rust-bitcoin

Merge rust-bitcoin/rust-bitcoin#6798: bump yanked secp256k1 version to 0.33.0

935d8eb86e904b3d4ef26ec8ca1ae543daacc914 deps: bump secp256k1 to 0.33.0 (satsfy (Renato Britto))

Pull request description:

The 0.32.0-beta line was yanked from crates.io when 0.33.0 was released.

Also `XOnlyPublicKey::serialize` was deprecated for `to_byte_array` and `secp256k1::Keypair::from_seckey_byte_array` became
`from_secret_bytes`.


ACKs for top commit:
apoelstra:
ACK 935d8eb86e904b3d4ef26ec8ca1ae543daacc914; successfully ran local tests


Tree-SHA512: 62221a72567082200a5f710898bfdd187e553859f496653bd6e86e64c0ca1e2476381637101e7b1507d72071f8aca079f94976ad1bb89211150723f716310e51

Merge rust-bitcoin/rust-bitcoin#6790: Implement Rem<NonZero{I,U}64> for {Signed}Amount

7ceb9f04cf33161590d9f8137dd606e2e23d498e Implement Rem<NonZero{I,U}64> for {Signed}Amount (Martin Habovstiak)
60e21d58adab5dec6fd83be1c997fa03b833c1bd Rename `amount/result.rs` to `amount/ops.rs` (Martin Habovstiak)

Pull request description:

`Rem` and `RemAssign` were already implemented for `u64` and `i64` and we also had `Div` and `DivAssign` for `NonZeroU64` and `NonZeroI64` but `Rem{Assign}` for `NonZero{U,I}64` were missing. This PR adds them along with a little cleanup.


ACKs for top commit:
apoelstra:
ACK 7ceb9f04cf33161590d9f8137dd606e2e23d498e; successfully ran local tests. LGTM. But lol that even stdlib's "nonzero" types are unusable without adding unreachable panic paths.


Tree-SHA512: c1c9513f6620ea4cc966be91e2529e790db17692c1c7d5d0360c8feb35392cd75d64255017ae2662f3ee6146d03198b98bf10d9b97dc1c47939a636d07465ea3

deps: bump secp256k1 to 0.33.0

The 0.32.0-beta line was yanked from crates.io when 0.33.0 was
released.

XOnlyPublicKey::serialize was deprecated for to_byte_array.
secp256k1::Keypair::from_seckey_byte_array became
`from_secret_bytes`.

Merge rust-bitcoin/rust-bitcoin#6785: build(deps): bump taiki-e/install-action from 2.82.4 to 2.82.5

3856bf4f19d67a70c9224c48c6750a940f089b81 build(deps): bump taiki-e/install-action from 2.82.4 to 2.82.5 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.4 to 2.82.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.5</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 46.0.1.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.126.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.6.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.14.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.1.0.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.86.8] - 2026-08-26</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.1.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.258.0.</p>
</li>
<li>
<p>Update <code>oxfmt@latest</code> to 1.80.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.12.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 2.0.0.</p>
</li>
<li>
<p>Update <code>cargo-zigbuild@latest</code> to 0.23.2.</p>
</li>
</ul>
<h2>[2.86.7] - 2026-08-24</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.4.1.</p>
</li>
<li>
<p>Update <code>rafn@latest</code> to 0.1.5.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.22.0.</p>
</li>
</ul>
<h2>[2.86.6] - 2026-08-23</h2>
<ul>
<li>
<p>Update <code>dprint@latest</code> to 0.56.1.</p>
</li>
<li>
<p>Update <code>cargo-lambda@latest</code> to 1.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.10.</p>
</li>
</ul>
<h2>[2.86.5] - 2026-08-21</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.4.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.257.1.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.36.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/bffeee26d4db9be238a4ea78d8826604ebcb594d"><code>bffeee2</code></a> Release 2.82.5</li>
<li><a href="https://github.com/taiki-e/install-action/commit/5bafa69e5add729bd5cc9c0646ed12e1af612c99"><code>5bafa69</code></a> ci: Test GitHub-hosted ubuntu 26.04 runners</li>
<li><a href="https://github.com/taiki-e/install-action/commit/e7b7497213f2263bcf738032dcc69fd4c14b1813"><code>e7b7497</code></a> Update wasmtime manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/e9838983e85b61bb8ceb03c66a676d5a37507462"><code>e983898</code></a> Update <code>wasmtime@latest</code> to 46.0.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/0cd66872025ce95e85d8831011a3d60693cb5b06"><code>0cd6687</code></a> Update <code>wasm-bindgen@latest</code> to 0.2.126</li>
<li><a href="https://github.com/taiki-e/install-action/commit/151275d7b873bc8f076b2e0addaaf908740405ca"><code>151275d</code></a> Update <code>vacuum@latest</code> to 0.29.6</li>
<li><a href="https://github.com/taiki-e/install-action/commit/1a104bfb141e3d8faadbdc6c3306789dd461f1c9"><code>1a104bf</code></a> Update syft manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/edab3a363f10f8d5af8efc8633ad982b899bfbde"><code>edab3a3</code></a> Update <code>mise@latest</code> to 2026.6.14</li>
<li><a href="https://github.com/taiki-e/install-action/commit/46c1ccf9e1e2e709f19c2846fb39337b5045c0f6"><code>46c1ccf</code></a> Update <code>cargo-rdme@latest</code> to 2.1.0</li>
<li>See full diff in <a href="https://github.com/taiki-e/install-action/compare/682e7d9e49c5e653d371fc6adbda67653461378a...bffeee26d4db9be238a4ea78d8826604ebcb594d">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
satsfy:
ACK 3856bf4f19d67a70c9224c48c6750a940f089b81
apoelstra:
ACK 3856bf4f19d67a70c9224c48c6750a940f089b81; successfully ran local tests


Tree-SHA512: 117f94e2df1b5717a2aa99f94d0d65701d1debe7ac5b6344f4b944bf64a145b569755b75652f57a98ea4ebc02530e4e32ed2499c4ad2e04eb8c4bdd64c510872

Merge rust-bitcoin/rust-bitcoin#6748: Capitalize Bitcoin protocol references in docs

2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963 Capitalize Bitcoin protocol references (Jamil Lambert, PhD)
77054a4f9113d1a0d5f2f61c3279c36701960a21 Hyphenate rust-bitcoin (Jamil Lambert, PhD)
cbedca4543c24a5ac41abeffb2e307b4eac92921 Standardize Bitcoin network naming in docs (Jamil Lambert, PhD)

Pull request description:

Bitcoin should have a capital `B` when referring to the protocol, network, or software. And lower case `b` when referring to the currency.

Correct all of the docs so that the capitalization is consistent. Including a couple of other minor adjacent corrections.

Standardize docs to `Bitcoin {network}`.


ACKs for top commit:
tcharding:
ACK 2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963
apoelstra:
ACK 2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963; successfully ran local tests


Tree-SHA512: 453d72987c6d1fb0e7e86cda6f66ea60e596fbf801a3b5374e661d66a838e6b20c949adab9d362c277cc1957cec96c9613b3c953677a7103231264c1e668a579

Merge rust-bitcoin/rust-bitcoin#6765: addresses: Remove all non-`Infallible` `From` impls on error types

ad74b7d44ffe562ec1089e615db196873daa4954 addresses: Remove all non-Infallible From impls on errors (Mitchell Bagot)
d0891037ca87d2bfb69f194aaeb350156d434fdc Replace uses of From on addresses errors (Mitchell Bagot)

Pull request description:

Currently, addresses has From impls on various errors, for various errors. While addresses is not near 1.0, such From impls represent a public API commitment and should be removed.

Remove all uses of error conversion From impls for addresses errors and remove the relevant From impls.


ACKs for top commit:
apoelstra:
ACK ad74b7d44ffe562ec1089e615db196873daa4954; successfully ran local tests
tcharding:
ACK ad74b7d44ffe562ec1089e615db196873daa4954


Tree-SHA512: b32502658cfc258b0997b1118adfe57c90f7d77c6306d5a1722541102fa471b139d3aed9223584985c8996905db4df9a5b03bc173e2490567eeb6c2d0292df50

Merge rust-bitcoin/rust-bitcoin#6778: ci: pin dependabot to Sunday 16:00 America/Chicago

ccc129aad10661b93407fd98896b38981954d991 ci: pin dependabot to Sunday 16:00 America/Chicago (satsfy (Renato Britto))

Pull request description:

Per apoelstra's ask on https://github.com/rust-bitcoin/rust-bitcoin/pull/6773#issuecomment-5395628053. Pinned to 16:00 at Austin city time which is the same as `America/Chicago`, the official IANA timezone name.

Dependabot used to run at [random moments](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#interval).


ACKs for top commit:
tcharding:
ACK ccc129aad10661b93407fd98896b38981954d991
apoelstra:
ACK ccc129aad10661b93407fd98896b38981954d991; successfully ran local tests


Tree-SHA512: 0be0461b03f979e4c63bd48546f70b2f7cca970dd5f6aa176138e477bd35160c271c18bcc2888bc360dcc7b80c94f602bff5a68f74b5263979a965e4685ad6c6

Merge rust-bitcoin/rust-bitcoin#6773: build(deps): bump actions/cache from 5.0.5 to 6.1.0

3b21f967867b2e78ab5fc7e5a6d7d981a9549e72 build(deps): bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot])

Pull request description:

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed and merged.</li>
<li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version number.</li>
<li>Approve the run to publish the new version and update the major tags for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li>
<li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li>
<li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li>
<li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li>
<li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li>
<li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li>
<li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li>
<li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li>
<li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li>
<li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li>
<li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 3b21f967867b2e78ab5fc7e5a6d7d981a9549e72; successfully ran local tests
satsfy:
ACK 3b21f967867b2e78ab5fc7e5a6d7d981a9549e72


Tree-SHA512: 7d32885b0c0a7b99fe8693dec176fc5f70d6ba8e294e1ffbaad3239b0fe37b4ec02a7ad4dcfe21d7017d50b29305ad24607364c6b6c32a411f44ac0d457da4d2

Merge rust-bitcoin/rust-bitcoin#6774: build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1

1d848840a0c231fb3881da98b07042122314b51d build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 (dependabot[bot])

Pull request description:

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/download-artifact/releases">actions/download-artifact's releases</a>.</em></p>
<blockquote>
<h2>v8.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for CJK characters in the artifact name by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/471">actions/download-artifact#471</a></li>
<li>Add a regression test for artifact name + content-type mismatches by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/472">actions/download-artifact#472</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v8...v8.0.1">https://github.com/actions/download-artifact/compare/v8...v8.0.1</a></p>
<h2>v8.0.0</h2>
<h2>v8 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.</p>
</blockquote>
<blockquote>
<p>[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).</p>
</blockquote>
<h3>Direct downloads</h3>
<p>To support direct uploads in <code>actions/upload-artifact</code>, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the <code>Content-Type</code> header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new <code>skip-decompress</code> parameter to <code>true</code>.</p>
<h3>Enforced checks (breaking)</h3>
<p>A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the <code>digest-mismatch</code> parameter. To be secure by default, we are now defaulting the behavior to <code>error</code> which will fail the workflow run.</p>
<h3>ESM</h3>
<p>To support new versions of the @actions/* packages, we've upgraded the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Don't attempt to un-zip non-zipped downloads by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/460">actions/download-artifact#460</a></li>
<li>Add a setting to specify what to do on hash mismatch and default it to <code>error</code> by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/461">actions/download-artifact#461</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v7...v8.0.0">https://github.com/actions/download-artifact/compare/v7...v8.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/download-artifact/commit/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"><code>3e5f45b</code></a> Add regression tests for CJK characters (<a href="https://redirect.github.com/actions/download-artifact/issues/471">#471</a>)</li>
<li><a href="https://github.com/actions/download-artifact/commit/e6d03f67377d4412c7aa56a8e2e4988e6ec479dd"><code>e6d03f6</code></a> Add a regression test for artifact name + content-type mismatches (<a href="https://redirect.github.com/actions/download-artifact/issues/472">#472</a>)</li>
<li><a href="https://github.com/actions/download-artifact/commit/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3"><code>70fc10c</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/461">#461</a> from actions/danwkennedy/digest-mismatch-behavior</li>
<li><a href="https://github.com/actions/download-artifact/commit/f258da9a506b755b84a09a531814700b86ccfc62"><code>f258da9</code></a> Add change docs</li>
<li><a href="https://github.com/actions/download-artifact/commit/ccc058e5fbb0bb2352213eaec3491e117cbc4a5c"><code>ccc058e</code></a> Fix linting issues</li>
<li><a href="https://github.com/actions/download-artifact/commit/bd7976ba57ecea96e6f3df575eb922d11a12a9fd"><code>bd7976b</code></a> Add a setting to specify what to do on hash mismatch and default it to <code>error</code></li>
<li><a href="https://github.com/actions/download-artifact/commit/ac21fcf45e0aaee541c0f7030558bdad38d77d6c"><code>ac21fcf</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/460">#460</a> from actions/danwkennedy/download-no-unzip</li>
<li><a href="https://github.com/actions/download-artifact/commit/15999bff51058bc7c19b50ebbba518eaef7c26c0"><code>15999bf</code></a> Add note about package bumps</li>
<li><a href="https://github.com/actions/download-artifact/commit/974686ed5098c7f9c9289ec946b9058e496a2561"><code>974686e</code></a> Bump the version to <code>v8</code> and add release notes</li>
<li><a href="https://github.com/actions/download-artifact/commit/fbe48b1d2756394be4cd4358ed3bc1343b330e75"><code>fbe48b1</code></a> Update test names to make it clearer what they do</li>
<li>Additional commits viewable in <a href="https://github.com/actions/download-artifact/compare/v7...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 1d848840a0c231fb3881da98b07042122314b51d; successfully ran local tests


Tree-SHA512: 4bc6d5a95cee7c75aebcb92bc36c39b34c2b05948b2e6c36b679b812321076e3501191fb21d4641604e9366c25d05e4ff82a282d834fdff569395e50c6aa108c

Merge rust-bitcoin/rust-bitcoin#6775: build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1

5c0d27359e798a2f75388ca0723b74208f336c48 build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1 (dependabot[bot])

Pull request description:

Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.20.0 to 1.20.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p>
<blockquote>
<h2>v1.20.1</h2>
<p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p>
<h4>In this release:</h4>
<ul>
<li>Upgrade dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/732870f031d2fb36309d0deaf36abcc704a7be65"><code>732870f</code></a> release: cargo-binstall v1.20.1 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2590">#2590</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/84c209e6313ba472763c1b34615f03c41e7413dd"><code>84c209e</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2586">#2586</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/9e9fc4635d22c94c113187350872d6916c005474"><code>9e9fc46</code></a> build(deps): bump the deps group with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2589">#2589</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/a387173c6f65daf8c665f747f297385a6a8c68f9"><code>a387173</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2588">#2588</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/733bffce578000b64507ac3d683a61c2b605c21d"><code>733bffc</code></a> build(deps): bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2587">#2587</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/252c5e70a6eae3a9de06b610159a568eaf705055"><code>252c5e7</code></a> build(deps): bump the deps group across 1 directory with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2585">#2585</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/1d2ff7ce3f67fe46c45478d09d1670c1f1b100dc"><code>1d2ff7c</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2584">#2584</a>)</li>
<li>See full diff in <a href="https://github.com/cargo-bins/cargo-binstall/compare/30b5ca8b54e1dcffd9548bc87ede1531310fdc67...732870f031d2fb36309d0deaf36abcc704a7be65">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 5c0d27359e798a2f75388ca0723b74208f336c48; successfully ran local tests
satsfy:
ACK 5c0d27359e798a2f75388ca0723b74208f336c48


Tree-SHA512: a21a2398906184633fbc534cb48b4d2c5b1de7351f5ac991bba31c6080e51e13f15ff64b29a94e3c7aadd9b15d8fbbe315bed741569b9d6b37c48410cb11c5ef

Merge rust-bitcoin/rust-bitcoin#6776: build(deps): bump actions/checkout from 6.0.2 to 7.0.0

25ab130b9bea1579030e735880046577ccad0faa build(deps): bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot])

Pull request description:

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 25ab130b9bea1579030e735880046577ccad0faa; successfully ran local tests
satsfy:
ACK 25ab130b9bea1579030e735880046577ccad0faa


Tree-SHA512: c3e4906f6a150a030f5db08c7da667459982d0e4cb9e605d19f489cd50526705fad58a07dbfd87a8cec6a5b79eb3ce1bb1fa59bbc117fe680852b0dc76821518

Merge rust-bitcoin/rust-bitcoin#6777: build(deps): bump taiki-e/install-action from 2.82.0 to 2.82.4

24c8df4787d21eedb5570545980a68301d81751c build(deps): bump taiki-e/install-action from 2.82.0 to 2.82.4 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.0 to 2.82.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.4</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.11.24.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.13.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.54.0.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.1.</p>
</li>
</ul>
<h2>2.82.3</h2>
<ul>
<li>
<p>Update <code>zizmor@latest</code> to 1.26.1.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 46.0.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.5.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.12.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.104.0.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.35.5.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.138.</p>
</li>
<li>
<p>Update <code>cargo-crap@latest</code> to 0.3.0.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.20.1.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.0.1.</p>
</li>
</ul>
<h2>2.82.2</h2>
<ul>
<li>
<p>Update <code>xh@latest</code> to 0.26.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.23.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.2.</p>
</li>
<li>
<p>Update <code>sccache@latest</code> to 0.16.0.</p>
</li>
</ul>
<h2>2.82.1</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.4.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.22.</p>
</li>
<li>
<p>Update <code>osv-scanner@latest</code> to 2.4.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.11.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.11.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.86.6] - 2026-08-23</h2>
<ul>
<li>
<p>Update <code>dprint@latest</code> to 0.56.1.</p>
</li>
<li>
<p>Update <code>cargo-lambda@latest</code> to 1.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.10.</p>
</li>
</ul>
<h2>[2.86.5] - 2026-08-21</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.4.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.257.1.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.36.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.10.</p>
</li>
<li>
<p>Update <code>cargo-dinghy@latest</code> to 0.8.6.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.0.</p>
</li>
</ul>
<h2>[2.86.4] - 2026-08-20</h2>
<ul>
<li>
<p>Update <code>oxfmt@latest</code> to 1.79.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.8.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.14.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.56.0.</p>
</li>
<li>
<p>Update <code>cargo-about@latest</code> to 0.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.9.</p>
</li>
</ul>
<h2>[2.86.3] - 2026-08-18</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/682e7d9e49c5e653d371fc6adbda67653461378a"><code>682e7d9</code></a> Release 2.82.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/88e83503037db61d4f066a4d9cb32e6fc06b70c2"><code>88e8350</code></a> Update wasmtime manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/cf0e00b44cf05faddafcc8082c6c2366e2a02380"><code>cf0e00b</code></a> Update wasm-bindgen manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/a130ea674166df9065f363cbb53f1f2bc4a6298c"><code>a130ea6</code></a> Update vacuum manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/0bdcc65dc21d0ae46842dc5ad063d69ce8991365"><code>0bdcc65</code></a> Update <code>uv@latest</code> to 0.11.24</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3f52215559b820ee57b68e3fa9b38f6cd205e9c8"><code>3f52215</code></a> Update <code>mise@latest</code> to 2026.6.13</li>
<li><a href="https://github.com/taiki-e/install-action/commit/294a073b0ebe66401c699c21b98e9ecb5a6da735"><code>294a073</code></a> Update <code>just@latest</code> to 1.54.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f9bf24932b3cbfe7ae26b5addcd257989e14ec4d"><code>f9bf249</code></a> Update cargo-rdme manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/98288d38cbfc5fa065ff61c6971d50dc3ba7d408"><code>98288d3</code></a> Update <code>biome@latest</code> to 2.5.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3"><code>ace6ebe</code></a> Release 2.82.3</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/b8cecb83565409bcc297b2df6e77f030b2a468d5...682e7d9e49c5e653d371fc6adbda67653461378a">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 24c8df4787d21eedb5570545980a68301d81751c; successfully ran local tests
satsfy:
ACK 24c8df4787d21eedb5570545980a68301d81751c


Tree-SHA512: e31af029eeff4bf1e9abcc8f73725d2e7fb87972d38039311252650e40af103d130dd7d16c6947b1333f7f77e5ce30ac6b6908017c34e7597c1f57d69b4c49e4

Merge rust-bitcoin/rust-bitcoin#6768: units: Add `#[inline]` to simple functions

75c1d648bc3ac9e65b222ef6a56332b304e41815 units: Add #[inline] to simple functions (Mitchell Bagot)

Pull request description:

Where functions merely delegate to other functions, or only perform trivial operations, they should be annotated with #[inline] to nudge the compiler towards improving performance by inlining them. Before the final 1.0 release, any remaining simple functions should be tagged with the #[inline] attribute.

Add #[inline] to trivial functions in all modules.


ACKs for top commit:
apoelstra:
ACK 75c1d648bc3ac9e65b222ef6a56332b304e41815; successfully ran local tests
tcharding:
ACK 75c1d648bc3ac9e65b222ef6a56332b304e41815


Tree-SHA512: e0434a8523cd097ddeddd626e68497310c8efb8c3c071d37d066dc16dd5a0a701876abde78bfdac515cdd5edd75cc383685d2a8b43293a35fa2aca789a32b301

Merge rust-bitcoin/rust-bitcoin#6766: bitcoin: make legacy sighash takes `EcdsaSighashType`

7cffa4621b1a8ccb2219848fd9a8c576fe4de20c bitcoin: make legacy sighash takes `EcdsaSighashType` (jrakibi)

Pull request description:

Currently the legacy sighash API takes a u32 for sighash type.
Now that `EcdsaSighashType` can also represent non-standard values, we can change it to take EcdsaSighashType instead.

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/1657


ACKs for top commit:
apoelstra:
ACK 7cffa4621b1a8ccb2219848fd9a8c576fe4de20c; successfully ran local tests
tcharding:
ACK 7cffa4621b1a8ccb2219848fd9a8c576fe4de20c


Tree-SHA512: cd7482de41dc3d88a348fd269821d656aec00c74eda3caea1eb114d4aa0ab673c9d6f286e16db5d592360c89b3c1acad757544d13e93dd7ba8776de7476909f1

Merge rust-bitcoin/rust-bitcoin#6762: primitives: Flatten error constructors

c772cb1b52f575c6d4b9566440c18faa143e0c13 primitives: Flatten error constructors (Mitchell Bagot)

Pull request description:

Typically speaking, nested error construction yields code that's not very readable. Instead, we can make use of map_err to repeatedly wrap inner error types to produce the final error types as needed.

Flatten nested error constructors in primitives to use repeated map_err calls.

Contributes to #6539


ACKs for top commit:
tcharding:
ACK c772cb1b52f575c6d4b9566440c18faa143e0c13
apoelstra:
ACK c772cb1b52f575c6d4b9566440c18faa143e0c13; successfully ran local tests


Tree-SHA512: c00645798ca9dd602c54b735a6d282e0964c46634fd813b6942a3e6ae8d940958391226ecf95aa8f2a6346251072c80bd4b49e2394ff5c09a9071210be349192

ci: pin dependabot to Sunday 16:00 America/Chicago

Merge rust-bitcoin/rust-bitcoin#6725: primitives: Add doctest examples

2877a0633d5d94f58803c0eca1b72e0182030981 primitives: Add module doc examples (Mitchell Bagot)
89b13277a1340516904a32a6379b12ed58b734da primitives: Add examples to script::owned methods (Mitchell Bagot)
ecd3a19ca976d8dc8442b3be726710cb80b2fbed primitives: Add examples to Witness methods (Mitchell Bagot)
493ce74e8475a7c70834072196aca6a154d4d140 primitives: Add simple examples to script-adjacent types (Mitchell Bagot)
5ffdd985d1afc3423a24faacbb3d9eb33506ddd9 primitives: Add examples to from_script on script hash types (Mitchell Bagot)
9f4ef91840892faf9e864b72d32d7527cd0ce115 primitives: Remove outdated comment on Header::block_hash (Mitchell Bagot)
75f29146c1d3d0b51525c91d7fbf4ef6744a26e6 primitives: Add examples to block module and methods (Mitchell Bagot)

Pull request description:

Per C-EXAMPLE, every item in a crate is supposed to include an example/doctest. Since many functions in primitives are trivial, providing an example for every method and type is needlessly verbose. However, most modules, types and some methods can benefit from the introduction of examples to clarify quirks and uses of the functionality.

Add doctests examples liberally to modules, types and methods throughout primitives.


ACKs for top commit:
tcharding:
ACK 2877a0633d5d94f58803c0eca1b72e0182030981
apoelstra:
ACK 2877a0633d5d94f58803c0eca1b72e0182030981; successfully ran local tests


Tree-SHA512: f9ee96654e4ba367838ac4014c28194828e267fb3926eacf4cd157b80259b841f5e76aded407258ad9cb0d5440e6e68a7e11bead6b7600535b3b1869cac92227

Merge rust-bitcoin/rust-bitcoin#6755: crypto: Extend `EcdsaSighashType` to non-standard values

619e16acbc65593fed9c7d4100bc3d551829c19f crypto: replace EcdsaSighashType derives with manual impls (jrakibi)
baa6ee0e71b871c29aa7b75027c3d3ed4771a144 Add tests for non-standard sighash types (jrakibi)
3fb16c665b4ba562b81ca1df544d7f4136b02010 crypto: Make from_slice accept non-standard sighash types (jrakibi)
50c06af4b3c4274f44ec751bfef06fd987343a08 crypto: extend EcdsaSighashType to accept NonStandard (jrakibi)

Pull request description:

The current segwit v0 sighash API takes `EcdsaSighashType`, which only accepts _standard_ values. This means we cannot compute the correct sighash for _consensus-valid_ transactions that use _non-standard_ sighash type, so verifying their signatures fails.

We extend `EcdsaSighashType` to accept any u8 value (solution proposed by Apoelstra in https://github.com/rust-bitcoin/rust-bitcoin/issues/1657#issuecomment-1456876763).

This is a step to make legacy encoding also take `EcdsaSighashType` instead of u32 to close #1657 (will open a separate PR for it after getting feedback on this one)

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6647 and https://github.com/rust-bitcoin/rust-bitcoin/issues/4133

_This might also address #777_


ACKs for top commit:
apoelstra:
ACK 619e16acbc65593fed9c7d4100bc3d551829c19f; successfully ran local tests


Tree-SHA512: a446767f920c691a9f11774e5a7329036154c1a3d762cf293565a7ac9e3aa7a96bd94a4177b28661aa417334f4d4cd001065c37dfc11c69a2b944425c026c6e3

primitives: Add #[inline] to simple functions

Following the recent additions to primitives, and before the final
release, new simple functions need have #[inline] added to them.

Add #[inline] to simple functions throughout the crate.

Merge rust-bitcoin/rust-bitcoin#6761: Manual bump of dtolnay/rust-toolchain specifying toolchain

4fa6b1c71d34e0121e834b78f486ac9b46f2cf57 ci: pass toolchain input to rust-toolchain action (satsfy (Renato Britto))
06ba6541bca755b6e7088f6a893218d96a9d2ad4 build(deps): update dtolnay/rust-toolchain requirement to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 (dependabot[bot])

Pull request description:

Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6751

The dependabot bump moved `stable` branch pin to `master`, which has no toolchain default and requires it to be specified. The solution here is inspired on Miri CI workflow and another rust.yml job, which already implements the same.


ACKs for top commit:
tcharding:
ACK 4fa6b1c71d34e0121e834b78f486ac9b46f2cf57
apoelstra:
ACK 4fa6b1c71d34e0121e834b78f486ac9b46f2cf57; successfully ran local tests


Tree-SHA512: 02de193e168a639ed9f4f191d3ca10f8d70824e4ae25163fe92475096103da3c4903c99e7cc8dbd21ce4839b5a48a42e57e8dec4edb162c50cdef8f721f217bb

ci: pass toolchain input to rust-toolchain action

The dependabot bump moved stable branch pin to master, which has no
default and requires the toolchain specified. Inspired on miri ci
workflow, which already implements this.

Merge rust-bitcoin/rust-bitcoin#6757: ci: gen PR labels from master instead of fork

000113045370d6dac13f8a91101bc31134278315 ci: gen PR labels from master instead of fork (satsfy (Renato Britto))

Pull request description:

This fixes a CI issue and doubles as a security fix.

The labeler job now fails on every fork PR. This is because, [yesterday](https://github.com/rust-bitcoin/rust-bitcoin/commit/2d138d732b791f7d1a7ef715794f5c2f4fad3b62), CI's `actions/checkout` was updated to v7 and refuses to fetch fork PR code from a `pull_request_target` workflow unless the step opts in with `allow-unsafe-pr-checkout`. IIUC, that was a safety issue because the old job checked out the fork and ran `cargo metadata` on its manifests while holding the base repo's token (known as [pwn-request vulnerability](https://www.endorlabs.com/learn/pwn-request-threat-a-hidden-danger-in-github-actions)).

But from my understanding of this workflow, the fork checkout is not necessary. So I dropped it and, making the problem go away.

One consequence is: if a PR adds a new crate, the PR will not get label `C-<crate>`. Seems acceptable to me.

Btw I see 0.32.xx and 0.32.xxx have this same issue.


ACKs for top commit:
tcharding:
utACK 000113045370d6dac13f8a91101bc31134278315
jamillambert:
ACK 000113045370d6dac13f8a91101bc31134278315
apoelstra:
ACK 000113045370d6dac13f8a91101bc31134278315; successfully ran local tests


Tree-SHA512: 80e918fbf2a595f4724459b64e1d2facf4fc88917dd4681e3e7b9dc93987156cabe3d5ec51b62bad1dd3e638e5f41ccb83b79a1a3d9cd52157c1f8ec3e06200e

Merge rust-bitcoin/rust-bitcoin#6741: units: Add and standardise doc and comment links

0004759e3865caf677c1ecad2f9df5a50f53acfa units: Replace in-line links with tag links (Mitchell Bagot)
d2675c71655e48e1d93617750c8f9ae5106bcd86 Fix blank space in doc link (Mitchell Bagot)
e5ac2a6c5aa641f1cb9bd5b81cda40992db1c1eb units: Add links to docs (Mitchell Bagot)

Pull request description:

The C-LINK docs guideline recommends including links for types and modules throughout the public-facing documentation. Additionally, at least in VSCode, these links can be followed through Ctrl-Click, even when in private code comments. As such, all types and modules should be modified to links to improve both user docs readability, and code navigation.


ACKs for top commit:
satsfy:
ACK 0004759
apoelstra:
ACK 0004759e3865caf677c1ecad2f9df5a50f53acfa; successfully ran local tests
tcharding:
ACK 0004759e3865caf677c1ecad2f9df5a50f53acfa I didn't check all changes in patch 1 because satsfy seems to have been most thorough.


Tree-SHA512: 2e0f265af2f996ef0c62564587882a77418eeb974293f083ad806aa02b530347ada5ae260757838b2e98002a46b896ff348498c404d3b01816352a49e6fd7829

ci: gen PR labels from master instead of fork

The labeler checked out the fork and ran cargo metadata on
its manifests while holding the base repo token, a github
actions security vulnerability called pwn request.

But we don't need the fork checkout to generate labels, this
commit now does it from master.

Merge rust-bitcoin/rust-bitcoin#6732: primitives: Doc links follow-up

54e22747d012e90cc4eaf0d33d0ce9ab40ae6cda Remove link brackets from deprecation note (Mitchell Bagot)
c2754d9a566103127484748ae06c8a53063a3179 Add full stop after Script method docs (Mitchell Bagot)
fb0324399f04b36752b26a5ce335401963a9d5c2 primitives: Replace in-line links with tag links (Mitchell Bagot)

Pull request description:

This is a follow-up to #6728.


ACKs for top commit:
apoelstra:
ACK 54e22747d012e90cc4eaf0d33d0ce9ab40ae6cda; successfully ran local tests


Tree-SHA512: 2574befb511ef68a0ff21b602d8e0d18d3550f1f4b9c55458007224ae2e9504600084747f4fa7cc9576c4df196e76881cebb7f4677c277ba3b89f87521865d31