CommitWatch RSS
RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

2289 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

524security candidates506second-pass queue2193AI analyses
148commits · 30 days
304commits · 60 days
1150commits · 180 days
2055commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
489Strong · 80–100
1083Adequate · 60–79
566Thin · 40–59
151Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot649193645068
Andrew Poelstra21072145089
Tobin C. Harding41566410063
jrakibi944994068
Nick Johnson19121190060
Jamil Lambert, PhD11919116061
satsfy (Renato Britto)381527066
Fmt Bot331431045
Trevor Arjeski111111069
Shing Him Ng31731056
Ismail Daif22622050
Martin Habovstiak28527069
Analysis record

Published AI watches

Last scanned 29 minutes ago

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6912: build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3

This is a routine Dependabot update that changes the pinned version of GitHub's official CodeQL upload-sarif action from 4.37.0 to 4.37.3 in a single CI workflow. The action only uploads static analysis results to GitHub; it does not touch…

b51cec63by Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin lib…

90330d15by Andrew Poelstra+8−84 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6906: consensus_encoding, primitives: expose exact encoding size for block and transaction

This commit adds a way to ask, in advance, exactly how many bytes a Bitcoin block or transaction will take when serialized. It is a feature addition for the library's encoding system, not a fix for a vulnerability. There is no indication i…

No security-relevant signals in commit message or diffFeature addition: expose exact encoded sizeNo mention of vulnerability, CVE, bug bounty, or security report
1a365d53by Andrew Poelstra+129−1068 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 88 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump dtolnay/rust-toolchain

This is a routine update by Dependabot that changes which version of a popular GitHub Action (dtolnay/rust-toolchain) is used to install Rust in automated CI workflows. The commit only updates pinned commit hashes in workflow files; it doe…

a31e0b0eby dependabot[bot]+8−84 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained action used only to upload static-analysis results (SARIF files) from a scheduled CI job. The change does not touch any project source code, cryptographic logic, or user-facing …

2cac6e38by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6787: Move `from_script` to `Address` and drop `AddressExt`

This change is a routine code cleanup, not a security fix. It moves a method that converts Bitcoin output scripts into human-readable addresses from a temporary 'extension trait' directly onto the main Address type. The actual conversion l…

ed42dabdby Andrew Poelstra+38−414 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6061: Units improvements

This is a routine code-quality and API-expansion pull request for the rust-bitcoin library's 'units' crate. It widens some fee-rate constructors from 32-bit to 64-bit inputs, renames the old 32-bit versions, improves serde error messages, …

API surface change: new u64 fee-rate constructors return NumOpResult to prevent silent overflowRenaming of existing u32 constructors to *_u32 may break downstream callers at compile time (breaking API change)Removal of artificial restriction in from_per_vb allows larger valid inputs
f9460859by Andrew Poelstra+266−12211 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6862: units: Preserve error in NumOpResult add and sub

This commit fixes a bug in how the library handles math errors. Previously, if you added or subtracted two values and one of them already had an error (for example, dividing by zero), the library would silently replace that original error …

Error-state information loss in arithmetic wrapper typeIncorrect error propagation could mask prior failures such as division by zeroDefensive correctness fix in numeric operation result handling
5324e59aby Andrew Poelstra+26−41 file
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security sca…

cargo audit advisory remediationdependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)dependency upgrade for known-vulnerable crate (crossbeam-epoch)
5f5f666dby Andrew Poelstra+51−1849 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6884: units: Fix div_by_fee_rate_floor precision

This commit fixes a precision bug in a Rust Bitcoin library function that calculates how much transaction weight a given amount of money can afford at a given fee rate. The old code rounded the fee rate up to a coarser unit (satoshis per k…

Incorrect fee-rate-to-weight conversion leading to understated affordable weightInteger rounding direction (ceil) used as divisor in floor division causing off-by-one or larger precision lossAddition of overflow handling for Weight::MAX
9caad2c1by Andrew Poelstra+23−52 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedprimitives: Add doc links for typesby Mitchell Bagot · 0ccb9bea · Aug 12, 2026 · 20 filesMessage 68 · AdequateInformational 15Details
Commit message · Mitchell Bagot

primitives: Add doc links for types

According to the C-LINK API guideline, docs should make use of links
to reference functions and types throughout, as this allows users to
quickly click-through to the referenced function/type.

Wrap backticked types and functions as links throughout.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates documentation comments in the rust-bitcoin library. It converts plain backtick-wrapped type and function names into clickable Rust doc links (e.g., changing `Block` to [`Block`]). No executable code, logic, or behavior was changed, so there is no security impact.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6713: build(deps): bump cargo-bins/cargo-binstall from 1.19.1 to 1.20.0by Andrew Poelstra · 617302d3 · Aug 10, 2026 · 1 fileMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6713: build(deps): bump cargo-bins/cargo-binstall from 1.19.1 to 1.20.0

3fdbd379ed7c29d2a576cc9263582a9933212f90 build(deps): bump cargo-bins/cargo-binstall from 1.19.1 to 1.20.0 (dependabot[bot])

Pull request description:

Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.19.1 to 1.20.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p>
<blockquote>
<h2>v1.20.0</h2>
<p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p>
<h4>In this release:</h4>
<ul>
<li>Fix IPv6 DNS issue for macOS (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2574">#2574</a> <a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2567">#2567</a> <a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2579">#2579</a>)</li>
<li>Add <code>os-name</code> template variable for <code>pkg-url</code> and <code>bin-dir</code> (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2328">#2328</a> <a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2570">#2570</a>)</li>
<li>Remove quad9 dns fallback (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2572">#2572</a>)</li>
</ul>
<h4>Other changes:</h4>
<ul>
<li>Upgrade dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/30b5ca8b54e1dcffd9548bc87ede1531310fdc67"><code>30b5ca8</code></a> release: cargo-binstall v1.20.0 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2583">#2583</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/bdd791de5adfec6407aee16a3b287f12ba0ef2d8"><code>bdd791d</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2565">#2565</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/657ff6595f9080d94bd696e3656fa7f84152adcf"><code>657ff65</code></a> build(deps): bump netdev from 0.43.0 to 0.44.0 in the deps group (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2581">#2581</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/280a9357bf131d957a090c390bf426ed086fa405"><code>280a935</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2580">#2580</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/ad6ae0185bd1663c6fbd1c4efa0c82d8105a5716"><code>ad6ae01</code></a> bugfix: IPv6 DNS issue (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2579">#2579</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/f8810ffa11196f23afb38e6fb64716fbf814ad8f"><code>f8810ff</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2578">#2578</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/f9b4c532b4655a9c9c00a50db9b48b265c32a055"><code>f9b4c53</code></a> Remove quad9 dns fallback (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2572">#2572</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/7884deddd95d515c3701294cf61a8b96cccc123b"><code>7884ded</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2571">#2571</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/1c2b96c2b86875d56caeec7b7ee9980812daf0d9"><code>1c2b96c</code></a> feat: add os-name template variable for pkg-url and bin-dir (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2570">#2570</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/7c6d6446dab5843b9ab70840f15fbad89e729fbd"><code>7c6d644</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2569">#2569</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/cargo-bins/cargo-binstall/compare/aaa84a43aec4955a42c5ffc65d258961e39f276e...30b5ca8b54e1dcffd9548bc87ede1531310fdc67">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cargo-bins/cargo-binstall&package-manager=github_actions&previous-version=1.19.1&new-version=1.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK 3fdbd379ed7c29d2a576cc9263582a9933212f90; successfully ran local tests


Tree-SHA512: 8a4ee41d3c68ea93c655aae94ff628076b3041b3f329a88cf9baedc4fae1da648839cee69fbc0d151d61eac39c64585f66cf4e068d30c3f308480e78120705b2

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine update to a GitHub Actions workflow that bumps the version of a helper tool called cargo-binstall from 1.19.1 to 1.20.0. The tool is only used during automated version-compatibility checks in CI and is not part of the actual rust-bitcoin library that users install. There is no indication this update fixes or introduces a security problem in the project itself.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6714: build(deps): bump taiki-e/install-action from 2.81.4 to 2.81.10by Andrew Poelstra · e8250092 · Aug 10, 2026 · 2 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6714: build(deps): bump taiki-e/install-action from 2.81.4 to 2.81.10

a2a3f838bd5fd057cbb92877122acc2d0ecef0fe build(deps): bump taiki-e/install-action from 2.81.4 to 2.81.10 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.81.4 to 2.81.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.81.10</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.1.3.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.159.</p>
</li>
<li>
<p>Update <code>cosign@latest</code> to 3.1.1.</p>
</li>
</ul>
<h2>2.81.9</h2>
<ul>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.123.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.2.</p>
</li>
<li>
<p>Update <code>parse-changelog@latest</code> to 0.6.17.</p>
</li>
<li>
<p>Update <code>just@latest</code> to 1.52.0.</p>
</li>
<li>
<p>Update <code>gungraun-runner@latest</code> to 0.19.2.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.20.0.</p>
</li>
</ul>
<h2>2.81.8</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.2.</p>
</li>
<li>
<p>Update <code>parse-dockerfile@latest</code> to 0.1.7.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.1.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.1.</p>
</li>
</ul>
<h2>2.81.7</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 45.0.1.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.1.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.45.1.</p>
</li>
<li>
<p>Update <code>rclone@latest</code> to 1.74.3.</p>
</li>
<li>
<p>Update <code>cargo-audit@latest</code> to 0.22.2.</p>
</li>
</ul>
<h2>2.81.6</h2>
<ul>
<li>
<p>Update <code>prek@latest</code> to 0.4.4.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.0.</p>
</li>
</ul>
<h2>2.81.5</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.19.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.85.11] - 2026-08-09</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.2.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.127.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.3.</p>
</li>
<li>
<p>Update <code>osv-scanner@latest</code> to 2.5.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.3.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.112.0.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.10.0.</p>
</li>
</ul>
<h2>[2.85.10] - 2026-08-07</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.2.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.2.7.</p>
</li>
<li>
<p>Update <code>cosign@latest</code> to 3.1.3.</p>
</li>
<li>
<p>Update <code>coreutils@latest</code> to 0.10.0.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.2.0.</p>
</li>
<li>
<p>Update <code>cargo-crap@latest</code> to 0.4.3.</p>
</li>
</ul>
<h2>[2.85.9] - 2026-08-06</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.1.</p>
</li>
<li>
<p>Update <code>wild@latest</code> to 0.10.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.2.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/7a79fe8c3a13344501c80d99cae481c1c9085912"><code>7a79fe8</code></a> Release 2.81.10</li>
<li><a href="https://github.com/taiki-e/install-action/commit/13599f4dab5fc9777c7a29b255a9106d1107ee1d"><code>13599f4</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/ee40c2ad7099d51081c7f37b4d3d914a008b8403"><code>ee40c2a</code></a> Update <code>tombi@latest</code> to 1.1.3</li>
<li><a href="https://github.com/taiki-e/install-action/commit/c2336861b9e97b4c0e1b19bc5d8968501d4d3b3f"><code>c233686</code></a> Update <code>release-plz@latest</code> to 0.3.159</li>
<li><a href="https://github.com/taiki-e/install-action/commit/7f72f38ad02c28b2456e65ab89c50a362bb98aaa"><code>7f72f38</code></a> Update mise manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f8c685240840f35b073b629510ed9b7a853227f7"><code>f8c6852</code></a> Update <code>cosign@latest</code> to 3.1.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/fd2f5e3d644b484055ebf4268f474c565f148f25"><code>fd2f5e3</code></a> Release 2.81.9</li>
<li><a href="https://github.com/taiki-e/install-action/commit/537f98ea83c367b35b9810b787d0b2ded00efc1a"><code>537f98e</code></a> Update <code>wasm-bindgen@latest</code> to 0.2.123</li>
<li><a href="https://github.com/taiki-e/install-action/commit/6bf6dde29b365c072c8c9b09b160ba21042e6b1e"><code>6bf6dde</code></a> Update <code>tombi@latest</code> to 1.1.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/c1e16527666111091c11f4145f629c642a3c5aef"><code>c1e1652</code></a> Update release-plz manifest</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/cde8c9e634f4a17bc06b61413ac0ef75450eac46...7a79fe8c3a13344501c80d99cae481c1c9085912">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.81.4&new-version=2.81.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK a2a3f838bd5fd057cbb92877122acc2d0ecef0fe; successfully ran local tests


Tree-SHA512: ad182a3450d8503e5de3c631e221ddb7ea23eaacb55532d14cde4b9235d22eb7f5a4773453ed9d158423271d23c9c8d904ee106802121bc27fd88cfb9c7d701c

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine Dependabot update that changes the version of a third-party GitHub Action used only in automated testing workflows. It does not touch the actual Bitcoin library code, user-facing APIs, or any shipped software. There is no indication this fixes or introduces a security problem.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6694: units: Flatten Error Constructorsby Andrew Poelstra · 622ab209 · Aug 8, 2026 · 6 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6694: units: Flatten Error Constructors

9c43790cc9628606c25eb6cc4bce1b587b699512 units: Flatten nested error constructors (Abeeujah)
51ced9efd4ea23d265d2141565db1cc406dfc180 Allow unnecessary_map_on_constructor lint rule (Abeeujah)

Pull request description:

Refactor nested error constructors with chained `map_err` transformation,
This improves readability by making each error conversion step explicit
and easy to reason about.
- Patch 1: Allows the `unnecessary_map_on_constructor` lint rule.
- Patch 2: Flattens double nested `Err` constructors.


ACKs for top commit:
apoelstra:
ACK 9c43790cc9628606c25eb6cc4bce1b587b699512; successfully ran local tests; kinda code-churny but definitely an improvement


Tree-SHA512: 7102f91027511de2404850f65ef7c6a81aaeafc57db334c7d75293796ae9712691bb4a4951d7e84f212eb23e41c69b3df7fe1821f474d7cc420abf0a1aefbc21

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a code cleanup that rewrites how error values are constructed in the Rust Bitcoin library. It changes nested constructor calls like Err(OuterError(InnerError { ... })) into a flatter style using map_err. There is no functional change to how amounts, locktimes, or hex parsing behave, and no security bug is introduced or fixed.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6678: units: Add `Weight::to_vb_*` functions, deprecating `to_vbytes_*`by Andrew Poelstra · 7f614781 · Aug 7, 2026 · 6 filesMessage 91 · StrongInformational 20Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6678: units: Add `Weight::to_vb_*` functions, deprecating `to_vbytes_*`

c4a5a5e64de86f100008972389a76c3eae2faeae Update API files (Mitchell Bagot)
4af70a4eb6a18f4f6ca27c4ea0898f5c9e4bc363 Replace uses of deprecated methods with Weight::to_vb_* (Mitchell Bagot)
519ba8c8a113e679f00a9669ccec51e5c5ef7b54 units: Add Weight::to_vb_* functions, deprecating to_vbytes_* (Mitchell Bagot)

Pull request description:

The Weight type uses from_vb* as the pattern for constructors, but to_vbytes_* for conversion. FeeRate is consistent with to/from_vb*. Before we go to 1.0, Weight's conversion functions should be renamed to keep everything consistent.

Add Weight::to_vb_{floor,ceil} and deprecate Weight::to_vbytes_{floor,ceil}.


ACKs for top commit:
apoelstra:
ACK c4a5a5e64de86f100008972389a76c3eae2faeae; successfully ran local tests


Tree-SHA512: ae4c7781511bf8f654633c2d2b4f7e8ae99ba7385a0f5c2641a01045f14c888554d85080c31c0b56bf99f8b481fc88231cc687066d270995bf18617e3232b6f3

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This is a routine API cleanup in a Rust Bitcoin library. It adds new method names (to_vb_floor, to_vb_ceil) for converting transaction 'weight' to 'virtual bytes' and marks the old names (to_vbytes_floor, to_vbytes_ceil) as deprecated. The actual math is unchanged, and existing callers are updated to use the new names. There is no security bug or fix here.

AI review queuedUpdate API filesby Mitchell Bagot · a75c53c8 · Aug 6, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API listing files (text snapshots of public functions) to reflect a newly added public function, `to_consensus_u32`, on the `CompactTarget` type. It does not change any source code, logic, or behavior, and therefore has no security relevance on its own.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6675: units: Remove unnecessary track_callerby Andrew Poelstra · ce894f36 · Aug 6, 2026 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6675: units: Remove unnecessary track_caller

a1942b52f5efd29a7ed52fd2e77490c24c1809f2 units: Remove unnecessary track_caller (Tobin C. Harding)

Pull request description:

I audited `units` with Claude to check for missing usage of `track_caller`. None found but bot did uncover two usages that are unnecessary because the functions don't panic.

Remove unnecessary `track_caller` attributes on functions that do not panic.

Part of #5518


ACKs for top commit:
apoelstra:
ACK a1942b52f5efd29a7ed52fd2e77490c24c1809f2; successfully ran local tests


Tree-SHA512: a6ef2104165d3e708b699796c2416175f0c941a71b6220d19de07a574c9401c63e567004e629269c99ba3aa67ace2568316304e8090a1b796992e2bfd50aeeb1

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit removes two Rust compiler hints (`#[track_caller]`) from helper functions that simply return a value or call a user-provided fallback. These functions never panic, so the hints were unnecessary and had no security effect. The change is a minor code cleanup with no functional or security impact.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6644: primitives: Add serde impls for `WitnessVersion`by Andrew Poelstra · 4981faa7 · Aug 5, 2026 · 2 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6644: primitives: Add serde impls for `WitnessVersion`

3f4adcb9c64a0165b270d7636d9469c0894a6157 Update API files (Mitchell Bagot)
394a351c38dc0b05ad2cd3a8b23fa8f96a30e65f Add tests to cover new serde traits (Mitchell Bagot)
ffbdf5729dc87587782883d1895cb5de4d292240 Add serde impls for WitnessVersion (Mitchell Bagot)

Pull request description:

The WitnessVersion type in primitives should have serde trait impls, per the C-SERDE guideline.

Add serde Serialize and Deserialize impls for WitnessVersion.

Contributes to #6630


ACKs for top commit:
tcharding:
ACK 3f4adcb9c64a0165b270d7636d9469c0894a6157
apoelstra:
ACK 3f4adcb9c64a0165b270d7636d9469c0894a6157; successfully ran local tests


Tree-SHA512: d75d41780db615205464d638fb7640842957f240e919364d821d032ed07afec63fdaec44f99e75d8c8368888348e4efa72246dfe97574462e51b6ab877cd78d1

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This commit adds standard serialization/deserialization support for the WitnessVersion type when the optional serde feature is enabled. It is a routine feature addition with no security relevance visible in the code or commit message.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` privateby Andrew Poelstra · 07d91f7f · Aug 4, 2026 · 4 filesMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

9c391145fa57dc54e6af1f18758db4e0ba2049de Update the API text files (Tobin C. Harding)
b37accc3db1f164a5b3dee7ff6bbd7a2d0af5be4 Make the WitnessesEncoder private (Tobin C. Harding)

Pull request description:

The `WitnessesEncoder` is an auxilary encoder that is used internally within the transaction encoder. It does not need to be public.

Make it private and put the code right below where it is used.


ACKs for top commit:
apoelstra:
ACK 9c391145fa57dc54e6af1f18758db4e0ba2049de; successfully ran local tests


Tree-SHA512: 1b950e7f3d19bf923325c75a4009dcc903a065cca87fccad638d3d19c53ea824a81b19a07e09eaff5603aea659366d2b80e51a8a694be6f24ae96f5ca0c9c9e7

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit makes a small internal helper type called WitnessesEncoder private. It was previously exported as public API but is only used inside the transaction encoder. The change removes it from the public API surface and moves the code closer to where it is used. There is no security bug being fixed here.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logicby Andrew Poelstra · c5588ba5 · Aug 4, 2026 · 1 fileMessage 91 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

80dcef1527479e2e0790bf5995636b7640bb56f8 Scrub the transaction encoding logic (Tobin C. Harding)

Pull request description:

Third time lucky. Layout the encoding code in `transaction` as is now customary. (`Transaction` was done but I missed the others.)

Code move only.


ACKs for top commit:
apoelstra:
ACK 80dcef1527479e2e0790bf5995636b7640bb56f8; successfully ran local tests


Tree-SHA512: 737266a34151f4449cfc74e8788c94d991e4931b9cd837fbc551fbd7afc3062623525b9165325c371caea0a78e12b5746e71e66c697b1684a5628c8bb4cc8855

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a pure code reorganization (refactor) in the rust-bitcoin library. It moves transaction encoding and decoding definitions around within a single file so the code follows the project's preferred layout. No logic, behavior, or security properties were changed.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4by Andrew Poelstra · 5c92c0b0 · Aug 4, 2026 · 2 filesMessage 96 · StrongInformational 15Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

eb9544f9d07a38d81998e5e1f96faaba43546ca0 build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.12 to 2.81.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.81.4</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.4.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.47.1.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.45.0.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.4.0.</p>
</li>
<li>
<p>Update <code>cargo-mutants@latest</code> to 27.1.0.</p>
</li>
</ul>
<h2>2.81.3</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.3.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.18.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.0.</p>
</li>
</ul>
<h2>2.81.2</h2>
<ul>
<li>
<p>Update <code>mise@latest</code> to 2026.5.18.</p>
</li>
<li>
<p>Update <code>cargo-semver-checks@latest</code> to 0.48.0.</p>
</li>
</ul>
<h2>2.81.1</h2>
<ul>
<li>
<p>Update <code>cargo-no-dev-deps@latest</code> to 0.2.24.</p>
</li>
<li>
<p>Update <code>cargo-hack@latest</code> to 0.6.45.</p>
</li>
</ul>
<h2>2.81.0</h2>
<ul>
<li>
<p>Support <code>convco</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1831">#1831</a>, thanks <a href="https://github.com/graelo"><code>@​graelo</code></a>)</p>
</li>
<li>
<p>Support <code>docgarden</code> (<a href="https://redirect.github.com/taiki-e/install-action/pull/1830">#1830</a>, thanks <a href="https://github.com/jesse-black"><code>@​jesse-black</code></a>)</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.0.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.19.1.</p>
</li>
</ul>
<h2>2.80.0</h2>
<ul>
<li>Support <code>kingfisher</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1874">#1874</a>, thanks <a href="https://github.com/SAY-5"><code>@​SAY-5</code></a>)</li>
</ul>
<h2>2.79.15</h2>
<ul>
<li>
<p>Update <code>typos@latest</code> to 1.47.0.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.251.0.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.27.2.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.17.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.1.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.85.7] - 2026-08-02</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 47.0.3.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.1.</p>
</li>
<li>
<p>Update <code>rclone@latest</code> to 1.75.0.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.110.0.</p>
</li>
</ul>
<h2>[2.85.6] - 2026-08-01</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.255.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.2.5.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.18.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.5.3.</p>
</li>
<li>
<p>Update <code>cargo-crap@latest</code> to 0.4.0.</p>
</li>
</ul>
<h2>[2.85.5] - 2026-07-30</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.0.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.50.0.</p>
</li>
<li>
<p>Update <code>sccache@latest</code> to 0.17.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.16.</p>
</li>
</ul>
<h2>[2.85.4] - 2026-07-29</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.11.33.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.15.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/cde8c9e634f4a17bc06b61413ac0ef75450eac46"><code>cde8c9e</code></a> Release 2.81.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/1e4ec7678aaae334aeea28c8427c4e089bd7ac59"><code>1e4ec76</code></a> ci: Temporarily disable broken opensuse/tumbleweed test</li>
<li><a href="https://github.com/taiki-e/install-action/commit/2ba2a47530f71d53918fc583d17d787dec4eb506"><code>2ba2a47</code></a> Update <code>vacuum@latest</code> to 0.28.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/193c1cc963fc6015a43bd656c624759cf2489e6d"><code>193c1cc</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/cb4b3f93f764d4397e62fed744879c14a37e6648"><code>cb4b3f9</code></a> Update <code>typos@latest</code> to 1.47.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/b6e08095932286aa3bc8066c8425cf400f5dad11"><code>b6e0809</code></a> Update <code>syft@latest</code> to 1.45.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/55ff171d0ce18bd578689162cd406f47f234b9db"><code>55ff171</code></a> Update prek manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/4dea5bb80f56642c56e7b47dd897c5ecff469424"><code>4dea5bb</code></a> Update mise manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3e82d2c35aa3d3b9fa923dd8070290a142e32eb9"><code>3e82d2c</code></a> Update cargo-shear manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/31e07c4d25ffc687960959659c9769d3252c88e1"><code>31e07c4</code></a> Update <code>cargo-neat@latest</code> to 0.4.0</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c...cde8c9e634f4a17bc06b61413ac0ef75450eac46">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.79.12&new-version=2.81.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK eb9544f9d07a38d81998e5e1f96faaba43546ca0; successfully ran local tests
satsfy:
ACK eb9544f9d07a38d81998e5e1f96faaba43546ca0


Tree-SHA512: b9424910bb0f991686929a42b12b1a1183de5b5a86667d0a19a6c0d8b0944dc06d94451e3e357644d4bf7a509bd5b44ec24ad77a0627cdc5b9706808d84cbe39

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine Dependabot update that bumps the version of a third-party GitHub Action used only in automated testing workflows. The change does not touch the project's actual Bitcoin library code, and there is no indication it fixes or introduces a security problem.

AI review queuedScrub the transaction encoding logicby Tobin C. Harding · 80dcef15 · Aug 3, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Tobin C. Harding

Scrub the transaction encoding logic

Third time lucky. Layout the encoding code in `transaction` as is now
customary. (`Transaction` was done but I missed the others.)

Code move only.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a pure code reorganization: it moves existing transaction encoding and decoding definitions around within a single file so they follow the project's preferred layout. No logic was changed, no security bug was fixed, and no new behavior was introduced.

AI review queuedMake the WitnessesEncoder privateby Tobin C. Harding · b37accc3 · Aug 3, 2026 · 2 filesMessage 58 · ThinInformational 15Details
Commit message · Tobin C. Harding

Make the WitnessesEncoder private

The `WitnessesEncoder` is an auxilary encoder that is used internally
within the transaction encoder. It does not need to be public.

Make it private and put the code right below where it is used.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply hides an internal helper type called WitnessesEncoder from public view. It is a routine API-cleanup change with no security relevance visible in the code or commit message.

AI review queuedbuild(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0by dependabot[bot] · 1c438632 · Aug 3, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/08807647e7069bb48b6ef5acd8ec9567f424441b...fac544c07dec837d0ccb6301d7b5580bf5edae39)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/setup-uv. There is no indication of malicious code or a security vulnerability in this change.

AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 5293bee4 · Aug 3, 2026 · 1 fileMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.0 to 4.36.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.36.2
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine automated update by Dependabot that changes the pinned version of a GitHub-provided security scanning helper used in a workflow. It does not modify the project's actual Bitcoin library code, its cryptographic logic, or any code that end users run. There is no indication this introduces a security issue.

AI review queuedbuild(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4by dependabot[bot] · eb9544f9 · Aug 3, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.12 to 2.81.4.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c...cde8c9e634f4a17bc06b61413ac0ef75450eac46)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.81.4
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI analysis · Informational 15/100

This is a routine Dependabot update that bumps a GitHub Actions helper used in automated testing workflows from version 2.79.12 to 2.81.4. It only changes which version of the action is invoked during CI runs; it does not modify the Rust Bitcoin library code or any shipped software. There is no indication this introduces a security issue.

AI review queuedUpdate API filesby Mitchell Bagot · 6ea25bed · Aug 3, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files to remove two lines that documented a `From<u16>` conversion for a locktime type. No actual Rust source code was changed, so there is no runtime behavior change or security fix in this commit itself. It is a documentation/snapshot maintenance update.

AI review queuedUpdate API filesby Mitchell Bagot · 351acf8e · Jul 31, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated API snapshot text files to reflect that the remainder (modulo) operator for the Weight type now returns another Weight instead of a plain number. It contains no source code changes, no bug fix, and no security-related content.

AI review queuedconsensus_encoding: decoder docs which are consensus specificby Nick Johnson · 5cdd5aa0 · Jul 31, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Nick Johnson

consensus_encoding: decoder docs which are consensus specific

The decode module has 6 driver functions bound to `Decode`, and thus
are consensus-encoding specific.

- `decode_from_slice<T: Decode>`
- `decode_from_slice_unbounded<T: Decode>`
- `decode_from_hex<T: Decode>`
- `decode_from_read<T: Decode>`
- `decode_from_read_unbuffered<T: Decode>`
- `decode_from_read_unbuffered_with<T: Decode>`
- `check_decode<T: Decode>`

One type is bound to `Decode`.

- `VecDecoder<T: Decode>`

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes documentation comments in the consensus_encoding crate. It renames descriptions like 'Primitive decoders' to 'Primitive and combinator decoder types' and updates several function doc comments to say 'consensus decodable type' instead of 'object'. No code logic, signatures, or behavior changed. There is no security impact.

AI review queuedhashes: update API filesby Andrew Poelstra · 44552e3a · Jul 31, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Andrew Poelstra

hashes: update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates three text files that list the public API surface of the `bitcoin_hashes` crate. It adds entries for newly exposed SHA-256 midstate methods and a constant. There is no code change, no bug fix, and no security-related content.

AI review queuedUpdate API filesby Mitchell Bagot · cebefd5c · Jul 31, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates machine-generated API snapshot text files to add a newly exposed public function, CompactTarget::to_target, to the recorded public interface. There is no source code change, no bug fix, and no security-relevant behavior change in this commit itself.

AI review queuedUpdate API filesby Mitchell Bagot · 8356c542 · Jul 30, 2026 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates generated text files that list the project's public API surface. The change shows that a Sum trait implementation for a numeric result type was broadened to accept more input types. No actual source code was modified, and there is no indication of a security fix or vulnerability.

AI review queuedunits: Implement serde traits for relative lock timesby Tobin C. Harding · f6d22308 · Jul 30, 2026 · 1 fileMessage 81 · StrongInformational 15Details
Commit message · Tobin C. Harding

units: Implement serde traits for relative lock times

To satisfy the API guideline
[C-SERDE](https://rust-lang.github.io/api-guidelines/interoperability.html#data-structures-implement-serdes-serialize-deserialize-c-serde),
data types in a crate must implement serde's `Serialize` and
`Deserialize` traits.

Add custom impls for the relative lock time subtypes. Note we use 512
second intervals for the `NumberOf512Seconds` type and not seconds so
that there is no error path.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit adds standard data serialization/deserialization support (serde traits) for two relative lock time types in the rust-bitcoin library. It is a routine API completeness change with no security relevance visible in the code or commit message.

AI review queuedImplement serde traits for absolute locktime typesby Tobin C. Harding · 0252bea5 · Jul 30, 2026 · 1 fileMessage 81 · StrongInformational 18Details
Commit message · Tobin C. Harding

Implement serde traits for absolute locktime types

To satisfy the API guideline
[C-SERDE](https://rust-lang.github.io/api-guidelines/interoperability.html#data-structures-implement-serdes-serialize-deserialize-c-serde),
data types in a crate must implement serde's `Serialize` and
`Deserialize` traits.

Add custom impls for the absolute lock time sub types.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 18/100

This commit adds standard data serialization/deserialization support (serde) for two Bitcoin locktime types: block height and median-time-past. It is an API completeness change, not a security fix or vulnerability. The new code validates values during deserialization using the same existing constructors, so it does not introduce obvious weaknesses.

AI review queuedunits: make Sequence inner field privateby satsfy (Renato Britto) · 30f280da · Jul 29, 2026 · 6 filesMessage 68 · AdequateInformational 20Details
Commit message · satsfy (Renato Britto)

units: make Sequence inner field private

The public inner field violates C-STRUCT-PRIVATE. The value is already
accessible through `from_consensus` and `to_consensus_u32` so nothing
is lost by hiding the field.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This commit makes a single internal number field private in a Rust Bitcoin library type called Sequence. It is an API-cleanup change to follow Rust naming conventions (C-STRUCT-PRIVATE). It does not fix a memory corruption bug, a cryptographic flaw, or a consensus issue. Existing code inside the project is updated to use the already-provided public constructor and getter, so behavior is unchanged.