Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes,…
This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no chan…
This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than al…
This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature …
This commit adds standard data-encoding support for a Bitcoin Taproot hash type (TapLeafHash) so it can be properly serialized and deserialized in PSBT data. There is no indication of a security bug being fixed; it appears to be a missing-…
No security-relevant signal in commit message or diffChange is a feature addition (encoding trait implementations)No bounds-checking, memory-safety, or cryptographic flaws evident in diff
This commit is a routine code reorganization in the rust-bitcoin library. It moves the `Address::from_script` method out of the main `Address` type into a new 'extension trait' called `AddressExt`. The actual logic of the function is copie…
This commit is a routine release preparation: it bumps the version number of the `bitcoin-primitives` crate from 0.102.0 to 0.103.0, updates related dependency declarations in other crates, refreshes lock files, and adds a changelog entry.…
This commit is a routine version bump for the bitcoin_hashes crate from 1.0.0 to 1.1.0. It updates dependency references across the workspace, records the release in the changelog, and adjusts deprecation lint allowances in tests. There is…
This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual c…
No security-relevant behavioral change observedAPI rename and return-type encapsulation onlyNo new validation, bounds checking, or constant-time guarantees added
This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability…
No security-relevant logic changePure API renaming/refactoringDeprecated method removal may break downstream callers at compile time
This commit is a routine version bump for the internal 'bitcoin-internals' crate from 0.5.0 to 0.6.0. It updates version numbers across package manifests and lock files, and adds a changelog describing API cleanups and small improvements. …
This commit simply removes an unused software dependency (the hex-conservative crate) from the internals sub-package and updates related package configuration files. It is a routine cleanup change with no security relevance.
This commit is a routine internal code cleanup in the rust-bitcoin project. It swaps old base58 encoding helper functions for a new equivalent type, Base58CkString, in three source files. There is no indication from the commit itself that …
No security-relevant signal in the diff: equivalent API swap onlyNo new dependencies or unsafe blocks introducedNo changes to input validation, parsing, or secret handling
This commit adds a new `try_push` method to an internal `Buffer` trait used during Base58 encoding. It is a straightforward, additive change that lets encoding code gracefully handle a full fixed-size buffer in no-allocation builds. There …
This commit is a simple renaming of internal Rust functions from names ending in '_with' to names ending in '_with_decoder'. It does not change what the code does, only what the functions are called, to avoid confusion with another functio…
This commit is a routine internal code reorganization in the rust-bitcoin library. It moves a helper trait (ScriptPubKeyBufExt) and its functions from one internal module to another, and re-exports it so existing users see no change. There…
This is a routine code-maintenance change: the developers are marking an old helper macro as deprecated and telling users how to write the same code by hand. There is no bug fix, no security patch, and no vulnerability being addressed in t…
This commit is a routine automated code-formatting run by the rustfmt tool. It only changes whitespace, import order, and line breaks in five files. There are no functional changes, no bug fixes, and no security-related modifications.
This commit is a routine code cleanup in the rust-bitcoin library. It replaces a macro used to define SHA-256 tagged hash identifiers with direct Rust code that does the same thing. The actual hash values and behavior are unchanged; only t…
This is a routine update to the project's automated testing configuration. A tool used to run example tests changed its syntax, so the developer updated one line to keep the same tests running the same way. There is no user-facing change a…
The labeller runs in a separate workflow for security reasons, but this forces the `download-artifact` action to need an explicit token.
Here is a test end to end run on my remote: https://github.com/nyonson/rust-bitcoin/pull/5
ACKs for top commit: apoelstra: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756; successfully ran local tests; sure, whatever satsfy: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756 tcharding: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Security candidateMerge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decodingby Andrew Poelstra · c5fd1832 · Aug 5, 2026 · 5 filesMessage 100 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding
b0eba4c097ca68da53abbbaf8603a5facd7c82bd Rename Error to DecodeCheckError (Mitchell Bagot) 7e6ab80baf795c9985d63c35d54b622ec59daa0a Add tests for decode_check_to_array (Mitchell Bagot) ae6ea3616fd6de3fb8cd976346d0b5d9a537abc7 base58: Add decode_check_to_array (Mitchell Bagot) 0a70c578514c3ecfedac508045397b627071e265 Split decode into build_base256 (Mitchell Bagot)
Pull request description:
At present, base58 has only encoding functionality in no-alloc builds. In order to allow decoding of known size data from base58 without an allocator, the base58 crate needs a decoder function like hex's decode_to_array. Such a function has more failure modes than the alloc decode_check function, so new error types are required also.
- Patch 1 splits the existing decode function into a private build_base256 function that writes to a provided scratch buffer. - Patch 1 introduces decode_check_to_array function for decoding short (<128 char) base58 strings to byte arrays, and associated error types. - Patch 2 adds tests to cover the new function. - Patch 3 renames Error to DecodeCheckError, retaining a deprecated type alias.
ACKs for top commit: tcharding: ACK b0eba4c097ca68da53abbbaf8603a5facd7c82bd apoelstra: ACK b0eba4c097ca68da53abbbaf8603a5facd7c82bd; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Security candidateMerge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0by Andrew Poelstra · 0f68fcb3 · Aug 4, 2026 · 10 filesMessage 93 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0
8899dfd242cf418ee6ce3f05e5828e8579af9f3c release bitcoin_hashes 1.2.0 (Andrew Poelstra) 44552e3ad3035e1001b665bfd4dd3511042cd1f2 hashes: update API files (Andrew Poelstra) 7d8f06d256152a3de1ec9b54e3dd643271983f0d hashes: add several methods to sha256::Midstate for computing them in const contexts (Andrew Poelstra) dc21841b46abc39c49ed7075131f1ac46416137f hashes: add sha256::Midstate::SHA256_IV constant (Andrew Poelstra)
Pull request description:
Adds a new `Midstate::SHA256_IV` constant which allows you to construct a midstate equivalent to a new empty sha256 engine. Then adds `update` methods to `Midstate` which allow you to "ratchet forward" arbitrary midstates, 64 bytes at a time, by hashing the data. There is one fast method and two slow constfn methods.
The motivation is that in Elements we have many Merkle roots which are computed using sha256 midstates, which is safe to do because we're using domain-separated hashes and because our internal nodes are always hashes of exactly 64 bytes of data, which do not not need any length-suffixing. In rust-simplicity we have several such Merkle root types, many of which have a huge pile of precomputed constants, but whose constructors are forced to be non-`const`, which limits their use in generic contexts.
It's maybe a bit uncouth for me to just add some methods I need and cut a new release in a 1.x crate, but
* we have taken great pains to keep `hashes` out of other crates' public APIs, so its stability is not as paramount as it would be for encoding or units, say * all the new methods (and one constant) are on the `Midstate` type, which is a "don't touch this unless you are a cryptographer" part of the API and already has some ugly methods * the additions seem pretty reasonable to me, assuming you accept that we have a `Midstate` type at all; essentially they generalize the already-existing `hash_tag` method * I am BDFL of this project
ACKs for top commit: tcharding: ACK 8899dfd242cf418ee6ce3f05e5828e8579af9f3c
Security candidateci: fix labeller permissionsby Nick Johnson · 715f2bd6 · Aug 4, 2026 · 1 fileMessage 75 · AdequateTriage 0Details
Commit message · Nick Johnson
ci: fix labeller permissions
The labeller runs in a separate workflow for security reasons, but this forces the download-artifact actoin to need an explicit token.
75/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege statedocumentation-only discount
Security candidateMerge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3by Andrew Poelstra · f7d364cd · Aug 4, 2026 · 15 filesMessage 96 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3
ae935faddb52aa66087c2c148c8e33a7aaf1a662 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot])
Pull request description:
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824"><code>1cce339</code></a> Fix checkout init for SHA-256 repositories (<a href="https://redirect.github.com/actions/checkout/issues/2439">#2439</a>)</li> <li><a href="https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231"><code>900f221</code></a> fix: expand merge commit SHA regex and add SHA-256 test cases (<a href="https://redirect.github.com/actions/checkout/issues/2414">#2414</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98"><code>0c366fd</code></a> Update changelog (<a href="https://redirect.github.com/actions/checkout/issues/2357">#2357</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK ae935faddb52aa66087c2c148c8e33a7aaf1a662; successfully ran local tests satsfy: ACK ae935faddb52aa66087c2c148c8e33a7aaf1a662
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountautomated dependency-update discount
Security candidatebase58ck: Bump version to 0.5.0by Tobin C. Harding · 8479b56e · Aug 3, 2026 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding
base58ck: Bump version to 0.5.0
In preparation for release add a changelog entry, bump the version, and update the lock files.
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes, bug fixes, or security patches in this commit itself.
Security candidateRename Error to DecodeCheckErrorby Mitchell Bagot · b0eba4c0 · Aug 3, 2026 · 5 filesMessage 58 · ThinInformational 20Details
Commit message · Mitchell Bagot
Rename Error to DecodeCheckError
The Error type in base58 represents an error that can occur when decoding a base58check string. Since there now exists the DecodeCheckArrayError for errors that can occur when decoding in allocless builds, the main error type should also be renamed to clarify its exact use.
Rename Error to DecodeCheckError. Add deprecated type alias Error for DecodeCheckError.
This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no change to how data is decoded, validated, or handled, and no security bug is fixed.
Add a unit test for the new constant. Rename the internal-only function compute_midstate_unoptimized to update_midstate_unoptimized, and change call sites to call it with the new SHA256_IV constant.
This lets us "ratchet forward" arbitrary midstates in const contexts. The next commit will expose this general functionality in a correct way (by enforcing lengths). I would like this in rust-simplicity, so I can compute various Merkle roots in const contexts.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than always starting fresh. There is no security bug or fix here—just a code cleanup and API preparation for future const-context hashing features.
Security candidatehashes: add several methods to sha256::Midstate for computing them in const contextsby Andrew Poelstra · 7d8f06d2 · Jul 31, 2026 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · Andrew Poelstra
hashes: add several methods to sha256::Midstate for computing them in const contexts
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature addition with no obvious security bug, no fix of a vulnerability, and no disclosed security relevance.
taproot-primitives: Implement encoding traits for TapLeafHash
The TapLeafHash type in taproot-primitives, is consensus encoded in PSBT. As such, it needs to have encoding trait implementations.
Add encoder and decoder for TapLeafHash and implement Encode and Decode on the hash type.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Informational 17/100
This commit adds standard data-encoding support for a Bitcoin Taproot hash type (TapLeafHash) so it can be properly serialized and deserialized in PSBT data. There is no indication of a security bug being fixed; it appears to be a missing-feature addition.
The Address::from_script function relies on Params in the function signature. Since Params can't be moved to addresses or primitives, this function should be left behind in an extension trait for now.
Introduce AddressExt extension trait and move minimal functionality from Address into it.
73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 18/100
This commit is a routine code reorganization in the rust-bitcoin library. It moves the `Address::from_script` method out of the main `Address` type into a new 'extension trait' called `AddressExt`. The actual logic of the function is copied unchanged. This is a design change to resolve a dependency issue (the `Params` type cannot be moved into a lower-level crate), not a security fix.
Security candidateci: update cargo-rbmt ever month instead of weekby Nick Johnson · 778018e1 · Jul 27, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · Nick Johnson
ci: update cargo-rbmt ever month instead of week
The week updates have been too noisy with the rbmt churn, hoping the monthly schedule gives us a poke if we fall behind, but isn't noisy.
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update pathdocumentation-only discount
Security candidateprimitives: Bump version to 0.103.0by Tobin C. Harding · 5612224d · Jul 17, 2026 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding
primitives: Bump version to 0.103.0
In preparation for release add a changelog entry, bump the version, and update the lock files.
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a routine release preparation: it bumps the version number of the `bitcoin-primitives` crate from 0.102.0 to 0.103.0, updates related dependency declarations in other crates, refreshes lock files, and adds a changelog entry. There are no code logic changes and no security fix or vulnerability introduced in the diff itself.
Security candidatehashes: bump version to 1.1.0by Nick Johnson · bf3f25f4 · Jul 15, 2026 · 9 filesMessage 45 · ThinInformational 15Details
Commit message · Nick Johnson
hashes: bump version to 1.1.0
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a routine version bump for the bitcoin_hashes crate from 1.0.0 to 1.1.0. It updates dependency references across the workspace, records the release in the changelog, and adjusts deprecation lint allowances in tests. There is no security-relevant code change.
- Replace ckd_pub_tweak with derive_child_tweak returning XpubChildTweak. - Remove Xpub::ckd_pub_tweak. Users must use Xpub::derive_child_tweak and XpubChildTweak instead.
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Informational 17/100
This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual cryptographic math and behavior remain the same; only the way callers receive the result has changed. There is no indication this fixes a security bug.
refactor(bip32): rename Xpub and Xpriv derivation methods
- Rename the xpriv and xpub derivation APIs to derive_child and derive_path - Remove derive_priv, derive_xpriv, derive_pub, derive_xpub, and ckd_pub. Callers should now use derive_child for single ChildNumber derivation and derive_path for path derivation.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Informational 18/100
This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability introduced; it is purely a refactoring that may require downstream developers to update their code.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountautomated dependency-update discount
Security candidateinternals: Bump version to 0.6.0by Tobin C. Harding · aed7a9ce · Jul 13, 2026 · 16 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding
internals: Bump version to 0.6.0
In preparation for release add a changelog, bump the version, and update the lock files.
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a routine version bump for the internal 'bitcoin-internals' crate from 0.5.0 to 0.6.0. It updates version numbers across package manifests and lock files, and adds a changelog describing API cleanups and small improvements. There is no code change that fixes a security bug or introduces a vulnerability.
Security candidateci: update LTS branches for toolchain and kani cronsby Nick Johnson · 183197ab · Jul 10, 2026 · 3 filesMessage 62 · AdequateTriage 0Details
Commit message · Nick Johnson
ci: update LTS branches for toolchain and kani crons
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update pathdocumentation-only discount
Security candidateRemove hex dep from internalsby Tobin C. Harding · bd0d4bc0 · Jul 9, 2026 · 8 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding
Remove hex dep from internals
The `hex` dep is no longer used in `internals` (since #6339).
Remove it.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit simply removes an unused software dependency (the hex-conservative crate) from the internals sub-package and updates related package configuration files. It is a routine cleanup change with no security relevance.
Security candidatedocs: root readme cleanupby Nick Johnson · efeab943 · Jul 8, 2026 · 1 fileMessage 70 · AdequateTriage 0Details
Commit message · Nick Johnson
docs: root readme cleanup
* PSBT has moved to the rust-psbt crate. * The CI badges are not helpful when viewed from things like crates.io, we have detection jobs now for maintainers for stuff like kani. * Update deprecated library json rpc library. * Update changelog links to work from anywhere. Also add missing crates.
70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Replace external uses of base58 encoding with Base58CkString
Before the old encoding functions can be removed, all uses from outside the crate need to be replaced with the equivalent calls from the new Base58CkString type.
Replace all uses of encode_check and encode_check_to_fmt with equivalent Base58CkString uses.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 17/100
This commit is a routine internal code cleanup in the rust-bitcoin project. It swaps old base58 encoding helper functions for a new equivalent type, Base58CkString, in three source files. There is no indication from the commit itself that this fixes a security bug; it appears to be part of a refactoring to remove deprecated functions.
As part of the introduction of no-alloc encoding, the Buffer trait will need a push function that can fail gracefully when it overflows. The simplest solution is to introduce a try_push function that is infallible for Vec and calls through to try_push on ArrayVec.
Add try_push function to Buffer trait.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
memory safety
AI analysis · Informational 15/100
This commit adds a new `try_push` method to an internal `Buffer` trait used during Base58 encoding. It is a straightforward, additive change that lets encoding code gracefully handle a full fixed-size buffer in no-allocation builds. There is no bug fix, no behavior change to existing code paths, and no security issue visible in the diff.
