70062732"><code>2959f9e</code></a> Update <code>tombi@latest</code> to 1.1.6</li>
<li><a href="https://github.com/taiki-e/install-action/commit/9bfa119f6c347b458726d629758b16dd861727a4"><code>9bfa119</code></a> Update <code>kingfisher@latest</code> to 1.105.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f198b91ffb69aa6008cb3b0ea9cf6eb6b0af01f4"><code>f198b91</code></a> Update just manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/20feedd5827d6d189bca20753dbd5582948e7478"><code>20feedd</code></a> Update <code>gungraun-runner@latest</code> to 0.19.3</li>
<li><a href="https://github.com/taiki-e/install-action/commit/314197aa953241335b4a4c41c2d6e8066d6150da"><code>314197a</code></a> Update <code>editorconfig-checker@latest</code> to 3.8.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f8632ebbd28b43dce012ff3db91c959c7751db33"><code>f8632eb</code></a> Update <code>dprint@latest</code> to 0.55.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/4234dc0f7acb7e7774a1716b103fcaf2d9ed9b4d"><code>4234dc0</code></a> Update <code>cargo-tarpaulin@latest</code> to 0.36.0</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/bffeee26d4db9be238a4ea78d8826604ebcb594d...16b05812d776ae1dfaabc8277e421fb6d2506419">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.5&new-version=2.82.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 11e5f5fe97bcc36406a7ab4a7c96997ab7c4522f; successfully ran local tests


Tree-SHA512: dd0168fc4bca1701a29f8310bb92c1b613c34f3845a896a031061f4dfa4d6fd4c1995bcc07415fc9802baa487136b5103d02af9b90ad41100440f07823050887

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine Dependabot update that bumps a GitHub Actions helper (taiki-e/install-action) used in automated testing workflows from version 2.82.5 to 2.82.7. It only changes which version of a third-party action is invoked when installing testing tools. There is no indication this fixes or introduces a security problem in the rust-bitcoin library itself.

Security candidateMerge rust-bitcoin/rust-bitcoin#6804: build(deps): bump actions/checkout from 6.0.2 to 7.0.0by Andrew Poelstra · 84da61f7 · Aug 31, 2026 · 1 fileMessage 96 · StrongInformational 18Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6804: build(deps): bump actions/checkout from 6.0.2 to 7.0.0

b9e9f313a5781b8484a27915806b417661280e27 build(deps): bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot])

Pull request description:

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=6.0.2&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK b9e9f313a5781b8484a27915806b417661280e27; successfully ran local tests


Tree-SHA512: e4555eab58bbdc36c1adf03568e345279fdc1293f75de05008598854b0d4b3ec793e53d0a9054b735144a029a2439a70848154e1e34168ed1ca3ee2ac3de16fb

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege statedocumentation-only discountautomated dependency-update discountmerge-commit duplicate discount
AI analysis · Informational 18/100

This is a routine update to the version of the GitHub Actions 'checkout' tool used by the project's automated testing pipeline. The new version includes a security improvement that blocks risky checkouts for certain trigger types, but the project already uses safe settings (no persistent credentials, full history fetch). It does not change the Bitcoin library code that users install.

Security candidateMerge rust-bitcoin/rust-bitcoin#6802: Automated nightly rustfmt (2026-08-30)by Andrew Poelstra · f57e1352 · Aug 31, 2026 · 2 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6802: Automated nightly rustfmt (2026-08-30)

8be20b5159937a66934c07f90837061659511427 2026-08-30 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK 8be20b5159937a66934c07f90837061659511427; successfully ran local tests


Tree-SHA512: 69fbb0ea042b79a076896ffee22588e47f6386dc4fb8afd35c148cf0825a3c41ea23cf1fe919f19f0a59609b4b92c008d3148272fcc633947e9e2889823d19da

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathmerge-commit duplicate discount
AI analysis · Informational 15/100

This is an automated code-formatting commit. It only changes whitespace and line breaks in two source files to match the latest nightly rustfmt style. No program logic, behavior, or security properties were changed.

Security candidateMerge rust-bitcoin/rust-bitcoin#6786: fuzz: Add bip158 fuzz_targets for BasicFilterby Andrew Poelstra · bcc00e46 · Aug 30, 2026 · 5 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6786: fuzz: Add bip158 fuzz_targets for BasicFilter

ac372d46587cd08534371866e53d218a78630ca2 fuzz: Add bip158 fuzz_targets for BasicFilter (Abeeujah)

Pull request description:

Add fuzz targets for bitcoin-bip158 `BasicFilter::from_block` and `BasicFilter::from_byte`.

- `build_filter` exercises filter construction from a synthetic block with fuzzed scripts and verifies round-trip serialization, match_all/match_any correctness.
- `parse_filter` deserializes arbitrary bytes to construct a BasicFilter, and verifies batch matching is consistent with per-query matching.


ACKs for top commit:
apoelstra:
ACK ac372d46587cd08534371866e53d218a78630ca2; successfully ran local tests


Tree-SHA512: 1a716ee84c7a3a13caea31a40948175fcea23fa9157f6eed9eab7f0fcdc479281b1330d7c9a0e712dc2fa977eecafa18979841d857f9d9954bf553a327cec8e6

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlfuzzing or regression evidencemerge-commit duplicate discount
AI analysis · Informational 15/100

This commit only adds new fuzz testing code for the BIP158 BasicFilter feature. Fuzz tests are automated tools that feed random or crafted inputs to code to find bugs, but they do not themselves change the behavior of the main library or fix any vulnerability. There is no indication this commit addresses a security issue.

AI review queuedbuild(deps): bump actions/checkout from 6.0.2 to 7.0.0by dependabot[bot] · b9e9f313 · Aug 30, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/checkout from 6.0.2 to 7.0.0

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the version of a GitHub-provided action used to check out source code during automated testing. There is no indication of a security issue in the project itself, and the change does not alter application code that handles Bitcoin transactions, keys, or network data.

AI review queuedbuild(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7by dependabot[bot] · 11e5f5fe · Aug 30, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.5 to 2.82.7.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/bffeee26d4db9be238a4ea78d8826604ebcb594d...16b05812d776ae1dfaabc8277e421fb6d2506419)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.82.7
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps a GitHub Actions helper (taiki-e/install-action) used only in CI workflows to install the cargo-mutants testing tool. The change does not touch any Rust source code, cryptography, network handling, or released library behavior. There is no indication of a security issue in the commit or supplied references.

Security candidateMerge rust-bitcoin/rust-bitcoin#6547: ci: upgrade to rbmt 0.5.3 and delete api filesby Andrew Poelstra · 22e9b657 · Aug 30, 2026 · 33 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6547: ci: upgrade to rbmt 0.5.3 and delete api files

53ea3d6f15afab5d35091122cd46f1d364811b5e api: remove api snapshot files (satsfy (Renato Britto))
c5f77ae9c9e08e266ca8b7393f0c786b2372bae9 ci: upload api-diff artifact for the labeller (satsfy (Renato Britto))
5c865aa63b600a978a24a4eaa25fd5b11fbdeda8 ci: upgrade to cargo-rbmt 0.5.3 (satsfy (Renato Britto))

Pull request description:

Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6522
Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6580
Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6612

This PR upgrades the CI to cargo-rbmt 0.5.1 and replicates the 0.32.xxx CI, borrowing heavily from https://github.com/rust-bitcoin/rust-bitcoin/pull/6508.

- Remove API files. Depend on diff check CI job replicating 0.32.xxx.
- Adapt the docs to cargo-rbmt 0.5.1.
- `docsrs` was merged into `docs` (with `--no-docsrs` for plain rustdoc).
- Put the version in the manifest as the source of truth.
- Upgrading cross so that it uses a modern TOML parser.


ACKs for top commit:
apoelstra:
ACK 53ea3d6f15afab5d35091122cd46f1d364811b5e; successfully ran local tests


Tree-SHA512: 34dfce4fe39d1eed72a340b2658d1067d568c447d14eb6bd6408dcbb2ffbfaa77f06f85a4bc44fee3bf59089b914656188c4ff40c380b42c14f4343407732053

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathmerge-commit duplicate discount
AI analysis · Informational 15/100

This commit is a routine maintenance change to the project's continuous integration (CI) setup. It upgrades an internal tool called cargo-rbmt to version 0.5.3, removes pre-generated API snapshot files from the repository, and adjusts scripts so those snapshots are generated on demand during CI instead. There is no change to the actual Bitcoin library code that users rely on, and no security-relevant behavior is introduced or fixed.

Security candidateMerge rust-bitcoin/rust-bitcoin#6763: bip152: validate prefill count before allocating short IDsby Andrew Poelstra · db69835e · Aug 29, 2026 · 1 fileMessage 96 · StrongModerate 57Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6763: bip152: validate prefill count before allocating short IDs

7f80030897591c1d3bcf5023fe24d78115034403 bip152: test excessive prefill indexes (racequite)
cf94409eb486fd20e404acca67e87ccec6f1ebb4 bip152: validate prefill count before allocating short IDs (racequite)

Pull request description:

`HeaderAndShortIds::from_block` documents that invalid prefill indexes return `Error::InvalidPrefill`. However, it calculated the short ID capacity using unchecked subtraction before validating the input.

When the number of prefill indexes exceeds the number of transactions, this subtraction panics with overflow checks enabled. Other build configurations may wrap the subtraction and attempt an invalid or excessively large allocation.

Use `checked_sub` to return `Error::InvalidPrefill` before allocating the short ID vector. Add a regression test covering a single-transaction block with too many prefill indexes.


ACKs for top commit:
apoelstra:
ACK 7f80030897591c1d3bcf5023fe24d78115034403; successfully ran local tests


Tree-SHA512: 22d77e24df00332016107c482ae68c16fcdea387fa5fd4e5675d2e90c9067a4c1a961b6a9523bc58c99260f1011ae12e30e034881c7c2ccdb45f68972b948a9c

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetydefensive validationfuzzing or regression evidencemerge-commit duplicate discount
AI analysis · Moderate 57/100

This change fixes a panic/crash bug in Bitcoin compact block (BIP152) encoding. When a caller asked to 'prefill' more transactions than actually exist in the block, the code subtracted the two numbers without checking, which could cause the program to panic (in safe builds) or try to allocate a nonsensical amount of memory (in other builds). The patch validates the count first and returns a proper error instead.