units: disable default features in encoding
What the developer wrote
Authored by Nick Johnson
units: disable default features in encoding
What changed, and why it matters
This is a small build-configuration fix in a Rust package file. It stops an optional dependency from automatically pulling in its default features, and explicitly wires the crate's own 'std' and 'alloc' features through to that dependency. The change is defensive: without it, a no-std build could accidentally end up requiring standard-library features, which can cause compilation failures or force an unwanted configuration. There is no direct evidence of an exploitable vulnerability.
Treat as a normal build hygiene patch. Verify that no-std and alloc-only builds of units still compile and pass tests when the encoding feature is enabled. No urgent security action is indicated.
Security signals we found
Build configuration hardening: disables default features on optional dependency to prevent feature leakage
No-std/embedded compatibility fix: ensures optional dependency does not force std
No memory-safety, cryptographic, or input-validation signals present in diff
Evidence from the diff
In units/Cargo.toml, the optional dependency on consensus-encoding (renamed ‘encoding’) is changed to disable its default features. The crate’s std and alloc feature flags are also forwarded to encoding?/std and encoding?/alloc respectively. This ensures that when the encoding dependency is enabled, its feature set tracks the units crate’s no-std/alloc/std configuration rather than always enabling std via default features. The change prevents feature leakage and keeps no-std builds valid.
Changed components
units/Cargo.tomlconsensus-encoding optional dependency integrationno-std/alloc build feature propagationInspect captured patch +3 / −3
diff --git a/units/Cargo.toml b/units/Cargo.toml
index ec2b5a31..829dab13 100644
--- a/units/Cargo.toml
+++ b/units/Cargo.toml
@@ -14,11 +14,11 @@ exclude = ["tests", "contrib"]
[features]
default = ["std"]
-std = ["alloc", "internals/std"]
-alloc = ["internals/alloc","serde?/alloc"]
+std = ["alloc", "internals/std", "encoding?/std"]
+alloc = ["internals/alloc", "serde?/alloc", "encoding?/alloc"]
[dependencies]
-encoding = { package = "consensus-encoding", path = "../consensus_encoding", optional = true }
+encoding = { package = "consensus-encoding", path = "../consensus_encoding", default-features = false, optional = true }
internals = { package = "bitcoin-internals", path = "../internals", version = "0.4.0" }
serde = { version = "1.0.195", default-features = false, features = ["derive"], optional = true }
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.