rust-bitcoin

Return 0 on Target::from_compact overflow

Currently, the Target::from_compact function treats a negative mantissa
as a failure mode and returns a Target value of zero. This lines up
with Core's SetCompact, which sets a pfNegative flag in the same case.
In Core, a pfOverflow flag is similarly set in overflow cases, and in
every case where a negative flag is treated as a failure, the overflow
is too. As such, our implementation should also return Target::ZERO in
the overflow case as it does for the negative case.

Return Target::ZERO for mantissa/exponent values which overflow in
Target::from_compact.

Clear pushnum cache on signature operations in sigop count

The `pushnum_cache` was not cleared when encountering a non-push
signature opcode like `OP_CHECKSIG`. This allowed stale push numbers
to leak into subsequent multisig operations if they weren't directly
preceded by a small int push.

Fix this by resetting the cache on signature opcodes, aligning the
sigop calculation with Bitcoin Core consensus logic.

Move from_key_and_merkle_root back to taproot-primitives

Contrary to the prior reasoning, this function is necessary for
TapTweak to be moved to taproot-primitives. Since TapTweak needs to
move to taproot-primitives for the sake of addresses, this will need
to be moved back to taproot-primitives.

Remove TapTweakHashExt and move from_key_and_merkle_root back to the
base type in taproot-primitives.

refactor: split bip32 path parse errors

refactor: split bip32 derivation errors

Replace impl_to_hex_from_lower_hex with deprecated inherent to_hex

The impl_to_hex_from_lower_hex macro from internals implements a to_hex
function for a type by calling through to an existing LowerHex impl.
This has been something that we've wanted to remove for a while, so
a first step involves deprecating the macro and removing all uses.

Replace impl_to_hex_from_lower_hex with deprecated inherent to_hex on
all types.

Move impl_array_newtype to include/array_newtype.rs

The array_newtype.rs include file has been used for bitcoin's
previously internal macro impl_array_newtype_stringify. Since the name
lends itself to dual usage with the impl_array_newtype macro, and the
two may be used together, the macro can be copied from internals to
this include file.

Move impl_array_newtype macro to include/array_newtype.rs. Deprecate in
internals and replace uses with include! copy.

Add regression test for from_base64 bug

To prevent changes to the from_base64 function reintroducing the non-65
byte invalid behaviour, a regression test should be added to catch any
changes.

Introduce regression test for
sign_message::MessageSignature::from_base64.

Use write! in UnknownAddressTypeError display

The write_err! macro is intended to provide source information for
errors in no_std environments. Where an error type does not have a
source, the write! macro should be used instead.
For UnknownAddressTypeError specifically, the use of write_err! causes
a stack overflow as it recurses infinitely to attempt to display self
as the source in write_err! in no_std builds.

Replace use of write_err! with write! in UnknownAddressTypeError
Display impl.

2026-06-14 automated rustfmt nightly

Add #[inline] to all trivial functions in crypto

All functions that are relatively trivial should be annotated with the
inline attribute to hint to the compiler to optimise them by inlining.

Add #[inline] to all small/trivial functions in crypto.

primitives: Simplify and optimize witness decoder

The current logic for the index space in witness decoder lets an
attacker allocate a claimed size without giving any input, which opens
the door to many DoS attacks, some of which we already handle.

But the current code still lets an attacker force a 16 MB allocation
with ~10 bytes of input.

The new logic pushes bytes blindly into `content` without building the
index space in `push_bytes()`, then in `end()` walks through `content`
to build the index space.

This simplifies the code, gives an important speedup, and avoids:

- the 16 MB up-front allocation we currently have for the index space
- `reserve_batch()` is no longer needed, along with the
`MIN_` and `MAX_VECTOR_ALLOCATE` constants

- we can drop the `cursor` field from the decoder
- the DoS vector where an attacker sends a few bytes to force a large
allocation, since the buffer only grows by the bytes actually received

network: Bump version to 1.0.0

In preparation for release add a changelog entry, bump the version
number, update local downstream crates, and update the lock files.

Move serde_round_trip macro to bip32

The serde_round_trip macro from internals is only used in the bip32
module for testing. Rather than pulling it in from internals, it should
instead be defined in-line in the tests module.

Move serde_round_trip macro to bip32. Add bincode dev dependency to
key_expression.

Remove Verification re-exports

These re-exports exist from the days when secp required an explicit
context for cryptographic operations. With the introduction of the
global context in recent secp versions, they are no longer needed.

Remove Verification re-exports from key modules.

Replace usage of secp256k1::Error with new error in ecdsa

The ecdsa::InvalidDerError can be used both in the key verify
functions but also to replace the Secp256k1 variant in DecodeError.

Replace DecodeError::Secp256k1 variant with InvalidDer.

crypto: Remove all From impls for error types

Aside from From<Infallible>, error types should not have any From
impls but should instead make use of map_err. This ensures greater
future flexibility for changes to the error types moving forward.

Remove From<InvalidSighashTypeError> for SigFromSliceError from
taproot.

Replace usage of secp256k1::Error with new errors in key

As part of the goal of providing more precise error types, the new
error types should be used for the from_bytes, from_secret_bytes and
verify functions on the key types. This also requires replacement of
the various Secp256k1 variants in enum error types.

Replace Secp256k1 error variants with specific error types and
replace error return types with specific types for from_bytes,
from_secret_bytes and verify functions.

Remove Secp256k1 variant from taproot SigFromSliceError

The Secp256k1 variant of the SigFromSliceError is no longer needed.
The secp parsing of the signature is now infallible, meaning there
cannot be a secp error during parsing of a signature from a slice.

Remove Secp256k1 error variant from taproot::SigFromSliceError.

Introduce errors for byte parsing and verification

At present, the from_bytes, from_secret_bytes and verify methods on
the key types all return secp256k1::Error. In all of these methods,
only a single variant of that error type is returned. To both hide
the secp type, and to provide the possibility for more meaningful
error values, new error types should be introduced.

Add FromSecretBytesError, InvalidPublicKeyError and VerifyError to
key errors.
Add InvalidDerError error type to ecdsa error submodule.

taproot: Remove From<&Signature> for SerializedSignature

The From<&'a Signature> for SerializedSignature impl functions by
derefing the signature and then serializing it. The presence of the
trait implies that SerializedSignature is some sort of reference to
the signature, when it is instead a type owning its own data.

Remove From<&Signature> impl from taproot::SerializedSignature.

Bump key-expression crate version

With the bip32 module moved, the key-expression crate should now have
a new version release before the next bitcoin release.

Bump key-expression version number to 0.1.0.
Update changelog.
Adjust bitcoin manifest to match new version number.
Update lock files.

Add From<Infallible> to sighash errors

In order to facilitate use in generics, all error types should have a
From<Infallible> implementation.

Add From<Infallible> to all sighash error types.

Make sighash error fields private

The sighash error types in crypto currently all have pub fields. This
prevents any future changes to their structure after a 1.0 and is not
required for any functionality.

Make all inner fields in sighash errors pub(super) or pub(crate).

Fixup changelog links and follow new policy

* Fixup off-by-one error in `bitcoin` links.
* bip158 does not have any tags yet.
* Not adding links for 0.32.x tags, the diff compare gets a little
wonky as the branch drifts further from master.
* `internals` and `units` have some inconsistent tag formatting.

Drop all links which are not helpful compares. Links to a single tag
are not all the helpful and niether is comparing to the beginning of time.