Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…
This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …
This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…
No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…
This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…
This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…
No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…
This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …
This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …
This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …
API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…
This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …
API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …
Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…
cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…
Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…
Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …
No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…
Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…
This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…
Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Security candidateMerge rust-bitcoin/rust-bitcoin#6755: crypto: Extend `EcdsaSighashType` to non-standard valuesby Andrew Poelstra · 61b4d777 · Aug 22, 2026 · 3 filesMessage 91 · StrongLow 47Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6755: crypto: Extend `EcdsaSighashType` to non-standard values
619e16acbc65593fed9c7d4100bc3d551829c19f crypto: replace EcdsaSighashType derives with manual impls (jrakibi) baa6ee0e71b871c29aa7b75027c3d3ed4771a144 Add tests for non-standard sighash types (jrakibi) 3fb16c665b4ba562b81ca1df544d7f4136b02010 crypto: Make from_slice accept non-standard sighash types (jrakibi) 50c06af4b3c4274f44ec751bfef06fd987343a08 crypto: extend EcdsaSighashType to accept NonStandard (jrakibi)
Pull request description:
The current segwit v0 sighash API takes `EcdsaSighashType`, which only accepts _standard_ values. This means we cannot compute the correct sighash for _consensus-valid_ transactions that use _non-standard_ sighash type, so verifying their signatures fails.
We extend `EcdsaSighashType` to accept any u8 value (solution proposed by Apoelstra in https://github.com/rust-bitcoin/rust-bitcoin/issues/1657#issuecomment-1456876763).
This is a step to make legacy encoding also take `EcdsaSighashType` instead of u32 to close #1657 (will open a separate PR for it after getting feedback on this one)
Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6647 and https://github.com/rust-bitcoin/rust-bitcoin/issues/4133
_This might also address #777_
ACKs for top commit: apoelstra: ACK 619e16acbc65593fed9c7d4100bc3d551829c19f; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This change fixes a bug where the library rejected certain unusual but Bitcoin-network-valid signature hash types. Before the fix, users could not verify signatures from real mainnet transactions that use these non-standard values, which could cause valid transactions to be incorrectly rejected. The patch extends the type system to accept any valid value while still treating the standard ones normally.
Security candidateMerge rust-bitcoin/rust-bitcoin#6761: Manual bump of dtolnay/rust-toolchain specifying toolchainby Andrew Poelstra · e42b17a3 · Aug 20, 2026 · 3 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6761: Manual bump of dtolnay/rust-toolchain specifying toolchain
4fa6b1c71d34e0121e834b78f486ac9b46f2cf57 ci: pass toolchain input to rust-toolchain action (satsfy (Renato Britto)) 06ba6541bca755b6e7088f6a893218d96a9d2ad4 build(deps): update dtolnay/rust-toolchain requirement to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 (dependabot[bot])
The dependabot bump moved `stable` branch pin to `master`, which has no toolchain default and requires it to be specified. The solution here is inspired on Miri CI workflow and another rust.yml job, which already implements the same.
ACKs for top commit: tcharding: ACK 4fa6b1c71d34e0121e834b78f486ac9b46f2cf57 apoelstra: ACK 4fa6b1c71d34e0121e834b78f486ac9b46f2cf57; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit updates the version of a third-party GitHub Action used to install Rust in automated CI workflows, and explicitly adds the 'stable' toolchain option where the newer version requires it. It is a routine infrastructure/maintenance change with no direct effect on the Rust Bitcoin library code or its security.
The dependabot bump moved stable branch pin to master, which has no default and requires the toolchain specified. Inspired on miri ci workflow, which already implements this.
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
This is a routine GitHub Actions CI maintenance patch. It updates workflow files to explicitly pass the Rust toolchain version ('stable') to a third-party GitHub Action after a dependency bump changed which branch of that action is being used. There is no change to the project's actual Bitcoin library code, no security fix, and no vulnerability being addressed.
Security candidateMerge rust-bitcoin/rust-bitcoin#6757: ci: gen PR labels from master instead of forkby Andrew Poelstra · cf6f5fdc · Aug 19, 2026 · 1 fileMessage 100 · StrongModerate 60Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6757: ci: gen PR labels from master instead of fork
000113045370d6dac13f8a91101bc31134278315 ci: gen PR labels from master instead of fork (satsfy (Renato Britto))
Pull request description:
This fixes a CI issue and doubles as a security fix.
The labeler job now fails on every fork PR. This is because, [yesterday](https://github.com/rust-bitcoin/rust-bitcoin/commit/2d138d732b791f7d1a7ef715794f5c2f4fad3b62), CI's `actions/checkout` was updated to v7 and refuses to fetch fork PR code from a `pull_request_target` workflow unless the step opts in with `allow-unsafe-pr-checkout`. IIUC, that was a safety issue because the old job checked out the fork and ran `cargo metadata` on its manifests while holding the base repo's token (known as [pwn-request vulnerability](https://www.endorlabs.com/learn/pwn-request-threat-a-hidden-danger-in-github-actions)).
But from my understanding of this workflow, the fork checkout is not necessary. So I dropped it and, making the problem go away.
One consequence is: if a PR adds a new crate, the PR will not get label `C-<crate>`. Seems acceptable to me.
Btw I see 0.32.xx and 0.32.xxx have this same issue.
ACKs for top commit: tcharding: utACK 000113045370d6dac13f8a91101bc31134278315 jamillambert: ACK 000113045370d6dac13f8a91101bc31134278315 apoelstra: ACK 000113045370d6dac13f8a91101bc31134278315; successfully ran local tests
This change fixes a GitHub Actions workflow that was checking out code from pull request forks and running a Rust metadata tool on it while holding a write-capable repository token. That combination is a known attack path (nicknamed 'pwn-request') where a malicious pull request could potentially steal or abuse the repository token. The patch removes the fork checkout entirely and instead generates labels from the repository's own master branch, closing the exposure. It is a defensive hardening fix rather than a fix for an already-exploited bug.
Security candidateci: gen PR labels from master instead of forkby satsfy (Renato Britto) · 00011304 · Aug 18, 2026 · 1 fileMessage 85 · StrongLow 47Details
Commit message · satsfy (Renato Britto)
ci: gen PR labels from master instead of fork
The labeler checked out the fork and ran cargo metadata on its manifests while holding the base repo token, a github actions security vulnerability called pwn request.
But we don't need the fork checkout to generate labels, this commit now does it from master.
85/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
This commit fixes a GitHub Actions workflow that was checking out code from a pull request's fork while holding a write-capable repository token. That setup is a known 'pwn request' attack pattern: a malicious fork could run code during the workflow and potentially steal or misuse the repository token. The fix removes the fork checkout and generates labels using only the trusted master branch, so untrusted code no longer runs with privileged credentials.
Security candidateMerge rust-bitcoin/rust-bitcoin#6752: build(deps): bump actions/checkout from 6.0.3 to 7.0.0by Andrew Poelstra · f8869644 · Aug 18, 2026 · 15 filesMessage 96 · StrongInformational 18Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6752: build(deps): bump actions/checkout from 6.0.3 to 7.0.0
2d138d732b791f7d1a7ef715794f5c2f4fad3b62 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (dependabot[bot])
Pull request description:
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li> <li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li> </ul> <p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK 2d138d732b791f7d1a7ef715794f5c2f4fad3b62; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege stateboot or update pathdocumentation-only discountautomated dependency-update discountmerge-commit duplicate discount
AI analysis · Informational 18/100
This commit is a routine update of the GitHub Actions checkout tool used by the project's automated testing and release pipelines. It does not change the Rust Bitcoin library code that users install. The new version of the checkout action includes a security hardening feature that blocks risky checkouts of pull requests from forks in certain workflow types, which is a defensive improvement rather than a vulnerability in the project itself.
Security candidateMerge rust-bitcoin/rust-bitcoin#6734: units: Prevent panic when parsing non-ASCII target and work hexby Andrew Poelstra · f4378f40 · Aug 15, 2026 · 2 filesMessage 91 · StrongModerate 62Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6734: units: Prevent panic when parsing non-ASCII target and work hex
bd7d8653c2600bf4cff6361823d67c5c6cab994f units: Prevent panic when parsing non-ASCII target and work hex (questfever)
Pull request description:
## Summary
Prevent `Target` and `Work` hex parsing from panicking on certain non-ASCII UTF-8 inputs.
Add a regression test verifying that invalid non-ASCII hex input is returned as an error.
## Details
The U256 hex parser uses `str::len()`, which returns the UTF-8 byte length, to calculate the boundary between its high and low halves:
```rust let high_len = s.len() - 32; let high_s = &s[..high_len]; let low_s = &s[high_len..]; ```
For an input such as:
`é0000000000000000000000000000000`
the string contains 32 characters but 33 bytes. This makes `high_len == 1`, which falls inside the two-byte UTF-8 encoding of `é`.
Slicing the string at that offset therefore panics.
This path is reachable through the public `Target::{from_hex, from_unprefixed_hex}` and `Work::{from_hex, from_unprefixed_hex}` APIs. Invalid hexadecimal input should produce an error rather than panic.
The parser now rejects non-ASCII input before splitting the string.
## Testing
- Added a regression test for the non-ASCII input above. - Ran cargo test -p bitcoin-units --all-features.
ACKs for top commit: apoelstra: ACK bd7d8653c2600bf4cff6361823d67c5c6cab994f; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlfuzzing or regression evidencemerge-commit duplicate discount
AI analysis · Moderate 62/100
This commit fixes a bug where certain unusual text inputs containing non-ASCII characters (like 'é') could crash the program when parsing Bitcoin 'Target' or 'Work' values from hexadecimal strings. The code was measuring string length in bytes instead of characters, so it could slice through the middle of a multi-byte character and panic. The fix rejects non-ASCII input before doing any byte-based slicing, turning a crash into a normal error.
919da441746bf220c011fe593bfaf80256071674 consensus_encoding: Bump version to 1.2.0 (Nick Johnson)
Pull request description:
Release the new lower level encoder/decoder driver interfaces. There should only be additions to the API in this release.
I have a [rust-psbt branch](https://git.rust-bitcoin.org/rust-bitcoin/rust-psbt/pulls/208) showing off the new interfaces end to end.
ACKs for top commit: tcharding: ACK 919da441746bf220c011fe593bfaf80256071674 apoelstra: ACK 919da441746bf220c011fe593bfaf80256071674; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Informational 15/100
This commit is a routine version bump for the bitcoin-consensus-encoding crate from 1.1.0 to 1.2.0. It only updates version numbers in lock files, the crate's Cargo.toml, and the changelog. There are no code changes, bug fixes, or security patches in the diff.
Security candidateMerge rust-bitcoin/rust-bitcoin#6711: primitives: Make `ScriptHash` and `WScriptHash` no-allocby Andrew Poelstra · fe0b3eb0 · Aug 12, 2026 · 5 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6711: primitives: Make `ScriptHash` and `WScriptHash` no-alloc
b2386c666d4b34bffb0c5b8f6a8da69663472595 Update API files (Mitchell Bagot) 4312fac4d6972b17c62f0f5c5675874091f5a93a primitives: Make ScriptHash and WScriptHash no-alloc (Mitchell Bagot)
Pull request description:
Currently, the entire primitives::script module is gated on the alloc feature. The ScriptHash and WScriptHash types as they are don't strictly require an allocator, and would permit most of the addresses crate to be no-alloc if they were available without the alloc feature.
Remove alloc feature gating for ScriptHash and WScriptHash by enabling a small script module with only them if the alloc feature is disabled.
ACKs for top commit: apoelstra: ACK b2386c666d4b34bffb0c5b8f6a8da69663472595; successfully ran local tests tcharding: ACK b2386c666d4b34bffb0c5b8f6a8da69663472595
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit is a routine feature-gating refactor. It makes two small hash types (ScriptHash and WScriptHash) available even when the library is compiled without an allocator. It does not change how those types behave, does not fix a bug, and does not alter any security-sensitive logic.
From the doc findings in https://github.com/rust-bitcoin/rust-bitcoin/pull/6651, there are only a handful (like, 2.5) of collection-based types in `consensus_encoding` which are tied to the higher level consensus codec `Encode`/`Decode` traits. These two patches expose the internals of the lower-level `Encoder`/`Decoder` traits which is a nice to have in rust-psbt where simple wrappers could then be defined for `PsbtEncode`/`PsbtDecode`.
## Encoding
I first tried to make some sort of `SliceEncoderWith` type following the pattern on the decoding-side, but this gets hairy due to the lifetimes present on the encoding-side. So I turned to `push_decode` and saw how Kixunil used an [iterator pattern there](https://github.com/Kixunil/push_decode/blob/master/src/encoders/iter.rs). I copied that over with a few tweaks and updated `SliceEncoder` to delegate to it.
One question I have here is that the new `IterEncoder` type defensively fuses the input iterator `let mut iter = iter.into_iter().fuse();`. I figure this is best practice, but it is useless for the existing `SliceEncoder` and there might be a performance hit?
The biggest change from `push_decode` is dropping the `I::Item: Into<E>, E: Encoder` bound and instead have an explicit type mapping, `Encoders`, for the type glue. This isn't a huge deal since not exposed to the caller, but it is what connects the `IterEncoder` logic to the existing `SliceEncoder`. But here are the details.
The little wrapper class in action:
```rust IterEncoder::new(Encoders::new(txs)) ```
vs. potentially the `Into` approach with a turbofish:
I think to avoid having to add some `From` impl manually to every existing encodable type, we would want some sort of blanket impl. As far as I can tell, the type system can't handle this because of the orphan rule. `From` is external *and* `<T as Encode>::Encoder<'e>` is uncovered, external. We could add a new trait, but that would have the same issues outside of `consensus_encoding`. Maybe I am missing a better pattern for this though.
The decoding side is simpler on paper since there are no lifetimes to worry about, but I ended up exposing two new types for necessary flexibility: `VecDecoderWith` and `ExactVecDecoderWith`. While the API expands, these all delegate to each other so I don't think a large maintenance burden.
I maintained the use of a `Default` bound like we have on our existing `Decoder` drivers. Recently convinced myself that this is fine: https://github.com/rust-bitcoin/rust-bitcoin/issues/6674.
ACKs for top commit: apoelstra: ACK 9d91a6a0bb1e44877e00a3db667ae8d8f1da2009; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundaryparser or protocol pathmerge-commit duplicate discount
AI analysis · Informational 18/100
This commit is a routine library refactor: it exposes lower-level building blocks for encoding and decoding lists of Bitcoin data, and rewrites existing list encoders/decoders to use those new building blocks. There is no direct security fix or vulnerability being patched. It is an API expansion and internal cleanup in the consensus_encoding crate.
Security candidateMerge rust-bitcoin/rust-bitcoin#6592: primitives: Update API testby Andrew Poelstra · 0969e567 · Aug 10, 2026 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6592: primitives: Update API test
dec8df68621fab7de6196c10f9324244511fe864 Derive Debug on Decoders struct (Mitchell Bagot) a3817e069687658ca3ff8333fbce888a08fc9cb7 Add Encoder struct (Mitchell Bagot) db25c0849cf09d629cab4ea29b10c4ac0f862c47 Add Copy struct for types with Copy (Mitchell Bagot) 57a2fac7573ab6f4b4b0a2c7614ef45859e09afd Extend Debug, Display and serde assertions (Mitchell Bagot) d12a0235501daca84b6c4e78c7727344771d38e9 Extend structs with new types (Mitchell Bagot) 5cb4b69081880a48599f41601d73bfa7b54006ac Add export tests for opcodes and witness_versions (Mitchell Bagot) 4706c5377403d014887b04ebda2ee233ff8afe2c Split locktime re-export test into absolute and relative (Mitchell Bagot) 1966cd470b989b59d70f7dbd16836ff508597bc8 Add new types to module export tests (Mitchell Bagot)
Pull request description:
The API test is intended to check that types in the crate implement various traits and are available to prevent regressions due to later changes. In practice, it hasn't been kept up to date as additions and changes have been made.
ACKs for top commit: apoelstra: ACK dec8df68621fab7de6196c10f9324244511fe864; successfully ran local tests tcharding: ACK dec8df68621fab7de6196c10f9324244511fe864
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit only updates an internal test file (primitives/tests/api.rs) that checks whether public types implement expected Rust traits and are exported correctly. It adds coverage for new types introduced in earlier development and reorganizes some existing tests. There is no change to production code, no bug fix, and no security-relevant behavior.
1c118339ac3d0d4445d2062d9b54e3dbc482b9af crypto: Bump version to 0.3.0 (Tobin C. Harding) b6d44ee8af9f388fc25989c2e9da73bdcf66fd1d primitives: Bump version to 0.103.1 (Tobin C. Harding) 9516435c7371c22e7a6f02b93f65a7231f41e123 primitives: Depend on encoding 1.1.0 (Tobin C. Harding)
Pull request description:
In preparation for release add a changelog entry, bump the version number, and update the lock files.
ACKs for top commit: apoelstra: ACK 1c118339ac3d0d4445d2062d9b54e3dbc482b9af; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit is a routine release-tracking merge. It only bumps version numbers (bitcoin-crypto to 0.3.0 and bitcoin-primitives to 0.103.1), updates dependency version requirements, refreshes lock files, and adds changelog entries. There are no code changes that fix or introduce security behavior.
The labeller runs in a separate workflow for security reasons, but this forces the `download-artifact` action to need an explicit token.
Here is a test end to end run on my remote: https://github.com/nyonson/rust-bitcoin/pull/5
ACKs for top commit: apoelstra: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756; successfully ran local tests; sure, whatever satsfy: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756 tcharding: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege statedocumentation-only discountmerge-commit duplicate discount
AI analysis · Informational 15/100
This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code, user-facing behavior, or introduce a security vulnerability.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.
Security candidateMerge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decodingby Andrew Poelstra · c5fd1832 · Aug 5, 2026 · 5 filesMessage 100 · StrongInformational 21Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding
b0eba4c097ca68da53abbbaf8603a5facd7c82bd Rename Error to DecodeCheckError (Mitchell Bagot) 7e6ab80baf795c9985d63c35d54b622ec59daa0a Add tests for decode_check_to_array (Mitchell Bagot) ae6ea3616fd6de3fb8cd976346d0b5d9a537abc7 base58: Add decode_check_to_array (Mitchell Bagot) 0a70c578514c3ecfedac508045397b627071e265 Split decode into build_base256 (Mitchell Bagot)
Pull request description:
At present, base58 has only encoding functionality in no-alloc builds. In order to allow decoding of known size data from base58 without an allocator, the base58 crate needs a decoder function like hex's decode_to_array. Such a function has more failure modes than the alloc decode_check function, so new error types are required also.
- Patch 1 splits the existing decode function into a private build_base256 function that writes to a provided scratch buffer. - Patch 1 introduces decode_check_to_array function for decoding short (<128 char) base58 strings to byte arrays, and associated error types. - Patch 2 adds tests to cover the new function. - Patch 3 renames Error to DecodeCheckError, retaining a deprecated type alias.
ACKs for top commit: tcharding: ACK b0eba4c097ca68da53abbbaf8603a5facd7c82bd apoelstra: ACK b0eba4c097ca68da53abbbaf8603a5facd7c82bd; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecated alias for backward compatibility. The changes are mostly refactoring and API expansion; there is no direct evidence of a security vulnerability being fixed.
Security candidateMerge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0by Andrew Poelstra · 0f68fcb3 · Aug 4, 2026 · 10 filesMessage 93 · StrongInformational 15Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0
8899dfd242cf418ee6ce3f05e5828e8579af9f3c release bitcoin_hashes 1.2.0 (Andrew Poelstra) 44552e3ad3035e1001b665bfd4dd3511042cd1f2 hashes: update API files (Andrew Poelstra) 7d8f06d256152a3de1ec9b54e3dd643271983f0d hashes: add several methods to sha256::Midstate for computing them in const contexts (Andrew Poelstra) dc21841b46abc39c49ed7075131f1ac46416137f hashes: add sha256::Midstate::SHA256_IV constant (Andrew Poelstra)
Pull request description:
Adds a new `Midstate::SHA256_IV` constant which allows you to construct a midstate equivalent to a new empty sha256 engine. Then adds `update` methods to `Midstate` which allow you to "ratchet forward" arbitrary midstates, 64 bytes at a time, by hashing the data. There is one fast method and two slow constfn methods.
The motivation is that in Elements we have many Merkle roots which are computed using sha256 midstates, which is safe to do because we're using domain-separated hashes and because our internal nodes are always hashes of exactly 64 bytes of data, which do not not need any length-suffixing. In rust-simplicity we have several such Merkle root types, many of which have a huge pile of precomputed constants, but whose constructors are forced to be non-`const`, which limits their use in generic contexts.
It's maybe a bit uncouth for me to just add some methods I need and cut a new release in a 1.x crate, but
* we have taken great pains to keep `hashes` out of other crates' public APIs, so its stability is not as paramount as it would be for encoding or units, say * all the new methods (and one constant) are on the `Midstate` type, which is a "don't touch this unless you are a cryptographer" part of the API and already has some ugly methods * the additions seem pretty reasonable to me, assuming you accept that we have a `Midstate` type at all; essentially they generalize the already-existing `hash_tag` method * I am BDFL of this project
ACKs for top commit: tcharding: ACK 8899dfd242cf418ee6ce3f05e5828e8579af9f3c
This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a security bug, fix, or vulnerability. The change expands the public API surface slightly, which is normal for a library release.
Security candidateci: fix labeller permissionsby Nick Johnson · 715f2bd6 · Aug 4, 2026 · 1 fileMessage 75 · AdequateInformational 12Details
Commit message · Nick Johnson
ci: fix labeller permissions
The labeller runs in a separate workflow for security reasons, but this forces the download-artifact actoin to need an explicit token.
75/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege statedocumentation-only discount
AI analysis · Informational 12/100
This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the repository for command-line GitHub operations. There is no change to the Rust Bitcoin library code that end users or applications depend on.
Security candidateMerge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3by Andrew Poelstra · f7d364cd · Aug 4, 2026 · 15 filesMessage 96 · StrongInformational 18Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3
ae935faddb52aa66087c2c148c8e33a7aaf1a662 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot])
Pull request description:
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824"><code>1cce339</code></a> Fix checkout init for SHA-256 repositories (<a href="https://redirect.github.com/actions/checkout/issues/2439">#2439</a>)</li> <li><a href="https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231"><code>900f221</code></a> fix: expand merge commit SHA regex and add SHA-256 test cases (<a href="https://redirect.github.com/actions/checkout/issues/2414">#2414</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98"><code>0c366fd</code></a> Update changelog (<a href="https://redirect.github.com/actions/checkout/issues/2357">#2357</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK ae935faddb52aa66087c2c148c8e33a7aaf1a662; successfully ran local tests satsfy: ACK ae935faddb52aa66087c2c148c8e33a7aaf1a662
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege stateboot or update pathdocumentation-only discountautomated dependency-update discountmerge-commit duplicate discount
AI analysis · Informational 18/100
This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-256 repositories and merge-commit handling, but the project does not treat this as a security fix. It is a standard maintenance change with very low direct security risk.
Security candidatebuild(deps): bump actions/checkout from 6.0.2 to 6.0.3by dependabot[bot] · ae935fad · Aug 3, 2026 · 15 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]
build(deps): bump actions/checkout from 6.0.2 to 6.0.3
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountautomated dependency-update discount
AI analysis · Informational 15/100
This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the action used to check out source code during CI/CD runs. There is no indication in the commit or supplied references that this fixes a security vulnerability or changes any behavior affecting the Rust Bitcoin library itself.
Security candidatebase58ck: Bump version to 0.5.0by Tobin C. Harding · 8479b56e · Aug 3, 2026 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding
base58ck: Bump version to 0.5.0
In preparation for release add a changelog entry, bump the version, and update the lock files.
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes, bug fixes, or security patches in this commit itself.
Security candidateRename Error to DecodeCheckErrorby Mitchell Bagot · b0eba4c0 · Aug 3, 2026 · 5 filesMessage 58 · ThinInformational 20Details
Commit message · Mitchell Bagot
Rename Error to DecodeCheckError
The Error type in base58 represents an error that can occur when decoding a base58check string. Since there now exists the DecodeCheckArrayError for errors that can occur when decoding in allocless builds, the main error type should also be renamed to clarify its exact use.
Rename Error to DecodeCheckError. Add deprecated type alias Error for DecodeCheckError.
This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no change to how data is decoded, validated, or handled, and no security bug is fixed.
Add a unit test for the new constant. Rename the internal-only function compute_midstate_unoptimized to update_midstate_unoptimized, and change call sites to call it with the new SHA256_IV constant.
This lets us "ratchet forward" arbitrary midstates in const contexts. The next commit will expose this general functionality in a correct way (by enforcing lengths). I would like this in rust-simplicity, so I can compute various Merkle roots in const contexts.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than always starting fresh. There is no security bug or fix here—just a code cleanup and API preparation for future const-context hashing features.
Security candidatehashes: add several methods to sha256::Midstate for computing them in const contextsby Andrew Poelstra · 7d8f06d2 · Jul 31, 2026 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · Andrew Poelstra
hashes: add several methods to sha256::Midstate for computing them in const contexts
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature addition with no obvious security bug, no fix of a vulnerability, and no disclosed security relevance.
taproot-primitives: Implement encoding traits for TapLeafHash
The TapLeafHash type in taproot-primitives, is consensus encoded in PSBT. As such, it needs to have encoding trait implementations.
Add encoder and decoder for TapLeafHash and implement Encode and Decode on the hash type.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Informational 17/100
This commit adds standard data-encoding support for a Bitcoin Taproot hash type (TapLeafHash) so it can be properly serialized and deserialized in PSBT data. There is no indication of a security bug being fixed; it appears to be a missing-feature addition.
The Address::from_script function relies on Params in the function signature. Since Params can't be moved to addresses or primitives, this function should be left behind in an extension trait for now.
Introduce AddressExt extension trait and move minimal functionality from Address into it.
73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 18/100
This commit is a routine code reorganization in the rust-bitcoin library. It moves the `Address::from_script` method out of the main `Address` type into a new 'extension trait' called `AddressExt`. The actual logic of the function is copied unchanged. This is a design change to resolve a dependency issue (the `Params` type cannot be moved into a lower-level crate), not a security fix.
