CommitWatch RSS
RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue248AI analyses
194commits · 30 days
405commits · 60 days
1283commits · 180 days
2070commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot640192109068
Tobin C. Harding4096544063
jrakibi944912068
Nick Johnson189204059
Andrew Poelstra512011075
Jamil Lambert, PhD114185061
Fmt Bot311412045
Trevor Arjeski111111069
Shing Him Ng3176056
Ismail Daif2263050
satsfy (Renato Britto)1766066
Martin Habovstiak2754069
Analysis record

Published AI watches

Last scanned 1 minute ago

Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

base58ck: Bump version to 0.5.0

This commit is a routine version bump for the base58ck crate from 0.4.0 to 0.5.0. It only updates version numbers in package manifests, lock files, and adds a changelog entry describing unrelated feature changes. There are no code changes,…

8479b56eby Tobin C. Harding+22−168 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Rename Error to DecodeCheckError

This commit is a routine code cleanup: it renames the `Error` type in the base58 module to the more descriptive `DecodeCheckError`, and adds a deprecated type alias so existing code using `base58::Error` continues to work. There is no chan…

b0eba4c0by Mitchell Bagot+45−395 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add sha256::Midstate::SHA256_IV constant

This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than al…

dc21841bby Andrew Poelstra+39−143 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add several methods to sha256::Midstate for computing them in const contexts

This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature …

7d8f06d2by Andrew Poelstra+80−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

taproot-primitives: Implement encoding traits for TapLeafHash

This commit adds standard data-encoding support for a Bitcoin Taproot hash type (TapLeafHash) so it can be properly serialized and deserialized in PSBT data. There is no indication of a security bug being fixed; it appears to be a missing-…

No security-relevant signal in commit message or diffChange is a feature addition (encoding trait implementations)No bounds-checking, memory-safety, or cryptographic flaws evident in diff
b2ab0896by Mitchell Bagot+59−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Split Address into an extension trait

This commit is a routine code reorganization in the rust-bitcoin library. It moves the `Address::from_script` method out of the main `Address` type into a new 'extension trait' called `AddressExt`. The actual logic of the function is copie…

c900fa8cby Mitchell Bagot+35−263 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

primitives: Bump version to 0.103.0

This commit is a routine release preparation: it bumps the version number of the `bitcoin-primitives` crate from 0.102.0 to 0.103.0, updates related dependency declarations in other crates, refreshes lock files, and adds a changelog entry.…

5612224dby Tobin C. Harding+48−88 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: bump version to 1.1.0

This commit is a routine version bump for the bitcoin_hashes crate from 1.0.0 to 1.1.0. It updates dependency references across the workspace, records the release in the changelog, and adjusts deprecation lint allowances in tests. There is…

bf3f25f4by Nick Johnson+34−269 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 80 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor(bip32): Xpub child tweak api

This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual c…

No security-relevant behavioral change observedAPI rename and return-type encapsulation onlyNo new validation, bounds checking, or constant-time guarantees added
37191717by Trevor Arjeski+21−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 85 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor(bip32): rename Xpub and Xpriv derivation methods

This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability…

No security-relevant logic changePure API renaming/refactoringDeprecated method removal may break downstream callers at compile time
f8f053fdby Trevor Arjeski+61−852 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

internals: Bump version to 0.6.0

This commit is a routine version bump for the internal 'bitcoin-internals' crate from 0.5.0 to 0.6.0. It updates version numbers across package manifests and lock files, and adds a changelog describing API cleanups and small improvements. …

aed7a9ceby Tobin C. Harding+73−5616 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove hex dep from internals

This commit simply removes an unused software dependency (the hex-conservative crate) from the internals sub-package and updates related package configuration files. It is a routine cleanup change with no security relevance.

bd0d4bc0by Tobin C. Harding+8−118 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace external uses of base58 encoding with Base58CkString

This commit is a routine internal code cleanup in the rust-bitcoin project. It swaps old base58 encoding helper functions for a new equivalent type, Base58CkString, in three source files. There is no indication from the commit itself that …

No security-relevant signal in the diff: equivalent API swap onlyNo new dependencies or unsafe blocks introducedNo changes to input validation, parsing, or secret handling
7f5fbd13by Mitchell Bagot+10−103 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add try_push to Buffer trait

This commit adds a new `try_push` method to an internal `Buffer` trait used during Base58 encoding. It is a straightforward, additive change that lets encoding code gracefully handle a full fixed-size buffer in no-allocation builds. There …

aafb6065by Mitchell Bagot+15−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: Rename _with decoder functions

This commit is a simple renaming of internal Rust functions from names ending in '_with' to names ending in '_with_decoder'. It does not change what the code does, only what the functions are called, to avoid confusion with another functio…

12325a67by Mitchell Bagot+18−174 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 63 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Move ScriptPubKeyBufExt to addresses

This commit is a routine internal code reorganization in the rust-bitcoin library. It moves a helper trait (ScriptPubKeyBufExt) and its functions from one internal module to another, and re-exports it so existing users see no change. There…

ed00d91aby Mitchell Bagot+92−552 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: Deprecate sha256t_tag macro

This is a routine code-maintenance change: the developers are marking an old helper macro as deprecated and telling users how to write the same code by hand. There is no bug fix, no security patch, and no vulnerability being addressed in t…

ac921e97by jrakibi+26−123 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

2026-07-05 automated rustfmt nightly

This commit is a routine automated code-formatting run by the rustfmt tool. It only changes whitespace, import order, and line breaks in five files. There are no functional changes, no bug fixes, and no security-related modifications.

673e5ee4by Fmt Bot+12−115 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: implement sha256t::Tag without the macro

This commit is a routine code cleanup in the rust-bitcoin library. It replaces a macro used to define SHA-256 tagged hash identifiers with direct Rust code that does the same thing. The actual hash values and behavior are unchanged; only t…

0131814dby jrakibi+30−133 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: adapt default and no feature bip32 test for rbmt 0.4.0

This is a routine update to the project's automated testing configuration. A tool used to run example tests changed its syntax, so the developer updated one line to keep the same tests running the same way. There is no user-facing change a…

5f933d5cby satsfy (Renato Britto)+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 29bb6aa2 · Jul 6, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.35.2 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...68bde559dea0fdcac2102bfdf6230c5f70eb485e)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.35.4
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump ncipollo/release-action from 1.20.0 to 1.21.0by dependabot[bot] · 5c75b6da · Jul 6, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump ncipollo/release-action from 1.20.0 to 1.21.0

Bumps [ncipollo/release-action](https://github.com/ncipollo/release-action) from 1.20.0 to 1.21.0.
- [Release notes](https://github.com/ncipollo/release-action/releases)
- [Commits](https://github.com/ncipollo/release-action/compare/b7eabc95ff50cbeeedec83973935c8f306dfcd0b...339a81892b84b4eeb0f6e744e4574d79d0d9b8dd)

---
updated-dependencies:
- dependency-name: ncipollo/release-action
dependency-version: 1.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump astral-sh/setup-uv from 7.1.2 to 8.1.0by dependabot[bot] · fab2fabb · Jul 6, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump astral-sh/setup-uv from 7.1.2 to 8.1.0

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.1.2 to 8.1.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41...08807647e7069bb48b6ef5acd8ec9567f424441b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump actions/cache from 5.0.0 to 5.0.5by dependabot[bot] · a22ae9a8 · Jul 6, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump actions/cache from 5.0.0 to 5.0.5

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.0 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf0...27d5ce7f107fe9357f9df03efb73ab90386fccae)

---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedUpdate API filesby Mitchell Bagot · b32abd74 · Jul 6, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queueddocs: Update dep-treeby Tobin C. Harding · 3ee5556f · Jul 6, 2026 · 1 fileMessage 63 · AdequateTriage 0Details
Commit message · Tobin C. Harding

docs: Update dep-tree

The workspace dependency trees have changed a bit:

- Added `internals` dep to `encoding`
- Added `crypto` crate

Run `cd docs; rm dep-tree; just gen-dep-tree > dep-tree`.

63/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI review queuedconsensus_encoding: Add decode_from_hex_withby Mitchell Bagot · b8c3387a · Jul 3, 2026 · 4 filesMessage 58 · ThinTriage 7Details
Commit message · Mitchell Bagot

consensus_encoding: Add decode_from_hex_with

Recently, decode_from_*_with functions have been added that take a
Decoder generic type instead of a Decode generic. The decode_from_hex
function does not currently have such a counterpart.

Introduce decode_from_hex_with counterpart to decode_from_hex.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedUpdate API filesby Mitchell Bagot · 16ca3c27 · Jul 2, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · 1976a374 · Jul 2, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedRemove unused const valuesby Mitchell Bagot · 606d1124 · Jun 30, 2026 · 1 fileMessage 58 · ThinTriage 12Details
Commit message · Mitchell Bagot

Remove unused const values

The const values SEGWIT_MARKER and SEGWIT_FLAG are only used in
consensus encoding code. Since the duplicate implementation in bitcoin
for the old traits is being deleted, the duplicates of these const
values can be removed and only the copies in primitives left.

Remove const values SEGWIT_MARKER and SEGWIT_FLAG.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedUse TxOutEncoder for TxOut encodingby Abeeujah · d30b2812 · Jun 30, 2026 · 1 fileMessage 68 · AdequateTriage 12Details
Commit message · Abeeujah

Use TxOutEncoder for TxOut encoding

TxOut has a TxOutEncoder newtype for consensus encoding TxOut
objects, but the Encode implementation currently uses a bare
Encoder3.

This fails to properly encapsulate the inner state of the
TxOut type and its encoding behavior. Switch the implementation
to use TxOutEncoder.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedUse TxInEncoder for TxIn encodingby Abeeujah · ef12ebee · Jun 30, 2026 · 1 fileMessage 68 · AdequateTriage 12Details
Commit message · Abeeujah

Use TxInEncoder for TxIn encoding

TxIn has a TxInEncoder newtype for consensus encoding TxIn
objects, but the Encode implementation currently uses a bare
Encoder3.

This fails to properly encapsulate the inner state of the
TxIn type and its encoding behavior. Switch the implementation
to use TxInEncoder.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedUpdate API filesby Abeeujah · 1fdb9c65 · Jun 30, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Abeeujah

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · a074762e · Jun 30, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedClose FromHexErrorby Mitchell Bagot · f0e8e7bc · Jun 30, 2026 · 4 filesMessage 41 · ThinTriage 19Details
Commit message · Mitchell Bagot

Close FromHexError

The FromHexError is currently unreleased but is necessary for hex
functionality. Since it is not ready for 1.0 as an enum, it should be
enclosed in a private struct as is typical for error types from units,
primitives, etc.

Rename FromHexError enum to FromHexErrorInner and add a new
FromHexError struct to privately wrap the inner enum.

41/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context! Too few words to establish purpose
Why it was queued
signing or wallet pathparser or protocol pathsecond-pass: security-sensitive path
AI review queuedAdjust fuzz targets to use consensus_encodingby Mitchell Bagot · f5041528 · Jun 29, 2026 · 9 filesMessage 78 · AdequateTriage 17Details
Commit message · Mitchell Bagot

Adjust fuzz targets to use consensus_encoding

Various fuzz targets use the old consensus code for serialisation and
deserialisation. Since we want to remove this consensus code, the fuzz
targets must be updated.

Replace all uses of old consensus code in fuzz targets with
consensus_encoding.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI review queuedhashes: update API filesby jrakibi · 6c0f1ea5 · Jun 26, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · jrakibi

hashes: update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedfuzz: rename old_bitcoin to bitcoin_0_32by Nick Johnson · e739ebb8 · Jun 25, 2026 · 10 filesMessage 55 · ThinTriage 17Details
Commit message · Nick Johnson

fuzz: rename old_bitcoin to bitcoin_0_32

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI review queuedfuzz: migrate 0.32.x fuzz targets to masterby Nick Johnson · f01340ee · Jun 25, 2026 · 13 filesMessage 78 · AdequateTriage 17Details
Commit message · Nick Johnson

fuzz: migrate 0.32.x fuzz targets to master

Centralize all fuzz infra on the master branch, including targets from
the LTS 0.32.x branch. This should make the infra and targets easier to
maintain, and they will probably be run more often in practice here.

The 0.32.x targets were migrated from hongfuzz to master's libfuzzer.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI review queuedconsensus_encoding: always enable alloc for serdeby Nick Johnson · d6730d68 · Jun 24, 2026 · 3 filesMessage 68 · AdequateTriage 0Details
Commit message · Nick Johnson

consensus_encoding: always enable alloc for serde

Since there is no "collect_bytes" exposed in serde, an allocation is
unavoidable for non-human-readable serialization. Make the alloc
dependency explicit in the feature declaration.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedPrevent panic in UserAgent arbitraryby Mitchell Bagot · eee88730 · Jun 23, 2026 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Prevent panic in UserAgent arbitrary

The current UserAgent arbitrary impl can panic when calling into
UserAgent::new, as it doesn't correctly sanitise the characters and
length of the name. While the decoder doesn't enforce these checks,
unexpected panics in the arbitrary impl are surprising and should be
avoided.

Prevent panics in UserAgent arbitrary impl by sanitising inputs to
UserAgent::new.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedAdjust Transaction arbitrary to satisfy decode checksby Mitchell Bagot · 1357c3c9 · Jun 23, 2026 · 1 fileMessage 83 · StrongTriage 17Details
Commit message · Mitchell Bagot

Adjust Transaction arbitrary to satisfy decode checks

The TransactionDecoder has various checks in place that enforce certain
invariants for the decoded Transaction values. In the arbitrary fuzz
targets, this can mean that the arbitrary values can fail to round-trip.
Instead, arbitrary should enforce the same invariants on constructed
values as the decoders do.

Adjust Transaction arbitrary impl to enforce the same invariants as the
TransactionDecoder.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI review queuedUpdate API filesby Mitchell Bagot · fed8a134 · Jun 23, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedAdd serde dep to consensus_encodingby Mitchell Bagot · d6a7362e · Jun 23, 2026 · 6 filesMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Add serde dep to consensus_encoding

The serde dependency will be necessary for the serde_as_consensus
module.

Add and extern serde dep to consensus_encoding

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedinternals: Update API filesby Mitchell Bagot · d7f527f0 · Jun 23, 2026 · 3 filesMessage 35 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

internals: Update API files

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message