What the developer wrote
Authored by fanquake
depends: Boost 1.91.0-1
What changed, and why it matters
This commit simply updates the Boost dependency used by Bitcoin Core's build system from version 1.90.0 to version 1.91.0-1, including the new download URL and cryptographic hash. There is no indication in the commit itself that this fixes a security issue. It appears to be a routine dependency version bump.
No immediate security action is required based on this commit alone. If security relevance is later claimed for Boost 1.91.0-1, verify against the upstream Boost release notes or a Bitcoin Core security advisory.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change modifies depends/packages/boost.mk to bump the Boost version from 1.90.0 to 1.91.0-1 and updates the corresponding SHA-256 checksum for the downloaded tarball. No code changes, patches, or security-related notes are present in the diff or commit message.
Changed components
depends/packages/boost.mkInspect captured patch +2 / −2
diff --git a/depends/packages/boost.mk b/depends/packages/boost.mk
index 5be0e60b..81d5ef5f 100644
--- a/depends/packages/boost.mk
+++ b/depends/packages/boost.mk
@@ -1,8 +1,8 @@
package=boost
-$(package)_version = 1.90.0
+$(package)_version = 1.91.0-1
$(package)_download_path = https://github.com/boostorg/boost/releases/download/boost-$($(package)_version)
$(package)_file_name = boost-$($(package)_version)-cmake.tar.gz
-$(package)_sha256_hash = 913ca43d49e93d1b158c9862009add1518a4c665e7853b349a6492d158b036d4
+$(package)_sha256_hash = 8a82bd11a720c70923806c36ee5c26dbd2d630c1eaa1d8fad9a7bd5529908a26
$(package)_build_subdir = build
define $(package)_set_vars
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.