What the developer wrote
Authored by Shing Him Ng
Bump honggfuzz to 0.5.58
This version was released on 23 Sept 2025
What changed, and why it matters
This commit simply updates a fuzz-testing helper library called honggfuzz from version 0.5.57 to 0.5.58. It only changes version numbers and lock-file checksums in files related to fuzz testing. There is no indication this fixes or introduces a security problem in the actual Bitcoin library code that users rely on.
No security action needed. Treat as a normal maintenance/dependency update.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is a routine dependency bump for the honggfuzz crate used only in the project’s fuzz harness (fuzz/Cargo.toml and fuzz/generate-files.sh), plus matching lock-file updates (Cargo-minimal.lock and Cargo-recent.lock). No source code in the bitcoin or p2p crates is modified, and the commit message does not mention any security fix or vulnerability.
Changed components
fuzz/Cargo.tomlfuzz/generate-files.shCargo-minimal.lockCargo-recent.lockInspect captured patch +6 / −6
diff --git a/Cargo-minimal.lock b/Cargo-minimal.lock
index 52e66766..750738c6 100644
--- a/Cargo-minimal.lock
+++ b/Cargo-minimal.lock
@@ -251,9 +251,9 @@ checksum = "3011d1213f159867b13cfd6ac92d2cd5f1345762c63be3554e84092d85a50bbd"
[[package]]
name = "honggfuzz"
-version = "0.5.57"
+version = "0.5.58"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc563d4f41b17364d5c48ded509f2bcf1c3f6ae9c7f203055b4a5c325072d57e"
+checksum = "6e8319f3cc8fe416e7aa1ab95dcc04fd49f35397a47d0b2f0f225f6dba346a07"
dependencies = [
"lazy_static",
"memmap2",
diff --git a/Cargo-recent.lock b/Cargo-recent.lock
index 2b377a56..42f41654 100644
--- a/Cargo-recent.lock
+++ b/Cargo-recent.lock
@@ -253,9 +253,9 @@ checksum = "3011d1213f159867b13cfd6ac92d2cd5f1345762c63be3554e84092d85a50bbd"
[[package]]
name = "honggfuzz"
-version = "0.5.57"
+version = "0.5.58"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc563d4f41b17364d5c48ded509f2bcf1c3f6ae9c7f203055b4a5c325072d57e"
+checksum = "6e8319f3cc8fe416e7aa1ab95dcc04fd49f35397a47d0b2f0f225f6dba346a07"
dependencies = [
"lazy_static",
"memmap2",
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index a92bb7ae..7c764a67 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -10,7 +10,7 @@ publish = false
cargo-fuzz = true
[dependencies]
-honggfuzz = { version = "0.5.57", default-features = false }
+honggfuzz = { version = "0.5.58", default-features = false }
bitcoin = { path = "../bitcoin", features = [ "serde", "arbitrary" ] }
p2p = { path = "../p2p", package = "bitcoin-p2p-messages", features = ["arbitrary"] }
arbitrary = { version = "1.4.1" }
diff --git a/fuzz/generate-files.sh b/fuzz/generate-files.sh
index ed14f6c0..4d364e2c 100755
--- a/fuzz/generate-files.sh
+++ b/fuzz/generate-files.sh
@@ -22,7 +22,7 @@ publish = false
cargo-fuzz = true
[dependencies]
-honggfuzz = { version = "0.5.57", default-features = false }
+honggfuzz = { version = "0.5.58", default-features = false }
bitcoin = { path = "../bitcoin", features = [ "serde", "arbitrary" ] }
p2p = { path = "../p2p", package = "bitcoin-p2p-messages", features = ["arbitrary"] }
arbitrary = { version = "1.4.1" }
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.