← Watch feed
Merge rust-bitcoin/rust-bitcoin#6775: build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1
Public commit record
96/100 · Strong
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6775: build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1
5c0d27359e798a2f75388ca0723b74208f336c48 build(deps): bump cargo-bins/cargo-binstall from 1.20.0 to 1.20.1 (dependabot[bot])
Pull request description:
Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.20.0 to 1.20.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p>
<blockquote>
<h2>v1.20.1</h2>
<p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p>
<h4>In this release:</h4>
<ul>
<li>Upgrade dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/732870f031d2fb36309d0deaf36abcc704a7be65"><code>732870f</code></a> release: cargo-binstall v1.20.1 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2590">#2590</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/84c209e6313ba472763c1b34615f03c41e7413dd"><code>84c209e</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2586">#2586</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/9e9fc4635d22c94c113187350872d6916c005474"><code>9e9fc46</code></a> build(deps): bump the deps group with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2589">#2589</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/a387173c6f65daf8c665f747f297385a6a8c68f9"><code>a387173</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2588">#2588</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/733bffce578000b64507ac3d683a61c2b605c21d"><code>733bffc</code></a> build(deps): bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2587">#2587</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/252c5e70a6eae3a9de06b610159a568eaf705055"><code>252c5e7</code></a> build(deps): bump the deps group across 1 directory with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2585">#2585</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/1d2ff7ce3f67fe46c45478d09d1670c1f1b100dc"><code>1d2ff7c</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2584">#2584</a>)</li>
<li>See full diff in <a href="https://github.com/cargo-bins/cargo-binstall/compare/30b5ca8b54e1dcffd9548bc87ede1531310fdc67...732870f031d2fb36309d0deaf36abcc704a7be65">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit:
apoelstra:
ACK 5c0d27359e798a2f75388ca0723b74208f336c48; successfully ran local tests
satsfy:
ACK 5c0d27359e798a2f75388ca0723b74208f336c48
Tree-SHA512: a21a2398906184633fbc534cb48b4d2c5b1de7351f5ac991bba31c6080e51e13f15ff64b29a94e3c7aadd9b15d8fbbe315bed741569b9d6b37c48410cb11c5ef
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
What changed, and why it matters
This is a routine automated update by Dependabot that changes one line in a GitHub Actions workflow. It switches the version of cargo-binstall (a helper tool used during automated testing) from 1.20.0 to 1.20.1. There is no indication this fixes or introduces a security problem in the rust-bitcoin library itself.
Recommended action
No security action required. Treat as routine maintenance. If desired, verify the cargo-binstall v1.20.1 release hash matches the pinned commit 732870f031d2fb36309d0deaf36abcc704a7be65.
Security signals we found
01
No security-relevant keywords in commit title or message
02
No CVE, advisory, or vulnerability disclosure referenced
03
Change is limited to a CI workflow dependency pin
04
Upstream release notes do not mention security fixes
05
No code changes to the rust-bitcoin crate
Evidence from the diff
The commit updates a pinned GitHub Action reference in .github/workflows/semver-checks.yml from cargo-binstall v1.20.0 (commit 30b5ca8b) to v1.20.1 (commit 732870f0). The action is only used in CI to install cargo-semver-checks for API compatibility checks. The upstream release notes describe the new version as only ‘Upgrade dependencies’ with no security advisory or CVE mentioned. The change does not touch any library code, cryptography, consensus logic, or public API.
Changed components
.github/workflows/semver-checks.ymlInspect captured patch +1 / −1
### .github/workflows/semver-checks.yml
@@ -30,7 +30,7 @@ jobs:
run: |
rustup default $(cargo metadata --format-version 1 | jq -r '.metadata.rbmt.toolchains.stable')
- name: "Install cargo-binstall"
- uses: cargo-bins/cargo-binstall@30b5ca8b54e1dcffd9548bc87ede1531310fdc67 # v1.20.0
+ uses: cargo-bins/cargo-binstall@732870f031d2fb36309d0deaf36abcc704a7be65 # v1.20.1
- name: "Binstall pinned cargo-semver-checks"
run: cargo binstall cargo-semver-checks@$(cat ./.github/workflows/cargo-semver-checks-version) --no-confirm
- name: "Run semver checks"Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.