rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal

Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses

149commits · 30 days

304commits · 60 days

1150commits · 180 days

2055commits · 365 days

Backfill bands

Aug 5 → Feb 6787 seen32 candidatesComplete

Feb 6 → Jun 6878 seen53 candidatesComplete

Jun 6 → Jul 6211 seen15 candidatesComplete

Jul 6 → Aug 5184 seen2 candidatesComplete

Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity

489Strong · 80–100

1083Adequate · 60–79

566Thin · 40–59

151Opaque · 0–39

20security candidates with opaque commit messaging

Read the scoring rubric →

Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.

Mitchell Bagot649193645068

Andrew Poelstra21072145089

Tobin C. Harding41566410063

jrakibi944994068

Nick Johnson19121190060

Jamil Lambert, PhD11919116061

satsfy (Renato Britto)381527066

Fmt Bot331431045

Trevor Arjeski111111069

Shing Him Ng31731056

Ismail Daif22622050

Martin Habovstiak28527069

Analysis record

Published AI watches

Last scanned 1 hour, 2 minutes ago

Informational 15 AI analysisMessage 96 · Strong

2 days, 9 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

4ed7c068by Andrew Poelstra+1−11 file

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 96 · Strong

2 days, 13 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 100 · Strong

2 days, 18 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced

67600795by Andrew Poelstra+2−22 files

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 96 · Strong

2 days, 19 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 91 · Strong

3 days, 1 hour ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files

No security note in commit

Open full analysis →Source commit ↗

Informational 20 AI analysisMessage 100 · Strong

3 days, 3 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report

1a365d53by Andrew Poelstra+129−1068 files

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 88 · Strong

3 days, 5 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

a31e0b0eby dependabot[bot]+8−84 files

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 93 · Strong

3 days, 5 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 93 · Strong

3 days, 5 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

7d7e7269by dependabot[bot]+2−22 files

No security note in commit

Open full analysis →Source commit ↗

Informational 21 AI analysisMessage 100 · Strong

3 days, 16 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue

457cb9b5by Andrew Poelstra+14−146 files

No security note in commit

Open full analysis →Source commit ↗

Informational 18 AI analysisMessage 96 · Strong

4 days, 6 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files

No security note in commit

Open full analysis →Source commit ↗

Low 35 AI analysisMessage 91 · Strong

4 days, 10 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs

f9460859by Andrew Poelstra+266−12211 files

No security note in commit

Open full analysis →Source commit ↗

Low 49 AI analysisMessage 96 · Strong

5 days, 10 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling

5324e59aby Andrew Poelstra+26−41 file

No security note in commit

Open full analysis →Source commit ↗

Low 37 AI analysisMessage 91 · Strong

5 days, 18 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)

5f5f666dby Andrew Poelstra+51−1849 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Low 37 AI analysisMessage 91 · Strong

6 days, 1 hour ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix

22bbc326by Andrew Poelstra+19−13 files

No security note in commit

Open full analysis →Source commit ↗

Low 37 AI analysisMessage 73 · Adequate

6 days, 4 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths

914365b4by Nick Johnson+19−13 files

No security note in commit

Open full analysis →Source commit ↗

Informational 18 AI analysisMessage 91 · Strong

6 days, 8 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams

81032b1aby Andrew Poelstra+208−16414 files

No security note in commit

Open full analysis →Source commit ↗

Low 38 AI analysisMessage 100 · Strong

6 days, 19 hours ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`

4af1ee1dby Andrew Poelstra+23−191 file

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 100 · Strong

1 week ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files

No security note in commit

Open full analysis →Source commit ↗

Moderate 62 AI analysisMessage 91 · Strong

1 week ago

RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX

9caad2c1by Andrew Poelstra+23−52 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0by Andrew Poelstra · 4ed7c068 · Sep 21, 2026 · 1 fileMessage 96 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

f6c31cbd78e1142d2454ec3fe7979b755c56e12e build(deps): bump actions/labeler from 6.2.0 to 7.0.0 (dependabot[bot])

Pull request description:

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.2.0 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/labeler/releases">actions/labeler's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Migrate to ESM and update dependencies by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/949">actions/labeler#949</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/labeler/compare/v6...v7.0.0">https://github.com/actions/labeler/compare/v6...v7.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/labeler/commit/bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13"><code>bf12e9b</code></a> feat: migrate to ESM and update dependencies (<a href="https://redirect.github.com/actions/labeler/issues/949">#949</a>)</li>
<li>See full diff in <a href="https://github.com/actions/labeler/compare/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/labeler&package-manager=github_actions&previous-version=6.2.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

ACKs for top commit:
apoelstra:
ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e; successfully ran local tests
satsfy:
ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e

Tree-SHA512: c01e93f62f62f0053adf8d6356c4b4766e12f338d8886004cdf4817e74362717807bee30b26b63bf39f1ad59b7586b628631e739606534e11e6215d4dccbf7c1

96/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly

Why it was queued

documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability. The change only affects internal project workflow automation and does not touch the rust-bitcoin library code that users install.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0by Andrew Poelstra · 67600795 · Sep 21, 2026 · 2 filesMessage 100 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

7d7e7269e50df6412aab796fd67b59abc94cc4ba build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (dependabot[bot])

Pull request description:

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p>
<blockquote>
<h2>v9.0.0 🌈 Change <code>prune-cache</code> default to <code>false</code></h2>
<h2>Changes</h2>
<p>This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a></p>
<p>Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.</p>
<h2>🚨 Breaking changes</h2>
<ul>
<li>Change <code>prune-cache</code> default to <code>false</code> <a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li>
</ul>
<h2>🐛 Bug fixes</h2>
<ul>
<li>fix: fall back to distribution ID when os-release has no version field <a href="https://github.com/cxzhong"><code>@cxzhong</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li>
</ul>
<h2>🚀 Enhancements</h2>
<ul>
<li>Speed up version client by partial response reads <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li>
</ul>
<h2>🧰 Maintenance</h2>
<ul>
<li>chore: update known checksums for 0.11.30 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li>
<li>chore: update known checksums for 0.11.29 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li>
</ul>
<h2>📚 Documentation</h2>
<ul>
<li>docs: update version references to v8.3.2 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li>
</ul>
<h2>⬆️ Dependency updates</h2>
<ul>
<li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li>
<li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/astral-sh/setup-uv/commit/c771a70e6277c0a99b617c7a806ffedaca235ff9"><code>c771a70</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/2f537ca87c1ffa233ca2a1b84815388e3e42d845"><code>2f537ca</code></a> chore: update known checksums for 0.11.30 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/2269552d547df6f50e57442326930d30d943afe3"><code>2269552</code></a> Speed up version client by partial response reads (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/47a7f4fb2e900d6c33a5b5f231fa21dbfaeba52f"><code>47a7f4f</code></a> Change <code>prune-cache</code> default to <code>false</code> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/71966eff34a27b0a62ed4b9f6f6e383e071b1bb5"><code>71966ef</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/f12b1f0a84bd6dc2331b36b2bbdbb1d1e617dbcc"><code>f12b1f0</code></a> fix: fall back to distribution ID when os-release has no version field (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84"><code>ecd24dd</code></a> chore: update known checksums for 0.11.29 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/6a191366842ac1502ba6c07e9b5acd5c2d9d8db3"><code>6a19136</code></a> docs: update version references to v8.3.2 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li>
<li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/setup-uv&package-manager=github_actions&previous-version=8.3.2&new-version=9.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

ACKs for top commit:
apoelstra:
ACK 7d7e7269e50df6412aab796fd67b59abc94cc4ba; successfully ran local tests

Tree-SHA512: 0618eec83ba5925b0fdcb30e6ec5dee7fa1763bca5e1b84b663683342b2c5307c5b8e93f35cac39d9e8b93edd3a726733e2b1aa798c0107a249a728d154c79da

100/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly

Why it was queued

documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mention no security fixes; the only breaking change is that cache pruning is now disabled by default, which can increase GitHub Actions cache usage and cost. There is no evidence this affects the security of the rust-bitcoin library or its build outputs.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74deby Andrew Poelstra · 90330d15 · Sep 21, 2026 · 4 filesMessage 91 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

a31e0b0e89778bbbd3d60ebc61c66c99b575a317 build(deps): bump dtolnay/rust-toolchain (dependabot[bot])

Pull request description:

Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de.
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/02cb101ec7c40f2c49e1d9714d64511d8e1b74de"><code>02cb101</code></a> Merge pull request 185 from fufesou/feat/force-non-host</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/b38a663c5df0fd5ac7bb65ded7b02a3f7af3b636"><code>b38a663</code></a> Pass --force-non-host unconditionally</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/a4f61a09a512763ecbf6a72db0464f906f59f011"><code>a4f61a0</code></a> Document rustup non-host opt-in requirement</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/06b350f08c8596edaf3d95d38686ba934fc4a6a7"><code>06b350f</code></a> Support force-non-host toolchains</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/d1031067263f94b142dd6c0ce24c5eb9d02d52a0"><code>d103106</code></a> Predefine branches up to 1.120</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/3ea7b2dde9987cecfa88322de1f09983972fc8e9"><code>3ea7b2d</code></a> Add 1.98.1 patch release</li>
<li>See full diff in <a href="https://github.com/dtolnay/rust-toolchain/compare/6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772...02cb101ec7c40f2c49e1d9714d64511d8e1b74de">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

ACKs for top commit:
apoelstra:
ACK a31e0b0e89778bbbd3d60ebc61c66c99b575a317; successfully ran local tests

Tree-SHA512: 526c648af02ba919dcd53aac0d930303bd8e344360e703ad04f099a2948a933f107333f7a01d0d6f0a12668568a4abbf393c0c9c2c5bdc35543b04e62b3d185c

91/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

AI review queuedbuild(deps): bump dtolnay/rust-toolchainby dependabot[bot] · a31e0b0e · Sep 20, 2026 · 4 filesMessage 88 · StrongInformational 15Details

Commit message · dependabot[bot]

build(deps): bump dtolnay/rust-toolchain

Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de.
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](https://github.com/dtolnay/rust-toolchain/compare/6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772...02cb101ec7c40f2c49e1d9714d64511d8e1b74de)

---
updated-dependencies:
- dependency-name: dtolnay/rust-toolchain
dependency-version: 02cb101ec7c40f2c49e1d9714d64511d8e1b74de
dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

88/100 · StrongMessage clarity

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

Why it was queued

documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it does not change any library code, cryptographic logic, or user-facing behavior of the rust-bitcoin crate itself. There is no indication of a security issue in the diff.

AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 2cac6e38 · Sep 20, 2026 · 1 fileMessage 93 · StrongInformational 15Details

Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

Why it was queued

documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

AI review queuedbuild(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0by dependabot[bot] · 7d7e7269 · Sep 20, 2026 · 2 filesMessage 93 · StrongInformational 15Details

Commit message · dependabot[bot]

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 9.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the workflow still uses it only to install and run the zizmor security scanner. There is no indication in the commit of any security bug, malicious change, or vulnerability being fixed or introduced.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6061: Units improvementsby Andrew Poelstra · f9460859 · Sep 19, 2026 · 11 filesMessage 91 · StrongLow 35Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

a002978d05f88a0864bcb07ed3711999ab92dc22 Improve error messages of `serde` errors (Martin Habovstiak)
30f7aba5ab61a27ab017cfd6dce93751338adb69 Add `FeeRate::from_sat_per_{vb,kvb,kwu}` methods (Martin Habovstiak)
fc1bed37e0bdc3d19b78f26fca0238ea72d939a2 Rename `u32`-taking `FeeRate::from_sat_per_*` (Martin Habovstiak)
861a8d609514423771e96e362b8ed345b27bb7c3 Deduplicate `FeeRate` constants in tests (Martin Habovstiak)
e4e124e87aee47ed637b87932dcddf7a6867c5d4 Remove artificial restriction from `from_per_vb` (Martin Habovstiak)

Pull request description:

This makes various improvements to units - see commits.

ACKs for top commit:
apoelstra:
ACK a002978d05f88a0864bcb07ed3711999ab92dc22; successfully ran local tests

Tree-SHA512: 64978ac0bcc559d1148afc7f3b4683876575d5b2f816c5d3bc0b1dc71a110cdaaad898d5c7897b1ea195d734514f2e999b39417d82f267067fb4ee7a9fa5f511

91/100 · StrongMessage clarity

Why it was queued

signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path

AI analysis · Low 35/100

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, and removes an artificial restriction. The changes are mostly additive or renaming; they do not appear to fix a known vulnerability and the commit message does not describe any security issue.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findingsby Andrew Poelstra · 5f5f666d · Sep 18, 2026 · 9 filesMessage 91 · StrongLow 37Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

6dc79c836479ada95a63b8b971d2c06bc4867715 benches: bump crossbeam-epoch to 0.9.21 (satsfy (Renato Britto))
540ff32d80820031f2b9a4464a6dbdec31bf9494 benched: bump rand to 0.9.5 (satsfy (Renato Britto))
23f7ab9e60ed6410d3e3806a215290aa54edac46 embedded: replace alloc-cortex-m with embedded-alloc (satsfy (Renato Britto))

Pull request description:

Resolve all solvable `cargo audit` errors brought up in https://github.com/rust-bitcoin/rust-bitcoin/issues/6405

This is a sister PR to https://github.com/rust-bitcoin/rust-bitcoin/pull/6895, which ignores 2 other `cargo audit` problems in `.cargo/audit.toml`.

## Commit 1

Per [`embedded-alloc` docs](https://github.com/rust-embedded/embedded-alloc/blob/master/CHANGELOG.md#changed-1):
> The `Heap` struct has been renamed to `LlffHeap` and requires the `llff` feature.

`alloc-cortex-m` was renamed to `embedded-alloc`. The new crate uses the heap through [`critical-section`](https://github.com/rust-embedded/embedded-alloc?tab=readme-ov-file#example) instead of calling `cortex_m::interrupt::free` directly, so the binary must provide an implementation. `cortex-m` includes it behind its [`critical-section-single-core`](https://docs.rs/critical-section/latest/critical_section/#usage-in-no-std-binaries) feature, hence the new direct dependency. `llff` selects the linked list first fit heap, the same `linked_list_allocator` backend `alloc-cortex-m` already used, and `default-features = false` avoids also compiling the [alternative `tlsf` heap](https://github.com/rust-embedded/embedded-alloc?tab=readme-ov-file#features).

## Commit 2

rand 0.9.5 is in the patched range. rand 0.7 has no patch, so jobserver 0.1.18 drops it entirely. See https://rustsec.org/advisories/RUSTSEC-2026-0097.html

## Commit 3

crossbeam-epoch is a transitive dependency of the benchmark harness, not declared in any Cargo.toml. Advisory patched at 0.9.20, so the lockfile bump is the only solution. See https://rustsec.org/advisories/RUSTSEC-2026-0204.html

ACKs for top commit:
tcharding:
ACK 6dc79c836479ada95a63b8b971d2c06bc4867715
apoelstra:
ACK 6dc79c836479ada95a63b8b971d2c06bc4867715; successfully ran local tests

Tree-SHA512: f48ce5449a01ccab5fb32f679813542ac400a662fd73624fbc9d65200edd57f68ad180eacfb7e5f0de7ac8d681c9fc64a1a74b4cd0bfcc6ed0605d3e375c6591

91/100 · StrongMessage clarity

Why it was queued

merge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Low 37/100

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security scanner warnings (cargo audit) about known issues in the old dependencies. The core rust-bitcoin library code is not directly changed, and the affected code is example/embedded firmware and benchmark tooling rather than production wallet logic.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precisionby Andrew Poelstra · 9caad2c1 · Sep 16, 2026 · 2 filesMessage 91 · StrongModerate 62Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

1b067e90f3dad98d727edf2c709c96e25925e04b units: Test div_by_fee_rate_floor precision (Jamil Lambert, PhD)
5970d84abd8bac00f4e4c6398bb253b2a33e9dac units: Fix div_by_fee_rate_floor precision (Jamil Lambert, PhD)

Pull request description:

`div_by_fee_rate_floor` divided by the sat/kwu rate rounded up, understating the maximum affordable weight. Divide by the sat/MvB rate with a widened intermediate, as done for `div_by_weight_*` in #4675.

Closes project-loupe/audit-rust-bitcoin#81

ACKs for top commit:
apoelstra:
ACK 1b067e90f3dad98d727edf2c709c96e25925e04b; successfully ran local tests
tcharding:
ACK 1b067e90f3dad98d727edf2c709c96e25925e04b

Tree-SHA512: 6cc01c973f8a8cb8253e3e6c90ea5d17d47eaa01aee1683db312535715efc27c7da8561c7a9921a94689b1553e2e872a4f17d5006baa6c8a458d9ca71f05e596

91/100 · StrongMessage clarity

Why it was queued

signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path

AI analysis · Moderate 62/100

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per kilo-weight-unit), which could make the result slightly too small, understating the affordable weight. The fix uses a wider intermediate calculation with satoshis per million virtual bytes, matching a previous fix for related functions. It also now properly reports overflow when the result exceeds the maximum representable weight.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6880: primitives: Fix OutPoint serde vout endiannessby Andrew Poelstra · b784d516 · Sep 16, 2026 · 1 fileMessage 91 · StrongLow 38Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6880: primitives: Fix OutPoint serde vout endianness

674198e595d8192eeb85703018153b24835957fe primitives: Test OutPoint serde endianness (Jamil Lambert, PhD)
40528b9741099b14684aea5cf9cfcd6c130dc4eb primitives: Fix OutPoint serde vout endianness (Jamil Lambert, PhD)

Pull request description:

The non-human-readable `OutPoint` serializer writes `vout` as `u32::to_le_bytes()`, but the sequence visitor deserialized the field directly as a `u32`. Under a serializer whose integer byte order or width differs from those fixed little-endian bytes (for example bincode's big-endian or varint modes) the roundtrip returns the wrong `vout`, or fails. The map visitor already reads `[u8; 4]` and calls `u32::from_le_bytes`.

Read the `vout` field as `[u8; 4]` and decode it with `u32::from_le_bytes` in the sequence visitor, matching the serializer and the map visitor.

Closes project-loupe/audit-rust-bitcoin#126

ACKs for top commit:
apoelstra:
ACK 674198e595d8192eeb85703018153b24835957fe; successfully ran local tests
tcharding:
ACK 674198e595d8192eeb85703018153b24835957fe

Tree-SHA512: f56bc45dc2d794ed1ed32421834487f35adeeaab06b717e30dec141c13a6c963ad563ca74b25153ca4351de1bd2f404ea258fb42aac6484ff8bca84d12e875ec

91/100 · StrongMessage clarity

Why it was queued

signing or wallet pathmerge-commit duplicate discountsecond-pass: broader security terminologysecond-pass: security-sensitive path

AI analysis · Low 38/100

This commit fixes a serialization bug in how the `OutPoint` type (a Bitcoin transaction output identifier) handles its `vout` number when using non-human-readable serde formats. The code was writing `vout` as fixed little-endian bytes but reading it back as a generic integer, which could corrupt or fail deserialization under formats that use big-endian or variable-length integers. The fix makes the reader match the writer by always decoding four little-endian bytes. A regression test using bincode in big-endian mode was added.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6850: Use stacked attributes for feature conjunctionsby Andrew Poelstra · ab7652b3 · Sep 15, 2026 · 3 filesMessage 91 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6850: Use stacked attributes for feature conjunctions

95395f17876e6ca7458a362ace0f71cb22e60649 primitives: stack feature gates in tx example (satsfy (Renato Britto))
25b5814a0ab20d27026827e432c0a723746eec95 encoding: stack the feature gates in tests (satsfy (Renato Britto))

Pull request description:

Reading `policy.md` I noticed it says to use stacked attributes rather than `cfg(all(...))` whenever possible [\[1\]](https://github.com/rust-bitcoin/rust-bitcoin/blob/master/docs/policy.md#attributes), but then grepped 7 places in code where this was not the case, including in primitives. One commit per crate.

ACKs for top commit:
tcharding:
ACK 95395f17876e6ca7458a362ace0f71cb22e60649
apoelstra:
ACK 95395f17876e6ca7458a362ace0f71cb22e60649; successfully ran local tests

Tree-SHA512: b24a490722c5887926d64450fd0f03660bc7493f98e02d23dc2fb24beffb205815fec308a48f6cb9c40db402ddd0951b6abf8537b87a616597f0127c452e2270

91/100 · StrongMessage clarity

Why it was queued

signing or wallet pathparser or protocol pathmerge-commit duplicate discountsecond-pass: security-sensitive path

AI analysis · Informational 15/100

This commit is a code-style cleanup with no security impact. It changes how Rust conditional-compilation attributes are written, replacing combined `#[cfg(all(...))]` checks with stacked `#[cfg(...)]` attributes, following the project's own documented style policy. No program behavior changes.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6882: build(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2by Andrew Poelstra · a18caa85 · Sep 14, 2026 · 2 filesMessage 96 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6882: build(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2

35095071907110087cceb7038264861b421e4adc build(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.11 to 2.83.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.83.2</h2>
<ul>
<li>
<p>Update <code>parse-dockerfile@latest</code> to 0.1.8.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.5.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.56.0.</p>
</li>
<li>
<p>Update <code>gungraun-runner@latest</code> to 0.19.4.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.4.1.</p>
</li>
</ul>
<h2>2.83.1</h2>
<ul>
<li>
<p>Update <code>rclone@latest</code> to 1.74.4.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.4.</p>
</li>
<li>
<p>Update <code>cargo-deny@latest</code> to 0.20.2.</p>
</li>
</ul>
<h2>2.83.0</h2>
<ul>
<li>
<p>Support <code>cargo-about</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1924">#1924</a>, thanks <a href="https://github.com/ruffsl"><code>@ruffsl</code></a>)</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.28.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.12.0.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.106.0.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.3.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>

<h2>[Unreleased]</h2>
<h2>[2.87.12] - 2026-09-12</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.2.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.259.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.13.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.165.</p>
</li>
<li>
<p>Update <code>protoc-gen-connect-openapi@latest</code> to 0.27.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.5.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.144.</p>
</li>
</ul>
<h2>[2.87.11] - 2026-09-11</h2>
<ul>
<li>
<p>Update <code>biome@latest</code> to 2.5.13.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.12.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.4.</p>
</li>
<li>
<p>Update <code>kache@latest</code> to 0.19.0.</p>
</li>
</ul>
<h2>[2.87.10] - 2026-09-10</h2>
<ul>
<li>
<p>Update <code>zizmor@latest</code> to 1.30.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.11.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.4.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.164.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.3.</p>
</li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/43aecc8d72668fbcfe75c31400bc4f890f1c5853"><code>43aecc8</code></a> Release 2.83.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/fca47892c74f4dffa1e86ad93eca31cf898c2541"><code>fca4789</code></a> Update prek manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/b41cc1f9ab348b9db341d8597853df93b08652f0"><code>b41cc1f</code></a> Update <code>parse-dockerfile@latest</code> to 0.1.8</li>
<li><a href="https://github.com/taiki-e/install-action/commit/8d866f8ca86db77044d7d29639e24660d0b37b88"><code>8d866f8</code></a> Update <code>mise@latest</code> to 2026.7.5</li>
<li><a href="https://github.com/taiki-e/install-action/commit/7ebe462223a33af951eed3c3ab1f754ddf2992e2"><code>7ebe462</code></a> Update <code>just@latest</code> to 1.56.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/01ab5633b01b19988c158b5366d64947fd6cacce"><code>01ab563</code></a> Update <code>gungraun-runner@latest</code> to 0.19.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f164a682e7e0033cf72f1d5722d079fe82275c1e"><code>f164a68</code></a> Update <code>cargo-neat@latest</code> to 0.4.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/2ca9b94c269419b7b0c711c09d0b21c4e1d51145"><code>2ca9b94</code></a> Release 2.83.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/8598f86981150fb7f6511798af658bbf80a8ea46"><code>8598f86</code></a> Update parse-dockerfile manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/76cfe4de2d710e12bae93580164f20dff9fd96e9"><code>76cfe4d</code></a> Update <code>rclone@latest</code> to 1.74.4</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/5ebac0d9522d786674368e47e92963ba13f2c376...43aecc8d72668fbcfe75c31400bc4f890f1c5853">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.11&new-version=2.83.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

ACKs for top commit:
apoelstra:
ACK 35095071907110087cceb7038264861b421e4adc; successfully ran local tests
satsfy:
ACK 35095071907110087cceb7038264861b421e4adc

Tree-SHA512: 70f4da27a773a65a8bf99852311817d79ef38d4c3eb3cfb4288ef2646e02367a7dbaceac844f969cea2bb75a6535af431c7b17f628a53a9bd2f8d74ec3fbdd62

96/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine update to a GitHub Actions helper used in automated testing workflows. It changes the pinned version of taiki-e/install-action (a tool installer) from 2.82.11 to 2.83.2 in two workflow files. There is no indication this fixes or introduces a security issue in the rust-bitcoin library itself.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6878: Automated nightly rustfmt (2026-09-13)by Andrew Poelstra · c1af7e19 · Sep 14, 2026 · 4 filesMessage 91 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6878: Automated nightly rustfmt (2026-09-13)

909e1f23f829afd9d5475c3744995e5229b05e04 2026-09-13 automated rustfmt nightly (Fmt Bot)

Pull request description:

Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action

ACKs for top commit:
apoelstra:
ACK 909e1f23f829afd9d5475c3744995e5229b05e04; successfully ran local tests
satsfy:
ACK 909e1f23f829afd9d5475c3744995e5229b05e04

Tree-SHA512: 0237f0a909bab93b60bae3f1ace465d76c0084198bd4ef3bb4f1033276881260e7a7393ca94de6fb949c4a75d40f41e60a2616f99a8e3aa4e23b2f5a4ec9eae6

91/100 · StrongMessage clarity

Why it was queued

signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path

AI analysis · Informational 15/100

This commit is an automated code-formatting run by a bot. It only changes whitespace, line breaks, and brace placement in four source files. No program logic, math, or security behavior was altered.

AI review queuedbuild(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2by dependabot[bot] · 35095071 · Sep 13, 2026 · 2 filesMessage 93 · StrongInformational 15Details

Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.11 to 2.83.2.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/5ebac0d9522d786674368e47e92963ba13f2c376...43aecc8d72668fbcfe75c31400bc4f890f1c5853)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.83.2
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps a third-party GitHub Action used in testing workflows from version 2.82.11 to 2.83.2. It only changes two lines in CI configuration files and does not touch any application code, cryptographic logic, or user-facing behavior.

AI review queuedinternals: Escape control chars in parse errorsby Jamil Lambert, PhD · ef30002b · Sep 10, 2026 · 1 fileMessage 68 · AdequateLow 49Details

Commit message · Jamil Lambert, PhD

internals: Escape control chars in parse errors

InputString rendered input verbatim in its cannot_parse and
unknown_variant Display helpers, allowing control characters
(e.g. newlines) into error output and enabling log injection.

Escape the input with escape_debug.

Assisted-by: Claude Opus 4.8

68/100 · AdequateMessage clarity

✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Why it was queued

second-pass: broader security terminology

AI analysis · Low 49/100

This commit fixes a log-injection-style issue in error messages. When the library failed to parse a string, it would print the user's raw input directly into the error text. If that input contained hidden control characters such as newlines or tabs, those characters would appear in logs or other output, potentially confusing log parsers, hiding malicious content, or making errors harder to read. The fix escapes those characters so they appear as visible symbols instead of being executed as formatting.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6845: ci: install rbmt from crates.io in replay jobby Andrew Poelstra · 2f3cf11b · Sep 10, 2026 · 1 fileMessage 91 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6845: ci: install rbmt from crates.io in replay job

bfc3703872c07560c3ed442a2bedb756596a3817 ci: install rbmt from crates.io in replay job (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6838

The newly added `replay-crash-store` job of corpus fuzzing installed `cargo-rbmt` from version of an outdated file `rbmt-version` file that doesn't exist anymore. Pull info from `Cargo.toml` `rbmt.version`. 100% my mistake here.

ACKs for top commit:
tcharding:
ACK bfc3703872c07560c3ed442a2bedb756596a3817
apoelstra:
ACK bfc3703872c07560c3ed442a2bedb756596a3817; successfully ran local tests

Tree-SHA512: 3767090700ebf85e058acdae1fb741db2a26444ff404ea3f3036dddef58fb4a84412687b56ebf3b5f0e1a58621393782e2e7d1a6af8f84bc633cc6ab29351bd9

91/100 · StrongMessage clarity

Why it was queued

fuzzing or regression evidencedocumentation-only discountmerge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine CI maintenance fix. It changes how an internal developer tool (cargo-rbmt) is installed during an automated fuzzing replay job, switching from a pinned git revision to a version number read from the project's Cargo.toml. There is no security issue here.

AI review queuedMerge rust-bitcoin/rust-bitcoin#4675: Units improvementsby Andrew Poelstra · f57f3be6 · Sep 10, 2026 · 8 filesMessage 91 · StrongInformational 19Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#4675: Units improvements

f80747556c8c3e0abaa28585e11cc55f36d056cf Add test for `FeeRate::from_per_kvb` (Martin Habovstiak)
3c71e5361e1d53291ae118986578d42e74c72b15 Make infallible fns actually infallible (Martin Habovstiak)
d022dfaddf5de82029ce4911b30aaf046ec60088 Improve the precision of `div_by_weight_*` (Martin Habovstiak)
00f5be2b6757f737bd46da7d29e1644122bad998 Add `to_msat` conversion method to amount types (Martin Habovstiak)
7db4f2b33cd4adcc9846188127e7cef3545f333e Fix documentation of `checked_{div,rem}` (Martin Habovstiak)
3b29ac5b7fd4e81eb679f50f2be04e3664a189b2 Update the doc of amounts (Martin Habovstiak)
116ade8aaa5a0d952985efc02d371a9d87d31303 Improve the warning on float amount methods (Martin Habovstiak)
adc8c5f7704470f16766af1d260feeee0bf663e5 Fix stale comment about precision (Martin Habovstiak)
e86502cc494acd6b68efc52988cc8c862cc8990d Improve the documentation of `units` (Martin Habovstiak)
25ae539b6b1ffe854d44b3ca0a337299928d0f80 De-clutter the example in `units` (Martin Habovstiak)

Pull request description:

Various improvements that fell out of my review of `units` crate. My review is not over yet, but I need a break, so I'm at least publishing this for review. (Feel free to review, I'll just make another PR if I find more.)

These are just documentation improvements. See individual commits for details.

ACKs for top commit:
tcharding:
ACK f80747556c8c3e0abaa28585e11cc55f36d056cf
apoelstra:
ACK f80747556c8c3e0abaa28585e11cc55f36d056cf; successfully ran local tests

Tree-SHA512: 5266890a9bab7bccf274b40c40146fcbd4e6beb736ff9f160f2b767f75f04b7b94ae8f0dc24f0586b35511d3483d5018e01378c05cf6db29968670f182762239

91/100 · StrongMessage clarity

Why it was queued

signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path

AI analysis · Informational 19/100

This is a routine code-quality and documentation update for the Rust Bitcoin 'units' crate. It adds a few helper methods, improves precision of fee-rate calculations, and updates documentation and warnings. There is no indication of a security vulnerability being fixed, and the changes are described by the author as 'just documentation improvements' plus minor API refinements.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6840: build(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11by Andrew Poelstra · 79482c3c · Sep 7, 2026 · 2 filesMessage 96 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6840: build(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11

798bf10704183049839e7ff5c69e63876001aacb build(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.7 to 2.82.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.11</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.253.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.27.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.2.</p>
</li>
<li>
<p>Update <code>mdbook@latest</code> to 0.5.4.</p>
</li>
</ul>
<h2>2.82.10</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.2.0.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.140.</p>
</li>
</ul>
<h2>2.82.9</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.9.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.4.8.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.37.0.</p>
</li>
<li>
<p>Update <code>cargo-leptos@latest</code> to 0.3.7.</p>
</li>
</ul>
<h2>2.82.8</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.8.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.26.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.48.0.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.72.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.7.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.4.6.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.0.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.55.1.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.2.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>

<h2>[Unreleased]</h2>
<h2>[2.87.7] - 2026-09-06</h2>
<ul>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.128.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.10.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.2.</p>
</li>
<li>
<p>Update <code>rclone@latest</code> to 1.75.1.</p>
</li>
</ul>
<h2>[2.87.6] - 2026-09-05</h2>
<ul>
<li>
<p>Update <code>rafn@latest</code> to 0.1.6.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.11.3.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.57.1.</p>
</li>
<li>
<p>Update <code>convco@latest</code> to 0.7.2.</p>
</li>
</ul>
<h2>[2.87.5] - 2026-09-04</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.30.3.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.9.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.50.1.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.1.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.161.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.5.2.</p>
</li>
<li>
<p>Update <code>oxfmt@latest</code> to 1.81.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.1.</p>
</li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/5ebac0d9522d786674368e47e92963ba13f2c376"><code>5ebac0d</code></a> Release 2.82.11</li>
<li><a href="https://github.com/taiki-e/install-action/commit/0ef1b06f246983bfc9b14d94cff7855d90529e46"><code>0ef1b06</code></a> Update <code>wasm-tools@latest</code> to 1.253.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/78ce37c0ce7da0b633b3ee9a800d18e6d4fb11e7"><code>78ce37c</code></a> Update <code>mise@latest</code> to 2026.7.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/080cc5c6de6a4709eb3c099c56ad225fa3db5492"><code>080cc5c</code></a> Update wasm-tools manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/c870c7a1dbaa5d99671937765392df21151c7808"><code>c870c7a</code></a> Update <code>uv@latest</code> to 0.11.27</li>
<li><a href="https://github.com/taiki-e/install-action/commit/dcc765d42b0daa9842059edfb11fda14143027e2"><code>dcc765d</code></a> Update <code>mise@latest</code> to 2026.7.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/98fa0bac11003b6f1143fd1634b47d42624003b2"><code>98fa0ba</code></a> Update <code>mdbook@latest</code> to 0.5.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/544756b7938b454b9339922116f9f21301cc8169"><code>544756b</code></a> Update martin manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/116765984988a711571bdb8292667a67de89b08e"><code>1167659</code></a> Update kingfisher manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ca5e0a7228a263c12320511f1b10890972a12bbc"><code>ca5e0a7</code></a> Update biome manifest</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/16b05812d776ae1dfaabc8277e421fb6d2506419...5ebac0d9522d786674368e47e92963ba13f2c376">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.7&new-version=2.82.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

ACKs for top commit:
apoelstra:
ACK 798bf10704183049839e7ff5c69e63876001aacb; successfully ran local tests

Tree-SHA512: 120a52a92c5990d13ff7f1405f3c9903ad30dfc09eac870ae763aca8b0544a5a13db729f304d604ab089d6edab9eecf5fba5a419a6fca2f6efe1e6077690f896

96/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine update to a GitHub Actions helper used only in automated testing workflows. It changes the pinned version of taiki-e/install-action, which downloads and installs Rust tools like cargo-mutants during CI runs. There is no change to the rust-bitcoin library code, no user-facing behavior change, and no disclosed security issue.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6841: build(deps): bump actions/labeler from 6.1.0 to 6.2.0by Andrew Poelstra · e0dae5c4 · Sep 7, 2026 · 1 fileMessage 96 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6841: build(deps): bump actions/labeler from 6.1.0 to 6.2.0

cf7dd14007d4293a0026a5f278d082339ea0ef67 build(deps): bump actions/labeler from 6.1.0 to 6.2.0 (dependabot[bot])

Pull request description:

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.1.0 to 6.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/labeler/releases">actions/labeler's releases</a>.</em></p>
<blockquote>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Improve PR number validation and warning messages in input handling by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/939">actions/labeler#939</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/943">actions/labeler#943</a></li>
<li>Bump <code>@typescript-eslint/eslint-plugin</code> from 8.59.1 to 8.61.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/942">actions/labeler#942</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/labeler/compare/v6.1.0...v6.2.0">https://github.com/actions/labeler/compare/v6.1.0...v6.2.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/labeler/commit/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d"><code>b8dd2d9</code></a> Bump <code>@typescript-eslint/eslint-plugin</code> from 8.59.1 to 8.61.1 (<a href="https://redirect.github.com/actions/labeler/issues/942">#942</a>)</li>
<li><a href="https://github.com/actions/labeler/commit/53affe8ca4150876fc7eb7d268d3a1f74511a244"><code>53affe8</code></a> Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...</li>
<li><a href="https://github.com/actions/labeler/commit/f612d9ad188e81643862c2de70f57fbb1d17abd1"><code>f612d9a</code></a> Fix: Improve PR number validation and warning messages in input handling (<a href="https://redirect.github.com/actions/labeler/issues/939">#939</a>)</li>
<li>See full diff in <a href="https://github.com/actions/labeler/compare/f27b608878404679385c85cfa523b85ccb86e213...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/labeler&package-manager=github_actions&previous-version=6.1.0&new-version=6.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

ACKs for top commit:
apoelstra:
ACK cf7dd14007d4293a0026a5f278d082339ea0ef67; successfully ran local tests

Tree-SHA512: 61338f586014ef0098437e9c2d99c7e49eae9bd3f4397976ddc507c393e6f5405397badfa8f8022ec8b300feb2c8b7685de9863f3db5116b3f9a573c66deedf5

96/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine update to a GitHub Actions workflow that automatically labels pull requests. It bumps the version of the 'actions/labeler' tool from 6.1.0 to 6.2.0. The newer version fixes a minor bug in how pull request numbers are validated and updates some internal software libraries. There is no indication this change affects the security of the actual rust-bitcoin code or its users.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6839: build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2by Andrew Poelstra · 3434d8e6 · Sep 7, 2026 · 2 filesMessage 96 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6839: build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2

2427fa6add1a172cc87ba57eef70dfae8ca9bb62 build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (dependabot[bot])

Pull request description:

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p>
<blockquote>
<h2>v8.3.2 🌈 update known checksums for 0.11.28</h2>
<h2>Changes</h2>
<p>Just a maintenance release</p>
<h2>🧰 Maintenance</h2>
<ul>
<li>chore: update known checksums for 0.11.28 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/947">#947</a>)</li>
</ul>
<h2>📚 Documentation</h2>
<ul>
<li>docs: update version references to v8.3.1 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/946">#946</a>)</li>
</ul>
<h2>⬆️ Dependency updates</h2>
<ul>
<li>chore: roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/948">#948</a>)</li>
</ul>
<h2>v8.3.1 🌈 update known checksums for 0.11.27</h2>
<h2>Changes</h2>
<p>Just a maintenance release</p>
<h2>🧰 Maintenance</h2>
<ul>
<li>Change update-docs PR labels from 'update-docs' to 'documentation' <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/945">#945</a>)</li>
<li>chore: update known checksums for 0.11.27 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/944">#944</a>)</li>
</ul>
<h2>📚 Documentation</h2>
<ul>
<li>docs: update version references to v8.3.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/939">#939</a>)</li>
</ul>
<h2>v8.3.0 🌈 Support uv.lock as a version-file source</h2>
<h2>Changes</h2>
<p>Thanks to <a href="https://github.com/somaz94"><code>@somaz94</code></a> you can now use the pinned version of uv itself in <code>uv.lock</code>. It gets picked up automatically.
If you have pinned another version of uv in your <code>uv.lock</code> you can use the inputs <code>version</code> or <code>version-source</code> to override this.</p>
<h2>🐛 Bug fixes</h2>
<ul>
<li>Strip environment markers from detected uv dependency pins <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/938">#938</a>)</li>
<li>Fix cache keys for Python version ranges <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/937">#937</a>)</li>
<li>fix: use BUILD_ID as backup for determining os version <a href="https://github.com/hgaiser"><code>@hgaiser</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/912">#912</a>)</li>
</ul>
<h2>🚀 Enhancements</h2>
<ul>
<li>feat: support uv.lock as a version-file source <a href="https://github.com/somaz94"><code>@somaz94</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/918">#918</a>)</li>
</ul>
<h2>🧰 Maintenance</h2>
<ul>
<li>ci: call docs update workflow from release <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/933">#933</a>)</li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/astral-sh/setup-uv/commit/11f9893b081a58869d3b5fccaea48c9e9e46f990"><code>11f9893</code></a> chore: roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/948">#948</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/f79855603231e1609d02bec6956bd0e05cbc46b5"><code>f798556</code></a> docs: update version references to v8.3.1 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/946">#946</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/e80544d808267c93733c3fd1e2c8c65e0c8707d6"><code>e80544d</code></a> chore: update known checksums for 0.11.28 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/947">#947</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/f98e06938123ccabd21905ea5d0069192241f9f1"><code>f98e069</code></a> Change update-docs PR labels from 'update-docs' to 'documentation' (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/945">#945</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/cd462639a967553a16241af35461402a96978d48"><code>cd46263</code></a> chore: update known checksums for 0.11.27 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/944">#944</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/11245c7e122cd1c2297e8115d1e43fe1570f6270"><code>11245c7</code></a> docs: update version references to v8.3.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/939">#939</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/d31148d669074a8d0a63714ba94f3201e7020bc3"><code>d31148d</code></a> Strip environment markers from detected uv dependency pins (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/938">#938</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/17c398959b4611a88929fabb5c563a8e43a0ff60"><code>17c3989</code></a> Fix cache keys for Python version ranges (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/937">#937</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/3cc3c11fdf511cab39136b7c946d973d4ad0df20"><code>3cc3c11</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/936">#936</a>)</li>
<li><a href="https://github.com/astral-sh/setup-uv/commit/9225f843d7a9f80a757cf25ef48901fda69ba4bc"><code>9225f84</code></a> chore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/924">#924</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...11f9893b081a58869d3b5fccaea48c9e9e46f990">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/setup-uv&package-manager=github_actions&previous-version=8.2.0&new-version=8.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

ACKs for top commit:
apoelstra:
ACK 2427fa6add1a172cc87ba57eef70dfae8ca9bb62; successfully ran local tests

Tree-SHA512: ba14136987c13466b40e0c5a83ac137f2f5191fe67d846091eab3828c64bf23978be12a933dcb941edbfeca4054625522947797947facbcaa3a114f1f672f235

96/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine update to a GitHub Actions helper used to install a Python tool called uv during automated security scanning workflows. It only changes the pinned version of that helper from 8.2.0 to 8.3.2 in two workflow files. There is no indication this fixes or introduces a security problem in the rust-bitcoin library itself.

AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 8d5a2f95 · Sep 6, 2026 · 1 fileMessage 93 · StrongInformational 15Details

Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine update by Dependabot to the GitHub CodeQL upload-sarif action used in a scheduled security-scanning workflow. It changes only the pinned commit hash for the action from version 4.36.2 to 4.37.0. There is no indication this change fixes or introduces a security vulnerability in the rust-bitcoin code itself.

AI review queuedbuild(deps): bump actions/labeler from 6.1.0 to 6.2.0by dependabot[bot] · cf7dd140 · Sep 6, 2026 · 1 fileMessage 93 · StrongInformational 15Details

Commit message · dependabot[bot]

build(deps): bump actions/labeler from 6.1.0 to 6.2.0

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/f27b608878404679385c85cfa523b85ccb86e213...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d)

---
updated-dependencies:
- dependency-name: actions/labeler
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps the GitHub Actions 'labeler' workflow dependency from version 6.1.0 to 6.2.0. The labeler action only manages pull-request labels; it does not touch source code, build artifacts, secrets, or the Bitcoin library itself. There is no indication in the commit of any security fix or vulnerability.

AI review queuedbuild(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11by dependabot[bot] · 798bf107 · Sep 6, 2026 · 2 filesMessage 93 · StrongInformational 15Details

Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.7 to 2.82.11.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/16b05812d776ae1dfaabc8277e421fb6d2506419...5ebac0d9522d786674368e47e92963ba13f2c376)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.82.11
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is an automated update by Dependabot that bumps a third-party GitHub Action used in the project's CI workflows from version 2.82.7 to 2.82.11. The action installs developer tools during automated testing. There is no indication in the commit that this fixes a security issue, and the change only affects internal build/test automation, not the published Rust Bitcoin library code.

AI review queuedbuild(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2by dependabot[bot] · 2427fa6a · Sep 6, 2026 · 2 filesMessage 93 · StrongInformational 15Details

Commit message · dependabot[bot]

build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...11f9893b081a58869d3b5fccaea48c9e9e46f990)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.3.2
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity

Why it was queued

documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The action is referenced by a fixed commit hash (a 'pin'), which is a security best practice. There is no indication in the commit that this fixes a security problem; it is a normal dependency bump.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6715: internals: migrate the `u256` type from the include system to the internals packageby Andrew Poelstra · 9fb8d3fa · Sep 4, 2026 · 18 filesMessage 91 · StrongInformational 15Details

Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6715: internals: migrate the `u256` type from the include system to the internals package

230c95aad69f343cef54654f0b03a6a71ea60f1b internals: move unused test dependencies to dev-dependencies (Nick Johnson)
f1b63f2b9c79e71fe07c93bd93252ae49946c5fd internals: migrate the u256 from include to internals (Nick Johnson)
4707d00d70c43796debcc89187f0b0587da46113 ci: fail if bitcoin-internals is exposed in public api (Nick Johnson)

Pull request description:

With `cargo-rbmt@0.5.*` is merged in #6547, `cargo-rbmt`'s api check can now enforce that a "private" dependency does not leak out of a crate's exposed API. With this enforcement, we can move over the `u256` type from the `include/` system into the standard `internals` package.

The third commit is not directly related, but noticed that `internals` appeared to be needlessly leaking dependencies.

Part of the #6458 effort.

ACKs for top commit:
tcharding:
ACK 230c95aad69f343cef54654f0b03a6a71ea60f1b
apoelstra:
ACK 230c95aad69f343cef54654f0b03a6a71ea60f1b; successfully ran local tests

Tree-SHA512: 71d30bf1f15767efaa6b67d66f3e8fd3cee2c2931d6ad4bfeb8f638b54be5667ca279f8654b67834ceb6ac95f9c1044a3aa7c98d1a78ffc16fdf293a8edffc97

91/100 · StrongMessage clarity

Why it was queued

merge-commit duplicate discountsecond-pass: broader security terminology

AI analysis · Informational 15/100

This commit is a routine internal code reorganization. It moves a 256-bit unsigned integer helper type (U256) from a duplicated file that was copy-pasted into multiple crates into a single shared internal crate. It also cleans up some test-only dependencies. There is no security-relevant behavior change visible in the diff.