RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
148commits · 30 days
304commits · 60 days
1150commits · 180 days
2055commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 4 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateci: update cargo-rbmt ever month instead of weekby Nick Johnson · 778018e1 · Jul 27, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · Nick Johnson

ci: update cargo-rbmt ever month instead of week

The week updates have been too noisy with the rbmt churn, hoping the
monthly schedule gives us a poke if we fall behind, but isn't noisy.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit simply renames a GitHub Actions workflow file and changes its schedule from weekly to monthly. It is a routine CI maintenance change with no security relevance.

Security candidateci: disable fail-fast in weekly toolchain update matrixby satsfy (Renato Britto) · d9fef884 · Jul 26, 2026 · 2 filesMessage 77 · AdequateInformational 15Details
Commit message · satsfy (Renato Britto)

ci: disable fail-fast in weekly toolchain update matrix

A broken 0.32.xxx job takes the master and 0.32.xx updates down with
it. Let each branch succeed or fail on its own.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit changes two GitHub Actions workflow files so that if one branch's automated toolchain update job fails, the other branches' jobs keep running instead of all being cancelled. It is a pure CI reliability/configuration tweak with no product code changes and no security relevance.

Security candidatecrypto: Bump version to 0.3.0by Tobin C. Harding · 1c118339 · Jul 22, 2026 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

crypto: Bump version to 0.3.0

In preparation for release add a changelog entry, bump the version
number, and update the lock files.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine release preparation: it bumps the version number of the `bitcoin-crypto` crate from 0.2.0 to 0.3.0, updates the changelog, and adjusts dependency references in related crates' configuration files and lock files. There are no code changes, bug fixes, or security patches in the diff.

Security candidateprimitives: Bump version to 0.103.0by Tobin C. Harding · 5612224d · Jul 17, 2026 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

primitives: Bump version to 0.103.0

In preparation for release add a changelog entry, bump the version,
and update the lock files.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine release preparation: it bumps the version number of the `bitcoin-primitives` crate from 0.102.0 to 0.103.0, updates related dependency declarations in other crates, refreshes lock files, and adds a changelog entry. There are no code logic changes and no security fix or vulnerability introduced in the diff itself.

Security candidateci: upgrade to cargo-rbmt 0.5.3by satsfy (Renato Britto) · 5c865aa6 · Jul 16, 2026 · 10 filesMessage 80 · StrongInformational 15Details
Commit message · satsfy (Renato Britto)

ci: upgrade to cargo-rbmt 0.5.3

Pin the rbmt version in Cargo.toml workspace metadata and install it
from crates.io, replacing the rbmt-version file. The weekly cron jobs
get rbmt through the setup-rbmt action.

The api task does an internal diff check, comparing the public API
against previous commit or PR base branch, failing on any diff for
review.

docsrs was merged into docs upstream, so the matrix keeps a single docs
task which now builds with the docs.rs configuration.

Drop ensure-maintainer-tools.sh, cargo-rbmt handles toolchain
setup itself now.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a routine update to the project's internal continuous-integration tooling. It changes how a helper tool called cargo-rbmt is installed and where its version is recorded, but it does not modify the actual Bitcoin library code or any user-facing behavior. There is no security issue visible in this change.

Security candidatehashes: bump version to 1.1.0by Nick Johnson · bf3f25f4 · Jul 15, 2026 · 9 filesMessage 45 · ThinInformational 15Details
Commit message · Nick Johnson

hashes: bump version to 1.1.0

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine version bump for the bitcoin_hashes crate from 1.0.0 to 1.1.0. It updates dependency references across the workspace, records the release in the changelog, and adjusts deprecation lint allowances in tests. There is no security-relevant code change.

Security candidaterefactor(bip32): Xpub child tweak apiby Trevor Arjeski · 37191717 · Jul 13, 2026 · 1 fileMessage 80 · StrongInformational 17Details
Commit message · Trevor Arjeski

refactor(bip32): Xpub child tweak api

- Replace ckd_pub_tweak with derive_child_tweak returning XpubChildTweak.
- Remove Xpub::ckd_pub_tweak. Users must use Xpub::derive_child_tweak
and XpubChildTweak instead.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Informational 17/100

This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual cryptographic math and behavior remain the same; only the way callers receive the result has changed. There is no indication this fixes a security bug.

Security candidaterefactor(bip32): rename Xpub and Xpriv derivation methodsby Trevor Arjeski · f8f053fd · Jul 13, 2026 · 2 filesMessage 85 · StrongInformational 18Details
Commit message · Trevor Arjeski

refactor(bip32): rename Xpub and Xpriv derivation methods

- Rename the xpriv and xpub derivation APIs to derive_child and derive_path
- Remove derive_priv, derive_xpriv, derive_pub, derive_xpub, and
ckd_pub. Callers should now use derive_child for single ChildNumber
derivation and derive_path for path derivation.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Informational 18/100

This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability introduced; it is purely a refactoring that may require downstream developers to update their code.

Security candidatebuild(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1by dependabot[bot] · 21337179 · Jul 13, 2026 · 5 filesMessage 93 · StrongInformational 19Details
Commit message · dependabot[bot]

build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.8 to 8.1.1.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d32b9829c1cb33d45e...5f6978faf089d4d20b00c7766989d076bb2fc7f1)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 8.1.1
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountautomated dependency-update discount
AI analysis · Informational 19/100

This is a routine Dependabot update that bumps a GitHub Actions helper used by automated weekly maintenance workflows to create pull requests. The change only affects internal tooling, not the Rust Bitcoin library code that users rely on. There is no direct evidence of a security vulnerability being fixed or introduced, but any third-party action update carries a small supply-chain risk if the new version were malicious or buggy.

Security candidateinternals: Bump version to 0.6.0by Tobin C. Harding · aed7a9ce · Jul 13, 2026 · 16 filesMessage 60 · AdequateInformational 15Details
Commit message · Tobin C. Harding

internals: Bump version to 0.6.0

In preparation for release add a changelog, bump the version, and
update the lock files.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine version bump for the internal 'bitcoin-internals' crate from 0.5.0 to 0.6.0. It updates version numbers across package manifests and lock files, and adds a changelog describing API cleanups and small improvements. There is no code change that fixes a security bug or introduces a vulnerability.

Security candidateci: update LTS branches for toolchain and kani cronsby Nick Johnson · 183197ab · Jul 10, 2026 · 3 filesMessage 62 · AdequateInformational 15Details
Commit message · Nick Johnson

ci: update LTS branches for toolchain and kani crons

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit only changes three GitHub Actions workflow files that control scheduled CI jobs. It updates the list of long-term support (LTS) branches used by automated cron jobs, replacing one branch name with two placeholder-looking names ('0.32.xxx' and '0.32.xx'). There are no changes to the Rust Bitcoin library code, no bug fixes, and no security-related modifications.

Security candidateRemove hex dep from internalsby Tobin C. Harding · bd0d4bc0 · Jul 9, 2026 · 8 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Remove hex dep from internals

The `hex` dep is no longer used in `internals` (since #6339).

Remove it.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit simply removes an unused software dependency (the hex-conservative crate) from the internals sub-package and updates related package configuration files. It is a routine cleanup change with no security relevance.

Security candidatedocs: root readme cleanupby Nick Johnson · efeab943 · Jul 8, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Nick Johnson

docs: root readme cleanup

* PSBT has moved to the rust-psbt crate.
* The CI badges are not helpful when viewed from things like crates.io,
we have detection jobs now for maintainers for stuff like kani.
* Update deprecated library json rpc library.
* Update changelog links to work from anywhere. Also add missing crates.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing boundarydocumentation-only discount
AI analysis · Informational 15/100

This commit only edits the project's README.md file. It removes outdated CI badges, updates the recommended JSON-RPC client library, fixes changelog links, and adds missing crates to the changelog list. No code, build scripts, or cryptographic logic was changed, so it has no direct security impact on users of the library.

Security candidateReplace external uses of base58 encoding with Base58CkStringby Mitchell Bagot · 7f5fbd13 · Jul 8, 2026 · 3 filesMessage 73 · AdequateInformational 17Details
Commit message · Mitchell Bagot

Replace external uses of base58 encoding with Base58CkString

Before the old encoding functions can be removed, all uses from outside
the crate need to be replaced with the equivalent calls from the new
Base58CkString type.

Replace all uses of encode_check and encode_check_to_fmt with equivalent
Base58CkString uses.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 17/100

This commit is a routine internal code cleanup in the rust-bitcoin project. It swaps old base58 encoding helper functions for a new equivalent type, Base58CkString, in three source files. There is no indication from the commit itself that this fixes a security bug; it appears to be part of a refactoring to remove deprecated functions.

Security candidateAdd try_push to Buffer traitby Mitchell Bagot · aafb6065 · Jul 8, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Add try_push to Buffer trait

As part of the introduction of no-alloc encoding, the Buffer trait will
need a push function that can fail gracefully when it overflows. The
simplest solution is to introduce a try_push function that is infallible
for Vec and calls through to try_push on ArrayVec.

Add try_push function to Buffer trait.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
memory safety
AI analysis · Informational 15/100

This commit adds a new `try_push` method to an internal `Buffer` trait used during Base58 encoding. It is a straightforward, additive change that lets encoding code gracefully handle a full fixed-size buffer in no-allocation builds. There is no bug fix, no behavior change to existing code paths, and no security issue visible in the diff.

Security candidatebuild(deps): bump actions/checkout from 5.0.0 to 6.0.2by dependabot[bot] · 14a75c38 · Jul 6, 2026 · 16 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/checkout from 5.0.0 to 6.0.2

Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathdocumentation-only discountautomated dependency-update discount
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the version of the GitHub Actions 'checkout' tool used by the project's CI workflows from version 5.0.0 to version 6.0.2. It only affects how the repository code is downloaded during automated testing and release tasks. There is no indication of a security vulnerability being fixed or introduced, and no project source code is changed.

Security candidateconsensus_encoding: Rename _with decoder functionsby Mitchell Bagot · 12325a67 · Jul 6, 2026 · 4 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

consensus_encoding: Rename _with decoder functions

The _with decoder functions are generic on Decoder instead of Decode,
which allows them to decode ad-hoc decoder types, rather than requiring
a type with Decode. However, the _with suffix is already used for
decode_from_read_unbuffered_with, in which it has a different meaning.
For the sake of consistency, the _with function suffix should instead
be with_decoder.

Rename _with decoder functions to use _with_decoder suffix instead.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive pathparser or protocol path
AI analysis · Informational 15/100

This commit is a simple renaming of internal Rust functions from names ending in '_with' to names ending in '_with_decoder'. It does not change what the code does, only what the functions are called, to avoid confusion with another function that already uses '_with' differently. There is no security issue here.

Security candidateMove ScriptPubKeyBufExt to addressesby Mitchell Bagot · ed00d91a · Jul 6, 2026 · 2 filesMessage 63 · AdequateInformational 17Details
Commit message · Mitchell Bagot

Move ScriptPubKeyBufExt to addresses

The new_p2pkh function is necessary to implement the script_pubkey
function on Address. Since the function signature includes a hash type
from crypto, it can't be moved to primitives yet. Instead, we can move
the extension trait to addresses where it can be used, and re-export
the trait in bitcoin to retain the same API.

Move ScriptPubKeyBufExt to addresses, Adjust new_p2pk function impl to
remove use of Builder::push_key.

63/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 17/100

This commit is a routine internal code reorganization in the rust-bitcoin library. It moves a helper trait (ScriptPubKeyBufExt) and its functions from one internal module to another, and re-exports it so existing users see no change. There is no indication this fixes a security bug or introduces a vulnerability.

Security candidatehashes: Deprecate sha256t_tag macroby jrakibi · ac921e97 · Jul 5, 2026 · 3 filesMessage 50 · ThinInformational 16Details
Commit message · jrakibi

hashes: Deprecate sha256t_tag macro

Deprecate the macro in favor of implementing sha256t::Tag by hand

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 16/100

This is a routine code-maintenance change: the developers are marking an old helper macro as deprecated and telling users how to write the same code by hand. There is no bug fix, no security patch, and no vulnerability being addressed in the commit itself.

Security candidate2026-07-05 automated rustfmt nightlyby Fmt Bot · 673e5ee4 · Jul 5, 2026 · 5 filesMessage 45 · ThinInformational 15Details
Commit message · Fmt Bot

2026-07-05 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a routine automated code-formatting run by the rustfmt tool. It only changes whitespace, import order, and line breaks in five files. There are no functional changes, no bug fixes, and no security-related modifications.

Security candidatehashes: implement sha256t::Tag without the macroby jrakibi · 0131814d · Jul 4, 2026 · 3 filesMessage 68 · AdequateInformational 15Details
Commit message · jrakibi

hashes: implement sha256t::Tag without the macro

Midstate::hash_tag is a const fn, so a tag can be defined by hand with
a sha256t::Tag impl without using the macro. The macro dates to a time
before sha256 could be computed in a const context (constfns make it
unnecessary now)

Migrate the tag definitions off the macro:
- taproot-primitives: TapLeafTag, TapBranchTag, TapTweakTag
- bitcoin: TapSighashTag

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup in the rust-bitcoin library. It replaces a macro used to define SHA-256 tagged hash identifiers with direct Rust code that does the same thing. The actual hash values and behavior are unchanged; only the internal implementation style is different.

Security candidateci: adapt default and no feature bip32 test for rbmt 0.4.0by satsfy (Renato Britto) · 5f933d5c · Jul 3, 2026 · 1 fileMessage 95 · StrongInformational 15Details
Commit message · satsfy (Renato Britto)

ci: adapt default and no feature bip32 test for rbmt 0.4.0

Rbmt 0.4.0 changes how the example test matrix parses feature specs. The
sentinel for no default features was removed (bare name now means no default
features). The config relied on the old meaning that bip32 ran with default
features and 'bip32:-' ran with no features.

Translate both to the new syntax so the same two runs are preserved: 'bip32'
(no features) and 'bip32:std secp-recovery' (default feature set).

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
secret or key material
AI analysis · Informational 15/100

This is a routine update to the project's automated testing configuration. A tool used to run example tests changed its syntax, so the developer updated one line to keep the same tests running the same way. There is no user-facing change and no security relevance.

Security candidateReplace uses of encode_to_engine with encode_to_hashby Mitchell Bagot · f40e1879 · Jul 2, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Replace uses of encode_to_engine with encode_to_hash

There are a couple of uses of encode_to_engine that follow the trivial
pattern and can be replaced with encode_to_hash.

Replace appropriate uses of encode_to_engine in sighash and primitives
with encode_to_hash to simplify the code.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This is a small internal code cleanup in the rust-bitcoin library. It replaces a slightly longer two-step hashing pattern with a shorter helper function that does the same thing. The actual cryptographic results and behavior are unchanged.

Security candidateExtend update toolchains to LTS branchesby Nick Johnson · 11f42a41 · Jul 1, 2026 · 2 filesMessage 45 · ThinInformational 15Details
Commit message · Nick Johnson

Extend update toolchains to LTS branches

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit changes two GitHub workflow files so that an automated bot updates the Rust compiler toolchain on both the master branch and a long-term support branch (0.32.x), instead of only on master. It is a routine CI/CD maintenance change with no security relevance.

Security candidateAdd {Lower,Upper}Hex to ecdsa::Signatureby Mitchell Bagot · 69540f98 · Jul 1, 2026 · 1 fileMessage 83 · StrongInformational 20Details
Commit message · Mitchell Bagot

Add {Lower,Upper}Hex to ecdsa::Signature

The Taproot Signature type has Debug, Display, LowerHex and UpperHex
impls. The ECDSA signature, by contrast, only has Debug and Display.
Since the Display impl already displays a lowercase hex format,
explicit lower and uppercase hex formatting should be added and the
Display impl modified to call through to LowerHex.

Add LowerHex and UpperHex impls and modify Display to call through to
LowerHex in ecdsa::Signature.
Add tests to verify new behaviour.

83/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarycryptography-sensitive path
AI analysis · Informational 20/100

This commit adds new ways to print ECDSA Bitcoin signatures as hexadecimal text (lowercase and uppercase), matching formatting already available for Taproot signatures. It also makes the existing Display implementation reuse the new LowerHex implementation. There is no security fix or behavior change that affects signatures themselves—only how they look when formatted as text.