RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue969AI analyses
188commits · 30 days
404commits · 60 days
1283commits · 180 days
2064commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192332068
Tobin C. Harding40965152063
jrakibi944963068
Nick Johnson1892091059
Andrew Poelstra512033075
Jamil Lambert, PhD1141849061
Fmt Bot311420045
Trevor Arjeski111111069
Shing Him Ng31724056
Ismail Daif22612050
satsfy (Renato Britto)17611066
Martin Habovstiak27511069
Analysis record

Published AI watches

Last scanned 35 minutes ago

Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API snapshot text files to remove two lines that documented a `From<u16>` conversion for a locktime type. No actual Rust source code was changed, so there is no runtime behavior change or security fix in …

6ea25bedby Mitchell Bagot+0−123 files
No security note in commit
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

base58ck: Bump version to 0.5.0

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes,…

8479b56eby Tobin C. Harding+22−168 files
No security note in commit
Informational 20 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Rename Error to DecodeCheckError

This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no chan…

b0eba4c0by Mitchell Bagot+45−395 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedprimitives: Move is_coinbase into primitivesby Mitchell Bagot · d325c292 · Dec 3, 2025 · 4 filesMessage 80 · StrongInformational 15Details
Commit message · Mitchell Bagot

primitives: Move is_coinbase into primitives

In order to move various functionality from BlockUncheckedExt trait
into the main Block<Unchecked> implementation, various surrouning
functionality must also be moved into primitives to prevent an
inverted dependency of primitives on bitcoin.

Move is_coinbase implementation from the TransactionExt in bitcoin
directly to the Transaction implementation in primitives.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine internal code reorganization. It moves a helper method, is_coinbase, from one module to another within the same project. The method's logic and behavior are unchanged, and there is no indication of a security fix or vulnerability.

AI review queuedprimitives: Move MerkleNode and TxIdentifier into primitivesby Mitchell Bagot · a8741234 · Dec 1, 2025 · 10 filesMessage 83 · StrongInformational 15Details
Commit message · Mitchell Bagot

primitives: Move MerkleNode and TxIdentifier into primitives

The MerkleNode trait in bitcoin provides convenience functions for
the TxMerkleNode and WitnessMerkleNode hash types to work with the
nodes as a tree. Moving the functionality of this trait into primitives
acts as a precursor to allow other functionality to move also.

Move the MerkleNode trait to primitives, making it private. Provide the
same interface for users through pub functions that wrap the private
trait. Introduce tests to cover mutants. Introduce TxIdentifier in
primitives.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine internal code reorganization. It moves the existing Merkle tree helper trait and transaction identifier abstraction from the main `bitcoin` crate into the lower-level `primitives` crate, and adds public wrapper functions and tests. The actual Merkle root calculation logic is copied verbatim, with no functional change.

AI review queuedUse usize for CompactSizeEncoder::newby Mitchell Bagot · b486c836 · Nov 30, 2025 · 6 filesMessage 68 · AdequateInformational 18Details
Commit message · Mitchell Bagot

Use usize for CompactSizeEncoder::new

The current CompactSizeEncoder::new() constructor uses an impl ToU64
for its first parameter. The ToU64 trait is part of internals, and
thus isn't permitted to be part of the public API of consensus_encoding.

Change the ToU64 parameter type to usize, encoding values outside of
the u64 range (such as on 128 bit system) as u64::MAX.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a small API cleanup, not a security fix. It changes a Bitcoin data-encoding helper so it accepts ordinary memory sizes (usize) instead of a special internal type. The only behavioral change is on hypothetical future 128-bit computers, where impossibly large values would be encoded as the maximum allowed u64 value. On all current systems the output is unchanged.

AI review queuedprimitives: Convert various functions to constby Mitchell Bagot · ec9ec525 · Nov 28, 2025 · 10 filesMessage 60 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Convert various functions to const

Convert constructors with zero arguments, getter and setter functions
to const in primitives.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code-quality improvement. It marks a number of simple constructor and getter functions as 'const', which lets the Rust compiler evaluate them at compile time. There is no change to what the functions do, no bug fix, and no security-relevant behavior change.

AI review queuedunits: Convert various functions to constby Mitchell Bagot · 98b5777c · Nov 28, 2025 · 8 filesMessage 60 · AdequateInformational 15Details
Commit message · Mitchell Bagot

units: Convert various functions to const

Convert constructors with zero arguments, getter and setter functions
to const in units.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code-quality improvement. It marks several simple constructor and getter functions as 'const', meaning they can be evaluated at compile time. There is no change to program logic, no bug fix, and no security relevance.

AI review queuedAdd decode test for reserve capacityby Jamil Lambert, PhD · 11d3f375 · Nov 26, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Add decode test for reserve capacity

There are new mutants in the reserve function for both VecDecoder and
ByteVecDecoder.

Add two new tests to check the functionality of reserve and kill the
mutants.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds two new unit tests to verify that two decoder types allocate memory in correctly-sized batches. It does not change any production code, fix a bug, or alter behavior. There is no security-relevant change.

AI review queuedunits: Replace manual ceil division with div_ceilby Mitchell Bagot · a9f54c64 · Nov 26, 2025 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

units: Replace manual ceil division with div_ceil

Since the bump to MSRV 1.74, we now have access to div_ceil for ceiled
division of integer types. There are various places in units that we
manually implement ceiling division that can now be replaced by calls
to div_ceil.

Convert div_by_weight_ceil, div_by_fee_rate_ceil and mul_by_weight
to use div_ceil in place of manual ceiling division.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup in the rust-bitcoin library. It replaces hand-written ceiling-division logic with Rust's newer built-in `div_ceil` function. The math result is intended to be identical, and there is no indication of a security bug being fixed.

AI review queuedSkip formatting byte arraysby Tobin C. Harding · 1f806395 · Nov 23, 2025 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Tobin C. Harding

Skip formatting byte arrays

8 byte column are easier to read.

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds formatting hints to test code so that a code formatter (rustfmt) leaves byte arrays arranged in tidy 8-byte columns. It does not change any behavior, logic, or security-sensitive code.

AI review queuedfuzz: Update generate_files.sh for current targetsby Mitchell Bagot · b7c2e084 · Nov 21, 2025 · 3 filesMessage 83 · StrongInformational 15Details
Commit message · Mitchell Bagot

fuzz: Update generate_files.sh for current targets

In a2c809b, several new fuzz targets were introduced for
consensus_encoding. The fuzz crate's Cargo.toml was updated, but the
corresponding changes to generate-files.sh were not made. Since the
fuzz Cargo.toml is generated by generate-files.sh, it should be kept
up to date with any new changes.

Add consensus_encoding dependency and new Clippy lints to
generate-files.sh, and update the Cargo.toml and daily fuzz files
by running generate-files.sh.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit is a routine maintenance update to the project's fuzz-testing infrastructure. It adds newly-created fuzz test targets to a script that auto-generates configuration files, and refreshes the generated files to match. There is no change to the actual Bitcoin library code that users rely on, and no security fix or vulnerability is present.

AI review queuedUpdate CHANGELOG.mdby maradini77 · 4eb16391 · Nov 21, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · maradini77

Update CHANGELOG.md

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit is a one-character typo fix in the changelog, changing 'paramater' to 'parameter'. It does not modify any source code, build scripts, tests, or documentation that affects how the software behaves.

AI review queuedio: Make traits dyn compatibleby Tobin C. Harding · 45d3f188 · Nov 21, 2025 · 6 filesMessage 78 · AdequateInformational 18Details
Commit message · Tobin C. Harding

io: Make traits dyn compatible

Add an API test that shows dyn compatibility of std io traits and the
same for ours. Patch the crate to make the test pass.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a routine API cleanup: it changes custom I/O traits in the rust-bitcoin project so they can be used with Rust's dynamic-dispatch feature ('dyn'). The code changes are purely about making the traits more flexible for downstream users. There is no indication in the commit or title that this fixes a security vulnerability, and the diff does not change any security-critical behavior such as bounds checking, parsing limits, or cryptographic validation.

AI review queuedprimitives: handle zero-input transactionsby Nick Johnson · 1f7969f4 · Nov 14, 2025 · 1 fileMessage 68 · AdequateLow 34Details
Commit message · Nick Johnson

primitives: handle zero-input transactions

rust-bitcoin always uses the Segwit witness encoding for zero input
transactions, described in detail in the Serialization notes of the
transaction docs. When decoding such case, there are no witnesses
so the decoder should skip to decoding the locktime.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 34/100

This commit fixes a bug in how the rust-bitcoin library decodes Bitcoin transactions that have no inputs. Normally, the library uses a special encoding for zero-input transactions. The decoder was incorrectly trying to read witness data even when there were no inputs, which would cause decoding to fail. The fix skips witness decoding when there are no inputs, and a new test verifies that an empty transaction can be encoded and decoded correctly.

AI review queuedRemove redundant array allocation and copy in OutPointDecoderby Mitchell Bagot · 0e5f901f · Nov 13, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Remove redundant array allocation and copy in OutPointDecoder

OutPointDecoder::end() currently decodes data into a 36-byte array,
before copying subslices to pass through to constructors for the inner
fields. This is needlessly wasteful.

Remove the array allocations and byte array copies in
OutPointDecoder::end() and construct inner OutPoint fields directly
from the decoded array.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup. It removes a temporary 36-byte buffer and manual byte copying when decoding an OutPoint (a Bitcoin transaction reference), replacing it with a direct split of the already-decoded byte array. There is no security-relevant change.

AI review queueddoc: Add version documentby Tobin C. Harding · 7888b60a · Nov 11, 2025 · 1 fileMessage 58 · ThinInformational 15Details
Commit message · Tobin C. Harding

doc: Add version document

Add a document that explicitly states which versions of `bitcoin` are
long term support (LTS).

Include a list that maps `bitcoin` version to its dependency versions
for crates in this repo.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit only adds a new documentation file describing which versions of the rust-bitcoin library are considered long-term support (LTS) and which dependency versions correspond to each release. No code was changed, and there is no security fix or vulnerability present.

AI review queuedrefactor: enable redundant_clone lint and fix warningsby Klaklax · 5ecef4b3 · Nov 5, 2025 · 19 filesMessage 62 · AdequateInformational 15Details
Commit message · Klaklax

refactor: enable redundant_clone lint and fix warnings

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup: it turns on a Rust linter warning for unnecessary .clone() calls and removes those unnecessary clones. There is no security-relevant behavior change.

AI review queuedAdd test to kill mutant in decode_from_readby Jamil Lambert, PhD · d391298b · Nov 4, 2025 · 1 fileMessage 78 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Add test to kill mutant in decode_from_read

Mutation testing found a mutant in decode_from_read.

Add a decode_from_read test the same as `decode_from_slice_extra_data`
and `decode_from_read_unbuffered_extra_data`.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a new unit test to the codebase. It does not change any production code, fix a bug, or alter behavior. The test verifies that a decoding function correctly ignores extra bytes after the expected data when reading from a stream. There is no security issue present in the commit itself.

AI review queuedAdd test to kill mutant in push_bytesby Jamil Lambert, PhD · 20ebf277 · Nov 4, 2025 · 1 fileMessage 78 · AdequateInformational 12Details
Commit message · Jamil Lambert, PhD

Add test to kill mutant in push_bytes

Mutation testing found a mutant in calculating the remaining bytes to
decode in `<impl Decoder for ByteVecDecoder>::push_bytes`.

Add tests for both single and multi-chunk consumption.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit only adds new unit tests for a decoder that reads length-prefixed byte vectors. It does not change any production code, so it cannot introduce or fix a runtime security vulnerability by itself. The tests verify that the decoder stops exactly at the declared payload length and does not accidentally consume extra trailing bytes.

AI review queuedconsensus_encoding: add clippy::use_self lintby Jose Storopoli · 7a970b1f · Oct 31, 2025 · 4 filesMessage 45 · ThinInformational 15Details
Commit message · Jose Storopoli

consensus_encoding: add clippy::use_self lint

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code-quality cleanup. It turns on a Rust linter rule (clippy::use_self) that encourages using 'Self' instead of repeating a type's name inside its own implementation blocks, and updates the affected code to satisfy the new rule. There is no functional change, no bug fix, and no security relevance.

AI review queuedunits: add clippy::use_self lintby Jose Storopoli · 29f9b110 · Oct 31, 2025 · 20 filesMessage 45 · ThinInformational 15Details
Commit message · Jose Storopoli

units: add clippy::use_self lint

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a code-style cleanup in the rust-bitcoin library's units crate. It enables a Clippy lint called use_self and replaces explicit type names (like FeeRate, Weight, LockTime) with the shorthand Self inside impl blocks. These changes do not alter program behavior, fix no bugs, and have no security relevance.

AI review queuedprimitives: add clippy::use_self lintby Jose Storopoli · f4d7e05d · Oct 31, 2025 · 11 filesMessage 45 · ThinInformational 15Details
Commit message · Jose Storopoli

primitives: add clippy::use_self lint

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only turns on a Rust style lint (clippy::use_self) and replaces explicit type names with `Self` in the source code. It does not change what the code does, only how it is written. There is no security impact.

AI review queuedConvert encoder/decoder constructors to constby Mitchell Bagot · db0de95e · Oct 31, 2025 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Convert encoder/decoder constructors to const

Using const functions allows the compiler to make certain optimisations
by precomputing some values during compilation, instead of at runtime.

Convert all constructors in the consensus_encoding crate to const, with
the following exceptions:
SliceEncoder::without_length_prefix - This needs to call T::encoder,
which would require making the Encodable trait use a const fn.
CompactSizeEncoder::new - Requires various ArrayVec functions to be
const, which requires a cascade of const functions elsewhere.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine performance and ergonomics improvement. It changes several Rust constructor functions from regular functions to 'const' functions, which lets the compiler precompute some values at compile time rather than runtime. There is no change to security behavior, no bug fix, and no vulnerability patch.

AI review queuedprimitives: Use stable hex depenencyby Tobin C. Harding · f43b94ef · Oct 28, 2025 · 18 filesMessage 68 · AdequateInformational 19Details
Commit message · Tobin C. Harding

primitives: Use stable hex depenency

We don't want `hex v0.3.0` to appear in the public API of `primitives
1.0.0`.

Add a dep on `hex v1.0.0` and use it for anything that appears in the
public API.

And it seems we do not need the `serde` feature of `hex-unstable` so
remove it.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit swaps in a newer, stable version of a helper library (hex-conservative 1.0.0) for public-facing parts of the rust-bitcoin 'primitives' crate, while keeping the older version for internal-only uses. It is a dependency/API-stability cleanup, not a fix for a known security bug. There is no direct evidence in the commit that it addresses an exploit or vulnerability.

AI review queuedbuild(deps): bump actions/upload-artifact from 4 to 5by dependabot[bot] · ad4835ef · Oct 27, 2025 · 3 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/upload-artifact from 4 to 5

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine dependency update by Dependabot that bumps the GitHub Actions 'upload-artifact' action from version 4 to version 5 in three internal workflow files. There is no code change to the rust-bitcoin library itself, and nothing in the commit suggests a security problem or fix.

AI review queuedbuild(deps): bump actions/download-artifact from 5 to 6by dependabot[bot] · 42f01eab · Oct 27, 2025 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/download-artifact from 5 to 6

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5 to 6.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps a GitHub Actions helper (used to download build artifacts) from version 5 to version 6 in a daily fuzzing workflow. There is no indication of a security vulnerability or malicious change in the commit itself.

AI review queuedChange extension trait function return types to Selfby Mitchell Bagot · faca7b36 · Oct 25, 2025 · 4 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

Change extension trait function return types to Self

Within the extension traits in the bitcoin crate, some functions use
a Self return type, while others use the specific type name. Use of a
specific type name causes discontinuity in the codebase, is longer,
and is semantically less clear for distinguishing return of a trait
implementor's type vs an instance of a specific type.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code-style cleanup. It changes some function return type declarations from explicit type names (like `TxOut` or `CompactTarget`) to `Self` inside Rust extension traits. This has no effect on what the functions do or on security.