taproot-primitives: Remove hashes/arbitrary
What the developer wrote
Authored by Mitchell Bagot
taproot-primitives: Remove hashes/arbitrary
The hashes crate does not have an arbitrary feature, and it the
unreleased feature is not used in this crate, so there's no reason to
attempt to enable it when the taproot-primitives crate arbitrary is
enabled.
What changed, and why it matters
This is a tiny build-configuration cleanup. It removes a non-existent feature flag ('hashes/arbitrary') from a list of features that get enabled when the 'arbitrary' feature is turned on in the taproot-primitives crate. The flag pointed to a feature that does not exist in the hashes crate, so it had no effect and could not cause a security problem. The change simply prevents a harmless misconfiguration.
No security action needed. Treat as a normal build cleanup.
Security signals we found
No strong security signals were identified.
Evidence from the diff
In taproot-primitives/Cargo.toml, the ‘arbitrary’ feature list included ‘hashes/arbitrary’. The hashes crate has no ‘arbitrary’ feature (and the commit message says an unreleased one is not used here), so this was a stale feature reference. Cargo would ignore or error on enabling a non-existent feature depending on version/strictness, but it could not introduce a vulnerability. The patch removes that one entry.
Changed components
taproot-primitives/Cargo.tomlInspect captured patch +1 / −1
diff --git a/taproot-primitives/Cargo.toml b/taproot-primitives/Cargo.toml
index 45d851d4..2acc7911 100644
--- a/taproot-primitives/Cargo.toml
+++ b/taproot-primitives/Cargo.toml
@@ -17,7 +17,7 @@ default = ["std", "hex"]
std = ["alloc", "crypto/std", "hashes/std", "internals/std", "serde?/std", "secp256k1/std"]
alloc = ["crypto/alloc", "hashes/alloc", "internals/alloc", "secp256k1/alloc"]
serde = ["dep:serde", "crypto/serde", "hashes/serde", "internals/serde", "secp256k1/serde"]
-arbitrary = ["crypto/arbitrary", "dep:arbitrary", "hashes/arbitrary", "secp256k1/arbitrary"]
+arbitrary = ["crypto/arbitrary", "dep:arbitrary", "secp256k1/arbitrary"]
hex = ["hashes/hex"]
[dependencies]
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.