What the developer wrote
Authored by Tobin C. Harding
units: Pin RC dependency
So that any subsequent RC releases of `consensus-encoding` don't
inadvertently break the build (like #5358) pin the `encoding`
dependency to an exact version.
What changed, and why it matters
This commit changes a single version requirement in a Rust package file so that a pre-release dependency is pinned to an exact version rather than allowing newer release-candidate versions. It is a build-stability fix, not a security patch. There is no code change that fixes a vulnerability or changes runtime behavior.
No security action required. Treat as a normal dependency-management/build-stability commit. If reviewing supply-chain risk, verify that the pinned RC version is acceptable until a final release is available.
Security signals we found
No source-code security fix present
Dependency version pinning only
Build-break prevention, not vulnerability remediation
No mention of CVE, advisory, or security issue in commit message
Evidence from the diff
In units/Cargo.toml, the dependency on bitcoin-consensus-encoding (aliased as encoding) is changed from version = “1.0.0-rc.2” to version = “=1.0.0-rc.2”. The leading equals sign tells Cargo to use exactly that version and not accept subsequent 1.0.0-rc.* releases. The commit message says this prevents future RC releases from inadvertently breaking the build, referencing a prior build break (#5358). No Rust source code was modified.
Changed components
units/Cargo.tomlbitcoin-consensus-encoding dependency version constraintInspect captured patch +1 / −1
diff --git a/units/Cargo.toml b/units/Cargo.toml
index 114ee1cb..99cff8b5 100644
--- a/units/Cargo.toml
+++ b/units/Cargo.toml
@@ -18,7 +18,7 @@ std = ["alloc", "internals/std", "encoding?/std"]
alloc = ["internals/alloc", "serde?/alloc", "encoding?/alloc"]
[dependencies]
-encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "1.0.0-rc.2", default-features = false, optional = true }
+encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "=1.0.0-rc.2", default-features = false, optional = true }
internals = { package = "bitcoin-internals", path = "../internals", version = "0.4.1" }
serde = { version = "1.0.195", default-features = false, features = ["derive"], optional = true }
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.