CommitWatch RSS
RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue248AI analyses
194commits · 30 days
405commits · 60 days
1283commits · 180 days
2070commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192109068
Tobin C. Harding4096544063
jrakibi944912068
Nick Johnson189204059
Andrew Poelstra512011075
Jamil Lambert, PhD114185061
Fmt Bot311412045
Trevor Arjeski111111069
Shing Him Ng3176056
Ismail Daif2263050
satsfy (Renato Britto)1766066
Martin Habovstiak2754069
Analysis record

Published AI watches

Last scanned 1 minute ago

Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

base58ck: Bump version to 0.5.0

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes,…

8479b56eby Tobin C. Harding+22−168 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Rename Error to DecodeCheckError

This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no chan…

b0eba4c0by Mitchell Bagot+45−395 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add sha256::Midstate::SHA256_IV constant

This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than al…

dc21841bby Andrew Poelstra+39−143 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add several methods to sha256::Midstate for computing them in const contexts

This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature …

7d8f06d2by Andrew Poelstra+80−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

taproot-primitives: Implement encoding traits for TapLeafHash

This commit adds standard data-encoding support for a Bitcoin Taproot hash type (TapLeafHash) so it can be properly serialized and deserialized in PSBT data. There is no indication of a security bug being fixed; it appears to be a missing-…

No security-relevant signal in commit message or diffChange is a feature addition (encoding trait implementations)No bounds-checking, memory-safety, or cryptographic flaws evident in diff
b2ab0896by Mitchell Bagot+59−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Split Address into an extension trait

This commit is a routine code reorganization in the rust-bitcoin library. It moves the `Address::from_script` method out of the main `Address` type into a new 'extension trait' called `AddressExt`. The actual logic of the function is copie…

c900fa8cby Mitchell Bagot+35−263 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

primitives: Bump version to 0.103.0

This commit is a routine release preparation: it bumps the version number of the `bitcoin-primitives` crate from 0.102.0 to 0.103.0, updates related dependency declarations in other crates, refreshes lock files, and adds a changelog entry.…

5612224dby Tobin C. Harding+48−88 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: bump version to 1.1.0

This commit is a routine version bump for the bitcoin_hashes crate from 1.0.0 to 1.1.0. It updates dependency references across the workspace, records the release in the changelog, and adjusts deprecation lint allowances in tests. There is…

bf3f25f4by Nick Johnson+34−269 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 80 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor(bip32): Xpub child tweak api

This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual c…

No security-relevant behavioral change observedAPI rename and return-type encapsulation onlyNo new validation, bounds checking, or constant-time guarantees added
37191717by Trevor Arjeski+21−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 85 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor(bip32): rename Xpub and Xpriv derivation methods

This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability…

No security-relevant logic changePure API renaming/refactoringDeprecated method removal may break downstream callers at compile time
f8f053fdby Trevor Arjeski+61−852 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

internals: Bump version to 0.6.0

This commit is a routine version bump for the internal 'bitcoin-internals' crate from 0.5.0 to 0.6.0. It updates version numbers across package manifests and lock files, and adds a changelog describing API cleanups and small improvements. …

aed7a9ceby Tobin C. Harding+73−5616 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove hex dep from internals

This commit simply removes an unused software dependency (the hex-conservative crate) from the internals sub-package and updates related package configuration files. It is a routine cleanup change with no security relevance.

bd0d4bc0by Tobin C. Harding+8−118 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace external uses of base58 encoding with Base58CkString

This commit is a routine internal code cleanup in the rust-bitcoin project. It swaps old base58 encoding helper functions for a new equivalent type, Base58CkString, in three source files. There is no indication from the commit itself that …

No security-relevant signal in the diff: equivalent API swap onlyNo new dependencies or unsafe blocks introducedNo changes to input validation, parsing, or secret handling
7f5fbd13by Mitchell Bagot+10−103 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add try_push to Buffer trait

This commit adds a new `try_push` method to an internal `Buffer` trait used during Base58 encoding. It is a straightforward, additive change that lets encoding code gracefully handle a full fixed-size buffer in no-allocation builds. There …

aafb6065by Mitchell Bagot+15−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: Rename _with decoder functions

This commit is a simple renaming of internal Rust functions from names ending in '_with' to names ending in '_with_decoder'. It does not change what the code does, only what the functions are called, to avoid confusion with another functio…

12325a67by Mitchell Bagot+18−174 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 63 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Move ScriptPubKeyBufExt to addresses

This commit is a routine internal code reorganization in the rust-bitcoin library. It moves a helper trait (ScriptPubKeyBufExt) and its functions from one internal module to another, and re-exports it so existing users see no change. There…

ed00d91aby Mitchell Bagot+92−552 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: Deprecate sha256t_tag macro

This is a routine code-maintenance change: the developers are marking an old helper macro as deprecated and telling users how to write the same code by hand. There is no bug fix, no security patch, and no vulnerability being addressed in t…

ac921e97by jrakibi+26−123 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

2026-07-05 automated rustfmt nightly

This commit is a routine automated code-formatting run by the rustfmt tool. It only changes whitespace, import order, and line breaks in five files. There are no functional changes, no bug fixes, and no security-related modifications.

673e5ee4by Fmt Bot+12−115 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: implement sha256t::Tag without the macro

This commit is a routine code cleanup in the rust-bitcoin library. It replaces a macro used to define SHA-256 tagged hash identifiers with direct Rust code that does the same thing. The actual hash values and behavior are unchanged; only t…

0131814dby jrakibi+30−133 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: adapt default and no feature bip32 test for rbmt 0.4.0

This is a routine update to the project's automated testing configuration. A tool used to run example tests changed its syntax, so the developer updated one line to keep the same tests running the same way. There is no user-facing change a…

5f933d5cby satsfy (Renato Britto)+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` privateby Andrew Poelstra · 07d91f7f · Aug 4, 2026 · 4 filesMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

9c391145fa57dc54e6af1f18758db4e0ba2049de Update the API text files (Tobin C. Harding)
b37accc3db1f164a5b3dee7ff6bbd7a2d0af5be4 Make the WitnessesEncoder private (Tobin C. Harding)

Pull request description:

The `WitnessesEncoder` is an auxilary encoder that is used internally within the transaction encoder. It does not need to be public.

Make it private and put the code right below where it is used.


ACKs for top commit:
apoelstra:
ACK 9c391145fa57dc54e6af1f18758db4e0ba2049de; successfully ran local tests


Tree-SHA512: 1b950e7f3d19bf923325c75a4009dcc903a065cca87fccad638d3d19c53ea824a81b19a07e09eaff5603aea659366d2b80e51a8a694be6f24ae96f5ca0c9c9e7

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI review queuedMerge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logicby Andrew Poelstra · c5588ba5 · Aug 4, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

80dcef1527479e2e0790bf5995636b7640bb56f8 Scrub the transaction encoding logic (Tobin C. Harding)

Pull request description:

Third time lucky. Layout the encoding code in `transaction` as is now customary. (`Transaction` was done but I missed the others.)

Code move only.


ACKs for top commit:
apoelstra:
ACK 80dcef1527479e2e0790bf5995636b7640bb56f8; successfully ran local tests


Tree-SHA512: 737266a34151f4449cfc74e8788c94d991e4931b9cd837fbc551fbd7afc3062623525b9165325c371caea0a78e12b5746e71e66c697b1684a5628c8bb4cc8855

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI review queuedMerge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4by Andrew Poelstra · 5c92c0b0 · Aug 4, 2026 · 2 filesMessage 96 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

eb9544f9d07a38d81998e5e1f96faaba43546ca0 build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.12 to 2.81.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.81.4</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.4.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.47.1.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.45.0.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.4.0.</p>
</li>
<li>
<p>Update <code>cargo-mutants@latest</code> to 27.1.0.</p>
</li>
</ul>
<h2>2.81.3</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.3.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.18.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.0.</p>
</li>
</ul>
<h2>2.81.2</h2>
<ul>
<li>
<p>Update <code>mise@latest</code> to 2026.5.18.</p>
</li>
<li>
<p>Update <code>cargo-semver-checks@latest</code> to 0.48.0.</p>
</li>
</ul>
<h2>2.81.1</h2>
<ul>
<li>
<p>Update <code>cargo-no-dev-deps@latest</code> to 0.2.24.</p>
</li>
<li>
<p>Update <code>cargo-hack@latest</code> to 0.6.45.</p>
</li>
</ul>
<h2>2.81.0</h2>
<ul>
<li>
<p>Support <code>convco</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1831">#1831</a>, thanks <a href="https://github.com/graelo"><code>@​graelo</code></a>)</p>
</li>
<li>
<p>Support <code>docgarden</code> (<a href="https://redirect.github.com/taiki-e/install-action/pull/1830">#1830</a>, thanks <a href="https://github.com/jesse-black"><code>@​jesse-black</code></a>)</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.0.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.19.1.</p>
</li>
</ul>
<h2>2.80.0</h2>
<ul>
<li>Support <code>kingfisher</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1874">#1874</a>, thanks <a href="https://github.com/SAY-5"><code>@​SAY-5</code></a>)</li>
</ul>
<h2>2.79.15</h2>
<ul>
<li>
<p>Update <code>typos@latest</code> to 1.47.0.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.251.0.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.27.2.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.17.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.1.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.85.7] - 2026-08-02</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 47.0.3.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.1.</p>
</li>
<li>
<p>Update <code>rclone@latest</code> to 1.75.0.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.110.0.</p>
</li>
</ul>
<h2>[2.85.6] - 2026-08-01</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.255.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.2.5.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.18.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.5.3.</p>
</li>
<li>
<p>Update <code>cargo-crap@latest</code> to 0.4.0.</p>
</li>
</ul>
<h2>[2.85.5] - 2026-07-30</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.0.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.50.0.</p>
</li>
<li>
<p>Update <code>sccache@latest</code> to 0.17.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.16.</p>
</li>
</ul>
<h2>[2.85.4] - 2026-07-29</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.11.33.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.15.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/cde8c9e634f4a17bc06b61413ac0ef75450eac46"><code>cde8c9e</code></a> Release 2.81.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/1e4ec7678aaae334aeea28c8427c4e089bd7ac59"><code>1e4ec76</code></a> ci: Temporarily disable broken opensuse/tumbleweed test</li>
<li><a href="https://github.com/taiki-e/install-action/commit/2ba2a47530f71d53918fc583d17d787dec4eb506"><code>2ba2a47</code></a> Update <code>vacuum@latest</code> to 0.28.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/193c1cc963fc6015a43bd656c624759cf2489e6d"><code>193c1cc</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/cb4b3f93f764d4397e62fed744879c14a37e6648"><code>cb4b3f9</code></a> Update <code>typos@latest</code> to 1.47.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/b6e08095932286aa3bc8066c8425cf400f5dad11"><code>b6e0809</code></a> Update <code>syft@latest</code> to 1.45.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/55ff171d0ce18bd578689162cd406f47f234b9db"><code>55ff171</code></a> Update prek manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/4dea5bb80f56642c56e7b47dd897c5ecff469424"><code>4dea5bb</code></a> Update mise manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3e82d2c35aa3d3b9fa923dd8070290a142e32eb9"><code>3e82d2c</code></a> Update cargo-shear manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/31e07c4d25ffc687960959659c9769d3252c88e1"><code>31e07c4</code></a> Update <code>cargo-neat@latest</code> to 0.4.0</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c...cde8c9e634f4a17bc06b61413ac0ef75450eac46">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.79.12&new-version=2.81.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK eb9544f9d07a38d81998e5e1f96faaba43546ca0; successfully ran local tests
satsfy:
ACK eb9544f9d07a38d81998e5e1f96faaba43546ca0


Tree-SHA512: b9424910bb0f991686929a42b12b1a1183de5b5a86667d0a19a6c0d8b0944dc06d94451e3e357644d4bf7a509bd5b44ec24ad77a0627cdc5b9706808d84cbe39

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI review queuedScrub the transaction encoding logicby Tobin C. Harding · 80dcef15 · Aug 3, 2026 · 1 fileMessage 68 · AdequateTriage 12Details
Commit message · Tobin C. Harding

Scrub the transaction encoding logic

Third time lucky. Layout the encoding code in `transaction` as is now
customary. (`Transaction` was done but I missed the others.)

Code move only.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedMake the WitnessesEncoder privateby Tobin C. Harding · b37accc3 · Aug 3, 2026 · 2 filesMessage 58 · ThinTriage 12Details
Commit message · Tobin C. Harding

Make the WitnessesEncoder private

The `WitnessesEncoder` is an auxilary encoder that is used internally
within the transaction encoder. It does not need to be public.

Make it private and put the code right below where it is used.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedbuild(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0by dependabot[bot] · 1c438632 · Aug 3, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/08807647e7069bb48b6ef5acd8ec9567f424441b...fac544c07dec837d0ccb6301d7b5580bf5edae39)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 5293bee4 · Aug 3, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.0 to 4.36.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.36.2
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4by dependabot[bot] · eb9544f9 · Aug 3, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.12 to 2.81.4.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c...cde8c9e634f4a17bc06b61413ac0ef75450eac46)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.81.4
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedUpdate API filesby Mitchell Bagot · 6ea25bed · Aug 3, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · 351acf8e · Jul 31, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedconsensus_encoding: decoder docs which are consensus specificby Nick Johnson · 5cdd5aa0 · Jul 31, 2026 · 2 filesMessage 73 · AdequateTriage 7Details
Commit message · Nick Johnson

consensus_encoding: decoder docs which are consensus specific

The decode module has 6 driver functions bound to `Decode`, and thus
are consensus-encoding specific.

- `decode_from_slice<T: Decode>`
- `decode_from_slice_unbounded<T: Decode>`
- `decode_from_hex<T: Decode>`
- `decode_from_read<T: Decode>`
- `decode_from_read_unbuffered<T: Decode>`
- `decode_from_read_unbuffered_with<T: Decode>`
- `check_decode<T: Decode>`

One type is bound to `Decode`.

- `VecDecoder<T: Decode>`

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedhashes: update API filesby Andrew Poelstra · 44552e3a · Jul 31, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Andrew Poelstra

hashes: update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · cebefd5c · Jul 31, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · 8356c542 · Jul 30, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedunits: Implement serde traits for relative lock timesby Tobin C. Harding · f6d22308 · Jul 30, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Tobin C. Harding

units: Implement serde traits for relative lock times

To satisfy the API guideline
[C-SERDE](https://rust-lang.github.io/api-guidelines/interoperability.html#data-structures-implement-serdes-serialize-deserialize-c-serde),
data types in a crate must implement serde's `Serialize` and
`Deserialize` traits.

Add custom impls for the relative lock time subtypes. Note we use 512
second intervals for the `NumberOf512Seconds` type and not seconds so
that there is no error path.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedImplement serde traits for absolute locktime typesby Tobin C. Harding · 0252bea5 · Jul 30, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Tobin C. Harding

Implement serde traits for absolute locktime types

To satisfy the API guideline
[C-SERDE](https://rust-lang.github.io/api-guidelines/interoperability.html#data-structures-implement-serdes-serialize-deserialize-c-serde),
data types in a crate must implement serde's `Serialize` and
`Deserialize` traits.

Add custom impls for the absolute lock time sub types.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedunits: make Sequence inner field privateby satsfy (Renato Britto) · 30f280da · Jul 29, 2026 · 6 filesMessage 68 · AdequateTriage 12Details
Commit message · satsfy (Renato Britto)

units: make Sequence inner field private

The public inner field violates C-STRUCT-PRIVATE. The value is already
accessible through `from_consensus` and `to_consensus_u32` so nothing
is lost by hiding the field.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedUpdate API filesby Mitchell Bagot · 76b1f333 · Jul 28, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedconsensus_encoding: Loosen serde_as_consensus trait boundsby Mitchell Bagot · 91a09335 · Jul 28, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Mitchell Bagot

consensus_encoding: Loosen serde_as_consensus trait bounds

The trait bounds in serde_as_consensus currently require Encode + Decode
for either serialize or deserialize. In the case of types which can be
Encoded but not Decoded (e.g. primitives' Block<Checked>) these
over-constrained bounds prevent serde serialisation, or vice-versa.

While this code has been released, removing trait bounds is not breaking
as it loosens the requirements on the type. That is, any Encode + Decode
type is also Encode alone or Decode alone.

Loosen trait bounds in serde_as_consensus to only Encode or Decode as
needed for each function.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedAdd encoding dep to taproot-primitivesby Mitchell Bagot · a291c3a2 · Jul 28, 2026 · 4 filesMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Add encoding dep to taproot-primitives

As a first step to introducing encoding for the hash types in
taproot-primitives, the encoding dependency needs to be added to the
crate.

Add consensus_encoding dependency to taproot-primitives.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedUpdate API filesby Mitchell Bagot · d166d57e · Jul 28, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 69e50bb3 · Jul 27, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.35.5 to 4.36.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/9e0d7b8d25671d64c341c19c0152d693099fb5ba...7211b7c8077ea37d8641b6271f6a365a22a5fbfa)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump taiki-e/install-action from 2.79.3 to 2.79.12by dependabot[bot] · d953dccc · Jul 27, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.79.3 to 2.79.12

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.3 to 2.79.12.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/65851e10cd6c377f11a60e600abc07cb08643468...6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.79.12
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedUpdate API filesby Mitchell Bagot · a487f942 · Jul 27, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · 85943c5a · Jul 27, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message