rust-bitcoin

This commit only updates a mutation-testing configuration file. It tells the mutation-testing tool to ignore one specific artificial code change in a buffer-resizing helper because the change behaves the same way and cannot be tested. There is no change to the actual library code, no bug fix, and no security relevance.

This commit only updates auto-generated API snapshot text files to reflect that several functions were made 'const' (usable at compile time) in a previous code change. No actual source code is modified, and there is no security relevance.

This commit simply updates a GitHub Actions configuration file to use a newer stable version of the Rust compiler (1.91.0 instead of 1.90.0). It changes one number in a CI workflow file and does not touch any source code, dependencies, or runtime behavior of the project. There is no security-relevant change.

This commit only adds a new policy section to the project's CONTRIBUTING.md file. It tells contributors that bot accounts are not allowed and that patches created by AI/LLMs must be disclosed and reviewed by a human. There are no code changes and no security implications.

This commit fixes bugs in an internal release-checking shell script used in continuous integration (CI). It tightens a grep pattern, prevents the script from crashing when the grep finds nothing, and updates the list of crates the script checks. There is no change to the Rust code that handles Bitcoin data, cryptography, or network messages, and no security-relevant behavior is introduced or fixed.

This commit is a routine code cleanup: it turns on a Rust linter warning for unnecessary .clone() calls and removes those unnecessary clones. There is no security-relevant behavior change.

This commit is a performance optimization inside the library that decodes Bitcoin transaction witness data. It replaces a decoder that allocated many small memory buffers with one that uses a single larger buffer and grows it as needed. There is no direct evidence in the commit that this fixes a security bug; it is described by the author as a performance improvement. The new code does add bounds checks, resizing logic, and tests for empty and incomplete inputs, which reduces the chance of memory-handling mistakes, but the change itself is not labeled as a security fix.

This commit is a routine maintenance update to the project's build and lint scripts. It upgrades internal maintainer tools, adds a 'quiet' log mode for CI runs, and adjusts the list of allowed duplicate dependencies. There are no changes to the actual Bitcoin library code that users or applications interact with, and nothing in the commit suggests a security problem or fix.

This commit only renames and reorganizes developer helper recipes in a justfile (a build/task runner configuration). It changes command aliases like `test-stable` to `ci-stable`, adds quick local recipes such as `lint` and `sane`, and groups existing recipes. There is no change to the actual Rust Bitcoin library code, cryptography, network handling, or any code that end users or downstream applications rely on.

This is a routine maintenance update to a GitHub Actions workflow. The project’s daily automated fuzzing job was failing because a dependency required a newer Rust compiler than the one pinned in the workflow. The change simply bumps the compiler version used for fuzzing from Rust 1.65.0 to 1.74.0 so the job can run again. It does not change any library code, user-facing behavior, or security-sensitive logic.

This commit only updates a mutation-testing configuration file. It tells the mutation-testing tool to skip certain artificial code changes because they would cause test runs to loop forever. It does not change any actual library code, fix a bug, or alter behavior of the rust-bitcoin software in production.

This commit only changes the project's mutation testing configuration. It adds the consensus_encoding crate to the list of source files that are automatically checked by a mutation testing tool. No production code, APIs, or security-sensitive logic was modified.

This commit only updates the project's mutation-testing configuration file. It makes test-exclusion rules apply per-crate rather than globally and renames one label. No program code, APIs, or security behavior changed, so there is no security impact.

This commit is a trivial configuration cleanup. It moves one test-mutation exclusion rule from the wrong section to the correct section in a file that tells the mutation-testing tool which functions to skip. No code behavior changes, and there is no security relevance.

This commit only adds a new unit test to the codebase. It does not change any production code, fix a bug, or alter behavior. The test verifies that a decoding function correctly ignores extra bytes after the expected data when reading from a stream. There is no security issue present in the commit itself.

This commit only adds new unit tests for a decoder that reads length-prefixed byte vectors. It does not change any production code, so it cannot introduce or fix a runtime security vulnerability by itself. The tests verify that the decoder stops exactly at the declared payload length and does not accidentally consume extra trailing bytes.

This commit only adds new unit tests for an existing code path. It does not change any production code, fix a bug, or alter behavior. There is no security issue present in the diff.

This is a purely cosmetic code cleanup. A public re-export statement was moved to sit with other public re-exports and prefixed with `self::`. The commit message explicitly says 'No logic change' and the diff confirms only two lines were reordered with no functional difference.

This commit adds a new automated security scanner called zizmor to the project's GitHub Actions CI pipeline. It only runs when pull requests modify files under the .github/ directory. There is no code change to the library itself and no vulnerability is being fixed or introduced.

This commit adds a new scheduled GitHub Actions workflow that runs an automated security scanner called zizmor against the repository's CI/CD configuration every day. It does not change any application code, fix a bug, or introduce a vulnerability. It is purely a defensive security monitoring addition.

This commit only adds code-quality comments to two GitHub workflow files so that the zizmor security linter stops flagging the use of 'pull_request_target' and 'workflow_run' triggers. It does not change any workflow logic, permissions, or behavior, and therefore has no direct security impact on the project itself.

This commit tightens the security settings on the project's GitHub Actions workflows. Previously, these automated scripts likely ran with broad default permissions that could let a compromised action read or modify code, open pull requests, or access secrets. The change sets the default permission to 'none' and then explicitly grants each workflow only the minimum permissions it actually needs (mostly just reading the repository, with write access only where required). This is a defensive hardening measure rather than a fix for an active attack.

This commit changes the project's GitHub Actions CI workflows so that after checking out the source code, the temporary GitHub authentication token is no longer kept in memory for later steps. This is a defensive hardening change: it reduces the risk that a compromised third-party action or malicious build step could steal the token and modify the repository or release artifacts. It does not fix an active bug in the Bitcoin library code itself.

This commit only changes how GitHub Actions automation is configured. It replaces floating version tags like @v5 with exact commit hashes (plus a comment showing the version). This is a standard hardening practice to prevent a compromised third-party action from silently updating under the same tag. It does not change any of the project's actual Bitcoin/Rust code, so it cannot directly introduce or fix a vulnerability in the library users depend on.

This commit only changes how often the project's automated dependency bot checks for GitHub Actions updates. It adds a 60-day cooldown to Dependabot. There is no code change, no bug fix, and no security vulnerability being patched.