Every captured commit receives deterministic security triage and a separate communication-quality score. Full patches and Ollama analysis are reserved for ranked candidates.
102candidates102AI analyses
194commits · 30 days
405commits · 60 days
1283commits · 180 days
2070commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication
Does the history explain itself?
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual c…
No security-relevant behavioral change observedAPI rename and return-type encapsulation onlyNo new validation, bounds checking, or constant-time guarantees added
This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability…
No security-relevant logic changePure API renaming/refactoringDeprecated method removal may break downstream callers at compile time
This commit adds new ways to print ECDSA Bitcoin signatures as hexadecimal text (lowercase and uppercase), matching formatting already available for Taproot signatures. It also makes the existing Display implementation reuse the new LowerH…
This commit adds standard Rust conversion traits (From/TryFrom) between an ECDSA signature and its serialized byte form. It is a small API-consistency change that mirrors traits already present on the Taproot signature type. There is no in…
No security-relevant keywords in commit title or messageNo changes to cryptographic validation or parsing logicOnly adds convenience trait implementations delegating to existing methods
This commit fixes a formatting bug in how Bitcoin ECDSA signatures are printed as text. Previously, the signature was printed in two separate pieces (the DER-encoded signature and the sighash byte), which could mishandle formatting options…
Incorrect format-flag handling in Display implBehavioral inconsistency between Signature::fmt and SerializedSignature::fmtRegression test added for format-string parity
This commit simply adds standard sorting traits (PartialOrd and Ord) to an ECDSA signature type and its associated sighash type, matching what already exists for similar types. There is no indication this fixes or introduces a security pro…
This commit is a routine API cleanup, not a security fix. It removes a helper trait called PrivateKeyExt and hides a low-level accessor method (as_inner) that exposes the underlying secret key object. The same signing behavior is preserved…
Reduction of public API surface for secret-key materialRemoval of extension trait that exposed raw ECDSA recoverable signingas_inner accessor narrowed from pub to pub(super)
This commit is a code cleanup: it splits one big error type into several smaller, more specific error types for BIP-32 extended key parsing. It does not change what the code accepts or rejects, only how errors are named and organized. Ther…
This commit is a pure code-style change. It reorders the implementation blocks for several error types in a Bitcoin-related Rust library so that the order of traits (From, std::error::Error, Display, helper methods) is consistent. No logic…
This commit adds a new convenience method, XOnlyPublicKey::verify, that lets users verify Schnorr (taproot) signatures without calling the underlying secp256k1 library directly. It is a straightforward API addition with no obvious security…
New public API surface for signature verificationWraps secp256k1::schnorr::verify without altering verification semanticsNo input parsing, no secret-key handling, no allocator changes
This commit is a code cleanup (refactor) that splits one combined error type into two separate error types for parsing BIP32 derivation paths. It does not change the actual parsing rules or fix any security bug. It only changes how error m…
This commit is a code cleanup in the rust-bitcoin library. It splits one general BIP32 derivation error type into several more specific error types and renames the old one. It does not change how keys are actually derived or add any new se…
No security-relevant logic changePublic API surface change (error types)Deprecation of existing public type alias
This commit only adds a new regression test. It does not change any production code. The test checks that a function called from_base64 correctly rejects base64 inputs that decode to fewer or more than 65 bytes. Because no actual fix is in…
Regression test references a prior bug in message-signature base64 decodingTest verifies length validation of decoded base64 inputNo production code change in this commit
This commit fixes a denial-of-service (DoS) weakness in how the rust-bitcoin library decodes Bitcoin transaction witness data. Previously, an attacker could send only about 10 bytes of data and trick the decoder into reserving 16 MB of mem…
Denial-of-service vector: small input forcing large memory allocationMemory allocation now proportional to bytes actually receivedRemoval of reserve_batch and MAX_VECTOR_ALLOCATE/MIN_VECTOR_ALLOCATE constants
This commit is a routine code cleanup: it moves a small test-only helper macro from a shared internal utility crate into the one place it is actually used. There is no change to user-facing behavior, no bug fix, and no security relevance.
This commit removes an unused error category from a Bitcoin cryptography library. It is a cleanup change because the underlying signature-parsing code can no longer fail in the way that error category described. There is no direct evidence…
Public error enum variant removed (API surface reduction)Removal of `From<secp256k1::Error>` conversionNo new input validation, bounds checks, or cryptographic operations added
This commit removes a convenience conversion that let users turn a borrowed Taproot signature into an owned, serialized byte form. The change is API-cleanup: the old trait made it look like the serialized form was just a view of the origin…
API semantics hardening: removing a trait impl whose existence misrepresented ownershipPotential misuse reduction: borrowed-to-owned conversion could encourage unnecessary cloning or confusion about signature lifetime/ownershipNo direct memory-safety or cryptographic bug is visible in the diff
This commit adds two small Rust trait implementations that allow certain error types to be automatically converted from the 'Infallible' type. 'Infallible' is a type that can never actually exist, so these conversions are purely for making…
This is a routine code cleanup that renames the type `DerivationPath` to `RelativeDerivationPath` throughout the project. The change is purely a refactor: it does not alter how the code behaves, what it computes, or how it handles data. Th…
This commit refactors how Bitcoin BIP-32 derivation paths are represented in the rust-bitcoin library. It splits the old single DerivationPath type into two: DerivationPath (relative paths like 0'/1) and AbsoluteDerivationPath (master-pref…
API hardening: type-level separation of absolute vs relative BIP-32 pathsBehavior change: DerivationPath no longer silently accepts 'm/' prefixNew error variants for missing or unexpected master prefix
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Routine changeMerge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktimeby Andrew Poelstra · 6ea4ff92 · Aug 5, 2026 · 2 filesMessage 100 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime
8867fe2e37f3fcd9e60a763c5e6911445ccdd13e units: reword docs to block count in relative locktime (satsfy (Renato Britto))
Pull request description:
This is a philosophical PR based on [this comment](https://github.com/rust-bitcoin/rust-bitcoin/issues/3632#issuecomment-5160990873). It rewrites the remaining spots that mention relative locktime docs to say block count instead of block height, because a relative lock counts blocks elapsed since the UTXO was confirmed, it is not a chain height.
The goal is to make locktime usage crystal clear to the user. The wording choice regarding lock times is unfortunate.
ACKs for top commit: apoelstra: ACK 8867fe2e37f3fcd9e60a763c5e6911445ccdd13e; successfully ran local tests tcharding: ACK 8867fe2e37f3fcd9e60a763c5e6911445ccdd13e
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The labeller runs in a separate workflow for security reasons, but this forces the `download-artifact` action to need an explicit token.
Here is a test end to end run on my remote: https://github.com/nyonson/rust-bitcoin/pull/5
ACKs for top commit: apoelstra: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756; successfully ran local tests; sure, whatever satsfy: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756 tcharding: ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Routine changeMerge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decodingby Andrew Poelstra · c5fd1832 · Aug 5, 2026 · 5 filesMessage 100 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding
b0eba4c097ca68da53abbbaf8603a5facd7c82bd Rename Error to DecodeCheckError (Mitchell Bagot) 7e6ab80baf795c9985d63c35d54b622ec59daa0a Add tests for decode_check_to_array (Mitchell Bagot) ae6ea3616fd6de3fb8cd976346d0b5d9a537abc7 base58: Add decode_check_to_array (Mitchell Bagot) 0a70c578514c3ecfedac508045397b627071e265 Split decode into build_base256 (Mitchell Bagot)
Pull request description:
At present, base58 has only encoding functionality in no-alloc builds. In order to allow decoding of known size data from base58 without an allocator, the base58 crate needs a decoder function like hex's decode_to_array. Such a function has more failure modes than the alloc decode_check function, so new error types are required also.
- Patch 1 splits the existing decode function into a private build_base256 function that writes to a provided scratch buffer. - Patch 1 introduces decode_check_to_array function for decoding short (<128 char) base58 strings to byte arrays, and associated error types. - Patch 2 adds tests to cover the new function. - Patch 3 renames Error to DecodeCheckError, retaining a deprecated type alias.
ACKs for top commit: tcharding: ACK b0eba4c097ca68da53abbbaf8603a5facd7c82bd apoelstra: ACK b0eba4c097ca68da53abbbaf8603a5facd7c82bd; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Routine changeMerge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0by Andrew Poelstra · 0f68fcb3 · Aug 4, 2026 · 10 filesMessage 93 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6646: hashes: add several methods to `Midstate` and release 1.2.0
8899dfd242cf418ee6ce3f05e5828e8579af9f3c release bitcoin_hashes 1.2.0 (Andrew Poelstra) 44552e3ad3035e1001b665bfd4dd3511042cd1f2 hashes: update API files (Andrew Poelstra) 7d8f06d256152a3de1ec9b54e3dd643271983f0d hashes: add several methods to sha256::Midstate for computing them in const contexts (Andrew Poelstra) dc21841b46abc39c49ed7075131f1ac46416137f hashes: add sha256::Midstate::SHA256_IV constant (Andrew Poelstra)
Pull request description:
Adds a new `Midstate::SHA256_IV` constant which allows you to construct a midstate equivalent to a new empty sha256 engine. Then adds `update` methods to `Midstate` which allow you to "ratchet forward" arbitrary midstates, 64 bytes at a time, by hashing the data. There is one fast method and two slow constfn methods.
The motivation is that in Elements we have many Merkle roots which are computed using sha256 midstates, which is safe to do because we're using domain-separated hashes and because our internal nodes are always hashes of exactly 64 bytes of data, which do not not need any length-suffixing. In rust-simplicity we have several such Merkle root types, many of which have a huge pile of precomputed constants, but whose constructors are forced to be non-`const`, which limits their use in generic contexts.
It's maybe a bit uncouth for me to just add some methods I need and cut a new release in a 1.x crate, but
* we have taken great pains to keep `hashes` out of other crates' public APIs, so its stability is not as paramount as it would be for encoding or units, say * all the new methods (and one constant) are on the `Midstate` type, which is a "don't touch this unless you are a cryptographer" part of the API and already has some ugly methods * the additions seem pretty reasonable to me, assuming you accept that we have a `Midstate` type at all; essentially they generalize the already-existing `hash_tag` method * I am BDFL of this project
ACKs for top commit: tcharding: ACK 8899dfd242cf418ee6ce3f05e5828e8579af9f3c
Routine changeunits: reword docs to block count in relative locktimeby satsfy (Renato Britto) · 8867fe2e · Aug 4, 2026 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · satsfy (Renato Britto)
units: reword docs to block count in relative locktime
This commit rewords the remaining spots that mention relative locktime docs to say block count instead of block height.
A relative lock counts blocks elapsed since the UTXO confirmed, it is not a chain height.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Routine changeMerge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` privateby Andrew Poelstra · 07d91f7f · Aug 4, 2026 · 4 filesMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private
9c391145fa57dc54e6af1f18758db4e0ba2049de Update the API text files (Tobin C. Harding) b37accc3db1f164a5b3dee7ff6bbd7a2d0af5be4 Make the WitnessesEncoder private (Tobin C. Harding)
Pull request description:
The `WitnessesEncoder` is an auxilary encoder that is used internally within the transaction encoder. It does not need to be public.
Make it private and put the code right below where it is used.
ACKs for top commit: apoelstra: ACK 9c391145fa57dc54e6af1f18758db4e0ba2049de; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was security-ranked
signing or wallet pathmerge-commit duplicate discount
Routine changeci: fix labeller permissionsby Nick Johnson · 715f2bd6 · Aug 4, 2026 · 1 fileMessage 75 · AdequateTriage 0Details
Commit message · Nick Johnson
ci: fix labeller permissions
The labeller runs in a separate workflow for security reasons, but this forces the download-artifact actoin to need an explicit token.
75/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was security-ranked
documentation-only discount
Routine changeMerge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`by Andrew Poelstra · ed5f1b68 · Aug 4, 2026 · 8 filesMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6661: units: Remove `From<u16>` from `NumberOfBlocks`
6ea25bed2982858815abeb8788f12f342584108b Update API files (Mitchell Bagot) f9b08eb1fb1ec6871d144f16c6fdad3d13d9b552 Remove From<u16> from NumberOfBlocks (Mitchell Bagot)
Pull request description:
The NumberOfBlocks type has a From\<u16> impl on it, which is used to simplify construction of the type in various tests. However, the from_height constructor already takes a u16 and functions identically. Since the NumberOf512Seconds type has no such From impl, it should be removed from this to reduce the API surface and make the two consistent.
Remove From\<u16> impl from NumberOfBlocks.
ACKs for top commit: apoelstra: ACK 6ea25bed2982858815abeb8788f12f342584108b; successfully ran local tests tcharding: ACK 6ea25bed2982858815abeb8788f12f342584108b
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was security-ranked
merge-commit duplicate discount
Routine changeMerge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logicby Andrew Poelstra · c5588ba5 · Aug 4, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic
80dcef1527479e2e0790bf5995636b7640bb56f8 Scrub the transaction encoding logic (Tobin C. Harding)
Pull request description:
Third time lucky. Layout the encoding code in `transaction` as is now customary. (`Transaction` was done but I missed the others.)
Code move only.
ACKs for top commit: apoelstra: ACK 80dcef1527479e2e0790bf5995636b7640bb56f8; successfully ran local tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was security-ranked
signing or wallet pathmerge-commit duplicate discount
Routine changeMerge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3by Andrew Poelstra · f7d364cd · Aug 4, 2026 · 15 filesMessage 96 · StrongTriage 0Details
Commit message · Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6662: build(deps): bump actions/checkout from 6.0.2 to 6.0.3
ae935faddb52aa66087c2c148c8e33a7aaf1a662 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot])
Pull request description:
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824"><code>1cce339</code></a> Fix checkout init for SHA-256 repositories (<a href="https://redirect.github.com/actions/checkout/issues/2439">#2439</a>)</li> <li><a href="https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231"><code>900f221</code></a> fix: expand merge commit SHA regex and add SHA-256 test cases (<a href="https://redirect.github.com/actions/checkout/issues/2414">#2414</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98"><code>0c366fd</code></a> Update changelog (<a href="https://redirect.github.com/actions/checkout/issues/2357">#2357</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10">compare view</a></li> </ul> </details> <br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK ae935faddb52aa66087c2c148c8e33a7aaf1a662; successfully ran local tests satsfy: ACK ae935faddb52aa66087c2c148c8e33a7aaf1a662
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit: apoelstra: ACK eb9544f9d07a38d81998e5e1f96faaba43546ca0; successfully ran local tests satsfy: ACK eb9544f9d07a38d81998e5e1f96faaba43546ca0
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was security-ranked
boot or update pathdocumentation-only discountautomated dependency-update discount
Routine changeUpdate API filesby Mitchell Bagot · 6ea25bed · Aug 3, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot
Update API files
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was security-ranked
documentation-only discount
Routine changeRemove From<u16> from NumberOfBlocksby Mitchell Bagot · f9b08eb1 · Aug 3, 2026 · 5 filesMessage 78 · AdequateTriage 0Details
Commit message · Mitchell Bagot
Remove From<u16> from NumberOfBlocks
The NumberOfBlocks type has a From<u16> impl on it, which is used to simplify construction of the type in various tests. However, the from_height constructor already takes a u16 and functions identically. Since the NumberOf512Seconds type has no such From impl, it should be removed from this to reduce the API surface and make the two consistent.
Remove From<u16> impl from NumberOfBlocks
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Routine changebase58ck: Bump version to 0.5.0by Tobin C. Harding · 8479b56e · Aug 3, 2026 · 8 filesMessage 60 · AdequateTriage 15Details
Commit message · Tobin C. Harding
base58ck: Bump version to 0.5.0
In preparation for release add a changelog entry, bump the version, and update the lock files.
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was security-ranked
cryptography-sensitive path
Routine changeSplit decode into build_base256by Mitchell Bagot · 0a70c578 · Aug 3, 2026 · 2 filesMessage 70 · AdequateTriage 0Details
Commit message · Mitchell Bagot
Split decode into build_base256
In preparation for the introduction of the decode_check_to_array, the main decoding logic should be broken out into a function that can be made no-alloc. In order to provide fallibility for a no-alloc decode on this, an error type that captures the failure to Buffer::try_push is needed.
Introduce build_base256 that decodes a base58 string into a scratch Buffer. Use build_base256 in decode function.
At present, base58 has only encoding functionality in no-alloc builds. In order to allow decoding of known size data from base58 without an allocator, the base58 crate needs a decoder function like hex's decode_to_array. Such a function has more failure modes than the alloc decode_check function, so new error types are required also.
Introduce decode_check_to_array function for decoding short (<128 char) base58 strings to byte arrays. Introduce DecodeCheckArrayError. Adjust error gating such that only errors in the public API appear in the error module.
