← Watch feed
Merge rust-bitcoin/rust-bitcoin#6798: bump yanked secp256k1 version to 0.33.0
Public commit record
91/100 · Strong
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6798: bump yanked secp256k1 version to 0.33.0
935d8eb86e904b3d4ef26ec8ca1ae543daacc914 deps: bump secp256k1 to 0.33.0 (satsfy (Renato Britto))
Pull request description:
The 0.32.0-beta line was yanked from crates.io when 0.33.0 was released.
Also `XOnlyPublicKey::serialize` was deprecated for `to_byte_array` and `secp256k1::Keypair::from_seckey_byte_array` became
`from_secret_bytes`.
ACKs for top commit:
apoelstra:
ACK 935d8eb86e904b3d4ef26ec8ca1ae543daacc914; successfully ran local tests
Tree-SHA512: 62221a72567082200a5f710898bfdd187e553859f496653bd6e86e64c0ca1e2476381637101e7b1507d72071f8aca079f94976ad1bb89211150723f716310e51
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
What changed, and why it matters
This commit updates the project's cryptographic library dependency from a yanked beta version to a stable release. A 'yanked' package is one the authors have removed from public download, usually because it has problems. The change itself is a routine maintenance update, not a fix for a known active attack. It keeps the project buildable for anyone downloading it fresh, but the commit message does not describe any specific security vulnerability in the old version.
Recommended action
Treat as a normal dependency maintenance merge. Verify that CI passes with secp256k1 0.33.0 and that downstream consumers are not pinned to the yanked 0.32.0-beta.2 release. No emergency response is warranted based on the supplied materials.
Security signals we found
01
Dependency moved from a yanked pre-release version to a stable release
02
Cryptographic library (secp256k1) is in the dependency chain
03
No explicit vulnerability or CVE mentioned in commit or PR description
04
No security-related code changes beyond API renames
Evidence from the diff
The commit bumps the secp256k1 crate dependency from 0.32.0-beta.2 (yanked on crates.io) to 0.33.0, and updates secp256k1-sys from 0.12.0 to 0.14.0. It also adapts rust-bitcoin source code to two API renames in the new secp256k1 release: XOnlyPublicKey::serialize becomes to_byte_array, and Keypair::from_seckey_byte_array becomes from_secret_bytes. Lockfiles for multiple workspace crates are regenerated. There is no diff evidence of a vulnerability fix; the stated reason is dependency availability and API compatibility.
Changed components
bitcoin/Cargo.tomlcrypto/Cargo.tomlkey_expression/Cargo.tomltaproot_primitives/Cargo.tomlcrypto/src/key.rsCargo-minimal.lockCargo-recent.lockbenches/Cargo.lockbitcoin/embedded/Cargo.lockInspect captured patch +109 / −63
### Cargo-minimal.lock
@@ -100,7 +100,7 @@ dependencies = [
"bitcoin_hashes 1.2.0",
"bitcoinconsensus",
"hex-conservative 1.1.0",
- "secp256k1 0.32.0-beta.2",
+ "secp256k1 0.33.0",
"serde",
"serde_json",
"serde_test",
@@ -164,7 +164,7 @@ dependencies = [
"bitcoin-primitives",
"bitcoin_hashes 1.2.0",
"hex-conservative 1.1.0",
- "secp256k1 0.32.0-beta.2",
+ "secp256k1 0.33.0",
"serde",
"serde_test",
]
@@ -233,7 +233,7 @@ dependencies = [
"bitcoin-network-kind",
"bitcoin_hashes 1.2.0",
"hex-conservative 1.1.0",
- "secp256k1 0.32.0-beta.2",
+ "secp256k1 0.33.0",
"serde",
"serde_json",
]
@@ -294,7 +294,7 @@ dependencies = [
"bitcoin-crypto",
"bitcoin-internals 0.6.0",
"bitcoin_hashes 1.2.0",
- "secp256k1 0.32.0-beta.2",
+ "secp256k1 0.33.0",
"serde",
]
@@ -671,13 +671,13 @@ dependencies = [
[[package]]
name = "secp256k1"
-version = "0.32.0-beta.2"
+version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5fdc7d6e800869d3fd60ff857c479bf0a83ea7bf44b389e64461e844204994"
+checksum = "519be132ce0792413872b1f2606f0fd8cbcf305c7120127704c60085c9bd4d63"
dependencies = [
"arbitrary",
"rand 0.9.0",
- "secp256k1-sys 0.12.0",
+ "secp256k1-sys 0.14.0",
"serde",
]
@@ -692,9 +692,9 @@ dependencies = [
[[package]]
name = "secp256k1-sys"
-version = "0.12.0"
+version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d3be00697c88c00fe102af8dc316038cc2062eab8da646e7463f4c0e70ca9fd"
+checksum = "0dba61e98ffcb8aaa452eb2be632df2f54a48f72a8facf8d275ec63610c55b7d"
dependencies = [
"cc",
]
### Cargo-recent.lock
@@ -93,7 +93,8 @@ dependencies = [
"bitcoin_hashes 1.2.0",
"bitcoinconsensus",
"hex-conservative 1.1.0",
- "secp256k1 0.32.0-beta.2",
+
+ "secp256k1 0.33.0",
"serde",
"serde_json",
"serde_test",
@@ -157,7 +158,7 @@ dependencies = [
"bitcoin-primitives",
"bitcoin_hashes 1.2.0",
"hex-conservative 1.1.0",
- "secp256k1 0.32.0-beta.2",
+ "secp256k1 0.33.0",
"serde",
"serde_test",
]
@@ -226,7 +227,7 @@ dependencies = [
"bitcoin-network-kind",
"bitcoin_hashes 1.2.0",
"hex-conservative 1.1.0",
- "secp256k1 0.32.0-beta.2",
+ "secp256k1 0.33.0",
"serde",
"serde_json",
]
@@ -281,7 +282,7 @@ dependencies = [
"bitcoin-crypto",
"bitcoin-internals 0.6.0",
"bitcoin_hashes 1.2.0",
- "secp256k1 0.32.0-beta.2",
+ "secp256k1 0.33.0",
"serde",
]
@@ -549,13 +550,13 @@ dependencies = [
[[package]]
name = "secp256k1"
-version = "0.32.0-beta.2"
+version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5fdc7d6e800869d3fd60ff857c479bf0a83ea7bf44b389e64461e844204994"
+checksum = "519be132ce0792413872b1f2606f0fd8cbcf305c7120127704c60085c9bd4d63"
dependencies = [
"arbitrary",
"rand",
- "secp256k1-sys 0.12.0",
+ "secp256k1-sys 0.14.0",
"serde",
]
@@ -570,9 +571,9 @@ dependencies = [
[[package]]
name = "secp256k1-sys"
-version = "0.12.0"
+version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d3be00697c88c00fe102af8dc316038cc2062eab8da646e7463f4c0e70ca9fd"
+checksum = "0dba61e98ffcb8aaa452eb2be632df2f54a48f72a8facf8d275ec63610c55b7d"
dependencies = [
"cc",
]
### benches/Cargo.lock
@@ -37,7 +37,7 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
[[package]]
name = "base58ck"
-version = "0.3.0"
+version = "0.5.0"
dependencies = [
"bitcoin-internals",
"bitcoin_hashes",
@@ -57,23 +57,42 @@ checksum = "d965446196e3b7decd44aa7ee49e31d630118f90ef12f97900f262eb915c951d"
[[package]]
name = "bitcoin"
-version = "0.33.0-beta.0"
+version = "0.33.0-beta"
dependencies = [
"base58ck",
"base64",
"bech32",
+ "bitcoin-addresses",
"bitcoin-consensus-encoding",
+ "bitcoin-crypto",
"bitcoin-internals",
"bitcoin-io",
+ "bitcoin-key-expression",
"bitcoin-network-kind",
"bitcoin-primitives",
+ "bitcoin-taproot-primitives",
"bitcoin-units",
"bitcoin_hashes",
"bitcoinconsensus",
- "hex-conservative 0.3.0",
+ "hex-conservative",
"secp256k1",
]
+[[package]]
+name = "bitcoin-addresses"
+version = "0.0.0"
+dependencies = [
+ "base58ck",
+ "bech32",
+ "bitcoin-crypto",
+ "bitcoin-internals",
+ "bitcoin-network-kind",
+ "bitcoin-primitives",
+ "bitcoin-taproot-primitives",
+ "bitcoin_hashes",
+ "serde",
+]
+
[[package]]
name = "bitcoin-benches"
version = "0.1.0"
@@ -83,55 +102,93 @@ dependencies = [
"bitcoin_hashes",
"chacha20-poly1305",
"criterion",
- "hex_lit",
+ "hex-conservative",
]
[[package]]
name = "bitcoin-consensus-encoding"
-version = "1.0.0-rc.3"
+version = "1.2.0"
dependencies = [
"bitcoin-internals",
+ "hex-conservative",
+ "serde",
]
[[package]]
-name = "bitcoin-internals"
-version = "0.5.0"
+name = "bitcoin-crypto"
+version = "0.3.0"
dependencies = [
- "hex-conservative 0.3.0",
+ "base58ck",
+ "bitcoin-internals",
+ "bitcoin-network-kind",
+ "bitcoin-primitives",
+ "bitcoin_hashes",
+ "hex-conservative",
+ "secp256k1",
+ "serde",
]
+[[package]]
+name = "bitcoin-internals"
+version = "0.6.0"
+
[[package]]
name = "bitcoin-io"
-version = "0.4.0-rc.0"
+version = "0.6.0"
dependencies = [
"bitcoin-consensus-encoding",
"bitcoin-internals",
"bitcoin_hashes",
]
[[package]]
-name = "bitcoin-network-kind"
+name = "bitcoin-key-expression"
version = "0.1.0"
+dependencies = [
+ "base58ck",
+ "bitcoin-crypto",
+ "bitcoin-internals",
+ "bitcoin-network-kind",
+ "bitcoin_hashes",
+ "hex-conservative",
+ "secp256k1",
+ "serde",
+]
+
+[[package]]
+name = "bitcoin-network-kind"
+version = "1.0.0"
dependencies = [
"bitcoin-internals",
"serde",
]
[[package]]
name = "bitcoin-primitives"
-version = "1.0.0-rc.2"
+version = "0.103.1"
dependencies = [
"bitcoin-consensus-encoding",
"bitcoin-internals",
"bitcoin-units",
"bitcoin_hashes",
- "hex-conservative 0.3.0",
- "hex-conservative 1.0.1",
+ "hex-conservative",
+]
+
+[[package]]
+name = "bitcoin-taproot-primitives"
+version = "0.1.0"
+dependencies = [
+ "bitcoin-consensus-encoding",
+ "bitcoin-crypto",
+ "bitcoin-internals",
+ "bitcoin_hashes",
+ "secp256k1",
+ "serde",
]
[[package]]
name = "bitcoin-units"
-version = "1.0.0-rc.4"
+version = "0.5.0"
dependencies = [
"bitcoin-consensus-encoding",
"bitcoin-internals",
@@ -140,11 +197,11 @@ dependencies = [
[[package]]
name = "bitcoin_hashes"
-version = "0.19.0"
+version = "1.2.0"
dependencies = [
"bitcoin-consensus-encoding",
"bitcoin-internals",
- "hex-conservative 0.3.0",
+ "hex-conservative",
]
[[package]]
@@ -186,7 +243,7 @@ checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
[[package]]
name = "chacha20-poly1305"
-version = "0.1.2"
+version = "0.2.1"
[[package]]
name = "ciborium"
@@ -340,25 +397,13 @@ dependencies = [
[[package]]
name = "hex-conservative"
-version = "0.3.0"
+version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4afe881d0527571892c4034822e59bb10c6c991cce6abe8199b6f5cf10766f55"
+checksum = "35431185f361ccf3ffc58254628af5f1f5d5f28531da2e02e5d6c82bbc282a10"
dependencies = [
"arrayvec",
]
-[[package]]
-name = "hex-conservative"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "366fa3443ac84474447710ec17bb00b05dfbd096137817981e86f992f21a2793"
-
-[[package]]
-name = "hex_lit"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3011d1213f159867b13cfd6ac92d2cd5f1345762c63be3554e84092d85a50bbd"
-
[[package]]
name = "itertools"
version = "0.13.0"
@@ -585,19 +630,19 @@ dependencies = [
[[package]]
name = "secp256k1"
-version = "0.32.0-beta.2"
+version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5fdc7d6e800869d3fd60ff857c479bf0a83ea7bf44b389e64461e844204994"
+checksum = "519be132ce0792413872b1f2606f0fd8cbcf305c7120127704c60085c9bd4d63"
dependencies = [
"rand",
"secp256k1-sys",
]
[[package]]
name = "secp256k1-sys"
-version = "0.12.0"
+version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d3be00697c88c00fe102af8dc316038cc2062eab8da646e7463f4c0e70ca9fd"
+checksum = "0dba61e98ffcb8aaa452eb2be632df2f54a48f72a8facf8d275ec63610c55b7d"
dependencies = [
"cc",
]
### bitcoin/Cargo.toml
@@ -38,7 +38,7 @@ internals = { package = "bitcoin-internals", path = "../internals", version = "0
io = { package = "bitcoin-io", path = "../io", version = "0.6.0", default-features = false, features = ["alloc", "hashes"] }
network = { package = "bitcoin-network-kind", path = "../network", version = "1.0.0", default-features = false, features = ["alloc"]}
primitives = { package = "bitcoin-primitives", path = "../primitives", version = "0.103.0", default-features = false, features = ["alloc", "hex"] }
-secp256k1 = { version = "0.32.0-beta.2", default-features = false, features = ["alloc"] }
+secp256k1 = { version = "0.33.0", default-features = false, features = ["alloc"] }
taproot-primitives = { package = "bitcoin-taproot-primitives", path = "../taproot_primitives", version = "0.1.0", default-features = false, features = ["alloc", "hex"] }
units = { package = "bitcoin-units", path = "../units", version = "0.5.0", default-features = false, features = ["alloc"] }
### bitcoin/embedded/Cargo.lock
@@ -350,18 +350,18 @@ dependencies = [
[[package]]
name = "secp256k1"
-version = "0.32.0-beta.2"
+version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5fdc7d6e800869d3fd60ff857c479bf0a83ea7bf44b389e64461e844204994"
+checksum = "519be132ce0792413872b1f2606f0fd8cbcf305c7120127704c60085c9bd4d63"
dependencies = [
"secp256k1-sys",
]
[[package]]
name = "secp256k1-sys"
-version = "0.12.0"
+version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d3be00697c88c00fe102af8dc316038cc2062eab8da646e7463f4c0e70ca9fd"
+checksum = "0dba61e98ffcb8aaa452eb2be632df2f54a48f72a8facf8d275ec63610c55b7d"
dependencies = [
"cc",
]
### crypto/Cargo.toml
@@ -29,7 +29,7 @@ internals = { package = "bitcoin-internals", path = "../internals", version = "0
network = { package = "bitcoin-network-kind", path = "../network", version = "1.0.0", default-features = false }
# This is a temporary dep for the sake of PushBytes impls. This should not be retained for crypto 1.0.
primitives = { package = "bitcoin-primitives", path = "../primitives", version = "0.103.0", default-features = false, features = [] }
-secp256k1 = { version = "0.32.0-beta.2", default-features = false }
+secp256k1 = { version = "0.33.0", default-features = false }
arbitrary = { version = "1.4.1", optional = true }
hex = { package = "hex-conservative", version = "1.1.0", default-features = false, optional = true }
### crypto/src/key.rs
@@ -403,7 +403,7 @@ impl XOnlyPublicKey {
/// Serializes the x-only public key as a byte-encoded x coordinate value (32 bytes).
#[inline]
pub fn serialize(&self) -> ([u8; constants::SCHNORR_PUBLIC_KEY_SIZE], Parity) {
- (self.to_inner().serialize(), self.parity())
+ (self.to_inner().to_byte_array(), self.parity())
}
/// Converts this x-only public key to a full public key.
@@ -2475,7 +2475,7 @@ mod tests {
fn keypair_secp_roundtrip() {
let bitcoin_key = Keypair::generate();
let secp_key =
- secp256k1::Keypair::from_seckey_byte_array(bitcoin_key.to_secret_bytes()).unwrap();
+ secp256k1::Keypair::from_secret_bytes(bitcoin_key.to_secret_bytes()).unwrap();
assert_eq!(Keypair::from_secp(secp_key), bitcoin_key);
}
### key_expression/Cargo.toml
@@ -27,7 +27,7 @@ hashes = { package = "bitcoin_hashes", path = "../hashes", version = "1.0.0", de
hex = { package = "hex-conservative", version = "1.1.0", default-features = false, features = ["alloc"] }
internals = { package = "bitcoin-internals", path = "../internals", version = "0.6.0" }
network = { package = "bitcoin-network-kind", path = "../network", version = "1.0.0", default-features = false }
-secp256k1 = { version = "0.32.0-beta.2", default-features = false }
+secp256k1 = { version = "0.33.0", default-features = false }
arbitrary = { version = "1.4.1", optional = true }
serde = { version = "1.0.195", default-features = false, features = ["derive"], optional = true }
### taproot_primitives/Cargo.toml
@@ -27,7 +27,7 @@ hashes = { package = "bitcoin_hashes", path = "../hashes", version = "1.0.0", de
internals = { package = "bitcoin-internals", path = "../internals", version = "0.6.0" }
arbitrary = { version = "1.4.1", optional = true }
-secp256k1 = { version = "0.32.0-beta.2", default-features = false }
+secp256k1 = { version = "0.33.0", default-features = false }
serde = { version = "1.0.195", default-features = false, features = [ "derive" ], optional = true }
[dev-dependencies]Risk score
Our methodology →Why this scored 29/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.