← Watch feed
Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de
Public commit record
91/100 · Strong
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6913: build(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de
a31e0b0e89778bbbd3d60ebc61c66c99b575a317 build(deps): bump dtolnay/rust-toolchain (dependabot[bot])
Pull request description:
Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de.
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/02cb101ec7c40f2c49e1d9714d64511d8e1b74de"><code>02cb101</code></a> Merge pull request 185 from fufesou/feat/force-non-host</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/b38a663c5df0fd5ac7bb65ded7b02a3f7af3b636"><code>b38a663</code></a> Pass --force-non-host unconditionally</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/a4f61a09a512763ecbf6a72db0464f906f59f011"><code>a4f61a0</code></a> Document rustup non-host opt-in requirement</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/06b350f08c8596edaf3d95d38686ba934fc4a6a7"><code>06b350f</code></a> Support force-non-host toolchains</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/d1031067263f94b142dd6c0ce24c5eb9d02d52a0"><code>d103106</code></a> Predefine branches up to 1.120</li>
<li><a href="https://github.com/dtolnay/rust-toolchain/commit/3ea7b2dde9987cecfa88322de1f09983972fc8e9"><code>3ea7b2d</code></a> Add 1.98.1 patch release</li>
<li>See full diff in <a href="https://github.com/dtolnay/rust-toolchain/compare/6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772...02cb101ec7c40f2c49e1d9714d64511d8e1b74de">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit:
apoelstra:
ACK a31e0b0e89778bbbd3d60ebc61c66c99b575a317; successfully ran local tests
Tree-SHA512: 526c648af02ba919dcd53aac0d930303bd8e344360e703ad04f099a2948a933f107333f7a01d0d6f0a12668568a4abbf393c0c9c2c5bdc35543b04e62b3d185c
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
What changed, and why it matters
This is a routine update to a GitHub Actions helper used to install Rust during automated testing. It only changes the pinned version of the dtolnay/rust-toolchain action in workflow files. There is no change to the actual rust-bitcoin library code that users install or run, and nothing in the commit indicates a security problem.
Recommended action
No security action needed. Treat as normal maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps the pinned SHA of dtolnay/rust-toolchain from 6c977a6… to 02cb101… across four GitHub workflow files. The upstream changes include support for force-non-host toolchains and branch predefinitions. This is a CI/CD dependency update only; no source code, cryptographic logic, or public API is modified.
Changed components
.github/workflows/cron-daily-audit.yml.github/workflows/cron-daily-miri.yml.github/workflows/rust.yml.github/workflows/semver-checks.ymlInspect captured patch +8 / −8
### .github/workflows/cron-daily-audit.yml
@@ -18,7 +18,7 @@ jobs:
with:
persist-credentials: false
- name: "Install Rustup"
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+ uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: stable
- name: "Install cargo-binstall"
### .github/workflows/cron-daily-miri.yml
@@ -26,7 +26,7 @@ jobs:
id: read_toolchain
run: echo "nightly_version=$(cargo metadata --format-version 1 | jq -r '.metadata.rbmt.toolchains.nightly')" >> $GITHUB_OUTPUT
- name: "Select toolchain"
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+ uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: ${{ steps.read_toolchain.outputs.nightly_version }}
components: miri
### .github/workflows/rust.yml
@@ -181,7 +181,7 @@ jobs:
with:
persist-credentials: false
- name: "Select toolchain"
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+ uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: stable
- name: "Add architecture i386 and install dependencies"
@@ -216,7 +216,7 @@ jobs:
with:
persist-credentials: false
- name: "Select toolchain"
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+ uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: ${{ needs.Prepare.outputs.nightly_version }}
- name: "Install rust-src"
@@ -254,7 +254,7 @@ jobs:
with:
persist-credentials: false
- name: "Select toolchain"
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+ uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: stable
- name: "Run policy script"
@@ -292,7 +292,7 @@ jobs:
with:
persist-credentials: false
- name: "Select toolchain"
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+ uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: stable
- name: "Check Encode coverage"
@@ -308,7 +308,7 @@ jobs:
persist-credentials: false
fetch-depth: 0 # required for full diff context
- name: "Select toolchain"
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+ uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: stable
- name: "Fetch base branch for diff"
### .github/workflows/semver-checks.yml
@@ -23,7 +23,7 @@ jobs:
fetch-depth: 0 # we need full history for cargo semver-checks
persist-credentials: false
- name: "Install Rustup"
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+ uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
with:
toolchain: stable
- name: "Select stable-version"Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.