RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue1033AI analyses
188commits · 30 days
403commits · 60 days
1283commits · 180 days
2062commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192359068
Tobin C. Harding40965156063
jrakibi944963068
Nick Johnson18920112059
Andrew Poelstra512035075
Jamil Lambert, PhD1141849061
Fmt Bot311422045
Trevor Arjeski111111069
Shing Him Ng31724056
Ismail Daif22612050
satsfy (Renato Britto)17612066
Martin Habovstiak27512069
Analysis record

Published AI watches

Last scanned 53 minutes ago

Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

This commit only changes documentation comments and variable names in the rust-bitcoin library. It rewords references to 'block height' as 'block count' for relative locktime, because a relative locktime measures elapsed blocks since a coi…

6ea4ff92by Andrew Poelstra+20−172 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code,…

CI workflow permission fixNo source code changesNo cryptographic or consensus changes
276e0a61by Andrew Poelstra+5−01 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry. There are no code changes and no security relevance.

9deb5de1by Andrew Poelstra+22−168 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding

This commit is a routine feature addition to the rust-bitcoin base58 crate. It adds a new no-allocator function to decode short base58-check strings into fixed-size byte arrays, and renames the existing error type while keeping a deprecate…

No security-relevant bug fix is described in the commit message or diff.New decoding path uses a fixed 128-byte scratch buffer (`ArrayVec`) and rejects oversized inputs.Checksum verification and invalid-character handling are preserved from the existing alloc implementation.
c5fd1832by Andrew Poelstra+330−775 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0

This commit is a routine feature release for the bitcoin_hashes crate. It adds new public methods and a constant to the SHA-256 Midstate type so developers can compute SHA-256 midstates in const contexts. There is no indication of a securi…

0f68fcb3by Andrew Poelstra+157−4210 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: reword docs to block count in relative locktime

This commit only rewords documentation comments and variable names in the codebase. It changes references from 'block height' to 'block count' for relative lock times, which is a terminology correction with no functional code changes. Ther…

8867fe2eby satsfy (Renato Britto)+20−172 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code …

07d91f7fby Andrew Poelstra+54−1324 files
No security note in commit
Informational 12 AI analysisMessage 75 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: fix labeller permissions

This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the reposi…

Workflow-only change with no library code modificationsUses the default GITHUB_TOKEN rather than a custom secretRuns in workflow_run context, which already has elevated repository access by design
715f2bd6by Nick Johnson+5−01 file
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`

This is a routine API cleanup, not a security fix. The developers removed a shortcut that let programmers create a 'number of blocks' value directly from any u16 number, replacing it with an existing named constructor called from_height. T…

ed5f1b68by Andrew Poelstra+18−358 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or…

c5588ba5by Andrew Poelstra+57−571 file
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It changes the pinned version from 6.0.2 to 6.0.3 across many workflow files. The newer version fixes minor bugs related to SHA-…

Dependency bump of actions/checkout to a patch releaseUpstream fixes for SHA-256 repository checkout and merge commit regexAll affected workflows already disable persisted credentials
f7d364cdby Andrew Poelstra+29−2915 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or…

5c92c0b0by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update the API text files

This commit only updates two generated API text files that list the public surface of the Rust crate. It removes entries for a `WitnessesEncoder` type, reflecting that the type is no longer part of the public API. There is no source code c…

9c391145by Tobin C. Harding+0−782 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Scrub the transaction encoding logic

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no n…

80dcef15by Tobin C. Harding+57−571 file
No security note in commit
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Make the WitnessesEncoder private

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

b37accc3by Tobin C. Harding+54−542 files
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

release bitcoin_hashes 1.2.0

This commit is a routine version bump for the bitcoin_hashes library from version 1.1.0 to 1.2.0. It only updates lock files, the package version number, and the changelog. There is no code change and no security relevance visible in the c…

8899dfd2by Andrew Poelstra+27−224 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/se…

1c438632by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or an…

5293bee4by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust B…

eb9544f9by dependabot[bot]+2−22 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 6.0.2 to 6.0.3

This is a routine automated update by Dependabot that bumps the GitHub Actions 'actions/checkout' dependency from version 6.0.2 to 6.0.3 across all project workflow files. It only changes pinned commit hashes and version comments for the a…

Routine patch-level dependency bumpNo changes to permissions, inputs, or workflow logicpersist-credentials: false already present on all checkout steps
ae935fadby dependabot[bot]+29−2915 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedconsensus_encoding: API updateby Nick Johnson · 0ac8e91f · Sep 28, 2025 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Nick Johnson

consensus_encoding: API update

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates a public API listing file (all-features.txt) to reflect that several decoder types now expose a new public method called min_bytes_needed(). It is a documentation/tracking change with no actual code modifications, no security fixes, and no behavior changes.

AI review queuedconsensus_encoding: add read interface for decodersby Nick Johnson · 93a085bd · Sep 28, 2025 · 9 filesMessage 93 · StrongInformational 17Details
Commit message · Nick Johnson

consensus_encoding: add read interface for decoders

Adds a min_bytes_needed requirement to the Decoder trait so that
the intermediate buffers used by the Read driver are appropriately sized.
push_decode doesn't have this function on the Decoder trait itself, but
given the simpler use case for bitcoin, I think it is an OK assumption
that all decoder's will know their min bytes.

Largely based on Martin Habovštiak's push_decode crate:
https://github.com/Kixunil/push_decode

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathparser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit adds a new way to decode Bitcoin data directly from a stream or file reader, plus a small required method on all decoders that reports how many more bytes are needed. It is a feature addition, not a fix for a known security bug. There is no evidence in the commit or supplied references that it addresses a vulnerability.

AI review queueddocs: fix inconsistent commentby radik878 · 5cd12014 · Sep 28, 2025 · 1 fileMessage 47 · ThinInformational 15Details
Commit message · radik878

docs: fix inconsistent comment

47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit fixes a one-word typo in a Rust source code comment. The comment for a PSBT (Partially Signed Bitcoin Transaction) output map constant incorrectly referenced 'PSBT_IN_PROPRIETARY' (input) instead of 'PSBT_OUT_PROPRIETARY' (output). No executable code was changed, so there is no security or functional impact.

AI review queueddocs: fix inconsistance in commentby radik878 · 94e598b3 · Sep 28, 2025 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · radik878

docs: fix inconsistance in comment

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit corrects a typo in a code comment. The actual numeric constant was already correct (0x15); only the comment above it wrongly said 0x14. There is no functional code change and therefore no security impact.

AI review queuedconsensus_encoding: add decoder I/O driversby Nick Johnson · 9fb668e1 · Sep 28, 2025 · 2 filesMessage 76 · AdequateInformational 15Details
Commit message · Nick Johnson

consensus_encoding: add decoder I/O drivers

The BufReader trait is much more efficient than the standard Read
trait, so it deserves its own interface. This is the opposite case on
the encode side where a buffered writer has the same interface as a
non-buffered one.

Unlike its Encodable sibling, the Decodable generic cannot be made
?Sized since it is being created and returned by value.

A Read-based interface will be added, but requires some sort of
min-length data exposed from each decoder.

Largely based on Martin Habovštiak's push_decode crate:
https://github.com/Kixunil/push_decode

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds new helper functions for reading and decoding Bitcoin consensus data from byte slices and buffered I/O readers. It is a routine feature addition with no apparent security bug. The code includes proper error handling and unit tests.

AI review queued2025-09-28 automated rustfmt nightlyby Fmt Bot · dbce0253 · Sep 28, 2025 · 8 filesMessage 45 · ThinInformational 15Details
Commit message · Fmt Bot

2025-09-28 automated rustfmt nightly

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is purely a code-formatting run by the rustfmt tool. It only reorders imports, breaks long lines, and adjusts whitespace. There are no functional changes, no bug fixes, and no security-related alterations.

AI review queuedconsensus_encoding: tag composers with inlineby Nick Johnson · 153ac218 · Sep 26, 2025 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Nick Johnson

consensus_encoding: tag composers with inline

The encoder/decoder composers just delegate to an inner encoder/decoder,
inlining these simple calls might help the compiler optimize things.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds compiler hints (#[inline]) to small functions that simply pass work along to other functions. It does not change what the code does, only how the compiler may optimize it. There is no security relevance.

AI review queuedUpdate API text filesby Tobin C. Harding · b8af0d73 · Sep 26, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Tobin C. Harding

Update API text files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates a generated text file that lists the public API surface of the crate. It records that a new type, AmountDecoder, is now exposed, but it does not change any actual source code, logic, or behavior. There is nothing here that could introduce a security vulnerability.

AI review queuedconsensus_encoding: API updatesby Nick Johnson · cf99839f · Sep 25, 2025 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Nick Johnson

consensus_encoding: API updates

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit is a routine API snapshot update. It only changes a generated text file that lists public API signatures, reflecting that some Encoder trait implementations no longer take a lifetime parameter. No actual source code, logic, or security behavior changed.

AI review queuedUpdate API text filesby Tobin C. Harding · d340c4dd · Sep 25, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Tobin C. Harding

Update API text files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates a generated text file that lists the public API surface of the `bitcoin_units` crate. It adds and removes entries reflecting other code changes (new decoder error types, new `Default`/`new` functions, changed error type aliases), but contains no actual source code changes. There is nothing in the commit that fixes, introduces, or alters program behavior, so it has no security relevance on its own.

AI review queuedunits: Hide amount decoder error internalsby Tobin C. Harding · 11811e09 · Sep 25, 2025 · 2 filesMessage 68 · AdequateInformational 18Details
Commit message · Tobin C. Harding

units: Hide amount decoder error internals

Introduces new policy on how we implement decoder error types.

- All internals are hidden
- No `From<OtherError>` impls
- Private constructors
- Inner enum is private (does not need non_exhaustive).

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a defensive API-hardening change, not a fix for an active security bug. It hides the internal details of an error type used when decoding Bitcoin amounts, so future library changes cannot accidentally expose or depend on those internals. It does not change how amounts are actually decoded or validated.

AI review queuedunits: Implement constructor for decodersby Tobin C. Harding · b02b3ad3 · Sep 25, 2025 · 5 filesMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

units: Implement constructor for decoders

So the decoders can be used by downstream add constructors for them
all. Also implement `Default` for the decoder types.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds public constructors and Default implementations for several data decoder types in the rust-bitcoin 'units' crate. It is a straightforward API usability improvement for downstream users and does not change any decoding logic, parsing rules, or security behavior.

AI review queuedconsensus_encoding: API updateby Nick Johnson · 43077e87 · Sep 22, 2025 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Nick Johnson

consensus_encoding: API update

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates a generated public-API listing file (api/units/all-features.txt). It records that new decoder types and traits for consensus encoding are now part of the exposed API, but it does not contain any actual code changes, bug fixes, or security patches. There is nothing here that directly creates or fixes a vulnerability.

AI review queuedunits: Implement decoding traitsby Tobin C. Harding · 88c6c3bd · Sep 22, 2025 · 7 filesMessage 58 · ThinInformational 18Details
Commit message · Tobin C. Harding

units: Implement decoding traits

In a similar fashion to what we did for encoding; for each of the
types that implements encoding add logic for decoding.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit adds decoding logic for several Bitcoin unit types (amounts, block heights, lock times, sequence numbers, block times) so they can be read from a byte stream, mirroring existing encoding logic. It is a routine feature addition, not a security fix.

AI review queuedconsensus_encoding: rename UnexptectedEofby Nick Johnson · e36cc96b · Sep 22, 2025 · 4 filesMessage 58 · ThinInformational 15Details
Commit message · Nick Johnson

consensus_encoding: rename UnexptectedEof

It is policy that all error types are suffixed with `Error` and live at
the bottom of the file.

Co-authored-by: Tobin C. Harding <me@tobin.cc>

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a simple rename of an error type from 'UnexpectedEof' to 'UnexpectedEofError' to follow the project's naming policy. It only moves the type definition to the bottom of the file and updates all references. There is no functional change and no security impact.

AI review queuedopcodes: Fix incorrect docsby Tobin C. Harding · 89795ffc · Sep 21, 2025 · 2 filesMessage 35 · OpaqueInformational 15Details
Commit message · Tobin C. Harding

opcodes: Fix incorrect docs

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only fixes a typo in documentation comments. The word 'Encodes' was changed to 'Decodes' in two Rust source files to accurately describe what the function does. No code behavior was changed.

AI review queuedMove chacha20_poly1305 benches to Criterionby Jamil Lambert, PhD · aeb60276 · Sep 19, 2025 · 4 filesMessage 68 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Move chacha20_poly1305 benches to Criterion

Move all of the bench code to individual files in
chacha20_poly1305/benches/

Add Criterion as a dependency in Cargo.toml

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit is a routine refactoring of benchmark code. It moves ChaCha20 performance tests out of the source crate and into a separate Criterion-based benchmark suite. There is no change to the actual ChaCha20/Poly1305 library code, no bug fix, and no security-related change.

AI review queuedUpdate transaction.rsby viktorking7 · d2ba147f · Sep 19, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · viktorking7

Update transaction.rs

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit fixes a single typo in a code comment ('pre-pended' to 'prepended'). No executable code, logic, or data handling was changed. It has no security relevance.

AI review queuedUpdate primitives.mdby viktorking7 · 43da48b3 · Sep 19, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · viktorking7

Update primitives.md

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit fixes a single spelling mistake in a documentation comment ('consenus-encoding' to 'consensus-encoding'). It changes no code, no build files, and no executable logic. There is no security relevance.

AI review queuedIntroduce arbitrary_* `bitcoin` fuzz targetsby Shing Him Ng · b19f2d4f · Sep 19, 2025 · 9 filesMessage 55 · ThinInformational 15Details
Commit message · Shing Him Ng

Introduce arbitrary_* `bitcoin` fuzz targets

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds and reorganizes fuzz testing code. Fuzz tests are automated quality-assurance tools that feed random or structured data to library functions to look for crashes or incorrect behavior. No changes are made to the actual Bitcoin library code that applications would use, so this commit cannot introduce a security vulnerability in shipped software on its own.

AI review queuedconsensus_encoding: drop Either for phantom databy Nick Johnson · 0edcebe8 · Sep 18, 2025 · 3 filesMessage 68 · AdequateInformational 15Details
Commit message · Nick Johnson

consensus_encoding: drop Either for phantom data

Drop the Either sum type in favor of phantom data and some trait bounds.
Composite decoders, like Decoder2, now have trait bounds which enforce
that all the inner decoder error types map to a common error type which
is held as phantom data in the composite decoder.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine internal refactoring of how composite data decoders combine error types. It removes a custom Either sum type and instead uses Rust's standard trait conversion (From) plus phantom data to enforce that all inner decoder errors can be converted into a single common error type. There is no indication this fixes a security bug; it is a design/API cleanup.

AI review queuedUpdate unsigned.rsby sashass1315 · 78b52a14 · Sep 18, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · sashass1315

Update unsigned.rs

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit fixes a single typo in a comment ('used' to 'use'). No code behavior changes, and there is no security relevance.

AI review queuedMove bitcoin benches to Criterionby Jamil Lambert, PhD · 98da28c8 · Sep 17, 2025 · 10 filesMessage 68 · AdequateInformational 15Details
Commit message · Jamil Lambert, PhD

Move bitcoin benches to Criterion

Move the benches from bitcoin to a new crate and use criterion to do the
benchmarking.

Criterion could not be run from within the bitcoin crate since it depends
on other packages that require rustc 1.81 or newer.

Also use hex_lit which works with criterion.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine refactoring of benchmark tests. It moves performance-measuring code out of the main bitcoin crate into a separate 'benches' crate and switches the benchmarking framework from Rust's built-in nightly-only 'test' harness to the popular 'Criterion' library. No application logic, security checks, or public APIs are changed.

AI review queuedconsensus_encoding: add decoder compositionby Nick Johnson · c7792c0e · Sep 16, 2025 · 3 filesMessage 58 · ThinInformational 15Details
Commit message · Nick Johnson

consensus_encoding: add decoder composition

This is largely based on push_decode's "chain" composition. Decoder's
are chained together and the result of both are returned as tuple.
Higher level composition just uses Decoder2's logic internally.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds new building blocks for combining multiple data decoders in sequence inside the rust-bitcoin library. It is a pure feature addition: it introduces helper types (Decoder2, Decoder3, Decoder4, Decoder6 and an Either error type) that let developers chain decoders together, plus tests showing they work. There is no bug fix, no mention of any security issue, and nothing in the code appears to create a vulnerability.

AI review queuedconsensus_encoding: add ArrayDecoderby Nick Johnson · 5274b00d · Sep 16, 2025 · 4 filesMessage 78 · AdequateInformational 15Details
Commit message · Nick Johnson

consensus_encoding: add ArrayDecoder

Very similar to push_decode's decoder, but is simplified by making
no effort to avoid the cost of zeo initialization of the array buffer.

Largely based on Martin Habovštiak's push_decode crate:
https://github.com/Kixunil/push_decode

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds a new helper decoder called ArrayDecoder to the rust-bitcoin consensus_encoding crate. It simply reads a fixed number of bytes from a stream and returns them as an array. There is no bug fix, behavior change, or security-sensitive modification here—just new code and tests.