RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
148commits · 30 days
304commits · 60 days
1150commits · 180 days
2055commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 48 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6736: benches: fix encoding use, add CI check, and standardize on criterionby Andrew Poelstra · 06ea6476 · Sep 3, 2026 · 10 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6736: benches: fix encoding use, add CI check, and standardize on criterion

a71766b7feafa1c563253074eab71d12cb17b26b benches: migrate last old benchmark and consolidate on criterion only (Nick Johnson)
6618875711cb4cad5e6a162c8219e03fb78131d4 benches: add criterion to CI, update out of date benches (Nick Johnson)

Pull request description:

Extends jrakibi's work in #6735. First commit cleans up the stale code in `benches` and adds the `benches` package to CI to prevent drift in the future. Second commit migrates the only other type of benchmark in the repository to `benches` to simplify the patterns.


ACKs for top commit:
apoelstra:
ACK a71766b7feafa1c563253074eab71d12cb17b26b; successfully ran local tests


Tree-SHA512: 3874c0007255ce0f8431264af1baa95d2c3c61da78298a87d169195695247e297aaafb3acb5910072d897f7fa227467aeb8d8ec87298229ed2c13fe11d7a773c

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This change is purely a cleanup of benchmark code. It moves the last remaining old-style benchmark into a shared benchmark package, switches the project to use the standard Criterion benchmarking library, and adds a CI check so benchmarks stay buildable. No user-facing code, cryptographic logic, or network behavior is changed.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6811: ci: add corpus fuzzing crash storeby Andrew Poelstra · 86e705f0 · Sep 3, 2026 · 5 filesMessage 100 · StrongInformational 14Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6811: ci: add corpus fuzzing crash store

e2a6f4bfd56b0657bb2da53946d88fdd387ba5f0 ci: report job summary for store replay crashes (satsfy (Renato Britto))
7b27d482f8e242d579a54a9751a4ef750421945e ci: fix crash artifacts never reaching the store (satsfy (Renato Britto))
9911d236ace906e8380cf6677f766a8b73c9867a fuzz: cap the crash store at 10k inputs (satsfy (Renato Britto))
257dd39debc6e893c32b16fea64111a5c9143d02 ci: add fuzz crash store (satsfy (Renato Britto))
99a6ffe724d54049f3dfbccd4815c44aeb99717a fuzz: unify target rustflags in one place (satsfy (Renato Britto))

Pull request description:

Fixes the issue I mentioned on https://github.com/rust-bitcoin/rust-bitcoin/issues/6784 and https://github.com/rust-bitcoin/rust-bitcoin/issues/6813.

Every time a crash happens, corpus fuzzing reports it and forgets. The issue gets automatically closed and CI would forget a problem ever existed. The error may or may not be re-encountered in the future.

This PR makes found errors persistent on a crash store. Every fuzzing error gets saved there. At the end corpus fuzzing daily run, after qa-assets corpora was updated, it replays the crash store.

This gives us 3 properties:
1. errors are not lost;
2. corpus fuzzing will not pass while an error still exists in the codebase and;
3. the normal fuzzing workflow keeps running uninterrupted (because any job that previously failed, moved the error to crash store so it will fuzz again now just fine).

Also unified the fuzz flags so because they were replicated in multiple scripts.

After these changes prove to work well on production, I'll put up the final change: run crash store on every PR. An automatic fuzz regression check.


ACKs for top commit:
apoelstra:
ACK e2a6f4bfd56b0657bb2da53946d88fdd387ba5f0; successfully ran local tests


Tree-SHA512: adb7b6719567ae257ac6dea427e097578fc028784c9aba00708d23f6d441faeac9bd7eaa911ac45f1bc11155d6b6d519e8cb5a319eabcf17621a1551d9b2de96

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 14/100

This commit is a CI (Continuous Integration) improvement for the project's fuzz testing pipeline. It adds a persistent 'crash store' so that fuzzing crashes are saved and later replayed to catch regressions. It does not change the actual Bitcoin library code, does not fix a security bug, and does not introduce a vulnerability. It is purely an infrastructure change to make fuzz testing more reliable.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6789: fuzz: fix p2p commands master and 0.32 divergenceby Andrew Poelstra · dc929f3b · Sep 3, 2026 · 1 fileMessage 100 · StrongInformational 18Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6789: fuzz: fix p2p commands master and 0.32 divergence

77923a0cb5f49ed1807067028a9cd87a68df2c78 fuzz: add regression tests for master-only p2p commands (satsfy (Renato Britto))
b38bcaaf7fd4ea7b71f3ecb7f025e7dc206719fa fuzz: run the compare_consensus_encoding tests (satsfy (Renato Britto))
1dd0a4b57cf5ec53d632988630e14dbec6f3625d fuzz: skip master exclusive V1NetworkMessage commands (satsfy (Renato Britto))

Pull request description:

Fixes https://github.com/rust-bitcoin/rust-bitcoin/issues/6784 (issue closed automatically but shouldn't have, I'll follow up with a PR for that).

The `compare_consensus_encoding` target panics when 0.32 decodes something master rejects. Bitcoin 0.32 stores unknown commands as `NetworkMessage::Unknown` without parsing, never fail. Master decodes `sendtxrcncl` and `feature` typed and rejects empty payloads.

Commits:
1. Skip the comparison for those two, keyed on the command in the V1 header
2. Gated the test module on `test` alone because `cfg(all(test, fuzzing))` could never run (optional, I may have misunderstood here).
3. Make both crash inputs into regression tests


ACKs for top commit:
apoelstra:
ACK 77923a0cb5f49ed1807067028a9cd87a68df2c78; successfully ran local tests


Tree-SHA512: 738bc34909d0523e74adc9702dbc68c42b2623cb3391d5cba4023382eec734bbcc16067e90753911e5121138772efd3aaf1cf4f338bb60b42874c2aecbce44ef

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 18/100

This is a fuzz-test-only fix. It changes a test harness so it skips comparing two newer Bitcoin P2P network commands ('feature' and 'sendtxrcncl') between the current master code and an older 0.32 release. The older release stores unknown commands as raw data, while the newer code parses and can reject them. The fix prevents the fuzz test from panicking on this expected difference. It does not change any production library code.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6814: fuzz: delete stale `hashes_0_32_cbor` targetby Andrew Poelstra · 4f61264d · Sep 2, 2026 · 4 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6814: fuzz: delete stale `hashes_0_32_cbor` target

b384c8fd5707b8977372ff4728245440d86ae59e fuzz: delete hashes_0_32_cbor target (satsfy (Renato Britto))

Pull request description:

Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6813

As https://github.com/rust-bitcoin/rust-bitcoin/issues/6813#issuecomment-5493237551 says:
> The fuzz failure here is "real" but it's a 0.32.x that we deleted on master in https://github.com/rust-bitcoin/rust-bitcoin/pull/2803 because it was triggering false positives.
>
> We should just delete the test.

Corpus job crashes because `serde_cbor` accepts various encodings for the same input, producing false positives.

The current hashes crate deleted this test long ago. Drop the unused `serde_cbor` dependency.

Branches 0.32.xx and 0.32.xxx don't have fuzz targets so the problem is not applicable there.


ACKs for top commit:
apoelstra:
ACK b384c8fd5707b8977372ff4728245440d86ae59e; successfully ran local tests


Tree-SHA512: 644c2bdace7e70b17d42a9bf70491c1fedd3881e270a1bd0da12664a38a067ba074dc0ba7e18fd3837304a601ef501cc72719871d5c86b4a279e65c2bf651028

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit removes an old fuzzing test that was producing false alarms. The test checked that data could be decoded and re-encoded by an old library (serde_cbor) and get the exact same bytes back, but that library has multiple valid ways to encode the same thing, so the test was unreliable. There is no security vulnerability being fixed here—just cleanup of a stale test and its unused dependency.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6767: primitives: Add #[inline] to simple functionsby Andrew Poelstra · ff93b704 · Sep 2, 2026 · 17 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6767: primitives: Add #[inline] to simple functions

0df86b2bdfef6e9619d26eef031bb7b04d513ff2 primitives: Add #[inline] to simple functions (Mitchell Bagot)

Pull request description:

Following the recent additions to primitives, and before the final release, new simple functions need have #[inline] added to them.

Add #[inline] to simple functions throughout the crate.


ACKs for top commit:
apoelstra:
ACK 0df86b2bdfef6e9619d26eef031bb7b04d513ff2; successfully ran local tests
tcharding:
ACK 0df86b2bdfef6e9619d26eef031bb7b04d513ff2
Kixunil:
ACK 0df86b2bdfef6e9619d26eef031bb7b04d513ff2


Tree-SHA512: c3e8ad4fc7a32e27117b5787c7fb05de73a0d281b65a286d1f4bf046f3da72e7fbff67095bd9db716725d90bc3934e0c7f757bbfc7d209c960dfe328f50fdd84

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds the Rust compiler hint #[inline] to many small, simple functions in the primitives crate. It does not change any logic, data handling, or security behavior. It is a performance and code-quality change, not a security fix or vulnerability.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6781: base58: Use `div_ceil` for reserve length calculationby Andrew Poelstra · be2b26d8 · Aug 31, 2026 · 1 fileMessage 100 · StrongLow 46Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6781: base58: Use `div_ceil` for reserve length calculation

196c27161d1e6e4d76b4be5978a7c45a864c96a6 Add regression test for reserve length calculation (Mitchell Bagot)
5b3cc125fdb6d015e0ddf14306dd7810a9110552 base58: Use div_ceil for reserve length calculation (Mitchell Bagot)

Pull request description:

When determining the size needed for an encoding buffer, the code currently uses an approximation by multiplying the payload length by 1.37. However, as this is done with integer operations, the value is rounded down, which for some payload lengths (namely 94), the encoding can panic due to an undersized buffer.

Use div_ceil for reserve length calculation to prevent panic on 94 byte encode.


ACKs for top commit:
satsfy:
tACK 196c27161d1e6e4d76b4be5978a7c45a864c96a6
tcharding:
ACK 196c27161d1e6e4d76b4be5978a7c45a864c96a6
apoelstra:
ACK 196c27161d1e6e4d76b4be5978a7c45a864c96a6; successfully ran local tests


Tree-SHA512: d0e737115211799874efecb1229885ddefae941a9132df3e19ea1f40f6c0c0c5238d42224a194b215e9657cb649b80c8511e4540029b5499a6f70cd254f71866

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidencemerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Low 46/100

This commit fixes a bug in the base58 encoding function used for Bitcoin-style addresses. When encoding certain payload sizes (specifically 94 bytes), the program could panic because it reserved a buffer that was slightly too small. The fix rounds the buffer-size calculation up instead of down, preventing the crash. The commit also adds a regression test using a 90-byte payload with checksum (which triggers the same rounding edge case).

AI review queuedMerge rust-bitcoin/rust-bitcoin#6803: build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7by Andrew Poelstra · 9a0a1d3f · Aug 31, 2026 · 2 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6803: build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7

11e5f5fe97bcc36406a7ab4a7c96997ab7c4522f build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.5 to 2.82.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.7</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.1.6.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.105.0.</p>
</li>
<li>
<p>Update <code>gungraun-runner@latest</code> to 0.19.3.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.8.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.55.1.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.36.0.</p>
</li>
</ul>
<h2>2.82.6</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.7.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.25.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.46.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.55.0.</p>
</li>
<li>
<p>Update <code>cargo-auditable@latest</code> to 0.7.5.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.87.2] - 2026-08-30</h2>
<ul>
<li>
<p>Update <code>typos@latest</code> to 1.50.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.0.</p>
</li>
<li>
<p>Update <code>shfmt@latest</code> to 3.14.0.</p>
</li>
</ul>
<h2>[2.87.1] - 2026-08-29</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.7.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.49.1.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.51.1.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.5.0.</p>
</li>
<li>
<p>Update <code>d2@latest</code> to 0.8.2.</p>
</li>
<li>
<p>Update <code>cargo-zigbuild@latest</code> to 0.23.3.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.2.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.11.</p>
</li>
</ul>
<h2>[2.87.0] - 2026-08-27</h2>
<ul>
<li>
<p>Support <code>kache</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1980">#1980</a>, thanks <a href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a>)</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.30.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.6.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.14.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.11.2.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/16b05812d776ae1dfaabc8277e421fb6d2506419"><code>16b0581</code></a> Release 2.82.7</li>
<li><a href="https://github.com/taiki-e/install-action/commit/68c845308d9b56d38e797c62e48eddfe1b4ba94f"><code>68c8453</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/8532697fda4ee37ccd65901e90d87a785c45d7bd"><code>8532697</code></a> Update trivy manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/2959f9e73b89d18f2d72d0aa55ed797e70062732"><code>2959f9e</code></a> Update <code>tombi@latest</code> to 1.1.6</li>
<li><a href="https://github.com/taiki-e/install-action/commit/9bfa119f6c347b458726d629758b16dd861727a4"><code>9bfa119</code></a> Update <code>kingfisher@latest</code> to 1.105.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f198b91ffb69aa6008cb3b0ea9cf6eb6b0af01f4"><code>f198b91</code></a> Update just manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/20feedd5827d6d189bca20753dbd5582948e7478"><code>20feedd</code></a> Update <code>gungraun-runner@latest</code> to 0.19.3</li>
<li><a href="https://github.com/taiki-e/install-action/commit/314197aa953241335b4a4c41c2d6e8066d6150da"><code>314197a</code></a> Update <code>editorconfig-checker@latest</code> to 3.8.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f8632ebbd28b43dce012ff3db91c959c7751db33"><code>f8632eb</code></a> Update <code>dprint@latest</code> to 0.55.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/4234dc0f7acb7e7774a1716b103fcaf2d9ed9b4d"><code>4234dc0</code></a> Update <code>cargo-tarpaulin@latest</code> to 0.36.0</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/bffeee26d4db9be238a4ea78d8826604ebcb594d...16b05812d776ae1dfaabc8277e421fb6d2506419">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.5&new-version=2.82.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 11e5f5fe97bcc36406a7ab4a7c96997ab7c4522f; successfully ran local tests


Tree-SHA512: dd0168fc4bca1701a29f8310bb92c1b613c34f3845a896a031061f4dfa4d6fd4c1995bcc07415fc9802baa487136b5103d02af9b90ad41100440f07823050887

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine Dependabot update that bumps a GitHub Actions helper (taiki-e/install-action) used in automated testing workflows from version 2.82.5 to 2.82.7. It only changes which version of a third-party action is invoked when installing testing tools. There is no indication this fixes or introduces a security problem in the rust-bitcoin library itself.

AI review queuedbuild(deps): bump actions/checkout from 6.0.2 to 7.0.0by dependabot[bot] · b9e9f313 · Aug 30, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump actions/checkout from 6.0.2 to 7.0.0

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the version of a GitHub-provided action used to check out source code during automated testing. There is no indication of a security issue in the project itself, and the change does not alter application code that handles Bitcoin transactions, keys, or network data.

AI review queuedbuild(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7by dependabot[bot] · 11e5f5fe · Aug 30, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.5 to 2.82.7.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/bffeee26d4db9be238a4ea78d8826604ebcb594d...16b05812d776ae1dfaabc8277e421fb6d2506419)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.82.7
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that bumps a GitHub Actions helper (taiki-e/install-action) used only in CI workflows to install the cargo-mutants testing tool. The change does not touch any Rust source code, cryptography, network handling, or released library behavior. There is no indication of a security issue in the commit or supplied references.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6790: Implement Rem<NonZero{I,U}64> for {Signed}Amountby Andrew Poelstra · 579bf87e · Aug 29, 2026 · 2 filesMessage 91 · StrongInformational 16Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6790: Implement Rem<NonZero{I,U}64> for {Signed}Amount

7ceb9f04cf33161590d9f8137dd606e2e23d498e Implement Rem<NonZero{I,U}64> for {Signed}Amount (Martin Habovstiak)
60e21d58adab5dec6fd83be1c997fa03b833c1bd Rename `amount/result.rs` to `amount/ops.rs` (Martin Habovstiak)

Pull request description:

`Rem` and `RemAssign` were already implemented for `u64` and `i64` and we also had `Div` and `DivAssign` for `NonZeroU64` and `NonZeroI64` but `Rem{Assign}` for `NonZero{U,I}64` were missing. This PR adds them along with a little cleanup.


ACKs for top commit:
apoelstra:
ACK 7ceb9f04cf33161590d9f8137dd606e2e23d498e; successfully ran local tests. LGTM. But lol that even stdlib's "nonzero" types are unusable without adding unreachable panic paths.


Tree-SHA512: c1c9513f6620ea4cc966be91e2529e790db17692c1c7d5d0360c8feb35392cd75d64255017ae2662f3ee6146d03198b98bf10d9b97dc1c47939a636d07465ea3

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 16/100

This commit adds new ways to use the remainder operator (the '%' modulo operation) with Bitcoin amount types and Rust's non-zero integer types. It is a routine feature addition with no apparent security relevance. The code does not fix a vulnerability, change access controls, or introduce risky behavior beyond what was already present for similar operations.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6785: build(deps): bump taiki-e/install-action from 2.82.4 to 2.82.5by Andrew Poelstra · 1ec75333 · Aug 28, 2026 · 2 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6785: build(deps): bump taiki-e/install-action from 2.82.4 to 2.82.5

3856bf4f19d67a70c9224c48c6750a940f089b81 build(deps): bump taiki-e/install-action from 2.82.4 to 2.82.5 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.4 to 2.82.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.5</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 46.0.1.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.126.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.6.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.14.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.1.0.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.86.8] - 2026-08-26</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.1.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.258.0.</p>
</li>
<li>
<p>Update <code>oxfmt@latest</code> to 1.80.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.12.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 2.0.0.</p>
</li>
<li>
<p>Update <code>cargo-zigbuild@latest</code> to 0.23.2.</p>
</li>
</ul>
<h2>[2.86.7] - 2026-08-24</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.4.1.</p>
</li>
<li>
<p>Update <code>rafn@latest</code> to 0.1.5.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.22.0.</p>
</li>
</ul>
<h2>[2.86.6] - 2026-08-23</h2>
<ul>
<li>
<p>Update <code>dprint@latest</code> to 0.56.1.</p>
</li>
<li>
<p>Update <code>cargo-lambda@latest</code> to 1.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.10.</p>
</li>
</ul>
<h2>[2.86.5] - 2026-08-21</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.4.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.257.1.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.36.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/bffeee26d4db9be238a4ea78d8826604ebcb594d"><code>bffeee2</code></a> Release 2.82.5</li>
<li><a href="https://github.com/taiki-e/install-action/commit/5bafa69e5add729bd5cc9c0646ed12e1af612c99"><code>5bafa69</code></a> ci: Test GitHub-hosted ubuntu 26.04 runners</li>
<li><a href="https://github.com/taiki-e/install-action/commit/e7b7497213f2263bcf738032dcc69fd4c14b1813"><code>e7b7497</code></a> Update wasmtime manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/e9838983e85b61bb8ceb03c66a676d5a37507462"><code>e983898</code></a> Update <code>wasmtime@latest</code> to 46.0.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/0cd66872025ce95e85d8831011a3d60693cb5b06"><code>0cd6687</code></a> Update <code>wasm-bindgen@latest</code> to 0.2.126</li>
<li><a href="https://github.com/taiki-e/install-action/commit/151275d7b873bc8f076b2e0addaaf908740405ca"><code>151275d</code></a> Update <code>vacuum@latest</code> to 0.29.6</li>
<li><a href="https://github.com/taiki-e/install-action/commit/1a104bfb141e3d8faadbdc6c3306789dd461f1c9"><code>1a104bf</code></a> Update syft manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/edab3a363f10f8d5af8efc8633ad982b899bfbde"><code>edab3a3</code></a> Update <code>mise@latest</code> to 2026.6.14</li>
<li><a href="https://github.com/taiki-e/install-action/commit/46c1ccf9e1e2e709f19c2846fb39337b5045c0f6"><code>46c1ccf</code></a> Update <code>cargo-rdme@latest</code> to 2.1.0</li>
<li>See full diff in <a href="https://github.com/taiki-e/install-action/compare/682e7d9e49c5e653d371fc6adbda67653461378a...bffeee26d4db9be238a4ea78d8826604ebcb594d">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.4&new-version=2.82.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
satsfy:
ACK 3856bf4f19d67a70c9224c48c6750a940f089b81
apoelstra:
ACK 3856bf4f19d67a70c9224c48c6750a940f089b81; successfully ran local tests


Tree-SHA512: 117f94e2df1b5717a2aa99f94d0d65701d1debe7ac5b6344f4b944bf64a145b569755b75652f57a98ea4ebc02530e4e32ed2499c4ad2e04eb8c4bdd64c510872

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine update to a GitHub Actions helper used only in automated testing workflows. It does not change the actual Bitcoin library code that users run, and nothing in the commit or its references describes any security problem.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6773: build(deps): bump actions/cache from 5.0.5 to 6.1.0by Andrew Poelstra · ba299575 · Aug 26, 2026 · 2 filesMessage 100 · StrongInformational 19Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6773: build(deps): bump actions/cache from 5.0.5 to 6.1.0

3b21f967867b2e78ab5fc7e5a6d7d981a9549e72 build(deps): bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot])

Pull request description:

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed and merged.</li>
<li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version number.</li>
<li>Approve the run to publish the new version and update the major tags for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li>
<li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li>
<li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li>
<li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li>
<li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li>
<li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li>
<li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li>
<li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li>
<li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li>
<li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li>
<li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5.0.5&new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 3b21f967867b2e78ab5fc7e5a6d7d981a9549e72; successfully ran local tests
satsfy:
ACK 3b21f967867b2e78ab5fc7e5a6d7d981a9549e72


Tree-SHA512: 7d32885b0c0a7b99fe8693dec176fc5f70d6ba8e294e1ffbaad3239b0fe37b4ec02a7ad4dcfe21d7017d50b29305ad24607364c6b6c32a411f44ac0d457da4d2

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 19/100

This commit updates the GitHub Actions 'cache' tool used in two automated fuzzing workflows from version 5.0.5 to 6.1.0. The change is a routine dependency bump by Dependabot. It does not modify the Rust Bitcoin library code that end users rely on. The new version mainly handles a minor cache-write error more gracefully and updates internal packages. There is no direct evidence this fixes an active security problem in rust-bitcoin itself.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6774: build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1by Andrew Poelstra · 2daef93a · Aug 26, 2026 · 1 fileMessage 96 · StrongInformational 13Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6774: build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1

1d848840a0c231fb3881da98b07042122314b51d build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 (dependabot[bot])

Pull request description:

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/download-artifact/releases">actions/download-artifact's releases</a>.</em></p>
<blockquote>
<h2>v8.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for CJK characters in the artifact name by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/471">actions/download-artifact#471</a></li>
<li>Add a regression test for artifact name + content-type mismatches by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/472">actions/download-artifact#472</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v8...v8.0.1">https://github.com/actions/download-artifact/compare/v8...v8.0.1</a></p>
<h2>v8.0.0</h2>
<h2>v8 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.</p>
</blockquote>
<blockquote>
<p>[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).</p>
</blockquote>
<h3>Direct downloads</h3>
<p>To support direct uploads in <code>actions/upload-artifact</code>, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the <code>Content-Type</code> header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new <code>skip-decompress</code> parameter to <code>true</code>.</p>
<h3>Enforced checks (breaking)</h3>
<p>A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the <code>digest-mismatch</code> parameter. To be secure by default, we are now defaulting the behavior to <code>error</code> which will fail the workflow run.</p>
<h3>ESM</h3>
<p>To support new versions of the @actions/* packages, we've upgraded the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Don't attempt to un-zip non-zipped downloads by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/460">actions/download-artifact#460</a></li>
<li>Add a setting to specify what to do on hash mismatch and default it to <code>error</code> by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/461">actions/download-artifact#461</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v7...v8.0.0">https://github.com/actions/download-artifact/compare/v7...v8.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/download-artifact/commit/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"><code>3e5f45b</code></a> Add regression tests for CJK characters (<a href="https://redirect.github.com/actions/download-artifact/issues/471">#471</a>)</li>
<li><a href="https://github.com/actions/download-artifact/commit/e6d03f67377d4412c7aa56a8e2e4988e6ec479dd"><code>e6d03f6</code></a> Add a regression test for artifact name + content-type mismatches (<a href="https://redirect.github.com/actions/download-artifact/issues/472">#472</a>)</li>
<li><a href="https://github.com/actions/download-artifact/commit/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3"><code>70fc10c</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/461">#461</a> from actions/danwkennedy/digest-mismatch-behavior</li>
<li><a href="https://github.com/actions/download-artifact/commit/f258da9a506b755b84a09a531814700b86ccfc62"><code>f258da9</code></a> Add change docs</li>
<li><a href="https://github.com/actions/download-artifact/commit/ccc058e5fbb0bb2352213eaec3491e117cbc4a5c"><code>ccc058e</code></a> Fix linting issues</li>
<li><a href="https://github.com/actions/download-artifact/commit/bd7976ba57ecea96e6f3df575eb922d11a12a9fd"><code>bd7976b</code></a> Add a setting to specify what to do on hash mismatch and default it to <code>error</code></li>
<li><a href="https://github.com/actions/download-artifact/commit/ac21fcf45e0aaee541c0f7030558bdad38d77d6c"><code>ac21fcf</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/460">#460</a> from actions/danwkennedy/download-no-unzip</li>
<li><a href="https://github.com/actions/download-artifact/commit/15999bff51058bc7c19b50ebbba518eaef7c26c0"><code>15999bf</code></a> Add note about package bumps</li>
<li><a href="https://github.com/actions/download-artifact/commit/974686ed5098c7f9c9289ec946b9058e496a2561"><code>974686e</code></a> Bump the version to <code>v8</code> and add release notes</li>
<li><a href="https://github.com/actions/download-artifact/commit/fbe48b1d2756394be4cd4358ed3bc1343b330e75"><code>fbe48b1</code></a> Update test names to make it clearer what they do</li>
<li>Additional commits viewable in <a href="https://github.com/actions/download-artifact/compare/v7...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/download-artifact&package-manager=github_actions&previous-version=7.0.0&new-version=8.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 1d848840a0c231fb3881da98b07042122314b51d; successfully ran local tests


Tree-SHA512: 4bc6d5a95cee7c75aebcb92bc36c39b34c2b05948b2e6c36b679b812321076e3501191fb21d4641604e9366c25d05e4ff82a282d834fdff569395e50c6aa108c

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
fuzzing or regression evidencedocumentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 13/100

This is a routine update to a GitHub Actions helper used in one workflow. The change bumps the version of the action that downloads saved files (artifacts) during automated fuzzing tests. The new version makes the tool stricter about file integrity checks and changes how it handles compressed files. There is no direct evidence this fixes an active security problem in the rust-bitcoin project itself, but staying current with action versions is generally good maintenance hygiene.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6775: build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1by Andrew Poelstra · cc1e28f1 · Aug 26, 2026 · 1 fileMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6775: build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1

5c0d27359e798a2f75388ca0723b74208f336c48 build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1 (dependabot[bot])

Pull request description:

Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.20.0 to 1.20.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p>
<blockquote>
<h2>v1.20.1</h2>
<p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p>
<h4>In this release:</h4>
<ul>
<li>Upgrade dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/732870f031d2fb36309d0deaf36abcc704a7be65"><code>732870f</code></a> release: cargo-binstall v1.20.1 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2590">#2590</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/84c209e6313ba472763c1b34615f03c41e7413dd"><code>84c209e</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2586">#2586</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/9e9fc4635d22c94c113187350872d6916c005474"><code>9e9fc46</code></a> build(deps): bump the deps group with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2589">#2589</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/a387173c6f65daf8c665f747f297385a6a8c68f9"><code>a387173</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2588">#2588</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/733bffce578000b64507ac3d683a61c2b605c21d"><code>733bffc</code></a> build(deps): bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2587">#2587</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/252c5e70a6eae3a9de06b610159a568eaf705055"><code>252c5e7</code></a> build(deps): bump the deps group across 1 directory with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2585">#2585</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/1d2ff7ce3f67fe46c45478d09d1670c1f1b100dc"><code>1d2ff7c</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2584">#2584</a>)</li>
<li>See full diff in <a href="https://github.com/cargo-bins/cargo-binstall/compare/30b5ca8b54e1dcffd9548bc87ede1531310fdc67...732870f031d2fb36309d0deaf36abcc704a7be65">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cargo-bins/cargo-binstall&package-manager=github_actions&previous-version=1.20.0&new-version=1.20.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 5c0d27359e798a2f75388ca0723b74208f336c48; successfully ran local tests
satsfy:
ACK 5c0d27359e798a2f75388ca0723b74208f336c48


Tree-SHA512: a21a2398906184633fbc534cb48b4d2c5b1de7351f5ac991bba31c6080e51e13f15ff64b29a94e3c7aadd9b15d8fbbe315bed741569b9d6b37c48410cb11c5ef

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes one line in a GitHub Actions workflow. It switches the version of cargo-binstall (a helper tool used during automated testing) from 1.20.0 to 1.20.1. There is no indication this fixes or introduces a security problem in the rust-bitcoin library itself.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6777: build(deps): bump taiki-e/install-action from 2.82.0 to 2.82.4by Andrew Poelstra · d8950542 · Aug 26, 2026 · 2 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6777: build(deps): bump taiki-e/install-action from 2.82.0 to 2.82.4

24c8df4787d21eedb5570545980a68301d81751c build(deps): bump taiki-e/install-action from 2.82.0 to 2.82.4 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.0 to 2.82.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.4</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.11.24.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.13.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.54.0.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.1.</p>
</li>
</ul>
<h2>2.82.3</h2>
<ul>
<li>
<p>Update <code>zizmor@latest</code> to 1.26.1.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 46.0.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.5.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.12.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.104.0.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.35.5.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.138.</p>
</li>
<li>
<p>Update <code>cargo-crap@latest</code> to 0.3.0.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.20.1.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.0.1.</p>
</li>
</ul>
<h2>2.82.2</h2>
<ul>
<li>
<p>Update <code>xh@latest</code> to 0.26.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.23.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.2.</p>
</li>
<li>
<p>Update <code>sccache@latest</code> to 0.16.0.</p>
</li>
</ul>
<h2>2.82.1</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.4.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.22.</p>
</li>
<li>
<p>Update <code>osv-scanner@latest</code> to 2.4.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.11.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.11.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.86.6] - 2026-08-23</h2>
<ul>
<li>
<p>Update <code>dprint@latest</code> to 0.56.1.</p>
</li>
<li>
<p>Update <code>cargo-lambda@latest</code> to 1.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.10.</p>
</li>
</ul>
<h2>[2.86.5] - 2026-08-21</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.4.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.257.1.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.36.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.10.</p>
</li>
<li>
<p>Update <code>cargo-dinghy@latest</code> to 0.8.6.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.0.</p>
</li>
</ul>
<h2>[2.86.4] - 2026-08-20</h2>
<ul>
<li>
<p>Update <code>oxfmt@latest</code> to 1.79.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.8.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.14.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.56.0.</p>
</li>
<li>
<p>Update <code>cargo-about@latest</code> to 0.9.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.9.</p>
</li>
</ul>
<h2>[2.86.3] - 2026-08-18</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/682e7d9e49c5e653d371fc6adbda67653461378a"><code>682e7d9</code></a> Release 2.82.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/88e83503037db61d4f066a4d9cb32e6fc06b70c2"><code>88e8350</code></a> Update wasmtime manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/cf0e00b44cf05faddafcc8082c6c2366e2a02380"><code>cf0e00b</code></a> Update wasm-bindgen manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/a130ea674166df9065f363cbb53f1f2bc4a6298c"><code>a130ea6</code></a> Update vacuum manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/0bdcc65dc21d0ae46842dc5ad063d69ce8991365"><code>0bdcc65</code></a> Update <code>uv@latest</code> to 0.11.24</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3f52215559b820ee57b68e3fa9b38f6cd205e9c8"><code>3f52215</code></a> Update <code>mise@latest</code> to 2026.6.13</li>
<li><a href="https://github.com/taiki-e/install-action/commit/294a073b0ebe66401c699c21b98e9ecb5a6da735"><code>294a073</code></a> Update <code>just@latest</code> to 1.54.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f9bf24932b3cbfe7ae26b5addcd257989e14ec4d"><code>f9bf249</code></a> Update cargo-rdme manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/98288d38cbfc5fa065ff61c6971d50dc3ba7d408"><code>98288d3</code></a> Update <code>biome@latest</code> to 2.5.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3"><code>ace6ebe</code></a> Release 2.82.3</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/b8cecb83565409bcc297b2df6e77f030b2a468d5...682e7d9e49c5e653d371fc6adbda67653461378a">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.0&new-version=2.82.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 24c8df4787d21eedb5570545980a68301d81751c; successfully ran local tests
satsfy:
ACK 24c8df4787d21eedb5570545980a68301d81751c


Tree-SHA512: e31af029eeff4bf1e9abcc8f73725d2e7fb87972d38039311252650e40af103d130dd7d16c6947b1333f7f77e5ce30ac6b6908017c34e7597c1f57d69b4c49e4

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine update to a GitHub Actions helper used only in automated testing workflows. It does not change the actual rust-bitcoin library code that users install, and there is no indication it fixes a security problem.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6768: units: Add `#[inline]` to simple functionsby Andrew Poelstra · dcc0173c · Aug 25, 2026 · 20 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6768: units: Add `#[inline]` to simple functions

75c1d648bc3ac9e65b222ef6a56332b304e41815 units: Add #[inline] to simple functions (Mitchell Bagot)

Pull request description:

Where functions merely delegate to other functions, or only perform trivial operations, they should be annotated with #[inline] to nudge the compiler towards improving performance by inlining them. Before the final 1.0 release, any remaining simple functions should be tagged with the #[inline] attribute.

Add #[inline] to trivial functions in all modules.


ACKs for top commit:
apoelstra:
ACK 75c1d648bc3ac9e65b222ef6a56332b304e41815; successfully ran local tests
tcharding:
ACK 75c1d648bc3ac9e65b222ef6a56332b304e41815


Tree-SHA512: e0434a8523cd097ddeddd626e68497310c8efb8c3c071d37d066dc16dd5a0a701876abde78bfdac515cdd5edd75cc383685d2a8b43293a35fa2aca789a32b301

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds the #[inline] compiler hint to many small, simple functions in the rust-bitcoin units crate. It does not change any logic, behavior, or public API. The change is purely a performance optimization to encourage the Rust compiler to inline trivial functions. There is no security relevance.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6762: primitives: Flatten error constructorsby Andrew Poelstra · f490d064 · Aug 25, 2026 · 2 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6762: primitives: Flatten error constructors

c772cb1b52f575c6d4b9566440c18faa143e0c13 primitives: Flatten error constructors (Mitchell Bagot)

Pull request description:

Typically speaking, nested error construction yields code that's not very readable. Instead, we can make use of map_err to repeatedly wrap inner error types to produce the final error types as needed.

Flatten nested error constructors in primitives to use repeated map_err calls.

Contributes to #6539


ACKs for top commit:
tcharding:
ACK c772cb1b52f575c6d4b9566440c18faa143e0c13
apoelstra:
ACK c772cb1b52f575c6d4b9566440c18faa143e0c13; successfully ran local tests


Tree-SHA512: c00645798ca9dd602c54b735a6d282e0964c46634fd813b6942a3e6ae8d940958391226ecf95aa8f2a6346251072c80bd4b49e2394ff5c09a9071210be349192

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a pure code-style cleanup. It rewrites how errors are wrapped in two source files so the code reads more cleanly, but it does not change what errors are produced, what data is accepted, or how the software behaves. There is no security issue here.

AI review queuedprimitives: Add #[inline] to simple functionsby Mitchell Bagot · 0df86b2b · Aug 21, 2026 · 17 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Add #[inline] to simple functions

Following the recent additions to primitives, and before the final
release, new simple functions need have #[inline] added to them.

Add #[inline] to simple functions throughout the crate.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds the Rust compiler hint `#[inline]` to many small, simple functions in the `primitives` crate. It does not change any behavior, fix any bug, or alter any security check. It is a performance and code-quality cleanup with no security relevance.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6741: units: Add and standardise doc and comment linksby Andrew Poelstra · 9dab0517 · Aug 18, 2026 · 20 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6741: units: Add and standardise doc and comment links

0004759e3865caf677c1ecad2f9df5a50f53acfa units: Replace in-line links with tag links (Mitchell Bagot)
d2675c71655e48e1d93617750c8f9ae5106bcd86 Fix blank space in doc link (Mitchell Bagot)
e5ac2a6c5aa641f1cb9bd5b81cda40992db1c1eb units: Add links to docs (Mitchell Bagot)

Pull request description:

The C-LINK docs guideline recommends including links for types and modules throughout the public-facing documentation. Additionally, at least in VSCode, these links can be followed through Ctrl-Click, even when in private code comments. As such, all types and modules should be modified to links to improve both user docs readability, and code navigation.


ACKs for top commit:
satsfy:
ACK 0004759
apoelstra:
ACK 0004759e3865caf677c1ecad2f9df5a50f53acfa; successfully ran local tests
tcharding:
ACK 0004759e3865caf677c1ecad2f9df5a50f53acfa I didn't check all changes in patch 1 because satsfy seems to have been most thorough.


Tree-SHA512: 2e0f265af2f996ef0c62564587882a77418eeb974293f083ad806aa02b530347ada5ae260757838b2e98002a46b896ff348498c404d3b01816352a49e6fd7829

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes documentation comments and doc links in the rust-bitcoin 'units' crate. It replaces plain-text type names with clickable Rustdoc links and fixes a minor blank-space issue in a doc link. There are no code behavior changes, no API changes, and no security fixes.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6732: primitives: Doc links follow-upby Andrew Poelstra · 2081db5a · Aug 18, 2026 · 7 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6732: primitives: Doc links follow-up

54e22747d012e90cc4eaf0d33d0ce9ab40ae6cda Remove link brackets from deprecation note (Mitchell Bagot)
c2754d9a566103127484748ae06c8a53063a3179 Add full stop after Script method docs (Mitchell Bagot)
fb0324399f04b36752b26a5ce335401963a9d5c2 primitives: Replace in-line links with tag links (Mitchell Bagot)

Pull request description:

This is a follow-up to #6728.


ACKs for top commit:
apoelstra:
ACK 54e22747d012e90cc4eaf0d33d0ce9ab40ae6cda; successfully ran local tests


Tree-SHA512: 2574befb511ef68a0ff21b602d8e0d18d3550f1f4b9c55458007224ae2e9504600084747f4fa7cc9576c4df196e76881cebb7f4677c277ba3b89f87521865d31

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes documentation comments and deprecation note formatting in the rust-bitcoin library. It replaces some inline Markdown-style links with separate reference-style link definitions, adds missing punctuation, and removes link brackets from a deprecation note. There are no code logic, API, or behavior changes, so it has no security impact.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6750: build(deps): bump taiki-e/install-action from 2.81.10 to 2.82.0by Andrew Poelstra · b4082eb9 · Aug 18, 2026 · 2 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6750: build(deps): bump taiki-e/install-action from 2.81.10 to 2.82.0

b00197e524ddf3bb7152317cf187a213788c7366 build(deps): bump taiki-e/install-action from 2.81.10 to 2.82.0 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.81.10 to 2.82.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.0</h2>
<ul>
<li>
<p>Support <code>cargo-vet</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1908">#1908</a>, thanks <a href="https://github.com/jakewimmer"><code>@​jakewimmer</code></a>)</p>
</li>
<li>
<p>Support <code>cargo-crap</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1905">#1905</a>, thanks <a href="https://github.com/BartoszCiesla"><code>@​BartoszCiesla</code></a>)</p>
</li>
<li>
<p>Support <code>cargo-leptos</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1903">#1903</a>, thanks <a href="https://github.com/404Simon"><code>@​404Simon</code></a>)</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.103.0.</p>
</li>
<li>
<p>Update <code>cargo-xwin@latest</code> to 0.23.0.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 45.0.2.</p>
</li>
<li>
<p>Update <code>cargo-deny@latest</code> to 0.19.9.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.4.5.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.10.</p>
</li>
</ul>
<h2>2.81.11</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.252.0.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.125.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.21.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.35.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.9.</p>
</li>
<li>
<p>Update <code>jaq@latest</code> to 3.1.0.</p>
</li>
<li>
<p>Update <code>cargo-insta@latest</code> to 1.48.0.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.0.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.86.1] - 2026-08-15</h2>
<ul>
<li>Fix an issue where <code>oxfmt</code> was accidentally installed as <code>oxfmt-{target}{exe}</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1969">#1969</a>)</li>
</ul>
<h2>[2.86.0] - 2026-08-15</h2>
<ul>
<li>Support <code>oxfmt</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1967">#1967</a>, thanks <a href="https://github.com/rami3l"><code>@​rami3l</code></a>)</li>
</ul>
<h2>[2.85.14] - 2026-08-15</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.4.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.74.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.4.0.</p>
</li>
<li>
<p>Update <code>mdbook-mermaid@latest</code> to 0.17.1.</p>
</li>
<li>
<p>Update <code>cargo-xwin@latest</code> to 0.23.1.</p>
</li>
</ul>
<h2>[2.85.13] - 2026-08-13</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.3.3.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.5.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.113.0.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.4.</p>
</li>
<li>
<p>Update <code>bpf-linker@latest</code> to 0.11.0.</p>
</li>
</ul>
<h2>[2.85.12] - 2026-08-12</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.3.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.256.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/b8cecb83565409bcc297b2df6e77f030b2a468d5"><code>b8cecb8</code></a> Release 2.82.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/981171473775d521e3ae1e0b14c569b51c48651e"><code>9811714</code></a> Update changelog</li>
<li><a href="https://github.com/taiki-e/install-action/commit/e7005464717d3cca03b48509ba65ebbde552e10c"><code>e700546</code></a> Update wasmtime manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/fdfb4a4a7c8af40d72ebb849dac38e8718ea669c"><code>fdfb4a4</code></a> Update mise manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ef03904287f8419ca540ee664cc9227c6d501867"><code>ef03904</code></a> Update martin manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/b6d098313f0ccec3f73270982ba4474205dbd7fd"><code>b6d0983</code></a> Update <code>kingfisher@latest</code> to 1.103.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ebeb9b1a53c2307773f018dca9868b795675e6c5"><code>ebeb9b1</code></a> Update just manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/119edcf29d9a2c67fad2ed58e04242daceb433e5"><code>119edcf</code></a> Update <code>cargo-xwin@latest</code> to 0.23.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/cd319da91ecc8685df284d89c5435723973a5668"><code>cd319da</code></a> Update <code>wasmtime@latest</code> to 45.0.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/4942894b57b5ad6fdcb38216eb1f7df561374b20"><code>4942894</code></a> Update cargo-xwin manifest</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/7a79fe8c3a13344501c80d99cae481c1c9085912...b8cecb83565409bcc297b2df6e77f030b2a468d5">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.81.10&new-version=2.82.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK b00197e524ddf3bb7152317cf187a213788c7366; successfully ran local tests


Tree-SHA512: b69757c8a6eaaf5a3f42d2aa14912dd7b1db62eb1b551dc4bb99104b5ee4f1198912a041be2e98d0c0f0f4cda57debe56c62e92b5702aab7a56ae32732c30faa

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine Dependabot update that bumps a GitHub Actions helper (taiki-e/install-action) used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or introduces a security issue.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6730: primitives: Remove `BlockHashDecoder` from `transaction` moduleby Andrew Poelstra · 793e4712 · Aug 15, 2026 · 6 filesMessage 91 · StrongInformational 20Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6730: primitives: Remove `BlockHashDecoder` from `transaction` module

76c19176514ef42d104ada21a1c47f58e762e7dd Update API files (Mitchell Bagot)
ff712f73840768fd2481d3a0b51890062049d36a primitives: Remove BlockHashDecoder from transaction module (Mitchell Bagot)

Pull request description:

The BlockHash type is present in the primitives::block module. However, the decoder and its associated error type is re-exported in both the transaction and block modules.

Remove BlockHashDecoder and BlockHashDecoderError re-exports from the primitives::transaction module.


ACKs for top commit:
tcharding:
ACK 76c19176514ef42d104ada21a1c47f58e762e7dd
apoelstra:
ACK 76c19176514ef42d104ada21a1c47f58e762e7dd; successfully ran local tests


Tree-SHA512: daf983550fea7219b6c8f9adcb3c96b5d7dd4c9eebead23b3bba97b8e27fb93965d5f37b7ee624744fbf0618f8570ffbc69c9ae1063ad9f971cd2d454ecc5144

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This change is a routine cleanup of the library's public API. It removes two items (BlockHashDecoder and BlockHashDecoderError) that were accidentally re-exported from the wrong module. The actual decoder and error type still exist in the correct block module, so no functionality is removed. There is no security issue here.

AI review queuedapi: remove api snapshot filesby satsfy (Renato Britto) · 53ea3d6f · Aug 14, 2026 · 24 filesMessage 68 · AdequateInformational 15Details
Commit message · satsfy (Renato Britto)

api: remove api snapshot files

The api CI task now diffs the generated API against the
base branch, so the committed snapshots no longer serve
as the check. They only produce rebase churn on every api
change, so drop them and ignore the generated location.

contrib/api.sh now points at the generated path and tells
the user how to produce the files when they are missing.

API snapshot was a prerequisite of Check Re-exports job,
so they must be regenerated now. Each re-exports script
implements an api snapshot generation for robustness.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: unusually broad change
AI analysis · Informational 15/100

This commit removes large, automatically-generated API snapshot text files from the rust-bitcoin repository. The snapshots were used to detect accidental changes to the public API, but they caused unnecessary merge conflicts. The project now generates these snapshots on demand during CI instead of storing them in git. This is a repository maintenance and CI workflow change, not a code behavior change, and it has no direct security impact on users of the library.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6728: primitives: Add links in docs and update encoding trait namesby Andrew Poelstra · 333869c7 · Aug 12, 2026 · 21 filesMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6728: primitives: Add links in docs and update encoding trait names

83cccd77a014d2bc0d9f53e08852a1fc494f19a6 primitives: Replace instances of old encoding trait names (Mitchell Bagot)
0ccb9beaf46733781e017753a406e208cc95f7ac primitives: Add doc links for types (Mitchell Bagot)

Pull request description:

According to the C-LINK API guideline, docs should make use of links to reference functions and types throughout, as this allows users to quickly click-through to the referenced function/type. During this change, the old encoding trait names should be changed so that they can be linked.

Wrap backticked types and functions as links throughout.
Replace old encoding trait names with renamed versions in docs and comments.


ACKs for top commit:
apoelstra:
ACK 83cccd77a014d2bc0d9f53e08852a1fc494f19a6; successfully ran local tests
tcharding:
ACK 83cccd77a014d2bc0d9f53e08852a1fc494f19a6


Tree-SHA512: 8d7016133cafd40493036f320ff7eb578a2c4f024e540eac5c76e92c768480054d2d0551d887cc12650ea31b8cdcf1d5d8dffa07e2f35667d998d969fb038e2f

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a documentation-only cleanup. It turns plain backtick-quoted type names (like `BlockHash`) into clickable Rust doc links (like [`BlockHash`]) and updates references to renamed encoding traits (e.g., `Encodable`/`Decodable` to `Encode`/`Decode`) in comments. No executable code logic was changed.

AI review queuedprimitives: Replace instances of old encoding trait namesby Mitchell Bagot · 83cccd77 · Aug 12, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Replace instances of old encoding trait names

In various places in the documentation and code comments, the old
encoding trait names of Encodable/Decodable are still used. While
adding in links, these can be changed to match the new names of Encode
and Decode.

Replace all instances of Encodable and Decodable with Encode/Decode and
add links to public doc instances of the new trait names.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates documentation and code comments. It renames references to old trait names (Encodable/Decodable) to the new names (Encode/Decode) and adds clickable documentation links. No actual program logic or behavior was changed.