CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 37 Bitcoin

Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

RB5f5f666d View source ↗
Public commit record

What the developer wrote

Authored by Andrew Poelstra

91/100 · Strong
Merge rust-bitcoin/rust-bitcoin#6896: Fix `cargo audit` findings

6dc79c836479ada95a63b8b971d2c06bc4867715 benches: bump crossbeam-epoch to 0.9.21 (satsfy (Renato Britto))
540ff32d80820031f2b9a4464a6dbdec31bf9494 benched: bump rand to 0.9.5 (satsfy (Renato Britto))
23f7ab9e60ed6410d3e3806a215290aa54edac46 embedded: replace alloc-cortex-m with embedded-alloc (satsfy (Renato Britto))

Pull request description:

Resolve all solvable `cargo audit` errors brought up in https://github.com/rust-bitcoin/rust-bitcoin/issues/6405

This is a sister PR to https://github.com/rust-bitcoin/rust-bitcoin/pull/6895, which ignores 2 other `cargo audit` problems in `.cargo/audit.toml`.

## Commit 1

Per [`embedded-alloc` docs](https://github.com/rust-embedded/embedded-alloc/blob/master/CHANGELOG.md#changed-1):
> The `Heap` struct has been renamed to `LlffHeap` and requires the `llff` feature.

`alloc-cortex-m` was renamed to `embedded-alloc`. The new crate uses the heap through [`critical-section`](https://github.com/rust-embedded/embedded-alloc?tab=readme-ov-file#example) instead of calling `cortex_m::interrupt::free` directly, so the binary must provide an implementation. `cortex-m` includes it behind its [`critical-section-single-core`](https://docs.rs/critical-section/latest/critical_section/#usage-in-no-std-binaries) feature, hence the new direct dependency. `llff` selects the linked list first fit heap, the same `linked_list_allocator` backend `alloc-cortex-m` already used, and `default-features = false` avoids also compiling the [alternative `tlsf` heap](https://github.com/rust-embedded/embedded-alloc?tab=readme-ov-file#features).

## Commit 2

rand 0.9.5 is in the patched range. rand 0.7 has no patch, so jobserver 0.1.18 drops it entirely. See https://rustsec.org/advisories/RUSTSEC-2026-0097.html

## Commit 3

crossbeam-epoch is a transitive dependency of the benchmark harness, not declared in any Cargo.toml. Advisory patched at 0.9.20, so the lockfile bump is the only solution. See https://rustsec.org/advisories/RUSTSEC-2026-0204.html


ACKs for top commit:
tcharding:
ACK 6dc79c836479ada95a63b8b971d2c06bc4867715
apoelstra:
ACK 6dc79c836479ada95a63b8b971d2c06bc4867715; successfully ran local tests


Tree-SHA512: f48ce5449a01ccab5fb32f679813542ac400a662fd73624fbc9d65200edd57f68ad180eacfb7e5f0de7ac8d681c9fc64a1a74b4cd0bfcc6ed0605d3e375c6591
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This is a routine dependency-maintenance merge that swaps out old, unmaintained helper libraries for newer, patched versions in the project's example embedded programs and benchmark harness. The changes are driven by automated security scanner warnings (cargo audit) about known issues in the old dependencies. The core rust-bitcoin library code is not directly changed, and the affected code is example/embedded firmware and benchmark tooling rather than production wallet logic.

Recommended action

No immediate action beyond normal review. Verify CI passes and cargo audit no longer reports the addressed advisories. Users of the rust-bitcoin library itself are not affected; only consumers of the embedded examples or benchmark harness benefit from the cleanup.

Security signals we found

01

cargo audit advisory remediation

02

dependency upgrade for known-vulnerable crate (rand 0.7 / jobserver)

03

dependency upgrade for known-vulnerable crate (crossbeam-epoch)

04

replacement of unmaintained embedded allocator (alloc-cortex-m -> embedded-alloc)

05

no changes to cryptographic or consensus logic

Risk score

Why this scored 37/100

Our methodology →
Potential impact 8/30
Exploitability 6/25
Stealth signal 4/15
Affected reach 7/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from rust-bitcoin

Related watches

Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0

This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability.…

4ed7c068by Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6910: build(deps): bump actions/checkout from 7.0.0 to 7.0.1

This commit is a routine update to the GitHub Actions checkout tool used by the project's automated workflows. It only changes version numbers in configuration files and does not alter the actual Bitcoin library code that users run. There …

328c4ae9by Andrew Poelstra+37−3717 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6911: build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This commit updates a GitHub Actions helper used to install a Python tool called uv, which runs the zizmor security scanner. The change only bumps the pinned version of the helper from 8.3.2 to 9.0.0. The new version's release notes mentio…

No security-relevant signals in commit or upstream release notesDependency bump in CI only, not in library codeNo CVE or advisory referenced
67600795by Andrew Poelstra+2−22 files
No security note in commit
Open full analysis →Source commit ↗