rust-bitcoin

p2p: remove else block, return early on conn err

Merge rust-bitcoin/rust-bitcoin#6836: bitcoin: move tests reading `tests/data` out of `src`

b4068f4ccdfca76160893252f50c90385c815a16 p2p: move merkle_tree tests to tests/ (satsfy (Renato Britto))
a0285f0094c45870fcded03be7bddf5ac97c5c10 bitcoin: move sighash tests to tests/ (satsfy (Renato Britto))
546c31d40f6c53a3489a41d70453d235afe7efe2 bitcoin: move taproot test to tests/ (satsfy (Renato Britto))
2c248d2cae77495c2e224f8029e22aec3bf3161f bitcoin: move bip158 test to tests/ (satsfy (Renato Britto))
2dcd5ab3bc085b5231becc42f05eeadc1d05aa3e bitcoin: move block test to tests/ (satsfy (Renato Britto))
8725bffa9e012aaabd31f95bad6d024b1707e952 bitcoin: move transaction test to tests/ (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6509
Inspired on https://github.com/rust-bitcoin/rust-bitcoin/pull/6311

We have test data in `<crate>/tests/data`. Folder `tests/` are excluded when publishing (`exclude = ["tests"]`). The problem is that some `<crate>/src/<test code>.rs` used macros like `include_str!()` or `include_bytes!()` importing data that gets excluded in published code, so the published unit tests would not compile.

This PR moves all data-based tests to folder `tests/`.

One friction point is: `tests/` only see public api from crate. So if a test imported from `tests/` using crate internal non-pub code, we would need to either add some way to access it or inline. I inlined some test vectors to cover these tests and kept them in crate code (only the first `keyPathSpending` vector of `bip341_tests.json` because `common_cache` and `taproot_cache` are private).

Note on commits: I separated them by move for ease of review. I don't like that we have so many, but its the tradeoff.


ACKs for top commit:
apoelstra:
ACK b4068f4ccdfca76160893252f50c90385c815a16; successfully ran local tests
tcharding:
ACK b4068f4ccdfca76160893252f50c90385c815a16


Tree-SHA512: 7744138905453022c06cd58ef6357537fb0e27e018932b15653caeacaa6bf10a8517d3c949ac1a72d5743e24567190727178ff28bf41c5b19b8b08666db1e3da

Merge rust-bitcoin/rust-bitcoin#6842: build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0

8d5a2f95cfd5e0517aff9ca8d0737dbdccff1b67 build(deps): bump github/codeql-action/upload-sarif (dependabot[bot])

Pull request description:

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p>
<blockquote>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>v4.36.3</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a> from github/update-v4.37.0-c7c896d71</li>
<li><a href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a> Add changenote for <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li>
<li><a href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a> Update changelog for v4.37.0</li>
<li><a href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a> from github/update-bundle/codeql-bundle-v2.26.0</li>
<li><a href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a> Add changelog note</li>
<li><a href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a> Update default bundle to codeql-bundle-v2.26.0</li>
<li><a href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a> from github/mbg/repo-props/config-file-shorthands</li>
<li><a href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a> Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...</li>
<li><a href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a> Thread <code>ActionState</code> to <code>initConfig</code></li>
<li><a href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a> Mark some <code>status-report</code> imports as <code>type</code>-only to avoid circular dependencies</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 8d5a2f95cfd5e0517aff9ca8d0737dbdccff1b67; successfully ran local tests


Tree-SHA512: b1ef20d84cdbf207e6b322dfc23a2d5148514d07d84fa7f0eaa764c90ae883313bcc026c3f0e0275e4da7310f8411feabeb7c6d5c1a0554fcc1df43b6e9531e2

Merge rust-bitcoin/rust-bitcoin#6837: Automated nightly rustfmt (2026-09-06)

ccc22407b925a92b618d4d2fa334664bb56f9f6c 2026-09-06 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK ccc22407b925a92b618d4d2fa334664bb56f9f6c; successfully ran local tests


Tree-SHA512: e348d095b703e89556c3aa66bbec2fc842b4f77f8bd5045c9502ec2c754bdff3c6029b634a2aa97dcde9557684580e21ecde77d381fb9610b75a9e32233e6d8e

Merge rust-bitcoin/rust-bitcoin#6819: Remove panics from `LegacyPublicKey::from_str`

e9eebc4a49e32d157f1372c8f895243fba7cda4d Remove panics from `LegacyPublicKey::from_str` (Martin Habovstiak)

Pull request description:

While the implementation was correct the lack of panics was not obvious from the code. This rewrites it to be completely panic-free.


ACKs for top commit:
apoelstra:
ACK e9eebc4a49e32d157f1372c8f895243fba7cda4d; successfully ran local tests


Tree-SHA512: 353cf2043d059f2e120bd49eb88c83d0a3cde451a805f9f34bafd0bdc1641ffc17b4e000e1be9ff817a740fe48f3456598ec85e3941481a81ca0c6b6e66bfe5c

Merge rust-bitcoin/rust-bitcoin#6688: crypto: Remove `alloc` gating from `WifKey` methods

b3f8712f932d101d2b3eae5ea44e585f63bb3a60 Remove FromWifError::InvalidBase58PayloadLength and inner error (Mitchell Bagot)
e09f6582dd41b9a8229d1b61bb955f652f1cfa98 Remove alloc gating from WifKey::from_wif and FromStr (Mitchell Bagot)
20039ae24c721493fee9ef6139df089272e99eb9 Remove alloc gate from WifKey::fmt_wif (Mitchell Bagot)

Pull request description:

With the new base58 no-alloc functionality, the WifKey fmt_wif and from_wif functions can be made no-alloc. This allows users without alloc to parse and write out WIF keys if needed and removes the last of the major alloc parts in the key module. Those that remain directly rely on alloc/std types.

- Patch 1 removes the alloc requirement for fmt_wif.
- Patch 2 removes the alloc requirement for from_wif.
- Patch 3 removes the unused error type InvalidBase58PayloadLengthError and variant from FromWifError.


ACKs for top commit:
apoelstra:
ACK b3f8712f932d101d2b3eae5ea44e585f63bb3a60; successfully ran local tests


Tree-SHA512: 01b67b3f8c59d8645025de3c3fc9811c988498340926fe1ed164f6edbb9a119ab7d7deff602290708869b0f3b1167ebfe18807f46abdd5fc46250dbaf935aeeb

Merge rust-bitcoin/rust-bitcoin#6812: units: Separate mathematical operation and failure mode in `NumOpError`

eb8cbe95d92df9249e936172bdd966cdbc3b57a8 units: Replace NumOpError internals with MathErrorKind (Mitchell Bagot)
d6822db9072576dfd5f53ba5f47473f7be5b00c1 units: Remove assumption that div cannot overflow (Tobin C. Harding)

Pull request description:

This is a replacement of #6772, attempting to implement the NumOpErrorType, as suggested in https://github.com/rust-bitcoin/rust-bitcoin/pull/6772#issuecomment-5395337886.

Adjust docs, MathOp and NumOpError to remove the assumption that div cannot overflow.
Introduce NumOpErrorType to separate failure mode from attempted mathematical operation.

Original work by: Tobin C. Harding \<me@tobin.cc>

Closes #4672


ACKs for top commit:
apoelstra:
ACK eb8cbe95d92df9249e936172bdd966cdbc3b57a8; successfully ran local tests


Tree-SHA512: a312cf7ba1752e3231626aab73dfcd3e5b7f54ff6e4d6803d56a64f34f2c1ecfd44c32a5f1f3a97df82a9229d619d537f4fd6eb731d03912cdfb668b37605cb3

Merge rust-bitcoin/rust-bitcoin#6346: Make `Keypair::as_inner` private

4cc9cda8bbb82982529aed62afe15a85aaffbd8c Make Keypair::as_inner private (Mitchell Bagot)

Pull request description:

Keypair::as_inner is currently only used to implement TapTweak. Since TapTweak exists in taproot-primitives and cannot be in crypto, it must be modified to manually serialize/deserialize to get the secp type rather than using as_inner.

Replace Keypair::as_inner use in TapTweak with Keypair::from_key_parts and make as_inner pub(super).


ACKs for top commit:
tcharding:
ACK 4cc9cda8bbb82982529aed62afe15a85aaffbd8c
apoelstra:
ACK 4cc9cda8bbb82982529aed62afe15a85aaffbd8c; successfully ran local tests


Tree-SHA512: 0674b3e11a731757a170cc3e6c158df81162d001b19a10ccb14c5bf5b630c2a25c8bcd855448b434d666853a7e6fe9cd9465d36c8878dfb0ee23ffc64b38721c

Merge rust-bitcoin/rust-bitcoin#6805: crypto: Add NonStandardSighashType wrapper

1c4a09ba6e218100fd620b3f3dff4f56c5ee1b2c crypto: Derive PartialEq, Eq and Hash for EcdsaSighashType (jrakibi)
54210869336f3cbb7fd00c3a1aa2e51ba58d762e crypto: Add `NonStandardSighashType` wrapper (jrakibi)

Pull request description:

Currently a value in the `NonStandard` variant can be anything, including a standard value, which makes the enum redundant (eg. EcdsaSighashType::All and EcdsaSighashType::NonStandard(0x01)).

Instead we can change the `NonStandard` variant to hold a type with private inner `u32`, so that `EcdsaSighashType::NonStandard` **_cannot_** represent a standard sighash type.

Users who need a non-standard sighash type can use `EcdsaSighashType::from_consensus`.

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6795


ACKs for top commit:
apoelstra:
ACK 1c4a09ba6e218100fd620b3f3dff4f56c5ee1b2c; successfully ran local tests; nice!


Tree-SHA512: 54eca2ee0fa3caa43952bb56f602be7b11d3ecd233f1add850fee6d3a84be78d24e087e428d4e0f5d79260fec4996616f9470b3b0bd0accea8e642585a8d9ecf

Merge rust-bitcoin/rust-bitcoin#6806: Remove `test_` prefix from tests

f338de73ee0db4a8725d176625ae09512fb29353 Remove test_ prefix from tests (Mitchell Bagot)

Pull request description:

Some tests in the repo have a test_ prefix in their names. Initially this began to prevent conflicts with function names in the super namespace, but was applied inconsistently. Further, this pattern is not idiomatic, and should instead be removed entirely.

Remove test_ prefix from all test names, using super:: to reference parent module names where necessary.

Closes #6794


ACKs for top commit:
apoelstra:
ACK f338de73ee0db4a8725d176625ae09512fb29353; successfully ran local tests


Tree-SHA512: 5d4c5e9630f33fceef02972c93f13878391b805fe82a184dfae6fb13dff008f70ce9b50069b88c08ae62493cc527ef92d8e7b07a96e759f0e814e4dbc73fa656

units: Replace NumOpError internals with MathErrorKind

The NumOpResult doesn't have a way to distinguish the cause of an error
from the operation that was performed. Some operations can have
multiple failure modes, such as division (div-by-zero vs overflow on
signed values). Rather than clutter the operation type, a new error kind
type which captures the failure mode should be introduced. Where a failure
mode applies to multiple operation types (e.g. overflow), the existing
MathOp is wrapped.

Introduce MathErrorKind to replace MathOp private field of NumOpError,
adjusting constructors as needed.

Merge rust-bitcoin/rust-bitcoin#6804: build(deps): bump actions/checkout from 6.0.2 to 7.0.0

b9e9f313a5781b8484a27915806b417661280e27 build(deps): bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot])

Pull request description:

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK b9e9f313a5781b8484a27915806b417661280e27; successfully ran local tests


Tree-SHA512: e4555eab58bbdc36c1adf03568e345279fdc1293f75de05008598854b0d4b3ec793e53d0a9054b735144a029a2439a70848154e1e34168ed1ca3ee2ac3de16fb

Merge rust-bitcoin/rust-bitcoin#6802: Automated nightly rustfmt (2026-08-30)

8be20b5159937a66934c07f90837061659511427 2026-08-30 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action


ACKs for top commit:
apoelstra:
ACK 8be20b5159937a66934c07f90837061659511427; successfully ran local tests


Tree-SHA512: 69fbb0ea042b79a076896ffee22588e47f6386dc4fb8afd35c148cf0825a3c41ea23cf1fe919f19f0a59609b4b92c008d3148272fcc633947e9e2889823d19da

Merge rust-bitcoin/rust-bitcoin#6786: fuzz: Add bip158 fuzz_targets for BasicFilter

ac372d46587cd08534371866e53d218a78630ca2 fuzz: Add bip158 fuzz_targets for BasicFilter (Abeeujah)

Pull request description:

Add fuzz targets for bitcoin-bip158 `BasicFilter::from_block` and `BasicFilter::from_byte`.

- `build_filter` exercises filter construction from a synthetic block with fuzzed scripts and verifies round-trip serialization, match_all/match_any correctness.
- `parse_filter` deserializes arbitrary bytes to construct a BasicFilter, and verifies batch matching is consistent with per-query matching.


ACKs for top commit:
apoelstra:
ACK ac372d46587cd08534371866e53d218a78630ca2; successfully ran local tests


Tree-SHA512: 1a716ee84c7a3a13caea31a40948175fcea23fa9157f6eed9eab7f0fcdc479281b1330d7c9a0e712dc2fa977eecafa18979841d857f9d9954bf553a327cec8e6

Merge rust-bitcoin/rust-bitcoin#6547: ci: upgrade to rbmt 0.5.3 and delete api files

53ea3d6f15afab5d35091122cd46f1d364811b5e api: remove api snapshot files (satsfy (Renato Britto))
c5f77ae9c9e08e266ca8b7393f0c786b2372bae9 ci: upload api-diff artifact for the labeller (satsfy (Renato Britto))
5c865aa63b600a978a24a4eaa25fd5b11fbdeda8 ci: upgrade to cargo-rbmt 0.5.3 (satsfy (Renato Britto))

Pull request description:

Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6522
Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6580
Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6612

This PR upgrades the CI to cargo-rbmt 0.5.1 and replicates the 0.32.xxx CI, borrowing heavily from https://github.com/rust-bitcoin/rust-bitcoin/pull/6508.

- Remove API files. Depend on diff check CI job replicating 0.32.xxx.
- Adapt the docs to cargo-rbmt 0.5.1.
- `docsrs` was merged into `docs` (with `--no-docsrs` for plain rustdoc).
- Put the version in the manifest as the source of truth.
- Upgrading cross so that it uses a modern TOML parser.


ACKs for top commit:
apoelstra:
ACK 53ea3d6f15afab5d35091122cd46f1d364811b5e; successfully ran local tests


Tree-SHA512: 34dfce4fe39d1eed72a340b2658d1067d568c447d14eb6bd6408dcbb2ffbfaa77f06f85a4bc44fee3bf59089b914656188c4ff40c380b42c14f4343407732053

Merge rust-bitcoin/rust-bitcoin#6763: bip152: validate prefill count before allocating short IDs

7f80030897591c1d3bcf5023fe24d78115034403 bip152: test excessive prefill indexes (racequite)
cf94409eb486fd20e404acca67e87ccec6f1ebb4 bip152: validate prefill count before allocating short IDs (racequite)

Pull request description:

`HeaderAndShortIds::from_block` documents that invalid prefill indexes return `Error::InvalidPrefill`. However, it calculated the short ID capacity using unchecked subtraction before validating the input.

When the number of prefill indexes exceeds the number of transactions, this subtraction panics with overflow checks enabled. Other build configurations may wrap the subtraction and attempt an invalid or excessively large allocation.

Use `checked_sub` to return `Error::InvalidPrefill` before allocating the short ID vector. Add a regression test covering a single-transaction block with too many prefill indexes.


ACKs for top commit:
apoelstra:
ACK 7f80030897591c1d3bcf5023fe24d78115034403; successfully ran local tests


Tree-SHA512: 22d77e24df00332016107c482ae68c16fcdea387fa5fd4e5675d2e90c9067a4c1a961b6a9523bc58c99260f1011ae12e30e034881c7c2ccdb45f68972b948a9c

Merge rust-bitcoin/rust-bitcoin#6798: bump yanked secp256k1 version to 0.33.0

935d8eb86e904b3d4ef26ec8ca1ae543daacc914 deps: bump secp256k1 to 0.33.0 (satsfy (Renato Britto))

Pull request description:

The 0.32.0-beta line was yanked from crates.io when 0.33.0 was released.

Also `XOnlyPublicKey::serialize` was deprecated for `to_byte_array` and `secp256k1::Keypair::from_seckey_byte_array` became
`from_secret_bytes`.


ACKs for top commit:
apoelstra:
ACK 935d8eb86e904b3d4ef26ec8ca1ae543daacc914; successfully ran local tests


Tree-SHA512: 62221a72567082200a5f710898bfdd187e553859f496653bd6e86e64c0ca1e2476381637101e7b1507d72071f8aca079f94976ad1bb89211150723f716310e51

deps: bump secp256k1 to 0.33.0

The 0.32.0-beta line was yanked from crates.io when 0.33.0 was
released.

XOnlyPublicKey::serialize was deprecated for to_byte_array.
secp256k1::Keypair::from_seckey_byte_array became
`from_secret_bytes`.

Merge rust-bitcoin/rust-bitcoin#6748: Capitalize Bitcoin protocol references in docs

2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963 Capitalize Bitcoin protocol references (Jamil Lambert, PhD)
77054a4f9113d1a0d5f2f61c3279c36701960a21 Hyphenate rust-bitcoin (Jamil Lambert, PhD)
cbedca4543c24a5ac41abeffb2e307b4eac92921 Standardize Bitcoin network naming in docs (Jamil Lambert, PhD)

Pull request description:

Bitcoin should have a capital `B` when referring to the protocol, network, or software. And lower case `b` when referring to the currency.

Correct all of the docs so that the capitalization is consistent. Including a couple of other minor adjacent corrections.

Standardize docs to `Bitcoin {network}`.


ACKs for top commit:
tcharding:
ACK 2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963
apoelstra:
ACK 2d9f0e3cbce7aed99fb2bf6537a6bf67e6fb3963; successfully ran local tests


Tree-SHA512: 453d72987c6d1fb0e7e86cda6f66ea60e596fbf801a3b5374e661d66a838e6b20c949adab9d362c277cc1957cec96c9613b3c953677a7103231264c1e668a579

Merge rust-bitcoin/rust-bitcoin#6765: addresses: Remove all non-`Infallible` `From` impls on error types

ad74b7d44ffe562ec1089e615db196873daa4954 addresses: Remove all non-Infallible From impls on errors (Mitchell Bagot)
d0891037ca87d2bfb69f194aaeb350156d434fdc Replace uses of From on addresses errors (Mitchell Bagot)

Pull request description:

Currently, addresses has From impls on various errors, for various errors. While addresses is not near 1.0, such From impls represent a public API commitment and should be removed.

Remove all uses of error conversion From impls for addresses errors and remove the relevant From impls.


ACKs for top commit:
apoelstra:
ACK ad74b7d44ffe562ec1089e615db196873daa4954; successfully ran local tests
tcharding:
ACK ad74b7d44ffe562ec1089e615db196873daa4954


Tree-SHA512: b32502658cfc258b0997b1118adfe57c90f7d77c6306d5a1722541102fa471b139d3aed9223584985c8996905db4df9a5b03bc173e2490567eeb6c2d0292df50

Merge rust-bitcoin/rust-bitcoin#6778: ci: pin dependabot to Sunday 16:00 America/Chicago

ccc129aad10661b93407fd98896b38981954d991 ci: pin dependabot to Sunday 16:00 America/Chicago (satsfy (Renato Britto))

Pull request description:

Per apoelstra's ask on https://github.com/rust-bitcoin/rust-bitcoin/pull/6773#issuecomment-5395628053. Pinned to 16:00 at Austin city time which is the same as `America/Chicago`, the official IANA timezone name.

Dependabot used to run at [random moments](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#interval).


ACKs for top commit:
tcharding:
ACK ccc129aad10661b93407fd98896b38981954d991
apoelstra:
ACK ccc129aad10661b93407fd98896b38981954d991; successfully ran local tests


Tree-SHA512: 0be0461b03f979e4c63bd48546f70b2f7cca970dd5f6aa176138e477bd35160c271c18bcc2888bc360dcc7b80c94f602bff5a68f74b5263979a965e4685ad6c6

Merge rust-bitcoin/rust-bitcoin#6776: build(deps): bump actions/checkout from 6.0.2 to 7.0.0

25ab130b9bea1579030e735880046577ccad0faa build(deps): bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot])

Pull request description:

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li>
</ul>
</details>
<br />


[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 25ab130b9bea1579030e735880046577ccad0faa; successfully ran local tests
satsfy:
ACK 25ab130b9bea1579030e735880046577ccad0faa


Tree-SHA512: c3e4906f6a150a030f5db08c7da667459982d0e4cb9e605d19f489cd50526705fad58a07dbfd87a8cec6a5b79eb3ce1bb1fa59bbc117fe680852b0dc76821518

Merge rust-bitcoin/rust-bitcoin#6766: bitcoin: make legacy sighash takes `EcdsaSighashType`

7cffa4621b1a8ccb2219848fd9a8c576fe4de20c bitcoin: make legacy sighash takes `EcdsaSighashType` (jrakibi)

Pull request description:

Currently the legacy sighash API takes a u32 for sighash type.
Now that `EcdsaSighashType` can also represent non-standard values, we can change it to take EcdsaSighashType instead.

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/1657


ACKs for top commit:
apoelstra:
ACK 7cffa4621b1a8ccb2219848fd9a8c576fe4de20c; successfully ran local tests
tcharding:
ACK 7cffa4621b1a8ccb2219848fd9a8c576fe4de20c


Tree-SHA512: cd7482de41dc3d88a348fd269821d656aec00c74eda3caea1eb114d4aa0ab673c9d6f286e16db5d592360c89b3c1acad757544d13e93dd7ba8776de7476909f1

ci: pin dependabot to Sunday 16:00 America/Chicago

Merge rust-bitcoin/rust-bitcoin#6725: primitives: Add doctest examples

2877a0633d5d94f58803c0eca1b72e0182030981 primitives: Add module doc examples (Mitchell Bagot)
89b13277a1340516904a32a6379b12ed58b734da primitives: Add examples to script::owned methods (Mitchell Bagot)
ecd3a19ca976d8dc8442b3be726710cb80b2fbed primitives: Add examples to Witness methods (Mitchell Bagot)
493ce74e8475a7c70834072196aca6a154d4d140 primitives: Add simple examples to script-adjacent types (Mitchell Bagot)
5ffdd985d1afc3423a24faacbb3d9eb33506ddd9 primitives: Add examples to from_script on script hash types (Mitchell Bagot)
9f4ef91840892faf9e864b72d32d7527cd0ce115 primitives: Remove outdated comment on Header::block_hash (Mitchell Bagot)
75f29146c1d3d0b51525c91d7fbf4ef6744a26e6 primitives: Add examples to block module and methods (Mitchell Bagot)

Pull request description:

Per C-EXAMPLE, every item in a crate is supposed to include an example/doctest. Since many functions in primitives are trivial, providing an example for every method and type is needlessly verbose. However, most modules, types and some methods can benefit from the introduction of examples to clarify quirks and uses of the functionality.

Add doctests examples liberally to modules, types and methods throughout primitives.


ACKs for top commit:
tcharding:
ACK 2877a0633d5d94f58803c0eca1b72e0182030981
apoelstra:
ACK 2877a0633d5d94f58803c0eca1b72e0182030981; successfully ran local tests


Tree-SHA512: f9ee96654e4ba367838ac4014c28194828e267fb3926eacf4cd157b80259b841f5e76aded407258ad9cb0d5440e6e68a7e11bead6b7600535b3b1869cac92227