Remove hex dep from internals

Rust Bitcoin/rust-bitcoin

bd0d4bc0 View source ↗

Public commit record

What the developer wrote

Authored by Tobin C. Harding

68/100 · Adequate

Remove hex dep from internals

The `hex` dep is no longer used in `internals` (since #6339).

Remove it.

✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This commit simply removes an unused software dependency (the hex-conservative crate) from the internals sub-package and updates related package configuration files. It is a routine cleanup change with no security relevance.

Recommended action

No security action needed. This is a dependency cleanup commit.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The commit removes the hex-conservative dependency from bitcoin-internals because it is no longer used after a prior change (#6339). It updates Cargo.toml files across the workspace to stop enabling the ‘hex’ feature on internals and removes the dependency from the lock files. No source code logic is changed.

Changed components

bitcoin-internals/Cargo.tomlCargo-minimal.lockCargo-recent.lockaddresses/Cargo.tomlbitcoin/Cargo.tomlcrypto/Cargo.tomlkey_expression/Cargo.tomlprimitives/Cargo.toml

Inspect captured patch +8 / −11

diff --git a/Cargo-minimal.lock b/Cargo-minimal.lock
index cedcfcf6..068da999 100644
--- a/Cargo-minimal.lock
+++ b/Cargo-minimal.lock
@@ -170,7 +170,6 @@ name = "bitcoin-internals"
 version = "0.5.0"
 dependencies = [
  "bincode",
- "hex-conservative 1.1.0",
  "serde",
  "serde_json",
 ]
diff --git a/Cargo-recent.lock b/Cargo-recent.lock
index 4afc7acf..3df14e01 100644
--- a/Cargo-recent.lock
+++ b/Cargo-recent.lock
@@ -169,7 +169,6 @@ name = "bitcoin-internals"
 version = "0.5.0"
 dependencies = [
  "bincode",
- "hex-conservative 1.1.0",
  "serde",
  "serde_json",
 ]
diff --git a/addresses/Cargo.toml b/addresses/Cargo.toml
index fea99d3d..47c3bd98 100644
--- a/addresses/Cargo.toml
+++ b/addresses/Cargo.toml
@@ -20,7 +20,7 @@ alloc = ["crypto/alloc", "internals/alloc", "primitives/alloc", "taproot_primiti
 
 [dependencies]
 crypto = { package = "bitcoin-crypto", path = "../crypto", version = "0.2.0", default-features = false, features = [] }
-internals = { package = "bitcoin-internals", path = "../internals", version = "0.5.0", features = ["hex"] }
+internals = { package = "bitcoin-internals", path = "../internals", version = "0.5.0" }
 taproot_primitives = { package = "bitcoin-taproot-primitives", path = "../taproot-primitives", version = "0.1.0", default-features = false, features = [] }
 primitives = { package = "bitcoin-primitives", path = "../primitives", version = "0.102.0", default-features = false, features = ["hex"] }
 
diff --git a/bitcoin/Cargo.toml b/bitcoin/Cargo.toml
index 3df5ac1a..6648cb59 100644
--- a/bitcoin/Cargo.toml
+++ b/bitcoin/Cargo.toml
@@ -34,7 +34,7 @@ hashes = { package = "bitcoin_hashes", path = "../hashes", version = "1.0.0", de
 key-expression = { package = "bitcoin-key-expression", path = "../key_expression", version = "0.1.0", default-features = false, features = ["alloc"] }
 encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "1.0.0", default-features = false, features = ["alloc", "hex"] }
 hex = { package = "hex-conservative", version = "1.1.0", default-features = false, features = ["alloc"] }
-internals = { package = "bitcoin-internals", path = "../internals", version = "0.5.0", features = ["alloc", "hex"] }
+internals = { package = "bitcoin-internals", path = "../internals", version = "0.5.0", features = ["alloc"] }
 io = { package = "bitcoin-io", path = "../io", version = "0.5.0", default-features = false, features = ["alloc", "hashes"] }
 network = { package = "bitcoin-network-kind", path = "../network", version = "1.0.0", default-features = false, features = ["alloc"]}
 primitives = { package = "bitcoin-primitives", path = "../primitives", version = "0.102.0", default-features = false, features = ["alloc", "hex"] }
diff --git a/crypto/Cargo.toml b/crypto/Cargo.toml
index 75e74910..f2babc40 100644
--- a/crypto/Cargo.toml
+++ b/crypto/Cargo.toml
@@ -20,12 +20,12 @@ rand = ["secp256k1/rand"]
 alloc = ["base58/alloc", "hashes/alloc", "hex?/alloc", "internals/alloc", "network/alloc", "primitives/alloc", "secp256k1/alloc", "serde?/alloc"]
 serde = ["dep:serde", "hashes/serde", "internals/serde", "secp256k1/serde"]
 arbitrary = ["dep:arbitrary", "secp256k1/arbitrary"]
-hex = ["dep:hex", "hashes/hex", "internals/hex", "primitives/hex"]
+hex = ["dep:hex", "hashes/hex", "primitives/hex"]
 
 [dependencies]
 base58 = { package = "base58ck", path = "../base58", version = "0.4.0", default-features = false }
 hashes = { package = "bitcoin_hashes", path = "../hashes", version = "1.0.0", default-features = false, features = ["hex"] }
-internals = { package = "bitcoin-internals", path = "../internals", version = "0.5.0", features = ["hex"] }
+internals = { package = "bitcoin-internals", path = "../internals", version = "0.5.0" }
 network = { package = "bitcoin-network-kind", path = "../network", version = "1.0.0", default-features = false }
 # This is a temporary dep for the sake of PushBytes impls. This should not be retained for crypto 1.0.
 primitives = { package = "bitcoin-primitives", path = "../primitives", version = "0.102.0", default-features = false, features = [] }
diff --git a/internals/Cargo.toml b/internals/Cargo.toml
index 1c3d088d..322251c4 100644
--- a/internals/Cargo.toml
+++ b/internals/Cargo.toml
@@ -16,13 +16,12 @@ exclude = ["api", "tests", "contrib"]
 
 [features]
 default = []
-std = ["alloc", "hex?/std"]
-alloc = ["hex?/alloc"]
+std = ["alloc"]
+alloc = []
 
 test-serde = ["serde", "dep:serde_json", "dep:bincode"]
 
 [dependencies]
-hex = { package = "hex-conservative", version = "1.1.0", default-features = false, optional = true }
 serde = { version = "1.0.195", default-features = false, optional = true }
 
 # Behind the test-serde feature.
diff --git a/key_expression/Cargo.toml b/key_expression/Cargo.toml
index 492bd5da..58334390 100644
--- a/key_expression/Cargo.toml
+++ b/key_expression/Cargo.toml
@@ -25,7 +25,7 @@ base58 = { package = "base58ck", path = "../base58", version = "0.4.0", default-
 crypto = { package = "bitcoin-crypto", path = "../crypto", version = "0.2.0", default-features = false }
 hashes = { package = "bitcoin_hashes", path = "../hashes", version = "1.0.0", default-features = false, features = ["hex"] }
 hex = { package = "hex-conservative", version = "1.1.0", default-features = false, features = ["alloc"] }
-internals = { package = "bitcoin-internals", path = "../internals", version = "0.5.0", features = ["hex"] }
+internals = { package = "bitcoin-internals", path = "../internals", version = "0.5.0" }
 network = { package = "bitcoin-network-kind", path = "../network", version = "1.0.0", default-features = false }
 secp256k1 = { version = "0.32.0-beta.2", default-features = false }
 
diff --git a/primitives/Cargo.toml b/primitives/Cargo.toml
index 20848fa4..bc8504ef 100644
--- a/primitives/Cargo.toml
+++ b/primitives/Cargo.toml
@@ -19,7 +19,7 @@ std = ["alloc", "hashes/std", "hex?/std", "internals/std", "units/std"]
 alloc = ["hashes/alloc", "hex?/alloc", "internals/alloc", "units/alloc"]
 serde = ["dep:serde", "encoding/serde", "hashes/serde", "internals/serde", "units/serde", "alloc", "hex"]
 arbitrary = ["dep:arbitrary", "units/arbitrary"]
-hex = ["dep:hex", "hashes/hex", "internals/hex", "encoding/hex"]
+hex = ["dep:hex", "hashes/hex", "encoding/hex"]
 
 [dependencies]
 encoding = { package = "bitcoin-consensus-encoding", path = "../consensus_encoding", version = "1.0.0", default-features = false }

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

base58ck: Bump version to 0.5.0

Rename Error to DecodeCheckError

hashes: add sha256::Midstate::SHA256_IV constant