CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

Merge rust-bitcoin/rust-bitcoin#6948: build(deps): bump taiki-e/install-action from 2.83.2 to 2.85.4

RBd1431904 View source ↗
Public commit record

What the developer wrote

Authored by Andrew Poelstra

96/100 · Strong
Merge rust-bitcoin/rust-bitcoin#6948: build(deps): bump taiki-e/install-action from 2.83.2 to 2.85.4

3c06ee7bf1703e38d3c06b3e820ce555966ccc4f build(deps): bump taiki-e/install-action from 2.83.2 to 2.85.4 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.83.2 to 2.85.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.85.4</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.11.33.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.15.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.6.</p>
</li>
</ul>
<h2>2.85.3</h2>
<ul>
<li>
<p>Update <code>xh@latest</code> to 0.26.2.</p>
</li>
<li>
<p>Update <code>ubi@latest</code> to 0.10.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.14.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.13.0.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.3.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.21.1.</p>
</li>
</ul>
<h2>2.85.2</h2>
<ul>
<li>
<p>Update <code>prek@latest</code> to 0.4.11.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.13.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.109.0.</p>
</li>
</ul>
<h2>2.85.1</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.30.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.32.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.12.</p>
</li>
<li>
<p>Update <code>cyclonedx@latest</code> to 0.33.1.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.5.2.</p>
</li>
</ul>
<h2>2.85.0</h2>
<ul>
<li>
<p>Support <code>wild</code> (alias: <code>wild-linker</code>). (<a href="https://redirect.github.com/taiki-e/install-action/pull/1949">#1949</a>)</p>
</li>
<li>
<p>Support <code>bpf-linker</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1950">#1950</a>)</p>
</li>
<li>
<p>Support <code>rafn</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1935">#1935</a>, thanks <a href="https://github.com/DarkWanderer"><code>@​DarkWanderer</code></a>)</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.5.1.</p>
</li>
<li>
<p>Update <code>zizmor@latest</code> to 1.28.0.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 47.0.2.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.87.21] - 2026-09-26</h2>
<ul>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.129.</p>
</li>
<li>
<p>Update <code>protoc-gen-connect-openapi@latest</code> to 0.27.3.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 49.0.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.19.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.13.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 2.7.0.</p>
</li>
</ul>
<h2>[2.87.20] - 2026-09-24</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.18.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.14.0.</p>
</li>
</ul>
<h2>[2.87.19] - 2026-09-23</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 49.0.0.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.5.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.146.</p>
</li>
</ul>
<h2>[2.87.18] - 2026-09-22</h2>
<ul>
<li>
<p>Update <code>oxfmt@latest</code> to 1.84.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.12.</p>
</li>
<li>
<p>Update <code>kache@latest</code> to 0.26.3.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.37.4.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e"><code>065d6a0</code></a> Release 2.85.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/971197ad86f8f6f161d7a8d91f1d711c4c21f628"><code>971197a</code></a> Update <code>uv@latest</code> to 0.11.33</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3fc72354cdfd0f85327736793faab9b90a6282bb"><code>3fc7235</code></a> Update syft manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/7e230c19cf947f65a34e4e6f737c5f594c6779ba"><code>7e230c1</code></a> Update sccache manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/51f77e860854ede202e22ff29a94094601feca62"><code>51f77e8</code></a> Update <code>mise@latest</code> to 2026.7.15</li>
<li><a href="https://github.com/taiki-e/install-action/commit/87ddca437422cbc964934ac7b2d8423c1838090a"><code>87ddca4</code></a> Update <code>biome@latest</code> to 2.5.6</li>
<li><a href="https://github.com/taiki-e/install-action/commit/18b1216eba7f8039b0f8d131d5473787f0edce68"><code>18b1216</code></a> Release 2.85.3</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3a7eb9d7de04335647f871d88d8831485be842be"><code>3a7eb9d</code></a> Update <code>xh@latest</code> to 0.26.2</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3d4a0c1c709bc0f907c2a23b1a17cf6296b08298"><code>3d4a0c1</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/9e4a53cd83bbbd84b17bc14008d4b067b9e99edb"><code>9e4a53c</code></a> Update <code>ubi@latest</code> to 0.10.0</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/43aecc8d72668fbcfe75c31400bc4f890f1c5853...065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.83.2&new-version=2.85.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
satsfy:
ACK 3c06ee7bf1703e38d3c06b3e820ce555966ccc4f
apoelstra:
ACK 3c06ee7bf1703e38d3c06b3e820ce555966ccc4f; successfully ran local tests


Tree-SHA512: 3218d6331343568c02852aefd6dbbe20a8bc6900bdd03fc7d80ade53290fe65951fb2e3414fb3ce73ef7437cf1fb454721ff88a72d1b316e011398330509efed
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This is a routine update by Dependabot to the version of a third-party GitHub Action used in the project's automated testing workflows. The change only affects internal continuous integration (CI) scripts, not the actual Bitcoin library code that users install. There is no indication of a security issue in the commit or supplied references.

Recommended action

No security action required. Treat as normal dependency maintenance for CI infrastructure.

Security signals we found

No strong security signals were identified.

Risk score

Why this scored 15/100

Our methodology →
Potential impact 0/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 0/15
Confidence 10/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from rust-bitcoin

Related watches

High 70 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6919: Sanitize serde size hints before allocating

This commit fixes a denial-of-service weakness in how the library deserializes lists of Bitcoin data (witnesses, amounts, fee rates) from untrusted input. Before the fix, a few bytes of attacker-controlled data could claim a list would con…

Untrusted serde size hint fed directly into Vec::with_capacityPotential memory exhaustion / OOM kill from small malicious inputDenial-of-service vector in deserialization paths
55ddbc0cby Andrew Poelstra+88−105 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6945: bitcoin: handle OP_CODESEPARATOR in legacy

This commit fixes how the Rust Bitcoin library calculates old-style (legacy) transaction signatures when the spending script contains a special opcode called OP_CODESEPARATOR. Previously the library did not handle this opcode at all, which…

Protocol correctness fix for legacy sighash serializationOP_CODESEPARATOR handling added to match Bitcoin Core consensus behaviorPreviously omitted test vectors restored, indicating prior non-compliance
5b815281by Andrew Poelstra+600−3093 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6946: Fix integer overflow in `get_array`

This commit fixes a small but real bug in a Rust helper that reads fixed-size chunks from a data slice. The helper was supposed to safely return 'nothing' when asked to read past the end of the data, but it accidentally added two numbers t…

Integer overflow in bounds-checking helperContract violation: method documented to return None on out-of-bounds access could panic insteadDebug-build panic (denial of service) possible
c6e80843by Andrew Poelstra+2−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗