Public commit record
63/100 · Adequate
What the developer wrote
Authored by Tobin C. Harding
Pin all RC dependencies
Me had trouble because of automatic resolution of RC depencies by
`cargo`. So now we want to pin to a specific version using the
"=X.Y.Z.rc.x" syntax. Do so for all dependencies that are currently in
an RC cycle.
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Explains rationale or failure mode
What changed, and why it matters
This commit changes version constraints for several in-development (release candidate) internal dependencies so Cargo will use an exact version rather than automatically picking a newer release candidate. It is a build/maintenance change to prevent unexpected dependency resolution, not a fix for a security vulnerability.
Recommended action
No security action required; treat as routine dependency/versioning hygiene.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch pins workspace dependencies that are in an RC cycle using Cargo’s ‘=X.Y.Z-rc.N’ exact-version syntax. It affects bitcoin-primitives, bitcoin-units, and bitcoin-consensus-encoding across bitcoin, hashes, io, p2p, and primitives crates. It also bumps p2p and primitives from bitcoin-consensus-encoding 1.0.0-rc.1 to =1.0.0-rc.2. No code logic changes are present.
Changed components
bitcoin/Cargo.tomlhashes/Cargo.tomlio/Cargo.tomlp2p/Cargo.tomlprimitives/Cargo.tomlInspect captured patch +8 / −8
diff --git a/bitcoin/Cargo.toml b/bitcoin/Cargo.toml
index f5c00ec9..b8ee2dcd 100644
--- a/bitcoin/Cargo.toml
+++ b/bitcoin/Cargo.toml
@@ -31,9 +31,9 @@ hashes = { package = "bitcoin_hashes", path = "../hashes", version = "0.18.0", d
hex = { package = "hex-conservative", version = "0.3.0", default-features = false, features = ["alloc"] }
internals = { package = "bitcoin-internals", path = "../internals", version = "0.4.2", features = ["alloc", "hex"] }
io = { package = "bitcoin-io", path = "../io", version = "0.3.0", default-features = false, features = ["alloc", "hashes"] }
-primitives = { package = "bitcoin-primitives", path = "../primitives", version = "1.0.0-rc.0", default-features = false, features = ["alloc", "hex"] }
+primitives = { package = "bitcoin-primitives", path = "../primitives", version = "=1.0.0-rc.0", default-features = false, features = ["alloc", "hex"] }
secp256k1 = { version = "0.32.0-beta.2", default-features = false, features = ["alloc"] }
-units = { package = "bitcoin-units", path = "../units", version = "1.0.0-rc.3", default-features = false, features = ["alloc"] }
+units = { package = "bitcoin-units", path = "../units", version = "=1.0.0-rc.3", default-features = false, features = ["alloc"] }
arbitrary = { version = "1.4.1", optional = true }
base64 = { version = "0.22.0", optional = true, default-features = false, features = ["alloc"] }
diff --git a/hashes/Cargo.toml b/hashes/Cargo.toml
index f351e89f..358a44d7 100644
--- a/hashes/Cargo.toml
+++ b/hashes/Cargo.toml
@@ -23,7 +23,7 @@ small-hash = []
[dependencies]
internals = { package = "bitcoin-internals", path = "../internals", version = "0.4.1" }
-encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "1.0.0-rc.2", default-features = false }
+encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "=1.0.0-rc.2", default-features = false }
hex = { package = "hex-conservative", version = "0.3.0", default-features = false, optional = true }
serde = { version = "1.0.195", default-features = false, optional = true }
diff --git a/io/Cargo.toml b/io/Cargo.toml
index 7d0d2e5b..2649a69d 100644
--- a/io/Cargo.toml
+++ b/io/Cargo.toml
@@ -20,7 +20,7 @@ alloc = ["encoding/alloc", "hashes?/alloc", "internals/alloc"]
[dependencies]
internals = { package = "bitcoin-internals", path = "../internals", version = "0.4.1" }
-encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "1.0.0-rc.2", default-features = false }
+encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "=1.0.0-rc.2", default-features = false }
hashes = { package = "bitcoin_hashes", path = "../hashes", version = "0.18.0", default-features = false, optional = true }
diff --git a/p2p/Cargo.toml b/p2p/Cargo.toml
index ce9a3233..ee93bc22 100644
--- a/p2p/Cargo.toml
+++ b/p2p/Cargo.toml
@@ -19,12 +19,12 @@ arbitrary = ["dep:arbitrary", "bitcoin/arbitrary"]
[dependencies]
bitcoin = { path = "../bitcoin/", default-features = false }
-encoding = { package = "bitcoin-consensus-encoding", version = "1.0.0-rc.1", path = "../consensus_encoding", default-features = false }
+encoding = { package = "bitcoin-consensus-encoding", version = "=1.0.0-rc.2", path = "../consensus_encoding", default-features = false }
hashes = { package = "bitcoin_hashes", version = "0.18.0", path = "../hashes", default-features = false }
hex = { package = "hex-conservative", version = "0.3.0", default-features = false }
internals = { package = "bitcoin-internals", path = "../internals", default-features = false }
io = { package = "bitcoin-io", path = "../io", default-features = false }
-units = { package = "bitcoin-units", path = "../units", version = "1.0.0-rc.3", default-features = false }
+units = { package = "bitcoin-units", path = "../units", version = "=1.0.0-rc.3", default-features = false }
arbitrary = { version = "1.4.1", optional = true }
diff --git a/primitives/Cargo.toml b/primitives/Cargo.toml
index a74fe196..b1cb43cb 100644
--- a/primitives/Cargo.toml
+++ b/primitives/Cargo.toml
@@ -21,10 +21,10 @@ arbitrary = ["dep:arbitrary", "units/arbitrary"]
hex = ["dep:hex-stable", "dep:hex-unstable", "hashes/hex", "internals/hex"]
[dependencies]
-encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "1.0.0-rc.1", default-features = false }
+encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "=1.0.0-rc.2", default-features = false }
hashes = { package = "bitcoin_hashes", path = "../hashes", version = "0.18.0", default-features = false }
internals = { package = "bitcoin-internals", path = "../internals", version = "0.4.1" }
-units = { package = "bitcoin-units", path = "../units", version = "1.0.0-rc.3", default-features = false, features = [ "encoding" ] }
+units = { package = "bitcoin-units", path = "../units", version = "=1.0.0-rc.3", default-features = false, features = [ "encoding" ] }
arrayvec = { version = "0.7.2", default-features = false }
arbitrary = { version = "1.4.1", optional = true }
Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.