RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue817AI analyses
188commits · 30 days
404commits · 60 days
1283commits · 180 days
2064commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192307068
Tobin C. Harding40965124063
jrakibi944959068
Nick Johnson1892069059
Andrew Poelstra512028075
Jamil Lambert, PhD1141842061
Fmt Bot311420045
Trevor Arjeski111111069
Shing Him Ng31718056
Ismail Daif2268050
satsfy (Renato Britto)1769066
Martin Habovstiak27511069
Analysis record

Published AI watches

Last scanned 31 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API snapshot text files to remove two lines that documented a `From<u16>` conversion for a locktime type. No actual Rust source code was changed, so there is no runtime behavior change or security fix in …

6ea25bedby Mitchell Bagot+0−123 files
No security note in commit
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

base58ck: Bump version to 0.5.0

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes,…

8479b56eby Tobin C. Harding+22−168 files
No security note in commit
Informational 20 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Rename Error to DecodeCheckError

This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no chan…

b0eba4c0by Mitchell Bagot+45−395 files
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API snapshot text files to reflect that the remainder (modulo) operator for the Weight type now returns another Weight instead of a plain number. It contains no source code changes, no bug fix, and no sec…

351acf8eby Mitchell Bagot+6−63 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: decoder docs which are consensus specific

This commit only changes documentation comments in the consensus_encoding crate. It renames descriptions like 'Primitive decoders' to 'Primitive and combinator decoder types' and updates several function doc comments to say 'consensus deco…

5cdd5aa0by Nick Johnson+11−132 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedupdate renamed clippy lintsby Conger Rassen · be83540a · Feb 17, 2026 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Conger Rassen

update renamed clippy lints

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedrefactor(fuzz): remove custom fuzz_utils moduleby Erick Cestari · 4b4053c0 · Feb 14, 2026 · 3 filesMessage 90 · StrongInformational 15Details
Commit message · Erick Cestari

refactor(fuzz): remove custom fuzz_utils module

Remove the hand-rolled `consume_random_bytes`, `consume_u64`, and
`consume_u32` helpers and the `bitcoin_fuzz` lib crate.

- Use `<&[u8]>::arbitrary` to split fuzz input into borrowed slices
- Flatten nested match blocks into early returns for readability

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup in the project's fuzz-testing harness. It removes a small set of hand-written helper functions and replaces them with a standard library approach for splitting fuzz input into slices. There is no change to the actual Bitcoin library code that users rely on, and nothing in the commit suggests a security fix.

AI review queuedchacha20poly1305: migrate to workspace lintby Nick Johnson · 639212bb · Feb 13, 2026 · 5 filesMessage 68 · AdequateTriage 0Details
Commit message · Nick Johnson

chacha20poly1305: migrate to workspace lint

Some copy code for initializing poly1305 key was refactored to
semantically equivelent (produces same machine code), but doesn't
trigger the clippy panic docs requirement.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedprimitives: Add hash type name to Debug outputby Mitchell Bagot · b75a2633 · Feb 13, 2026 · 12 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Add hash type name to Debug output

The hash types from primitives all debug using hexadecimal. Unlike
typical newtypes, they don't debug with the newtype name, making
the exact hash type unclear without contextual clues.

Introduce newtype name to debug output for hash types in primitives.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes how hash values look when printed for debugging. It adds the type name (like 'Txid(...)') around the hexadecimal hash string so developers can more easily tell which kind of hash they are looking at. It does not change how hashes are compared, stored, serialized, or used in Bitcoin logic.

AI review queuedhashes: Add hash type name to Debug outputby Mitchell Bagot · 17322bff · Feb 13, 2026 · 3 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

hashes: Add hash type name to Debug output

For the sake of uniformity with the changes in primitives, change
the Debug format in the hashes implementations for hash wrapper
types.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes how hash values look when printed in debugging output. Instead of showing just the raw hex string, the debug format now also includes the type name, like 'Txid(bitcoin_hashes::sha256d::Hash(...))'. It does not change any behavior that handles real bitcoin data, secrets, or network messages, and it introduces no security risk.

AI review queuedReplace DecoderNError implementations with macroby Mitchell Bagot · 6bec9c13 · Feb 9, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Replace DecoderNError implementations with macro

As with the EncoderN composite encoders, the DecoderNError types
can be trivially replaced with a macro to significantly reduce the
quantity of repeated boilerplate code for each of them.

Introduce define_decoder_n_error macro to define DecoderNError types
for any N.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup. It replaces several nearly identical error-type definitions with a single Rust macro, reducing duplicated boilerplate. There is no change to how the library behaves, what data it accepts, or how it handles errors.

AI review queueddev: implement standard traits for ChaCha20-Poly1305 data typesby Abeeujah · 0df18257 · Feb 5, 2026 · 3 filesMessage 90 · StrongTriage 0Details
Commit message · Abeeujah

dev: implement standard traits for ChaCha20-Poly1305 data types

Implement a comprehensive suite of common traits (Copy, Clone, Eq, Ord, Hash)
across chacha20_poly1305 cryptographic structures to improve API usability and integration with
standard library collections.

Changes
- Added Copy, Clone, PartialEq, Eq, PartialOrd, Ord, and Hash to:
- Poly1305
- Key
- Nonce
- U32x4
- State
- ChaCha20
- ChaCha20Poly1305
- Added Debug only to non-sensitive internal types (U32x4, State).

Security Note
The Debug trait was intentionally omitted for types holding sensitive data
(Key, Nonce, ChaCha20, etc.) to prevent accidental leakage of secret
keying values or internal cipher states through logging or unwraps.

90/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Names security-relevant behavior explicitly
Why it was queued
second-pass: broader security terminology
AI review queuedrefactor: remove From<UnexpectedEof> impls for decoder errorsby Abeeujah · 73ee530d · Feb 3, 2026 · 9 filesMessage 93 · StrongInformational 17Details
Commit message · Abeeujah

refactor: remove From<UnexpectedEof> impls for decoder errors

Replace From UnexpectedEOF implementations with .map_err() calls
across various primitive decoder types.

Modified types:
- VersionDecoderError
- BlockHashDecoderError
- TxMerkleNodeDecoderError
- WitnessMerkleNodeDecoderError
- CompactTargetDecoderError

Fixes: #5562

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This is a code cleanup change in the rust-bitcoin library. It removes automatic error conversions (From trait implementations) for certain decoder errors and replaces them with explicit .map_err() calls. The behavior of the code appears functionally identical—errors are still propagated the same way. There is no indication this fixes a security vulnerability.

AI review queuedEnforce lifetime in encoder_newtypeby Mitchell Bagot · d49f587c · Feb 2, 2026 · 23 filesMessage 58 · ThinInformational 17Details
Commit message · Mitchell Bagot

Enforce lifetime in encoder_newtype

Since we want all encoder types to include a lifetime, encoder_newtype
must be changed to introduce a lifetime to be passed to inner encoder
types.

Require lifetime specifier for encoder_newtype macro and introduce
lifetime for all affected call sites.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit is a Rust type-system cleanup. It changes a macro that creates encoder wrapper types so that every wrapper must carry a lifetime parameter, and updates all uses across the codebase. There is no change to runtime behavior, wire format, or cryptographic logic. It prevents future misuse of the macro but does not fix a known exploitable bug.

AI review queuedMove Transaction encoder inner type to aliasby Mitchell Bagot · 46d514de · Feb 2, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Move Transaction encoder inner type to alias

With the introduction of lifetimes, the inner encoder type for the
Transaction encoder will become sufficiently complex to trigger lints.

Introduce a type alias TransactionEncoderInner.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a minor internal code cleanup in the Rust Bitcoin library. It replaces a long, complex type definition inside a macro with a shorter type alias name. There is no change to how transactions are encoded, no change to public behavior, and no security relevance.

AI review queuedprimitives: Add fmt traits for simple wrapper typesby Mitchell Bagot · 6b534904 · Feb 2, 2026 · 6 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Add fmt traits for simple wrapper types

The integer wrapper types have inconsistent display trait
implementations. For 1.0, these should be unified to make working
with numeric types simple for users.

Introduce all fmt traits as passthroughs for CompactTarget and
both Version types.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds extra text formatting abilities (like showing numbers in hexadecimal, binary, or octal) to three simple numeric wrapper types in the rust-bitcoin library: block version, transaction version, and compact target. It is a routine usability improvement with no security relevance.

AI review queuedtest(p2p): Update deserialize for `AddrV2`by rustaceanrob · 1d587674 · Jan 31, 2026 · 1 fileMessage 67 · AdequateTriage 0Details
Commit message · rustaceanrob

test(p2p): Update deserialize for `AddrV2`

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedprimitives: fix tests that created txs with no outputsby jrakibi · 32fefd70 · Jan 25, 2026 · 2 filesMessage 83 · StrongInformational 15Details
Commit message · jrakibi

primitives: fix tests that created txs with no outputs

Update `decode_zero_inputs` and `block_decode` tests to include a
valid output, as transactions with no outputs are now rejected

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates two internal unit tests so they create transactions that have at least one output. The change is a test-only follow-up after the library started rejecting transactions with no outputs. There is no change to production code, no security fix, and no vulnerability being patched.

AI review queuedprimitives: reject transactions with 0 outputsby jrakibi · 15a947be · Jan 25, 2026 · 2 filesMessage 86 · StrongLow 47Details
Commit message · jrakibi

primitives: reject transactions with 0 outputs

Transactions must have at least one output.

This is another syntactic check that doesn't depend on any context,
and the last one on this list https://github.com/rust-bitcoin/rust-bitcoin/issues/5383#issuecomment-3646014920.
We add validation to reject transactions with empty outputs during decoding.

Two existing tests that created transactions with no outputs are ignored
and will be fixed in the next commit.

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 47/100

This commit adds a rule to reject Bitcoin transactions that have no outputs when they are decoded. In Bitcoin, every valid transaction must send bitcoin somewhere, so a transaction with zero outputs is invalid. The change prevents the library from accepting or processing such malformed transactions, which could otherwise lead to inconsistent behavior compared to Bitcoin Core and other nodes.

AI review queuedp2p: Allow too many argsby Tobin C. Harding · b997f142 · Jan 23, 2026 · 1 fileMessage 38 · OpaqueTriage 0Details
Commit message · Tobin C. Harding

p2p: Allow too many args

For now just shoosh the linter.

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedImprove test coverage for TxMerkleNodeby Jamil Lambert, PhD · 5fb07d04 · Jan 22, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Improve test coverage for TxMerkleNode

Add two tests to increase the test coverage to 100% for
transaction_merkle_node.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds two new unit tests for the TxMerkleNode type. It does not change any production code, fix a bug, or alter behavior. There is no security relevance.

AI review queuedbip152: Add an `Offset` wrapper typeby rustaceanrob · 940602f0 · Jan 22, 2026 · 2 filesMessage 90 · StrongTriage 0Details
Commit message · rustaceanrob

bip152: Add an `Offset` wrapper type

When implementing `encoding` with a list of items it's nice to have
`Encodable` implemented for the item that will go into the
`SliceEncoder` to avoid prep steps. I also think this type should be
revamped.

For one, having struct initialization available for this type allows for
creating completely invalid states that result in panics. This is shown
by a test that literally asserts creating the struct results in a panic
when trying to serialize it later. A simple case that is not currently
tested is when the user passes an unsorted vector in the initialization
and later tries to encode this type. I introduce two constructors here
that make it clear the client should sort the list themselves, or allow
the sort to happen on construction. The encoding functions here were
doing an immense amount of logic, which I think should be pushed out to
a designated method call.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedAdjust error re-export doc inliningby Mitchell Bagot · 9209abdf · Jan 21, 2026 · 3 filesMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

Adjust error re-export doc inlining

Error re-exports in bitcoin and primitives should use #[doc(no_inline)]
to ensure that pure re-export types are rendered as re-exports and not
defined types of the module in docs.

Use #[doc(no_inline)] for BlockHashDecoderError in primitives and
PushBytesError, ParseTransactionError, and ParseOutPointError in
bitcoin.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes how Rust documentation is generated for certain error types. It switches some re-exports from being shown as if they were defined in the current module to being shown as re-exports from another module. There is no change to actual code behavior, no security fix, and no vulnerability.

AI review queuedAdd *_with_max difficulty functions to Targetby Mitchell Bagot · 2f842a42 · Jan 18, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · Mitchell Bagot

Add *_with_max difficulty functions to Target

In order to allow for Target to eventually be moved out from bitcoin,
it is necessary to decouple its dependency on Params. Since it is
necessary to maintain the difficulty calculations, a Params-less
variation is introduced that the original version can call through to.

Add difficulty_with_max and difficulty_float_with_max to Target.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
second-pass: broader security terminology
AI review queued2026-01-18 automated rustfmt nightlyby Fmt Bot · 4d2fee84 · Jan 18, 2026 · 4 filesMessage 45 · ThinInformational 15Details
Commit message · Fmt Bot

2026-01-18 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup performed by an automated rustfmt nightly run. It reorders imports, collapses or expands brace blocks, removes blank lines, and adjusts line wrapping in test code. No program logic, APIs, or security behavior was changed.

AI review queuedprimitives: test individual output value > MAX_MONEYby jrakibi · 75682547 · Jan 17, 2026 · 1 fileMessage 60 · AdequateInformational 12Details
Commit message · jrakibi

primitives: test individual output value > MAX_MONEY

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit only adds a new unit test. It does not change any production code. The test checks that the library rejects Bitcoin transactions containing an output worth more than the maximum allowed money (MAX_MONEY + 1 satoshi) when decoding transaction bytes. It is a defensive test borrowed from Bitcoin Core's test data, confirming an existing safety check works.

AI review queuedFix typos highlighted in closed LLM PRsby Jamil Lambert, PhD · 8ff6130e · Jan 14, 2026 · 3 filesMessage 45 · ThinInformational 15Details
Commit message · Jamil Lambert, PhD

Fix typos highlighted in closed LLM PRs

Simple spelling mistakes etc. only.

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit fixes only spelling mistakes in documentation and a test comment. There are no code behavior changes, no security fixes, and no functional changes to the library.

AI review queuedFix incorrect comments in unitsby Jamil Lambert, PhD · 4ff621d4 · Jan 14, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Fix incorrect comments in units

Correct incorrect calculation of U16::MAX * 512.

Correct copy paste error that reverenced wrong fn name.

Originally highlighted in an LLM PR that was closed without merging.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only fixes two mistakes in code comments. One comment incorrectly named a previously called function, and another comment had a wrong arithmetic result for the maximum time value. No actual code behavior changes, so there is no security impact.

AI review queuedFix unreachable error bug during iteration of funding utxosby Shing Him Ng · a5bd5024 · Jan 7, 2026 · 1 fileMessage 50 · ThinLow 45Details
Commit message · Shing Him Ng

Fix unreachable error bug during iteration of funding utxos

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 45/100

This commit fixes a bug where a specific PSBT error—'PsbtUtxoOutOfbounds'—was not handled during transaction extraction, causing the program to panic (crash) instead of returning a proper error. The fix makes the code treat this error the same as a missing UTXO, returning a controlled error message instead of hitting an 'unreachable' panic path. It is a robustness fix that prevents crashes when processing malformed or inconsistent PSBT data.

AI review queuedRun the formatterby Jamil Lambert, PhD · d4e6ea90 · Jan 5, 2026 · 9 filesMessage 28 · OpaqueInformational 15Details
Commit message · Jamil Lambert, PhD

Run the formatter

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathparser or protocol pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is purely a code-formatting run. It rewraps long lines, reorders imports, removes blank lines, and adjusts whitespace to match the project's style rules. No logic, behavior, or security checks were changed.