Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…
This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …
This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…
No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…
This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…
This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…
No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…
This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …
This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …
This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …
API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…
This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …
API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …
Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…
cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…
Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…
Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …
No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…
Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…
This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…
Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Security candidateMerge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1by Andrew Poelstra · 328c4ae9 · Sep 21, 2026 · 17 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1
55c3a6f5d46ee147b0aea9abaee585ff22e47897 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot])
Pull request description:
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK 55c3a6f5d46ee147b0aea9abaee585ff22e47897; successfully ran local tests satsfy: ACK 55c3a6f5d46ee147b0aea9abaee585ff22e47897
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege stateboot or update pathdocumentation-only discountautomated dependency-update discountmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There is no indication this introduces a security problem.
Security candidateMerge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3by Andrew Poelstra · b51cec63 · Sep 21, 2026 · 1 fileMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK 2cac6e38036b3c175f0fc1368e231e06abf80817; successfully ran local tests
This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch the project's Rust code, dependencies, or build outputs. The upstream release notes state there are no user-facing changes in 4.37.3. There is no indication this introduces or fixes a security issue in rust-bitcoin itself.
Security candidateMerge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transactionby Andrew Poelstra · 1a365d53 · Sep 20, 2026 · 8 filesMessage 100 · StrongInformational 20Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction
0ac85705e849c7a44a730f6f2a41c6f0d069e42b primitives: make transaction and block exact encodable (Nick Johnson) 95b2d374f7a48e30a951722df7e6120b660f0d18 primitives: refactor handrolled witness encoder iterator (Nick Johnson) 50e81ce80404dd1d89557b0f2ea51e765e260eb4 consensus_encoding: add ExactSizeEncoder implementations to iterators (Nick Johnson)
Pull request description:
It is helpful in higher level protocols like PSBT to be able to get the serialized size of a type for things like length prefixes. To expose this on the top of the hierarchy `Block` and `Transaction` types, the lower level iterator needs to support exact size calculations (for stuff like inputs and outputs). A small code change, however, I think this is the first non-constant time exact size implementations due to iterator's dynamic size. I think it is worth it.
ACKs for top commit: apoelstra: ACK 0ac85705e849c7a44a730f6f2a41c6f0d069e42b; successfully ran local tests tcharding: ACK 0ac85705e849c7a44a730f6f2a41c6f0d069e42b
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundaryconstant-time or timing behaviorconsensus or confidential-proof validationsigning or wallet pathmerge-commit duplicate discount
AI analysis · Informational 20/100
This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication it addresses a security bug or was triggered by a security report.
Security candidateMerge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 cratesby Andrew Poelstra · 457cb9b5 · Sep 20, 2026 · 6 filesMessage 100 · StrongInformational 21Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates
836624fc736cff9382923ae3b512bf6a17aecc55 chacha20_poly1305: drop Copy from Error (satsfy (Renato Britto)) 642d545046f5f48ec26e7d4ef9dc28fd38fdec74 p2p: drop Copy from error types (satsfy (Renato Britto)) 8c2e6b1841211cff624d2492276066b8bcc1c0db key_expression: drop Copy from bip32 error types (satsfy (Renato Britto)) 61677cc71f0e35d2d6bcf3efcee5f969b634fa00 units: drop Copy from OutOfRangeError (satsfy (Renato Britto)) dae6356f31b717a9dce7bdc71dd0954bd86e07a5 policy: say when an error type derives Copy (satsfy (Renato Britto))
Pull request description:
I'm reviewing every trait in units for 1.0. We try to use `Copy` on rust-bitcoin types, but I claim that the errors should not use it.
The old criteria, "`Copy` if and only if not `non_exhaustive`", demands `Copy` on parse errors such as `ParseIntError`, which hold their input as a String and cannot derive it, and forbids it on `NumOpError`, which `NumOpResult` requires, and also misses important observations made previously in rust-bitcoin's history about the `Copy` trait (read the brief history below).
An error that implements `Copy` cannot later be updated to include, say, a `String`, so every `Copy` put into an error is a public commitment that would require a breaking change later, making it valuable to remove before 1.0. The codebase tends to the minimization of Copy usage on errors already, 30+ changes would be required in units alone to satisfy the existing rule in policy.md atm.
The only exception for using `Copy` are in errors that are a field of a type that derives `Copy`. That situation requires `Copy`, e.g.: ```rs #[derive(Copy, Clone)] pub enum NumOpResult<T> { Valid(T), Error(NumOpError), // a field of a Copy type, so NumOpError must be Copy } ```
A brief history of `Copy` trait discussions on rust-bitcoin:
- [#843 PR checklist](https://github.com/rust-bitcoin/rust-bitcoin/issues/843): project adds checklist item for every public type and qualifies with "does not implement traits we could regret (mainly `Copy`, `Eq`, `Ord`, `PartialOrd`)". - [#1127 Add policy section](https://github.com/rust-bitcoin/rust-bitcoin/pull/1127): "error types should not commit to implementing traits they may not be able to implement in the future, especially `Copy`". Turned into our present "if and only if". - [#3879 Remove Copy from PushBytesError](https://github.com/rust-bitcoin/rust-bitcoin/pull/3879): "it makes the code less maintainable because we must commit to implementing `Copy`". - [#4076 Derive Copy for NumOpResult](https://github.com/rust-bitcoin/rust-bitcoin/pull/4076): PR makes `NumOpError` `Copy` because the container needs it. The one exception on our new policy. - [#6347 units: Clean up the api tests](https://github.com/rust-bitcoin/rust-bitcoin/pull/6347): `Copy` asserted on the `Enums`, errors excluded.
ACKs for top commit: apoelstra: ACK 836624fc736cff9382923ae3b512bf6a17aecc55; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
secret or key materialdefensive validationcryptography-sensitive pathmerge-commit duplicate discount
AI analysis · Informational 21/100
This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated silently by the compiler. The team wants to drop it from errors because once an error type promises to be `Copy`, it can never later hold a `String` or other non-copyable data without a breaking change. This is a forward-looking API-cleanup change, not a fix for an active security bug. It also changes some error methods from taking `self` by value to taking `&self`, which is a minor API adjustment.
Security candidateMerge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`by Andrew Poelstra · ed42dabd · Sep 19, 2026 · 4 filesMessage 96 · StrongInformational 18Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`
fe90ee7a2142d6b589604bbc431dbf910675b8d4 addresses: Adjust Address::from_script docs (Mitchell Bagot) 1161a9f4e53253ecb9be1b2363d92bfda55d7c47 Move from_script to Address and drop AddressExt (Mitchell Bagot)
Pull request description:
The Address::from_script method in AddressExt takes an AsRef\<Params> argument. This argument is only used to extract the contained Network. Rather than use the Params type in the signature, which requires a bitcoin dep, the stable Network type should be used directly. With this change, the method can be directly moved to the main Address type. With said move, the extension trait can also be dropped entirely.
Adjust and move AddressExt::from_script to the Address type in addresses. Drop the AddressExt trait.
ACKs for top commit: apoelstra: ACK fe90ee7a2142d6b589604bbc431dbf910675b8d4; successfully ran local tests Kixunil: ACK fe90ee7a2142d6b589604bbc431dbf910675b8d4
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Informational 18/100
This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion logic is copied unchanged, and the old extension trait is removed so users can call the method more naturally. There is no indication this fixes a bug or vulnerability.
Security candidateMerge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and subby Andrew Poelstra · 5324e59a · Sep 18, 2026 · 1 fileMessage 96 · StrongLow 49Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub
b0d240127f78cffa4cfdba72c5b85bcfcd0a0810 units: Test add and sub preserve div-by-zero error (Jamil Lambert, PhD) 0004180290e08500d3833e7289451fdf78b8049a units: Preserve error in NumOpResult add and sub (Jamil Lambert, PhD)
Pull request description:
Adding or subtracting `NumOpResults` replaced any error operand with a fresh overflow error.
Propagate the original error instead of constructing a new overflow error.
ACKs for top commit: tcharding: ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810 Kixunil: ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810 apoelstra: ACK b0d240127f78cffa4cfdba72c5b85bcfcd0a0810; successfully ran local tests
This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error with a misleading 'overflow' error. Now it correctly keeps and reports the original error. This is a defensive correctness fix: it prevents error details from being lost, which could hide the true cause of a failure in downstream software.
Security candidateMerge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculationby Andrew Poelstra · 22bbc326 · Sep 18, 2026 · 3 filesMessage 91 · StrongLow 37Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation
914365b43c95aa63568da54acf12edc3fe7b8e9a consensus_encoding: fix bug in the composite encoder's exact size (Nick Johnson)
Pull request description:
The `ExactSizeEncoder::len` contract states that it should return the number of bytes *remaining* in the encoder. However, the composite encoders (e.g. `Encoder2`) return a static, total amount. This fix only returns amounts for non-finished sub-encoders.
nymius found this issue while hacking on rust-psbt.
ACKs for top commit: tcharding: ACK 914365b43c95aa63568da54acf12edc3fe7b8e9a apoelstra: ACK 914365b43c95aa63568da54acf12edc3fe7b8e9a; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundaryconsensus or confidential-proof validationmerge-commit duplicate discount
AI analysis · Low 37/100
This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrectly reporting the total size of all pieces even after some pieces were already processed. The fix makes it only count the pieces that have not yet been processed. The bug could cause callers that rely on len() for buffer sizing or progress checks to over-allocate or misjudge remaining work, but it is a correctness fix rather than a clear-cut security vulnerability.
Security candidateconsensus_encoding: fix bug in the composite encoder's exact sizeby Nick Johnson · 914365b4 · Sep 17, 2026 · 3 filesMessage 73 · AdequateLow 37Details
Commit message · Nick Johnson
consensus_encoding: fix bug in the composite encoder's exact size
The `ExactSizeEncoder::len` contract states that it should return the number of bytes *remaining* in the encoder. However, the composite encoders (e.g. `Encoder2`) return a static, total amount. This fix only returns amounts for non-finished sub-encoders.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
consensus or confidential-proof validation
AI analysis · Low 37/100
This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are left to write. The bug made this method report the total size of all pieces even after some pieces had already been written, which could mislead any code that relies on an accurate remaining-byte count. The fix makes the method only count bytes that have not yet been written.
Security candidateMerge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network typesby Andrew Poelstra · 81032b1a · Sep 17, 2026 · 14 filesMessage 91 · StrongInformational 18Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types
d8146e8a2ccddef2c67dd78eb3141d9b8edc6d4f addresses: Remove From<Network> for AddressParams (Mitchell Bagot) b82c9a5294d4f658bdbb4a4b779167e854d7d789 addresses: Remove From impls with KnownHrp and network types (Mitchell Bagot) a3d4b10e0d0cf4f3421ed2dd6a5c1e22d7b30712 addresses: Replace uses of NetworkKind and Params with AddressParams (Mitchell Bagot) 6ee899e66c9f600187665f5e52c17ab5abb05156 addresses: Replace public uses of Network with AddressParams (Mitchell Bagot) e556084cc77b14fcb456cbd82872dc88cd73c661 addresses: Add AddressParams type (Mitchell Bagot)
Pull request description:
The Network and NetworkKind types are currently used in the public API of the addresses crate. However, while the bitcoin-network-kind crate is 1.0, these types are not really stable the same way as other stable crate types are. Instead, we should aim to remove their use from the public API in favour of a to-be-stable AddressParams type.
Add AddressParams type with const values for current set of networks. Replace all public uses of bitcoin-network-kind types, except for Address::network_kind(), with appropriate AddressParams replacements.
ACKs for top commit: tcharding: ACK d8146e8a2ccddef2c67dd78eb3141d9b8edc6d4f apoelstra: ACK d8146e8a2ccddef2c67dd78eb3141d9b8edc6d4f; successfully ran local tests; hopefully we don't get too many https://github.com/rust-bitcoin/rust-bitcoin/issues/3166 complaints over this
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathsigning or wallet pathmerge-commit duplicate discount
AI analysis · Informational 18/100
This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security vulnerability here; it is a design change to make the address crate's public API more stable.
Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`
d0d2f2ee23959e0a970a90ed6ec3f8d9632af8b1 units: test that Sum keeps the error it was given (satsfy (Renato Britto)) ebbeb23687e5170cf847cd53f3d208acaffdcfc4 units: preserve original err summing NumOpResult (satsfy (Renato Britto))
The Sum impls replaced any error in the iterator with an addition overflow, so, say, a division by zero came out labelled MathOp::Add.
Also need to put `*amount` because a binding must have the same type in all alternatives, amount was a ref not owned while acc was, the compiler complained.
ACKs for top commit: apoelstra: ACK d0d2f2ee23959e0a970a90ed6ec3f8d9632af8b1; successfully ran local tests tcharding: ACK d0d2f2ee23959e0a970a90ed6ec3f8d9632af8b1 Kixunil: ACK d0d2f2ee23959e0a970a90ed6ec3f8d9632af8b1
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetymerge-commit duplicate discount
AI analysis · Low 38/100
This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely report it as an addition overflow. The fix preserves the original error so callers see the true cause of the failure. It is a correctness fix rather than a direct exploit, but misreported errors can mislead downstream code or users about what went wrong.
Note that nightly and stable rustc updates have broken: - https://github.com/rust-bitcoin/rust-bitcoin/actions/workflows/cron-weekly-update-stable.yml - https://github.com/rust-bitcoin/rust-bitcoin/actions/workflows/cron-weekly-update-nightly.yml
Because of `fail-fast`, a broken 0.32.xxx job takes the master and 0.32.xx updates down with it. This PR makes each branch succeed or fail on its own.
The cargo-rbmt install issue this PR originally also addressed was fixed on master by the shared setup-rbmt action, so that part is gone.
ACKs for top commit: apoelstra: ACK d9fef884e81f7686ce667352a1a97ad05826c482; successfully ran local tests tcharding: ACK d9fef884e81f7686ce667352a1a97ad05826c482
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancelled. This is purely a CI reliability/configuration change and does not touch any library code, cryptography, network handling, or user-facing behavior.
Merge rust-bitcoin/rust-bitcoin#6879: primitives: Fix Witness::get index overflow
ca6bf03d0b41521327e9041104612aaf538ff703 primitives: Test Witness::get index overflow (Jamil Lambert, PhD) fb0bbc1dd77da590f0ab94b166b41dd942a6410e primitives: Fix Witness::get index overflow (Jamil Lambert, PhD)
Pull request description:
`Witness::get` passes a caller-controlled index to `decode_cursor`, which computes `start_of_indices + index * 4` with unchecked arithmetic. A large index such as `usize::MAX / 4 + 1` overflows: with overflow checks off it wraps back to element 0's offset and returns the first element instead of `None`, and with them on it panics.
Use checked arithmetic so an out-of-range index returns `None`.
Closes project-loupe/audit-rust-bitcoin#159
ACKs for top commit: apoelstra: ACK ca6bf03d0b41521327e9041104612aaf538ff703; successfully ran local tests tcharding: ACK ca6bf03d0b41521327e9041104612aaf538ff703 satsfy: tACK ca6bf03d0b41521327e9041104612aaf538ff703
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetymerge-commit duplicate discount
AI analysis · Moderate 51/100
This commit fixes a bug in how the Bitcoin library reads items from a transaction witness. A function called Witness::get takes an index number from the caller and uses it to calculate a memory offset. With a very large index, the arithmetic could overflow, either returning the wrong witness item or causing the program to panic. The fix uses checked arithmetic so that any out-of-range index safely returns None. The bug was found during an external security audit.
Security candidateMerge rust-bitcoin/rust-bitcoin#6881: build(deps): bump cargo-bins/cargo-binstall from 1.20.1 to 1.21.0by Andrew Poelstra · 12a14bdf · Sep 15, 2026 · 1 fileMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6881: build(deps): bump cargo-bins/cargo-binstall from 1.20.1 to 1.21.0
145ce18399b7b4b598953d13261e4201beeda3ef build(deps): bump cargo-bins/cargo-binstall from 1.20.1 to 1.21.0 (dependabot[bot])
Pull request description:
Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.20.1 to 1.21.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p> <blockquote> <h2>v1.21.0</h2> <p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p> <h4>In this release:</h4> <ul> <li>bugfix: honour --version for git or local manifest (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2165">#2165</a> <a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2598">#2598</a></li> <li>Prefer ipv6 for hickory-dns dns resolution (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2595">#2595</a>%</li> </ul> <h4>Other changes:</h4> <ul> <li>Upgrade dependencies</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/ead08b90bd7b2e6d81963fb9cf0b7239f66d5db4"><code>ead08b9</code></a> release: cargo-binstall v1.21.0 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2605">#2605</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/802977a265b5f8825ebef2176db5f5f3edc82280"><code>802977a</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2603">#2603</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/45c74199ecd000df66e6831e4854e43e2210706b"><code>45c7419</code></a> Revert "ci(release-packages): Disable x86_64-apple-darwin" (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2604">#2604</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/1ed4c64e0e8fbfae6e9dabc91a36379fa7dc4916"><code>1ed4c64</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2602">#2602</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/3d9c602cf4a75690ce794b00d847819897b7766a"><code>3d9c602</code></a> fix: honour --version for git or local manifest (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2598">#2598</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/16386d7aec17cb0ec8457ab4df1ae7aac2e74492"><code>16386d7</code></a> ci(release-packages): Disable x86_64-apple-darwin (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2597">#2597</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/44018a4d9c280bea4bd3f908fabe5a0909f89f92"><code>44018a4</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2596">#2596</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/d9924acdd31c88b15c7a896bafd124fd4abcd1f0"><code>d9924ac</code></a> hickory-dns: Prefer ipv6 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2595">#2595</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/910d9e4456ce4b039662d2a02a34ef1d23c3c50c"><code>910d9e4</code></a> build(deps): bump cargo_toml from 0.22.3 to 1.0.0 in the deps group (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2592">#2592</a>)</li> <li><a href="https://github.com/cargo-bins/cargo-binstall/commit/cc0ff5705d427f8ef3f3343098bb13d864a7f8e7"><code>cc0ff57</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2591">#2591</a>)</li> <li>See full diff in <a href="https://github.com/cargo-bins/cargo-binstall/compare/732870f031d2fb36309d0deaf36abcc704a7be65...ead08b90bd7b2e6d81963fb9cf0b7239f66d5db4">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK 145ce18399b7b4b598953d13261e4201beeda3ef; successfully ran local tests
This is a routine automated update by Dependabot that changes one line in a GitHub Actions workflow. It bumps the version of cargo-binstall, a helper tool used only during CI checks for semantic versioning. There is no indication this fixes or introduces a security problem in the rust-bitcoin library itself.
• Replaced 7 nested error constructions in key, WIF, ECDSA, and Taproot parsing with chained map_err calls. This makes each conversion easier to follow from the leaf error to the outer wrapper, while preserving exact error values, intentional source-error discarding, and public APIs.
ACKs for top commit: Abeeujah: ACK a1ba025ea356f2753f8d4e297f132ed4c41bf72e apoelstra: ACK a1ba025ea356f2753f8d4e297f132ed4c41bf72e; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit is a code cleanup that rewrites how errors are wrapped in the Bitcoin crypto library. It changes nested error constructors into chained map_err calls but keeps the exact same error values and public behavior. There is no security-relevant change.
Follow up on #6546 by flattening 14 remaining nested error constructions in consensus_encoding. Chained map_err calls make each conversion read from the leaf error outward, improving readability while preserving behavior and public APIs.
Crate tests, feature checks, and repository lint pass.
ACKs for top commit: apoelstra: ACK 234f39fd8de288bd607a47ed34ee8377f31f0351; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
consensus or confidential-proof validationparser or protocol pathmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit is a pure code-style refactor. It rewrites how error values are constructed in the consensus encoding/decoding code, replacing direct nested constructor calls with chained `map_err` calls. The pull request explicitly states the goal is readability, and the behavior and public APIs are preserved. There is no security-relevant change.
76a18b1c104e9f1fe2a839364b7b015910241ee4 units: Remove amount parsing limit (Tobin C. Harding)
Pull request description:
The limit is somewhat arbitrary. It was introduced as a DoS protection. This sort of attack vector is not really our concern.
Fix: #6828
ACKs for top commit: apoelstra: ACK 76a18b1c104e9f1fe2a839364b7b015910241ee4; successfully ran local tests Kixunil: ACK 76a18b1c104e9f1fe2a839364b7b015910241ee4
This commit removes a 50-character limit on strings that can be parsed as Bitcoin amounts. The limit was originally added as a basic defense against denial-of-service (DoS) attacks using very long inputs. The maintainers decided the limit was arbitrary and that DoS protection is not this library's responsibility. The change means slightly longer strings can now be parsed, but the actual numeric range checks remain in place, so extremely large values still produce an out-of-range error.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit is a routine release-management change. It bumps the version number of the `bitcoin-internals` crate from 0.6.0 to 0.7.0, updates the changelog, and refreshes lock files and dependency declarations across the workspace. There are no code changes, bug fixes, or security patches in the diff.
Security candidateMerge rust-bitcoin/rust-bitcoin#6871: Remove uses of `Index` on `secp256k1::SecretKey`by Andrew Poelstra · 61626a16 · Sep 12, 2026 · 2 filesMessage 91 · StrongInformational 19Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6871: Remove uses of `Index` on `secp256k1::SecretKey`
72d03eb1cec3daf26290fd0913140915d03ce1b2 Remove uses of Index on secp256k1::SecretKey (Mitchell Bagot)
Pull request description:
The Index impl on secp256k1::SecretKey is considered upstream to be something we want to remove. In preparation for that, we should replace relevant uses of that trait with equivalent as_secret_bytes() calls.
Remove uses of the Index trait on the secp256k1::SecretKey.
ACKs for top commit: apoelstra: ACK 72d03eb1cec3daf26290fd0913140915d03ce1b2; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This is a small code cleanup change in a Bitcoin cryptography library. It replaces an older way of reading secret key bytes with a newer, more explicit method. There is no direct evidence in the commit that this fixes an active security bug, but it removes reliance on a trait that upstream developers want to eliminate, likely because it is considered a poor API for handling secret data.
Security candidateMerge rust-bitcoin/rust-bitcoin#6858: base58: saturate the reserve len multiplicationby Andrew Poelstra · aa91cf66 · Sep 12, 2026 · 1 fileMessage 100 · StrongLow 37Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6858: base58: saturate the reserve len multiplication
898da6ed12fcef49180d4b622d1a0a4dd5850f3d base58: saturate the reserve len multiplication (satsfy (Renato Britto))
Pull request description:
Use a `saturating_mul()` to handle overflows on `encoded_reserve_len`.
Didn't think this was worth a test because of the input needed to overflow this isn't allocatable on 64-bit and debug already catches it, so this is just fixing the release wrap.
Per https://github.com/project-loupe/audit-rust-bitcoin/issues/60
_This finding was discovered by [Project Loupe](https://github.com/project-loupe/loupe)._
ACKs for top commit: apoelstra: ACK 898da6ed12fcef49180d4b622d1a0a4dd5850f3d; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetymerge-commit duplicate discount
AI analysis · Low 37/100
This commit fixes a tiny but real arithmetic bug in the library's base58 string encoder. When asked to reserve memory for an extremely large encoded string, the old code could multiply two numbers together and silently wrap around to a small value on release builds (integer overflow), causing the program to reserve far less memory than needed and then write past the end. The fix uses saturating multiplication so the value stays at the maximum safe size instead of wrapping. The practical impact is limited because the input sizes needed to trigger this are not realistically allocatable on 64-bit systems, and debug builds already panic on overflow.
Fix `ServiceFlags` bitwise XOR implementations to perform actual XOR instead of delegating to `remove`.
`remove` uses `&= !other`, so reusing it for `BitXor` made toggling an unset flag a no-op. For example, `ServiceFlags::NONE ^ ServiceFlags::WITNESS` incorrectly returned `ServiceFlags::NONE`.
Implement `BitXor` and `BitXorAssign` directly using `^`, and add regression coverage for toggling both unset and set service flags.
ACKs for top commit: apoelstra: ACK 7d883da4013e5f787b30ce6844ecb20f562fa52e; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlmerge-commit duplicate discount
AI analysis · Low 49/100
This commit fixes a bug in how the rust-bitcoin library handled the XOR (exclusive-or) operator for Bitcoin network service flags. XOR is supposed to toggle bits on if they are off and off if they are on. The old code incorrectly used a 'remove' operation instead, which only turned bits off. That meant expressions like 'no flags XOR witness' wrongly stayed at 'no flags' instead of becoming 'witness'. The fix implements XOR directly with the proper bitwise operator and adds tests to prevent the bug from returning.
9e71cce17be751cabd63f58eee27b9250ba80e9b hashes: Test Hkdf::expand at maximum output length (Jamil Lambert, PhD) c61576fea722b164abd6aa230bf34f514078eda4 hashes: Fix Hkdf::expand panic at max length (Jamil Lambert, PhD)
Pull request description:
Hkdf::expand accepts an output buffer up to the RFC-5869 maximum of 255 * T::Hash::LEN bytes, but the per-block counter was a u8. At the maximum length the counter reaches 255 on the final block and the subsequent counter += 1 overflows.
Replace the u8 counter with a for loop which cannot overflow.
Closes project-loupe/audit-rust-bitcoin#5
ACKs for top commit: satsfy: tACK 9e71cce17be751cabd63f58eee27b9250ba80e9b tcharding: ACK 9e71cce17be751cabd63f58eee27b9250ba80e9b apoelstra: ACK 9e71cce17be751cabd63f58eee27b9250ba80e9b; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safetymerge-commit duplicate discount
AI analysis · Moderate 62/100
This commit fixes a panic (sudden crash) in the HKDF key-derivation function when a caller asks for the maximum allowed output length. The previous code used an 8-bit counter that overflowed on the final block, causing the program to abort. The fix replaces the counter with a loop that cannot overflow. This is a denial-of-service-style bug: a valid, RFC-compliant request could crash the library.
Security candidateMerge rust-bitcoin/rust-bitcoin#6847: Manual weekly update to rustc (to nightly-2026-09-05) on masterby Andrew Poelstra · cb240433 · Sep 11, 2026 · 8 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6847: Manual weekly update to rustc (to nightly-2026-09-05) on master
d69e1768d77d6bb8fb6f42cad8956d096674c5d5 crypto: reformat with new rustfmt (satsfy (Renato Britto)) 5259213e3b44afebe4c389644dcaa9aed9934b6e fuzz: drop the single element loop (satsfy (Renato Britto)) b4bec57170dda6e100600f86d26b3ef26134f704 p2p: remove else block, return early on conn err (satsfy (Renato Britto)) e04ef36d845b072214d08af4e4d5e90640680539 hashes: allow empty_enums for typestate markers (satsfy (Renato Britto)) 2f03a216b4e83734e0a2c5c1e59754e10009dd6e hashes: mark deprecation on cpufeatures macro (satsfy (Renato Britto)) 0dc4994d8d36b8994b0fa09bf0a74839d5707f8d units: use NonZero operands directly (satsfy (Renato Britto)) 6698dc881ddb3c3382d233d730f046aa457ddae9 Automated update to rustc nightly-2026-09-05 (Update Nightly Rustc Bot)
Required many changes: - units: drop `.get()` on NonZero operands - hashes: allow `deprecated` on cpufeatures modules - workspace: allow `empty_enums` for typestate markers - p2p: let-else early return in example - fuzz: unroll single element loop - crypto: reformat with new nightly rustfmt
ACKs for top commit: apoelstra: ACK d69e1768d77d6bb8fb6f42cad8956d096674c5d5; successfully ran local tests tcharding: ACK d69e1768d77d6bb8fb6f42cad8956d096674c5d5
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencecryptography-sensitive pathauthentication pathmerge-commit duplicate discount
AI analysis · Informational 15/100
This is a routine maintenance update that switches the project's pinned nightly Rust compiler version and makes the small code changes needed to keep the project compiling cleanly under the new compiler and its updated linting/formatting rules. There is no security-relevant change here.
Hkdf::expand accepts an output buffer up to the RFC-5869 maximum of 255 * T::Hash::LEN bytes, but the u8 counter overflows when incremented past the final block at that max length.
Replace the u8 counter with a for loop which cannot overflow.
Assisted-by: Claude Opus 4.8
73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
memory safety
AI analysis · Moderate 62/100
This commit fixes a bug in the HKDF key-derivation function where requesting the maximum allowed output length could cause the program to panic (crash) due to a counter overflow. The fix replaces an 8-bit counter that could wrap around past 255 with a loop using a larger integer type, so the maximum-length expansion completes safely.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is purely a code formatting change. It uses a newer version of rustfmt to re-wrap long match-arm expressions onto multiple lines in a single file. No logic, behavior, or security properties of the code were changed.
The macro expands to u8::max_value(), deprecated on new nightly.
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 20/100
This commit is a routine code cleanup. It changes the compiler warning suppression attribute from `#[allow(deprecated_in_future)]` to `#[allow(deprecated)]` because the upstream `cpufeatures` crate now triggers a current `deprecated` warning instead of a future one. There is no security bug being fixed and no behavior change to the program.
