RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
147commits · 30 days
304commits · 60 days
1150commits · 180 days
2055commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 40 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityci: add toggle to api break labelby Nick Johnson · 8f093fc6 · Aug 2, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Nick Johnson

ci: add toggle to api break label

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit changes a GitHub Actions workflow so that an 'API break' label is added when a version-compatibility check fails and removed when it passes. Previously the label was only added and a comment was always posted. There is no security issue visible in this change.

Lower-priority2026-08-02 automated rustfmt nightlyby Fmt Bot · 1aed04a9 · Aug 2, 2026 · 3 filesMessage 45 · ThinInformational 15Details
Commit message · Fmt Bot

2026-08-02 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is an automated code-formatting commit from rustfmt. It only removes blank lines between imports and wraps one long function call across multiple lines. There are no security changes.

Lower-priorityfuzz: fix ci job, install cargo-fuzz firstby Nick Johnson · 6aec26dc · Jul 31, 2026 · 2 filesMessage 78 · AdequateInformational 15Details
Commit message · Nick Johnson

fuzz: fix ci job, install cargo-fuzz first

Add explict bash shell for set -e fail fast default.

Use ${RUSTFLAGS:-} in fuzz.sh so an unset value expands to nothing and
any value the caller did set still gets through.

Co-authored-by: satsfy (Renato Britto) <renatobritto@protonmail.com>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit fixes the project's daily automated fuzzing test job. It adds an explicit installation step for the cargo-fuzz tool, ensures the script uses bash so error handling works correctly, and fixes a shell variable expansion quirk so custom Rust compiler flags don't break when unset. There is no change to the library code that users depend on, and no security vulnerability is present or patched.

AI review queuedUpdate API filesby Mitchell Bagot · 351acf8e · Jul 31, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files to reflect that the remainder (modulo) operator for the Weight type now returns another Weight instead of a plain number. It contains no source code changes, no bug fix, and no security-related content.

Lower-priorityAdd test to guarantee algebraic transform of Weightby Mitchell Bagot · 65c2ad6d · Jul 31, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Mitchell Bagot

Add test to guarantee algebraic transform of Weight

When implementing div and rem, a user should always be able to
reconstruct their original value knowing the divisor, remainder and
division result. That is, if a / b = d, a % b = r, then d * b + r must
equal a.

Add test that checks the inverse of a division and remainder on Weight.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a new unit test. It checks that dividing and taking the remainder of a Weight value can be reversed to get the original value. No code behavior is changed, and no security issue is introduced or fixed.

Lower-priorityMake Weight % Weight return Weightby Mitchell Bagot · 7e726dea · Jul 31, 2026 · 1 fileMessage 68 · AdequateInformational 19Details
Commit message · Mitchell Bagot

Make Weight % Weight return Weight

The Rem<Weight> for Weight op currently returns a u64. A remainder type
should always match the type itself, as the leftover after a division
is logically a sub-portion of the original quantity, and thus its type.

Adjust Rem<Weight> for Weight impl to return Weight instead of u64.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This commit is a small type-correctness fix for the Rust Bitcoin library. It changes the result type of the remainder operator (%) when both inputs are Weight values, so the result is a Weight instead of a plain number. This is a normal API cleanup, not a security fix.

AI review queuedconsensus_encoding: decoder docs which are consensus specificby Nick Johnson · 5cdd5aa0 · Jul 31, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Nick Johnson

consensus_encoding: decoder docs which are consensus specific

The decode module has 6 driver functions bound to `Decode`, and thus
are consensus-encoding specific.

- `decode_from_slice<T: Decode>`
- `decode_from_slice_unbounded<T: Decode>`
- `decode_from_hex<T: Decode>`
- `decode_from_read<T: Decode>`
- `decode_from_read_unbuffered<T: Decode>`
- `decode_from_read_unbuffered_with<T: Decode>`
- `check_decode<T: Decode>`

One type is bound to `Decode`.

- `VecDecoder<T: Decode>`

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes documentation comments in the consensus_encoding crate. It renames descriptions like 'Primitive decoders' to 'Primitive and combinator decoder types' and updates several function doc comments to say 'consensus decodable type' instead of 'object'. No code logic, signatures, or behavior changed. There is no security impact.

Lower-priorityconsensus_encoding: update package docs for consensus encoding clarityby Nick Johnson · 430dba8c · Jul 31, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Nick Johnson

consensus_encoding: update package docs for consensus encoding clarity

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only rewrites the user-facing documentation comments in a single Rust source file. It clarifies how the consensus encoding library works and reorganizes the description of provided functions. No program logic, APIs, or security behavior changed.

Lower-priorityconsensus_encoding: encoder docs which are consensus specificby Nick Johnson · b36f6459 · Jul 31, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Nick Johnson

consensus_encoding: encoder docs which are consensus specific

The `encode` trait, and things which bound on it, are tied to consensus
encodings. Everything else is agnostic.

There are 4 driver functions tied specifically to `Encode`, and these
are simpler wrappers over the drains bound to the agnostic `Encoder`.

- `encode_to_vec<T: Encode>`
- `encode_to_writer<T: Encode>`
- `encode_to_hex<T: Encode>`
- `check_encode<T: Encode>`

There are two types bound to `Encode`.

- `SliceEncoder<'e, T: Encode>`
- `PrefixedSliceEncoder<'e, T: Encode>`

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only changes documentation comments in a Rust Bitcoin library. It clarifies that certain encoding functions and types are specifically tied to Bitcoin consensus encoding rules. No code behavior was changed, so there is no security impact.

Security candidatehashes: add sha256::Midstate::SHA256_IV constantby Andrew Poelstra · dc21841b · Jul 31, 2026 · 3 filesMessage 78 · AdequateInformational 15Details
Commit message · Andrew Poelstra

hashes: add sha256::Midstate::SHA256_IV constant

Add a unit test for the new constant. Rename the internal-only function
compute_midstate_unoptimized to update_midstate_unoptimized, and change
call sites to call it with the new SHA256_IV constant.

This lets us "ratchet forward" arbitrary midstates in const contexts. The
next commit will expose this general functionality in a correct way (by
enforcing lengths). I would like this in rust-simplicity, so I can compute
various Merkle roots in const contexts.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than always starting fresh. There is no security bug or fix here—just a code cleanup and API preparation for future const-context hashing features.

Security candidatehashes: add several methods to sha256::Midstate for computing them in const contextsby Andrew Poelstra · 7d8f06d2 · Jul 31, 2026 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · Andrew Poelstra

hashes: add several methods to sha256::Midstate for computing them in const contexts

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature addition with no obvious security bug, no fix of a vulnerability, and no disclosed security relevance.

AI review queuedhashes: update API filesby Andrew Poelstra · 44552e3a · Jul 31, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Andrew Poelstra

hashes: update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates three text files that list the public API surface of the `bitcoin_hashes` crate. It adds entries for newly exposed SHA-256 midstate methods and a constant. There is no code change, no bug fix, and no security-related content.

AI review queuedUpdate API filesby Mitchell Bagot · cebefd5c · Jul 31, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates machine-generated API snapshot text files to add a newly exposed public function, CompactTarget::to_target, to the recorded public interface. There is no source code change, no bug fix, and no security-relevant behavior change in this commit itself.

Lower-priorityAdd to_target conversion to CompactTargetby Mitchell Bagot · e275bedf · Jul 31, 2026 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Mitchell Bagot

Add to_target conversion to CompactTarget

According to C-CONV-SPECIFIC, conversion methods should prefer
to/as/into over from, as it allows chaining. Due to CompactTarget being
stabilised before Target, Target currently has methods for converting
both to and from CompactTarget. Instead, a method for converting a
CompactTarget to a Target should exist on the CompactTarget.

Add to_target conversion method to CompactTarget and adjust test cases
to use it to kill mutants.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit adds a new convenience method, to_target(), to the CompactTarget type in the rust-bitcoin library. It simply calls the existing Target::from_compact() conversion under the hood and does not change any behavior, security logic, or calculations. It is a routine API ergonomics improvement, not a security fix.

AI review queuedUpdate API filesby Mitchell Bagot · 8356c542 · Jul 30, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated text files that list the project's public API surface. The change shows that a Sum trait implementation for a numeric result type was broadened to accept more input types. No actual source code was modified, and there is no indication of a security fix or vulnerability.

Lower-priorityAdd tests for NumOpResult sumby Mitchell Bagot · 75a27efa · Jul 30, 2026 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add tests for NumOpResult sum

To guarantee that the previous change to the sum permits summing over
Amount/SignedAmount, the test cases can be adjusted to also check
the new types.

Add tests to confirm Sum<Amount> and Sum<SignedAmount> to NumOpResult.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds new unit tests for summing Amount and SignedAmount values into a NumOpResult. It does not change any production code, fix a bug, or alter behavior. There is no security issue here.

Lower-priorityMake Sum generic for Signed/Amount -> NumOpResultby Mitchell Bagot · 4d37029c · Jul 30, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Make Sum generic for Signed/Amount -> NumOpResult

The current Sum implementations relating to Amount/SignedAmount only
permit users to sum NumOpResults into a NumOpResult. Since users are
far more likely to begin with an Amount/SignedAmount iterator, the Sum
impl should instead be generic over the source of NumOpResult<Amount>
allowing both summing NumOpResult<Amount> and Amount into a
NumOpResult.

Make Sum on NumOpResult<Amount/SignedAmount> generic to permit summing
over Amount and SignedAmount also.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a small Rust API ergonomics change. It makes the 'sum' operation more flexible so developers can add up plain Amount values directly into a result type, not just values that are already wrapped in that result type. There is no security-relevant change.

Lower-priorityUpdate the API text filesby Tobin C. Harding · e0e246e2 · Jul 30, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Tobin C. Harding

Update the API text files

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates a generated text file that lists the public API surface of the Rust Bitcoin library. It records that several locktime-related types now implement standard serde serialization and deserialization traits. There is no code change, no bug fix, and no security patch in this commit itself.

AI review queuedunits: Implement serde traits for relative lock timesby Tobin C. Harding · f6d22308 · Jul 30, 2026 · 1 fileMessage 81 · StrongInformational 15Details
Commit message · Tobin C. Harding

units: Implement serde traits for relative lock times

To satisfy the API guideline
[C-SERDE](https://rust-lang.github.io/api-guidelines/interoperability.html#data-structures-implement-serdes-serialize-deserialize-c-serde),
data types in a crate must implement serde's `Serialize` and
`Deserialize` traits.

Add custom impls for the relative lock time subtypes. Note we use 512
second intervals for the `NumberOf512Seconds` type and not seconds so
that there is no error path.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit adds standard data serialization/deserialization support (serde traits) for two relative lock time types in the rust-bitcoin library. It is a routine API completeness change with no security relevance visible in the code or commit message.

AI review queuedImplement serde traits for absolute locktime typesby Tobin C. Harding · 0252bea5 · Jul 30, 2026 · 1 fileMessage 81 · StrongInformational 18Details
Commit message · Tobin C. Harding

Implement serde traits for absolute locktime types

To satisfy the API guideline
[C-SERDE](https://rust-lang.github.io/api-guidelines/interoperability.html#data-structures-implement-serdes-serialize-deserialize-c-serde),
data types in a crate must implement serde's `Serialize` and
`Deserialize` traits.

Add custom impls for the absolute lock time sub types.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 18/100

This commit adds standard data serialization/deserialization support (serde) for two Bitcoin locktime types: block height and median-time-past. It is an API completeness change, not a security fix or vulnerability. The new code validates values during deserialization using the same existing constructors, so it does not introduce obvious weaknesses.

AI review queuedunits: make Sequence inner field privateby satsfy (Renato Britto) · 30f280da · Jul 29, 2026 · 6 filesMessage 68 · AdequateInformational 20Details
Commit message · satsfy (Renato Britto)

units: make Sequence inner field private

The public inner field violates C-STRUCT-PRIVATE. The value is already
accessible through `from_consensus` and `to_consensus_u32` so nothing
is lost by hiding the field.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This commit makes a single internal number field private in a Rust Bitcoin library type called Sequence. It is an API-cleanup change to follow Rust naming conventions (C-STRUCT-PRIVATE). It does not fix a memory corruption bug, a cryptographic flaw, or a consensus issue. Existing code inside the project is updated to use the already-provided public constructor and getter, so behavior is unchanged.

Lower-priorityunits: remove Default from Sequenceby satsfy (Renato Britto) · 944f7f21 · Jul 29, 2026 · 7 filesMessage 78 · AdequateInformational 19Details
Commit message · satsfy (Renato Britto)

units: remove Default from Sequence

The Sequence gets the Default trait but misses a `new()` function.

Remove the Sequence's Default and drop Sequence from the conformance tests,
the API snapshots and give the fuzz wrapper an explicit default instead.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 19/100

This commit removes the automatic default value for the Bitcoin transaction `Sequence` type in the rust-bitcoin library. Previously, code that asked for a default sequence number would silently get the maximum value (0xffffffff), which disables transaction replacement. The change forces callers to explicitly choose a sequence value, reducing the risk of accidental misconfiguration. It is an API-cleanup change rather than a fix for an active security bug.

Lower-priorityprimitives: Apply the witness item size limit to every elementby Kyle 🐆 · 67d30d2c · Jul 29, 2026 · 1 fileMessage 50 · ThinModerate 60Details
Commit message · Kyle 🐆

primitives: Apply the witness item size limit to every element

Assisted-by: Claude Opus 5

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Moderate 60/100

This commit fixes a bug in how the Rust Bitcoin library checks the size of individual pieces of data inside a Bitcoin transaction witness. Previously, only the first witness element had its size properly capped; after the first element, the size checker was accidentally reset to a much looser default, allowing oversized elements to slip through. The patch makes sure every single witness element gets the same strict size limit.

Lower-priorityunits: Restore the +1 in relative locktime satisfied by heightby Kyle 🐆 · ee13c6bb · Jul 29, 2026 · 1 fileMessage 50 · ThinModerate 61Details
Commit message · Kyle 🐆

units: Restore the +1 in relative locktime satisfied by height

Assisted-by: Claude Opus 5

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Moderate 61/100

This commit fixes an off-by-one bug in how rust-bitcoin checks whether a transaction can yet be spent based on block height. The code was treating a relative locktime of N blocks as satisfied after only N-1 confirmations, instead of the required N confirmations. This could let someone spend coins one block earlier than the Bitcoin protocol allows, which could cause a transaction to be rejected by the network or create inconsistent behavior between this library and other Bitcoin software.

Lower-priorityci: merge check-semver scripts into oneby Nick Johnson · 2be88754 · Jul 28, 2026 · 4 filesMessage 72 · AdequateInformational 15Details
Commit message · Nick Johnson

ci: merge check-semver scripts into one

Clean up a lot of the handling by leveraging check-semver features. This
allows the script to handle the semver trick.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a cleanup of the project's automated version-compatibility checking scripts. It merges two separate scripts into one and updates the GitHub Actions workflow that runs them. There is no change to the actual Bitcoin library code that users install, so this does not introduce or fix a security vulnerability in the software itself.