CommitWatch RSS
RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue652AI analyses
188commits · 30 days
404commits · 60 days
1283commits · 180 days
2064commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192247068
Tobin C. Harding40965105063
jrakibi944954068
Nick Johnson1892037059
Andrew Poelstra512024075
Jamil Lambert, PhD1141834061
Fmt Bot311419045
Trevor Arjeski111111069
Shing Him Ng31715056
Ismail Daif2267050
satsfy (Renato Britto)1768066
Martin Habovstiak27510069
Analysis record

Published AI watches

Last scanned 36 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

base58ck: Bump version to 0.5.0

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes,…

8479b56eby Tobin C. Harding+22−168 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Rename Error to DecodeCheckError

This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no chan…

b0eba4c0by Mitchell Bagot+45−395 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: decoder docs which are consensus specific

This commit only changes documentation comments in the consensus_encoding crate. It renames descriptions like 'Primitive decoders' to 'Primitive and combinator decoder types' and updates several function doc comments to say 'consensus deco…

5cdd5aa0by Nick Johnson+11−132 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add sha256::Midstate::SHA256_IV constant

This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than al…

dc21841bby Andrew Poelstra+39−143 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add several methods to sha256::Midstate for computing them in const contexts

This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature …

7d8f06d2by Andrew Poelstra+80−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: make Sequence inner field private

This commit makes a single internal number field private in a Rust Bitcoin library type called Sequence. It is an API-cleanup change to follow Rust naming conventions (C-STRUCT-PRIVATE). It does not fix a memory corruption bug, a cryptogra…

No security signal: this is an API-encapsulation refactorNo validation or serialization logic changedNo unsafe code, no cryptographic operations modified
30f280daby satsfy (Renato Britto)+9−96 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

taproot-primitives: Implement encoding traits for TapLeafHash

This commit adds standard data-encoding support for a Bitcoin Taproot hash type (TapLeafHash) so it can be properly serialized and deserialized in PSBT data. There is no indication of a security bug being fixed; it appears to be a missing-…

No security-relevant signal in commit message or diffChange is a feature addition (encoding trait implementations)No bounds-checking, memory-safety, or cryptographic flaws evident in diff
b2ab0896by Mitchell Bagot+59−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Split Address into an extension trait

This commit is a routine code reorganization in the rust-bitcoin library. It moves the `Address::from_script` method out of the main `Address` type into a new 'extension trait' called `AddressExt`. The actual logic of the function is copie…

c900fa8cby Mitchell Bagot+35−263 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: update cargo-rbmt ever month instead of week

This commit simply renames a GitHub Actions workflow file and changes its schedule from weekly to monthly. It is a routine CI maintenance change with no security relevance.

778018e1by Nick Johnson+46−461 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Use generic arguments for functions

This commit is a routine API cleanup: it makes a few Bitcoin merkle-root functions accept a broader range of input types (generic iterators and borrowed transactions) instead of only slices or exact iterator types. There is no security bug…

e887140aby Mitchell Bagot+26−184 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: Flatten nested checked_ops methods

This commit is a straightforward code cleanup in the rust-bitcoin library. It replaces deeply nested match blocks with newer, cleaner Rust syntax (let-else statements) inside safe arithmetic helper functions. The actual behavior of the cod…

99f3721dby Abeeujah+53−1274 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedUpdate api filesby Jamil Lambert, PhD · 2e8bd11d · Mar 10, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Jamil Lambert, PhD

Update api files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedAdd serde support for Vec<FeeRate>by Jamil Lambert, PhD · 1afe0abe · Mar 10, 2026 · 2 filesMessage 78 · AdequateTriage 0Details
Commit message · Jamil Lambert, PhD

Add serde support for Vec<FeeRate>

Serde support for Vec<FeeRate> is needed in corepc to update the bitcoin
dependence to 0.33.0.

Expand the serde support for FeeRate to also support Vec<FeeRate>.

Add tests of Vec<FeeRate> serialization and deserialization.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedconsensus_encoding: whitelist timeout mutantsby Nick Johnson · 8ab8c465 · Mar 10, 2026 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Nick Johnson

consensus_encoding: whitelist timeout mutants

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedprimitives: Move TxMerkleNodeDecoder/Error to merkle_treeby Mitchell Bagot · 469a9cc7 · Mar 10, 2026 · 4 filesMessage 73 · AdequateInformational 20Details
Commit message · Mitchell Bagot

primitives: Move TxMerkleNodeDecoder/Error to merkle_tree

In primitives the TxMerkleNode and its encoder are exported from the
merkle_tree module. The decoder is exported from the transaction
module.

Move the TxMerkleNodeDecoder and TxMerkleNodeDecoderError re-exports
to the merkle_tree module from the transaction module.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This commit is a straightforward code organization change. It moves where two helper types (TxMerkleNodeDecoder and TxMerkleNodeDecoderError) are publicly exported so they sit alongside related types in the merkle_tree module instead of the transaction module. There is no change to how data is decoded, no bug fix, and no security impact.

AI review queuedprimitives: Use ArrayRefEncoderby Tobin C. Harding · 736adeb9 · Mar 9, 2026 · 2 filesMessage 58 · ThinInformational 15Details
Commit message · Tobin C. Harding

primitives: Use ArrayRefEncoder

No need to copy the hash type when encoding the `TxMerkleNode` or
the `WitnessMerkleNode`.

Use `ArrayRefEncoder` as we do for the other hash types. Props to
claude for noticing this while chugging through some other changes
for me. I did the changes manually though.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a small internal code cleanup in the rust-bitcoin library. It changes how two hash-like types (transaction merkle node and witness merkle node) are encoded so that they reference existing data instead of making a copy. There is no security issue here—it's a performance/maintainability improvement that makes the code consistent with how other hash types are already encoded.

AI review queuedapi: update consensus_encoding traitsby Nick Johnson · 798195df · Mar 9, 2026 · 3 filesMessage 35 · OpaqueTriage 0Details
Commit message · Nick Johnson

api: update consensus_encoding traits

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedconsensus_encoding: add common trait implementationsby Nick Johnson · a7519267 · Mar 9, 2026 · 4 filesMessage 85 · StrongTriage 7Details
Commit message · Nick Johnson

consensus_encoding: add common trait implementations

Following API guidelines C-COMMON-TRAITS, adding Debug and Clone
implementations where we can to encoders and decoders.

A lot of the common traits, including PartialEq, Hash, Ord, Display,
Default, and Copy don't have semantic value for the stateful encoders
and decoders. For example, comparing two encoders with PartialEq would
be comparing a buffer and a cursor, not a logical value.

The composite decoders do not implement Clone because it would require a
Clone bound on the intermediate A::Output types, which seems too
constraining.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedImprove From<Infallible> impls to the hex_codec errorsby Tobin C. Harding · 5508596d · Mar 9, 2026 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Improve From<Infallible> impls to the hex_codec errors

Policy is to implement `From<Infallible>` for all error types.

Add missing impls, move the existing one to the 'right' place (right
by codebase convention), and import `Infallible`.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a routine code-quality change in a Rust Bitcoin library. It adds and reorganizes implementations of `From<Infallible>` for certain hex-decoding error types. `Infallible` is a Rust type that can never actually be produced, so these conversions are only useful for making the type system happy and have no security impact.

AI review queuedprimitives: Return reference to inner error in sourceby Tobin C. Harding · 73d30231 · Mar 9, 2026 · 2 filesMessage 73 · AdequateInformational 17Details
Commit message · Tobin C. Harding

primitives: Return reference to inner error in source

Each call to `source` for a stack of nested errors adds a layer. To
tie this all together `source` should return the layer below it i.e.,
the inner error not call through to `source` itself.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit fixes a small bug in how Rust error chains are reported for two Bitcoin parsing error types. Previously, when asking 'what caused this error?', the code accidentally skipped past the immediate cause and returned the next level up. Now it correctly returns the immediate inner error. This is a correctness fix for error reporting and does not directly create a security vulnerability or allow attacks.

AI review queuedconsensus_encoding: Add tests for CompactSizeDecoder limit handlingby Mitchell Bagot · c7592569 · Mar 7, 2026 · 1 fileMessage 83 · StrongInformational 14Details
Commit message · Mitchell Bagot

consensus_encoding: Add tests for CompactSizeDecoder limit handling

The CompactSizeDecoder can enforce a limit on the valid values to
decode through the new or new_with_limit constructors. At present,
there are no tests to validate this functionality at the boundary
values.

Introduce tests to check limit handling at the boundaries for both
the new and new_with_limit constructors.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validationparser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 14/100

This commit only adds new unit tests for an existing feature. It does not change any production code, fix a bug, or alter behavior. The tests verify that a decoder correctly accepts values at or below its configured limit and rejects values above it. There is no security issue here.

AI review queuedDo not call into_iterby Tobin C. Harding · fb006eb4 · Mar 3, 2026 · 1 fileMessage 51 · ThinInformational 15Details
Commit message · Tobin C. Harding

Do not call into_iter

Found by clippy and the new nightly toolchain update in (#5743).

No need to explicitly call `into_iter`.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a minor code cleanup commit. It removes unnecessary `.into_iter()` calls in three places where Rust will automatically handle iteration. The behavior of the code is unchanged, and there is no security issue.

AI review queuedconsensus_encoding: move decoders inline tests to integrationby Nick Johnson · 976a2348 · Feb 26, 2026 · 2 filesMessage 60 · AdequateTriage 7Details
Commit message · Nick Johnson

consensus_encoding: move decoders inline tests to integration

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedconsensus_encoding: move decode inline tests to integrationby Nick Johnson · 9d1810d3 · Feb 26, 2026 · 2 filesMessage 83 · StrongTriage 7Details
Commit message · Nick Johnson

consensus_encoding: move decode inline tests to integration

Prefer integration test over inline since they hit the exposed API. A test
can live in integration as long as every name it touches is reachable
through lib.rs.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedconsensus_encoding: beef up module docsby Nick Johnson · 3e765dba · Feb 24, 2026 · 3 filesMessage 68 · AdequateTriage 7Details
Commit message · Nick Johnson

consensus_encoding: beef up module docs

More conventional C-CRATE-DOC and C-EXAMPLE. The crate doc is essentially
a stripped down version of the original ADR doc. C-EXAMPLE calls for an
example on every public item within reason. It would be very repetative
to apply examples on every item in this crate, a single encoder and
decoder example can probably be used by all items.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedRemove alloc requirement for HexPrimitiveby Mitchell Bagot · 032c5db4 · Feb 24, 2026 · 3 filesMessage 80 · StrongInformational 18Details
Commit message · Mitchell Bagot

Remove alloc requirement for HexPrimitive

The Display/Debug/UpperHex/LowerHex implementations on HexPrimitive
all relied on alloc due to the implementation of hex_write_with_case.
This locks LowerHex and UpperHex on Header behind alloc, and led to
an unnecessary custom implementation of Display.

Change hex_write_with_case to remove alloc requirement, and remove
corresponding feature gates. Move hex_write_with_case to inherent
function on HexPrimitive, and rename to fmt_hex. Replace Display impl
on Header with call through to HexPrimitive. Remove feature gates on
Header Upper/LowerHex.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This is a routine code cleanup in the rust-bitcoin library. It removes the need for the 'alloc' feature when formatting certain Bitcoin data types as hex, making the hex formatting work in more constrained environments. There is no indication this fixes a security vulnerability.

AI review queuedAdjust from_str in HexPrimitive to be no-allocby Mitchell Bagot · 8b4b80b3 · Feb 24, 2026 · 4 filesMessage 80 · StrongInformational 17Details
Commit message · Mitchell Bagot

Adjust from_str in HexPrimitive to be no-alloc

The from_str implementation for parsing types from hex strings currently
relies on alloc due to the use of hex::decode_to_vec. This locks Header
FromStr decoding behind alloc.

Implement from_str without alloc, and adjust feature gates on
HeaderDecoder to match new relaxed requirements.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit is a routine refactoring of how hex strings are parsed into Bitcoin data structures in the rust-bitcoin library. It replaces an allocation-based hex decoder with a streaming, no-allocation decoder so the code can run in environments without a heap allocator. There is no direct security bug being fixed; it is a feature-gate and performance/capability cleanup.

AI review queuedconsensus_encoding: add track_caller to panic-able sitesby Nick Johnson · 0276325e · Feb 23, 2026 · 1 fileMessage 65 · AdequateTriage 7Details
Commit message · Nick Johnson

consensus_encoding: add track_caller to panic-able sites

Defensively added to the Decoder trait itself since the performance
impact is negligible.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
parser or protocol pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI review queuedRe-release without rc suffixby Tobin C. Harding · 418685a9 · Feb 23, 2026 · 20 filesMessage 90 · StrongTriage 0Details
Commit message · Tobin C. Harding

Re-release without rc suffix

Turns out that the `-rc.0` suffix causes way more problems than it
solves because of how `cargo` resolves the version numbers and what we
intended on using the RC releases for.

In brief

- We wanted to be able to do breaking changes if required
- We wanted to signal that these releases were almost there (TM)
- We wanted to be able to do downstream testing including releasing
downstream crates with the RC releases as part of their public API.

In hindsite we messed up and should have just kept iterating as normal
until we were ready.

Re-release the whole stack without any rc suffix's. However keep
`bitcoin 0.33.0-beta` because we want 0.32.0 to be the latest stable
release and its important that it shows as such on docs.rs

Also, for pre-1.0 crates that had an rc release just jump to the next
version i.e., `io 0.4.0-rc.0` goes to `io 0.5.0`. Just for good
measure.


crate | latest stable | latest RC | with this applied
-----------------------------------------------------------
consensus_encoding 0.0.0 1.0.0-rc.3 0.1.0
units 0.2.0 1.0.0-rc.4 0.3.0
primitives 0.101.0 1.0.0-rc.2 0.102.0
hashes 0.19.0 - 0.20.0
io 0.3.0 0.4.0-rc.0 0.5.0
base58ck 0.3.0 - 0.4.0


bitcoin - 0.33.0-beta.0 to be yanked. Release as 0.33.0-beta

p2p - updated deps, unrelased so no other changes.
internals - not touched (currently 0.5.0)
chacha20_poly1305 - not touched

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
second-pass: unusually broad change
AI review queuedUpdate apiby Nick Johnson · c9cdde0b · Feb 21, 2026 · 1 fileMessage 0 · OpaqueTriage 0Details
Commit message · Nick Johnson

Update api

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedconsensus_encoding: remove redundant trait boundsby Nick Johnson · 3ea57579 · Feb 20, 2026 · 1 fileMessage 45 · ThinTriage 7Details
Commit message · Nick Johnson

consensus_encoding: remove redundant trait bounds

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedUpdate the API filesby jrakibi · d65b496d · Feb 19, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · jrakibi

Update the API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedp2p: implement decoding for Addressby yancy · ca7e9259 · Feb 19, 2026 · 1 fileMessage 86 · StrongTriage 0Details
Commit message · yancy

p2p: implement decoding for Address

Endian byte order for both IPv4 and the port number are interpreted as
big endian per the Addr section of:
https://developer.bitcoin.org/reference/p2p_networking.html

In the test cases, `deserialize` is swapped for
`encoding::decode_from_slice` since the addition of push bytes decoding
is planned to replace the existing `deserialize` implementation.

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedconsensus: Add CompactSize range check to deserializationby Erick Cestari · 1dd1d92f · Feb 18, 2026 · 4 filesMessage 83 · StrongTriage 0Details
Commit message · Erick Cestari

consensus: Add CompactSize range check to deserialization

Reject CompactSize values exceeding MAX_COMPACT_SIZE (0x02000000) during
deserialization, matching Bitcoin Core's serialize.h limit.

Extract read_compact_size logic into a private free function to allow
tests to bypass the range check when validating non-minimal encoding.

Add test for the new SizeTooLargeCompactSize error at the boundary.

Update bip152 error test to expect failure at deserialization rather
than at index computation, since the range check now triggers earlier.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedhashes: simplify trait boundsby Conger Rassen · c423b93a · Feb 18, 2026 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Conger Rassen

hashes: simplify trait bounds

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedunits: Add fmt traits for simple wrapper typesby Mitchell Bagot · 9c166f5e · Feb 17, 2026 · 11 filesMessage 60 · AdequateInformational 19Details
Commit message · Mitchell Bagot

units: Add fmt traits for simple wrapper types

Add Display, LowerHex, UpperHex, Octal and Binary implementations for
all integer wrapper types except FeeRate.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit adds new ways to print or display several simple numeric wrapper types in the rust-bitcoin library, such as block heights, amounts, and timestamps. It does not change any security-sensitive logic, parsing, arithmetic, or network behavior. It is a routine API enhancement with no apparent security relevance.