RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2084 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

461security candidates452second-pass queue2076AI analyses
183commits · 30 days
396commits · 60 days
1293commits · 180 days
2063commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
318Strong · 80–100
1058Adequate · 60–79
557Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot643192641068
Tobin C. Harding41366410063
jrakibi944994068
Andrew Poelstra582155077
Nick Johnson18920189059
Jamil Lambert, PhD11418114061
Fmt Bot311431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
satsfy (Renato Britto)17617066
Martin Habovstiak27527069
Analysis record

Published AI watches

Last scanned 29 minutes ago

Informational 20 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6678: units: Add `Weight::to_vb_*` functions, deprecating `to_vbytes_*`

This is a routine API cleanup in a Rust Bitcoin library. It adds new method names (to_vb_floor, to_vb_ceil) for converting transaction 'weight' to 'virtual bytes' and marks the old names (to_vbytes_floor, to_vbytes_ceil) as deprecated. The…

7f614781by Andrew Poelstra+30−86 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6597: Release tracking PR: `crypto 0.3.0`

This commit is a routine release-tracking merge. It only bumps version numbers (bitcoin-crypto to 0.3.0 and bitcoin-primitives to 0.103.1), updates dependency version requirements, refreshes lock files, and adds changelog entries. There ar…

1fddd49eby Andrew Poelstra+34−1210 files
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API listing files (text snapshots of public functions) to reflect a newly added public function, `to_consensus_u32`, on the `CompactTarget` type. It does not change any source code, logic, or behavior, an…

a75c53c8by Mitchell Bagot+6−03 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6675: units: Remove unnecessary track_caller

This commit removes two Rust compiler hints (`#[track_caller]`) from helper functions that simply return a value or call a user-provided fallback. These functions never panic, so the hints were unnecessary and had no security effect. The c…

ce894f36by Andrew Poelstra+0−21 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6644: primitives: Add serde impls for `WitnessVersion`

This commit adds standard serialization/deserialization support for the WitnessVersion type when the optional serde feature is enabled. It is a routine feature addition with no security relevance visible in the code or commit message.

4981faa7by Andrew Poelstra+50−02 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`

This is a routine API cleanup, not a security fix. The developers removed a shortcut that let programmers create a 'number of blocks' value directly from any u16 number, replacing it with an existing named constructor called from_height. T…

ed5f1b68by Andrew Poelstra+18−358 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update the API text files

This commit only updates two generated API text files that list the public surface of the Rust crate. It removes entries for a `WitnessesEncoder` type, reflecting that the type is no longer part of the public API. There is no source code c…

9c391145by Tobin C. Harding+0−782 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityAdd pop to ArrayVecby Mitchell Bagot · 4c65ce7b · Dec 5, 2025 · 1 fileMessage 63 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add pop to ArrayVec

In order for ArrayVec to match the API of alloc::vec::Vec, it requires
both pop() and push() in order to correctly emulate a stack. Currently,
ArrayVec only implements push(), and so is unable to replace Vec in
features that require stack functionality.

Add pop() function to ArrayVec to return last item as an Option.

63/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit adds a normal 'pop' method to a small internal vector-like data structure called ArrayVec. It is a routine API addition to make the type behave more like Rust's standard Vec. There is no indication of a security bug or fix.

Lower-priorityAdd 0.32.6 and 0.32.7 bitcoin changelogby Mitchell Bagot · 5f010394 · Dec 4, 2025 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add 0.32.6 and 0.32.7 bitcoin changelog

The 0.32.x branch has changelog notes for 0.32.6 and 0.32.7, neither
of which is included on master.

Copy changelog notes for 0.32.6 and 0.32.7 to bitcoin/changelog on
master.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds text to a changelog file. It copies release notes for versions 0.32.6 and 0.32.7 from a maintenance branch into the master branch. No program code was changed, so this commit by itself cannot introduce a security vulnerability or fix one.

Lower-priorityio: Add version number to all dependenciesby Tobin C. Harding · 22126fee · Dec 4, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

io: Add version number to all dependencies

Explicit version numbers are required to publish - face palm.

Fixes the recent attempted release of `io v0.3.0`.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a routine packaging fix for the rust-bitcoin project's `io` subcrate. It adds missing version numbers to internal dependencies in the crate's manifest file (Cargo.toml) so the crate can be published to the Rust package registry. There is no code change, no security fix, and no vulnerability addressed.

Lower-priorityMove BlockUncheckedExt functions to Block<Unchecked> implby Mitchell Bagot · c391f2b4 · Dec 3, 2025 · 7 filesMessage 95 · StrongInformational 17Details
Commit message · Mitchell Bagot

Move BlockUncheckedExt functions to Block<Unchecked> impl

During the move of Block into primitives, some functionality was left
in an extension trait BlockUncheckedExt, due to dependencies on other
logic in bitcoin. To simplify the API, this logic is better included
directly on the Block<Unchecked> type and the extension trait removed.

Remove the BlockUncheckedExt trait, and move validate,
compute_merkle_root, and compute_witness_commitment functions to the
Block<Unchecked> implementation. Move tests from bitcoin that only
require primitives to primitives.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Informational 17/100

This commit is a code reorganization, not a security fix. It moves block validation helpers (Merkle root checks, witness commitment checks, and the validate() method) from an extension trait in the higher-level bitcoin crate directly onto the Block<Unchecked> type in the lower-level primitives crate. The goal is to simplify the public API and remove a workaround trait that existed only because of crate-dependency ordering. The actual validation logic is preserved, with only minor implementation changes such as using a different helper to encode the witness root into the hash engine.

Lower-priorityprimitives: Add consensus encoding traits for WitnessMerkleNodeby Mitchell Bagot · 8b31d65b · Dec 3, 2025 · 4 filesMessage 73 · AdequateInformational 17Details
Commit message · Mitchell Bagot

primitives: Add consensus encoding traits for WitnessMerkleNode

The logic in compute_witness_commitment relies on the ability to
consensus encode TxMerkleNode and WitnessMerkleNode hashes into a
HashEngine type. Currently, only TxMerkleNode implements Encodable,
with the encoding for WitnessMerkleNode and TxMerkleNode implemented
in bitcoin::merkle_tree based on bitcoin::consensus.

Implement consensus_encoding::Encodable on WitnessMerkleNode to
match the current implementation on TxMerkleNode.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 17/100

This commit adds standard Bitcoin consensus encoding and decoding support for WitnessMerkleNode, a data type used when computing witness commitments in SegWit blocks. It mirrors the existing support already present for TxMerkleNode. There is no indication this fixes a vulnerability; it appears to be a routine API completeness change.

AI review queuedprimitives: Move is_coinbase into primitivesby Mitchell Bagot · d325c292 · Dec 3, 2025 · 4 filesMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

primitives: Move is_coinbase into primitives

In order to move various functionality from BlockUncheckedExt trait
into the main Block<Unchecked> implementation, various surrouning
functionality must also be moved into primitives to prevent an
inverted dependency of primitives on bitcoin.

Move is_coinbase implementation from the TransactionExt in bitcoin
directly to the Transaction implementation in primitives.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine internal code reorganization. It moves a helper method, is_coinbase, from one module to another within the same project. The method's logic and behavior are unchanged, and there is no indication of a security fix or vulnerability.

AI review queuedprimitives: Move MerkleNode and TxIdentifier into primitivesby Mitchell Bagot · a8741234 · Dec 1, 2025 · 10 filesMessage 83 · StrongInformational 15Details
Commit message · Mitchell Bagot

primitives: Move MerkleNode and TxIdentifier into primitives

The MerkleNode trait in bitcoin provides convenience functions for
the TxMerkleNode and WitnessMerkleNode hash types to work with the
nodes as a tree. Moving the functionality of this trait into primitives
acts as a precursor to allow other functionality to move also.

Move the MerkleNode trait to primitives, making it private. Provide the
same interface for users through pub functions that wrap the private
trait. Introduce tests to cover mutants. Introduce TxIdentifier in
primitives.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine internal code reorganization. It moves the existing Merkle tree helper trait and transaction identifier abstraction from the main `bitcoin` crate into the lower-level `primitives` crate, and adds public wrapper functions and tests. The actual Merkle root calculation logic is copied verbatim, with no functional change.

Lower-priorityio: Grab changelog from already release 0.1.3by Tobin C. Harding · e900b44a · Dec 1, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

io: Grab changelog from already release 0.1.3

As usual we forgot to copy the changelog to master when doing the
0.1.3 point release.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only adds a missing changelog entry for a previously released version (io 0.1.3). No code was changed, so it cannot introduce or fix any security issue.

Lower-priorityio: Bump version to 0.3.0by Tobin C. Harding · 306291f9 · Dec 1, 2025 · 7 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

io: Bump version to 0.3.0

In preparation for release bump the version, add a changelog entry,
and update the lockfiles.

Set the since field in deprecation attribute from TBD to `0.3.0`.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine version bump for the bitcoin-io crate from 0.2.0 to 0.3.0. It updates version numbers in package manifests, lockfiles, a dependency reference, and fills in the release date and placeholder deprecation version strings. There are no code behavior changes and no security fixes or security-relevant changes in the diff itself.

Security candidateMove `impl_array_newtype` to `internals`by rustaceanrob · 20cd2327 · Dec 1, 2025 · 5 filesMessage 78 · AdequateInformational 15Details
Commit message · rustaceanrob

Move `impl_array_newtype` to `internals`

Discussion #5331 suggested removing `bitcoin` as a direct dependency
could be a reasonable goal for the `p2p` crate. One conflict along the
way is the use of this macro in `bip152` to implement the array-like
traits for the short IDs. Because `bitcoin` depends on `internals`, as
does `p2p`, we can move this macro into `internals` to help detangle
`p2p` and `bitcoin`.

Moves the deprecated methods to the `impl` blocks.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine code reorganization. It moves a helper macro that generates standard methods for array-like types from the main `bitcoin` crate into the shared `internals` crate. The goal is to let other crates (specifically `p2p`) use the macro without depending directly on `bitcoin`. The generated behavior is essentially unchanged, though a couple of deprecated `to_bytes` methods are moved from the macro into individual type definitions.

Lower-priorityhashes: Bump version to 0.18.0by Tobin C. Harding · 628a2c8c · Nov 30, 2025 · 7 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

hashes: Bump version to 0.18.0

Bump the `hashes` version. Update in all crates that depend on it
including adding an explicit version field in `p2p`.

Add a changelog entry and update the lock files

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine version bump for the bitcoin_hashes crate from 0.17.0 to 0.18.0. It updates version numbers in package manifests, lock files, and adds a changelog entry. There is no code change and no security relevance visible in the diff.

Lower-priorityhashes: Remove FromSliceErrorby Tobin C. Harding · 00cef094 · Nov 30, 2025 · 3 filesMessage 58 · ThinInformational 19Details
Commit message · Tobin C. Harding

hashes: Remove FromSliceError

This error type was returned by `Hash::from_slice` which was
deprecated in `v0.15.0` and removed in this to-be-released version.

Lets just remove the error type too since it is unlikely that anyone
is using it still if it is not returned by the lib.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This commit removes an old, already-deprecated error type called FromSliceError from the rust-bitcoin hashes crate. The function that used to return this error was removed in an earlier version, so this change just cleans up leftover code. It is a routine API cleanup, not a security fix.

AI review queuedUse usize for CompactSizeEncoder::newby Mitchell Bagot · b486c836 · Nov 30, 2025 · 6 filesMessage 68 · AdequateInformational 18Details
Commit message · Mitchell Bagot

Use usize for CompactSizeEncoder::new

The current CompactSizeEncoder::new() constructor uses an impl ToU64
for its first parameter. The ToU64 trait is part of internals, and
thus isn't permitted to be part of the public API of consensus_encoding.

Change the ToU64 parameter type to usize, encoding values outside of
the u64 range (such as on 128 bit system) as u64::MAX.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a small API cleanup, not a security fix. It changes a Bitcoin data-encoding helper so it accepts ordinary memory sizes (usize) instead of a special internal type. The only behavioral change is on hypothetical future 128-bit computers, where impossibly large values would be encoded as the maximum allowed u64 value. On all current systems the output is unchanged.

Lower-prioritydocs(hashes): replace deprecated GeneralHash referencesby Bashmunta · 31a07f1f · Nov 29, 2025 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · Bashmunta

docs(hashes): replace deprecated GeneralHash references

The GeneralHash trait was removed (see CHANGELOG #4085), but internal_macros.rs
still referenced it in macro docs. Updated hash_trait_impls! and general_hash_type! documentation to reflect actual current requirements

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit only updates documentation comments and a test comment in the rust-bitcoin hashes crate. It replaces outdated references to a removed 'GeneralHash' trait with descriptions of the actual current requirements. There are no code behavior changes.

AI review queuedprimitives: Convert various functions to constby Mitchell Bagot · ec9ec525 · Nov 28, 2025 · 10 filesMessage 60 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Convert various functions to const

Convert constructors with zero arguments, getter and setter functions
to const in primitives.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code-quality improvement. It marks a number of simple constructor and getter functions as 'const', which lets the Rust compiler evaluate them at compile time. There is no change to what the functions do, no bug fix, and no security-relevant behavior change.

AI review queuedunits: Convert various functions to constby Mitchell Bagot · 98b5777c · Nov 28, 2025 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Mitchell Bagot

units: Convert various functions to const

Convert constructors with zero arguments, getter and setter functions
to const in units.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code-quality improvement. It marks several simple constructor and getter functions as 'const', meaning they can be evaluated at compile time. There is no change to program logic, no bug fix, and no security relevance.

Lower-prioritydocs(crates): add consensus_encoding and crypto to current cratesby Bashmunta · 48a2e5c3 · Nov 27, 2025 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · Bashmunta

docs(crates): add consensus_encoding and crypto to current crates

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates a Markdown documentation file listing the project's crates. It adds two new crate names (`consensus_encoding` and `crypto`) to a descriptive list. There are no code changes, no bug fixes, and no security-related content.

Lower-priorityconsensus_encoding: Bump version to 1.0.0-rc.2by Tobin C. Harding · 4f500b87 · Nov 27, 2025 · 6 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

consensus_encoding: Bump version to 1.0.0-rc.2

Do another RC release, no changelog additions required IMO.

Includes:

- Added `reserve` method
- Used `Self` instead of `Foo`
- Made a few constructors const
- Removed `hashes` dep

Bump the version, update to use this RC version in crates that depend
on `encoding`, and update the lock files.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine version bump for a Rust package called `bitcoin-consensus-encoding`, moving it from one release candidate (1.0.0-rc.1) to the next (1.0.0-rc.2). It only updates version numbers in package manifests and lock files. There are no code changes, no bug fixes, and no security-related changes visible in the diff.

AI review queuedAdd decode test for reserve capacityby Jamil Lambert, PhD · 11d3f375 · Nov 26, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Add decode test for reserve capacity

There are new mutants in the reserve function for both VecDecoder and
ByteVecDecoder.

Add two new tests to check the functionality of reserve and kill the
mutants.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds two new unit tests to verify that two decoder types allocate memory in correctly-sized batches. It does not change any production code, fix a bug, or alter behavior. There is no security-relevant change.

AI review queuedunits: Replace manual ceil division with div_ceilby Mitchell Bagot · a9f54c64 · Nov 26, 2025 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

units: Replace manual ceil division with div_ceil

Since the bump to MSRV 1.74, we now have access to div_ceil for ceiled
division of integer types. There are various places in units that we
manually implement ceiling division that can now be replaced by calls
to div_ceil.

Convert div_by_weight_ceil, div_by_fee_rate_ceil and mul_by_weight
to use div_ceil in place of manual ceiling division.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup in the rust-bitcoin library. It replaces hand-written ceiling-division logic with Rust's newer built-in `div_ceil` function. The math result is intended to be identical, and there is no indication of a security bug being fixed.

Lower-priorityAdd in diff cargo-mutants CI workflowby user · 11228618 · Nov 25, 2025 · 2 filesMessage 78 · AdequateInformational 15Details
Commit message · user

Add in diff cargo-mutants CI workflow

This adds a new CI workflow in the rust.yml workflow file to be run
alongside tests on PRs and pushes.

This CI utilizes the `--in-diff` flag on cargo-mutants to check for
mutations in the source code within the PR diff.

This does not replace the current weekly cargo-mutants CI as changes
outside of the source code, whether through a change of a test or some
other change not explicitly in the rust source the diff mutation will
not catch.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit adds a new automated testing step to the project's GitHub Actions CI pipeline. It runs a tool called cargo-mutants on the code changed in a pull request to help detect whether tests are thorough enough. There is no change to the actual Bitcoin library code, no new feature, and no security fix or vulnerability.

Security candidatedocs: fix copy-paste errors in documentation commentsby Herobrine · 9b06f2d5 · Nov 25, 2025 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · Herobrine

docs: fix copy-paste errors in documentation comments

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit fixes two typos in documentation comments. One incorrectly called a private key type an 'extended public key,' and another incorrectly referenced a different struct name in a conversion function's doc comment. These are purely cosmetic comment corrections and do not change any executable code.

Security candidateRemove wildcard Error importsby Jamil Lambert, PhD · 5890ed91 · Nov 24, 2025 · 21 filesMessage 35 · OpaqueInformational 15Details
Commit message · Jamil Lambert, PhD

Remove wildcard Error imports

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a large but purely cosmetic code cleanup in the Rust Bitcoin library. It removes wildcard imports of error types (like `use Error::*`) and replaces them with explicit `Self::Variant` or fully-qualified names. The behavior of the code does not change; it only makes the source code easier to read and maintain.

Security candidateRun cargo formatby Jamil Lambert, PhD · 4985e208 · Nov 24, 2025 · 9 filesMessage 43 · ThinInformational 15Details
Commit message · Jamil Lambert, PhD

Run cargo format

Only formatted changes in the previous commit. There are still a lot
of unrealated lines of code that need formatting.

43/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit only reformats source code using the Rust formatter (cargo fmt). It changes whitespace, line breaks, and import grouping but does not alter program logic, behavior, or any security checks. There is no security issue.

Security candidateecdsa: Add to/from_signature, len, and iterby Tobin C. Harding · a098184e · Nov 23, 2025 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

ecdsa: Add to/from_signature, len, and iter

To the `ecdsa` type add `to_signature`, `from_signature`, `len`, and
`iter` methods.

Change the implementation of `IntoIter` for a sig reference so we can
add `iter` method as done in `taproot`.

While we are at it fix up the docs and layout all the methods in the
same order for both types (`ecdsa` and `taproot`).

This unifies the APIs of the two types `ecdsa::SerializedSignature`
and `taproot::SerializedSignature`.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarycryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine API cleanup for the rust-bitcoin library. It adds a few helper methods (to_signature, from_signature, len, iter) to the ECDSA serialized-signature type and reorders existing methods in the Taproot serialized-signature type so both types look the same. There is no security fix or behavior change that would affect users' funds or data.