What the developer wrote
Authored by Tobin C. Harding
p2p: Update arbitrary dep to 1.4.1
I don't know why `cargo` can't work this out but `just
update-lock-files` is throwing an error
```
error: failed to select a version for `arbitrary`.
... required by package `bitcoin-p2p-messages v0.1.0 (/home/tobin/build/rust-bitcoin/p2p)`
... which satisfies path dependency `p2p` of package `bitcoin-fuzz v0.0.1 (/home/tobin/build/rust-bitcoin/fuzz)`
versions that meet the requirements `^1.4` are: 1.4.0
all possible versions conflict with previously selected packages.
previously selected package `arbitrary v1.4.1`
... which satisfies dependency `arbitrary = "^1.4.1"` of package `bitcoin-fuzz v0.0.1 (/home/tobin/build/rust-bitcoin/fuzz)`
```
Just update the arbitrary dep to `v1.4.1` like in the other crates.
What changed, and why it matters
This commit is a routine dependency version bump in a build configuration file. It changes the required version of an optional test/fuzzing helper library from '1.4' to '1.4.1' so that it matches another crate in the same workspace and resolves a Cargo lock-file conflict. There is no indication this fixes or introduces a security vulnerability.
No security action needed. Treat as normal maintenance/dependency synchronization.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates p2p/Cargo.toml to pin the optional arbitrary dependency to exactly ^1.4.1, aligning it with the version already required by the bitcoin-fuzz crate. The change resolves a Cargo resolver conflict during lock-file generation. The arbitrary crate is an optional dependency used for fuzzing/test generation; this is a build hygiene change, not a code-level security fix.
Changed components
p2p/Cargo.tomlInspect captured patch +1 / −1
diff --git a/p2p/Cargo.toml b/p2p/Cargo.toml
index 009673d2..b22d759d 100644
--- a/p2p/Cargo.toml
+++ b/p2p/Cargo.toml
@@ -25,7 +25,7 @@ internals = { package = "bitcoin-internals", path = "../internals", default-feat
io = { package = "bitcoin-io", path = "../io", default-features = false }
units = { package = "bitcoin-units", path = "../units", default-features = false }
-arbitrary = { version = "1.4", optional = true }
+arbitrary = { version = "1.4.1", optional = true }
[dev-dependencies]
hex_lit = "0.1.1"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.