fix: add all optional feature dependencies
What the developer wrote
Authored by Nick Johnson
fix: add all optional feature dependencies
Ensure all optional feature dependencies are tested when creating the
lock files. rust-bitcoin's dependency tree is so lean right now though,
this is currently a no-op.
What changed, and why it matters
This is a small change to an internal maintenance script used to generate dependency lock files for testing. It adds the '--all-features' flag so that optional features are included when checking the project against minimal and recent dependency versions. The commit message explicitly says this is currently a no-op because rust-bitcoin has very few optional dependencies. There is no indication this fixes a security vulnerability.
No security action required. Treat as routine build/CI hygiene.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies contrib/update-lock-files.sh, a helper script for CI/maintenance that regenerates Cargo-minimal.lock and Cargo-recent.lock. The three cargo check invocations now pass –all-features. This ensures optional crate features are exercised during direct-minimal-versions and minimal-versions checks. The commit message states the change is effectively a no-op due to the current lean dependency tree. No code behavior is changed, no dependency versions are altered, and no vulnerability is described.
Changed components
contrib/update-lock-files.shInspect captured patch +3 / −3
diff --git a/contrib/update-lock-files.sh b/contrib/update-lock-files.sh
index d0b45a30..6d73aae9 100755
--- a/contrib/update-lock-files.sh
+++ b/contrib/update-lock-files.sh
@@ -17,14 +17,14 @@ NIGHTLY=$(cat nightly-version)
# Check that all explicit direct dependency versions are not lying,
# as in, they are not being bumped up by transitive dependency constraints.
-rm -f Cargo.lock && cargo +"$NIGHTLY" check -Z direct-minimal-versions
+rm -f Cargo.lock && cargo +"$NIGHTLY" check --all-features -Z direct-minimal-versions
# Now that our own direct dependency versions can be trusted, check
# against the lowest versions of the dependency tree which still
# satisfy constraints. Use this as the minimal version lock file.
-rm -f Cargo.lock && cargo +"$NIGHTLY" check -Z minimal-versions
+rm -f Cargo.lock && cargo +"$NIGHTLY" check --all-features -Z minimal-versions
cp -f Cargo.lock Cargo-minimal.lock
# Conservatively bump of recent dependencies.
cp -f Cargo-recent.lock Cargo.lock
-cargo check
+cargo check --all-features
cp -f Cargo.lock Cargo-recent.lock
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.