CommitWatch RSS
RB
← All projectsRust Bitcoin

rust-bitcoin

Rust library for Bitcoin data structures, serialization, consensus encoding, and scripts.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

2070 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

459security candidates448second-pass queue197AI analyses
194commits · 30 days
405commits · 60 days
1283commits · 180 days
2070commits · 365 days
Backfill bands
Aug 5 → Feb 6787 seen32 candidatesComplete
Feb 6 → Jun 6878 seen53 candidatesComplete
Jun 6 → Jul 6211 seen15 candidatesComplete
Jul 6 → Aug 5184 seen2 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

64/100 average clarity
311Strong · 80–100
1054Adequate · 60–79
555Thin · 40–59
150Opaque · 0–39
20security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Mitchell Bagot64019288068
Tobin C. Harding4096528063
jrakibi94498068
Nick Johnson189203059
Andrew Poelstra51209075
Jamil Lambert, PhD114184061
Fmt Bot311411045
Trevor Arjeski111110069
Shing Him Ng3174056
Ismail Daif2263050
satsfy (Renato Britto)1766066
Martin Habovstiak2754069
Analysis record

Published AI watches

Last scanned 43 minutes ago

Informational 17 AI analysisMessage 80 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor(bip32): Xpub child tweak api

This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual c…

No security-relevant behavioral change observedAPI rename and return-type encapsulation onlyNo new validation, bounds checking, or constant-time guarantees added
37191717by Trevor Arjeski+21−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 85 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor(bip32): rename Xpub and Xpriv derivation methods

This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability…

No security-relevant logic changePure API renaming/refactoringDeprecated method removal may break downstream callers at compile time
f8f053fdby Trevor Arjeski+61−852 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add try_push to Buffer trait

This commit adds a new `try_push` method to an internal `Buffer` trait used during Base58 encoding. It is a straightforward, additive change that lets encoding code gracefully handle a full fixed-size buffer in no-allocation builds. There …

aafb6065by Mitchell Bagot+15−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: Rename _with decoder functions

This commit is a simple renaming of internal Rust functions from names ending in '_with' to names ending in '_with_decoder'. It does not change what the code does, only what the functions are called, to avoid confusion with another functio…

12325a67by Mitchell Bagot+18−174 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

2026-07-05 automated rustfmt nightly

This commit is a routine automated code-formatting run by the rustfmt tool. It only changes whitespace, import order, and line breaks in five files. There are no functional changes, no bug fixes, and no security-related modifications.

673e5ee4by Fmt Bot+12−115 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: adapt default and no feature bip32 test for rbmt 0.4.0

This is a routine update to the project's automated testing configuration. A tool used to run example tests changed its syntax, so the developer updated one line to keep the same tests running the same way. There is no user-facing change a…

5f933d5cby satsfy (Renato Britto)+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add From/TryFrom for Signature/SerializedSignature

This commit adds standard Rust conversion traits (From/TryFrom) between an ECDSA signature and its serialized byte form. It is a small API-consistency change that mirrors traits already present on the Taproot signature type. There is no in…

No security-relevant keywords in commit title or messageNo changes to cryptographic validation or parsing logicOnly adds convenience trait implementations delegating to existing methods
3cf8c405by Mitchell Bagot+21−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 83 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add {Lower,Upper}Hex to ecdsa::Signature

This commit adds new ways to print ECDSA Bitcoin signatures as hexadecimal text (lowercase and uppercase), matching formatting already available for Taproot signatures. It also makes the existing Display implementation reuse the new LowerH…

69540f98by Mitchell Bagot+43−51 file
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 90 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace Signature Display with call to SerializedSignature

This commit fixes a formatting bug in how Bitcoin ECDSA signatures are printed as text. Previously, the signature was printed in two separate pieces (the DER-encoded signature and the sighash byte), which could mishandle formatting options…

Incorrect format-flag handling in Display implBehavioral inconsistency between Signature::fmt and SerializedSignature::fmtRegression test added for format-string parity
c8ee6361by Mitchell Bagot+18−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add PartialOrd, Ord to ecdsa::Signature

This commit simply adds standard sorting traits (PartialOrd and Ord) to an ECDSA signature type and its associated sighash type, matching what already exists for similar types. There is no indication this fixes or introduces a security pro…

1e020732by Mitchell Bagot+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove PrivateKeyExt and make PrivateKey::as_inner private

This commit is a routine API cleanup, not a security fix. It removes a helper trait called PrivateKeyExt and hides a low-level accessor method (as_inner) that exposes the underlying secret key object. The same signing behavior is preserved…

Reduction of public API surface for secret-key materialRemoval of extension trait that exposed raw ECDSA recoverable signingas_inner accessor narrowed from pub to pub(super)
e9ea66a1by Mitchell Bagot+14−344 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor: split bip32 xkey parse errors

This commit is a code cleanup: it splits one big error type into several smaller, more specific error types for BIP-32 extended key parsing. It does not change what the code accepts or rejects, only how errors are named and organized. Ther…

55ef86a2by Trevor Arjeski+214−771 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

style: reorder bip32 error impls

This commit is a pure code-style change. It reorders the implementation blocks for several error types in a Bitcoin-related Rust library so that the order of traits (From, std::error::Error, Display, helper methods) is consistent. No logic…

78a3ac3fby Trevor Arjeski+38−381 file
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove Encodable and Decodable impls for crate types

This commit removes old serialization/deserialization trait implementations (called Encodable and Decodable) from many Bitcoin data types in the rust-bitcoin library. It is described by the project as a cleanup step toward replacing the ol…

Large deletion of serialization code (535 lines removed)Removal of consensus encoding traits from core Bitcoin typesRemoval of transaction deserialization tests including extreme-size witness/scriptSig tests
6f136cdfby Mitchell Bagot+8−53512 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace uses of bitcoin::consensus with consensus_encoding

This commit swaps out an older Bitcoin data-encoding system for a newer one across six files. It is a routine internal refactoring change. There is no direct evidence in the commit that it fixes a security vulnerability, but any encoding c…

Refactor of consensus-critical serialization code (sighash, taproot leaf hash, BIP-158 filters, consensus validation)Change of compact-size encoder/decoder implementation and error typesRemoval of `bitcoin::consensus` dependency from several modules
22cf8fb6by Mitchell Bagot+38−356 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace uses of consensus in tests

This commit only changes test code and documentation examples in the rust-bitcoin library. It replaces older consensus encoding/decoding helper functions with newer equivalents from a different internal module. There is no change to produc…

171f6661by Mitchell Bagot+81−697 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add XOnlyPublicKey::verify

This commit adds a new convenience method, XOnlyPublicKey::verify, that lets users verify Schnorr (taproot) signatures without calling the underlying secp256k1 library directly. It is a straightforward API addition with no obvious security…

New public API surface for signature verificationWraps secp256k1::schnorr::verify without altering verification semanticsNo input parsing, no secret-key handling, no allocator changes
8a5deee2by Mitchell Bagot+28−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 83 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add tests to verify 0 return for overflow

This commit only adds new unit tests to verify that a previously changed function, Target::from_compact, returns zero when a Bitcoin 'compact' difficulty value overflows a 256-bit target. It does not change any production code. The tests c…

4ee43312by Mitchell Bagot+17−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Return 0 on Target::from_compact overflow

This commit fixes a bug in how rust-bitcoin converts Bitcoin 'compact' difficulty targets into full numeric Target values. Previously, if the compact value encoded a number too large to fit in a valid Target, the code would silently produc…

Consensus-critical code path modifiedOverflow/wraparound in cryptographic/numeric conversionAlignment with Bitcoin Core behavior (SetCompact overflow flag)
1fb9a651by Mitchell Bagot+7−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor: split bip32 path parse errors

This commit is a code cleanup (refactor) that splits one combined error type into two separate error types for parsing BIP32 derivation paths. It does not change the actual parsing rules or fix any security bug. It only changes how error m…

22a4cbc6by Trevor Arjeski+68−291 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedMerge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` privateby Andrew Poelstra · 07d91f7f · Aug 4, 2026 · 4 filesMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6667: Make the `WitnessesEncoder` private

9c391145fa57dc54e6af1f18758db4e0ba2049de Update the API text files (Tobin C. Harding)
b37accc3db1f164a5b3dee7ff6bbd7a2d0af5be4 Make the WitnessesEncoder private (Tobin C. Harding)

Pull request description:

The `WitnessesEncoder` is an auxilary encoder that is used internally within the transaction encoder. It does not need to be public.

Make it private and put the code right below where it is used.


ACKs for top commit:
apoelstra:
ACK 9c391145fa57dc54e6af1f18758db4e0ba2049de; successfully ran local tests


Tree-SHA512: 1b950e7f3d19bf923325c75a4009dcc903a065cca87fccad638d3d19c53ea824a81b19a07e09eaff5603aea659366d2b80e51a8a694be6f24ae96f5ca0c9c9e7

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI review queuedMerge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logicby Andrew Poelstra · c5588ba5 · Aug 4, 2026 · 1 fileMessage 91 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6668: Scrub the transaction encoding logic

80dcef1527479e2e0790bf5995636b7640bb56f8 Scrub the transaction encoding logic (Tobin C. Harding)

Pull request description:

Third time lucky. Layout the encoding code in `transaction` as is now customary. (`Transaction` was done but I missed the others.)

Code move only.


ACKs for top commit:
apoelstra:
ACK 80dcef1527479e2e0790bf5995636b7640bb56f8; successfully ran local tests


Tree-SHA512: 737266a34151f4449cfc74e8788c94d991e4931b9cd837fbc551fbd7afc3062623525b9165325c371caea0a78e12b5746e71e66c697b1684a5628c8bb4cc8855

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI review queuedMerge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4by Andrew Poelstra · 5c92c0b0 · Aug 4, 2026 · 2 filesMessage 96 · StrongTriage 0Details
Commit message · Andrew Poelstra

Merge rust-bitcoin/rust-bitcoin#6663: build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

eb9544f9d07a38d81998e5e1f96faaba43546ca0 build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4 (dependabot[bot])

Pull request description:

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.12 to 2.81.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.81.4</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.4.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.47.1.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.45.0.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.4.0.</p>
</li>
<li>
<p>Update <code>cargo-mutants@latest</code> to 27.1.0.</p>
</li>
</ul>
<h2>2.81.3</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.3.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.18.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.0.</p>
</li>
</ul>
<h2>2.81.2</h2>
<ul>
<li>
<p>Update <code>mise@latest</code> to 2026.5.18.</p>
</li>
<li>
<p>Update <code>cargo-semver-checks@latest</code> to 0.48.0.</p>
</li>
</ul>
<h2>2.81.1</h2>
<ul>
<li>
<p>Update <code>cargo-no-dev-deps@latest</code> to 0.2.24.</p>
</li>
<li>
<p>Update <code>cargo-hack@latest</code> to 0.6.45.</p>
</li>
</ul>
<h2>2.81.0</h2>
<ul>
<li>
<p>Support <code>convco</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1831">#1831</a>, thanks <a href="https://github.com/graelo"><code>@​graelo</code></a>)</p>
</li>
<li>
<p>Support <code>docgarden</code> (<a href="https://redirect.github.com/taiki-e/install-action/pull/1830">#1830</a>, thanks <a href="https://github.com/jesse-black"><code>@​jesse-black</code></a>)</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.28.0.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.19.1.</p>
</li>
</ul>
<h2>2.80.0</h2>
<ul>
<li>Support <code>kingfisher</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1874">#1874</a>, thanks <a href="https://github.com/SAY-5"><code>@​SAY-5</code></a>)</li>
</ul>
<h2>2.79.15</h2>
<ul>
<li>
<p>Update <code>typos@latest</code> to 1.47.0.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.251.0.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.27.2.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.17.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.1.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.85.7] - 2026-08-02</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 47.0.3.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.1.</p>
</li>
<li>
<p>Update <code>rclone@latest</code> to 1.75.0.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.110.0.</p>
</li>
</ul>
<h2>[2.85.6] - 2026-08-01</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.255.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.2.5.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.18.</p>
</li>
<li>
<p>Update <code>cargo-neat@latest</code> to 0.5.3.</p>
</li>
<li>
<p>Update <code>cargo-crap@latest</code> to 0.4.0.</p>
</li>
</ul>
<h2>[2.85.5] - 2026-07-30</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.0.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.50.0.</p>
</li>
<li>
<p>Update <code>sccache@latest</code> to 0.17.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.16.</p>
</li>
</ul>
<h2>[2.85.4] - 2026-07-29</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.11.33.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.15.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/cde8c9e634f4a17bc06b61413ac0ef75450eac46"><code>cde8c9e</code></a> Release 2.81.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/1e4ec7678aaae334aeea28c8427c4e089bd7ac59"><code>1e4ec76</code></a> ci: Temporarily disable broken opensuse/tumbleweed test</li>
<li><a href="https://github.com/taiki-e/install-action/commit/2ba2a47530f71d53918fc583d17d787dec4eb506"><code>2ba2a47</code></a> Update <code>vacuum@latest</code> to 0.28.4</li>
<li><a href="https://github.com/taiki-e/install-action/commit/193c1cc963fc6015a43bd656c624759cf2489e6d"><code>193c1cc</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/cb4b3f93f764d4397e62fed744879c14a37e6648"><code>cb4b3f9</code></a> Update <code>typos@latest</code> to 1.47.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/b6e08095932286aa3bc8066c8425cf400f5dad11"><code>b6e0809</code></a> Update <code>syft@latest</code> to 1.45.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/55ff171d0ce18bd578689162cd406f47f234b9db"><code>55ff171</code></a> Update prek manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/4dea5bb80f56642c56e7b47dd897c5ecff469424"><code>4dea5bb</code></a> Update mise manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/3e82d2c35aa3d3b9fa923dd8070290a142e32eb9"><code>3e82d2c</code></a> Update cargo-shear manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/31e07c4d25ffc687960959659c9769d3252c88e1"><code>31e07c4</code></a> Update <code>cargo-neat@latest</code> to 0.4.0</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c...cde8c9e634f4a17bc06b61413ac0ef75450eac46">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.79.12&new-version=2.81.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


ACKs for top commit:
apoelstra:
ACK eb9544f9d07a38d81998e5e1f96faaba43546ca0; successfully ran local tests
satsfy:
ACK eb9544f9d07a38d81998e5e1f96faaba43546ca0


Tree-SHA512: b9424910bb0f991686929a42b12b1a1183de5b5a86667d0a19a6c0d8b0944dc06d94451e3e357644d4bf7a509bd5b44ec24ad77a0627cdc5b9706808d84cbe39

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
documentation-only discountautomated dependency-update discountmerge-commit duplicate discountsecond-pass: broader security terminology
AI review queuedScrub the transaction encoding logicby Tobin C. Harding · 80dcef15 · Aug 3, 2026 · 1 fileMessage 68 · AdequateTriage 12Details
Commit message · Tobin C. Harding

Scrub the transaction encoding logic

Third time lucky. Layout the encoding code in `transaction` as is now
customary. (`Transaction` was done but I missed the others.)

Code move only.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedMake the WitnessesEncoder privateby Tobin C. Harding · b37accc3 · Aug 3, 2026 · 2 filesMessage 58 · ThinTriage 12Details
Commit message · Tobin C. Harding

Make the WitnessesEncoder private

The `WitnessesEncoder` is an auxilary encoder that is used internally
within the transaction encoder. It does not need to be public.

Make it private and put the code right below where it is used.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedbuild(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0by dependabot[bot] · 1c438632 · Aug 3, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/08807647e7069bb48b6ef5acd8ec9567f424441b...fac544c07dec837d0ccb6301d7b5580bf5edae39)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 5293bee4 · Aug 3, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.0 to 4.36.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.36.2
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4by dependabot[bot] · eb9544f9 · Aug 3, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.79.12 to 2.81.4

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.12 to 2.81.4.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c...cde8c9e634f4a17bc06b61413ac0ef75450eac46)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.81.4
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedUpdate API filesby Mitchell Bagot · 6ea25bed · Aug 3, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · 351acf8e · Jul 31, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedconsensus_encoding: decoder docs which are consensus specificby Nick Johnson · 5cdd5aa0 · Jul 31, 2026 · 2 filesMessage 73 · AdequateTriage 7Details
Commit message · Nick Johnson

consensus_encoding: decoder docs which are consensus specific

The decode module has 6 driver functions bound to `Decode`, and thus
are consensus-encoding specific.

- `decode_from_slice<T: Decode>`
- `decode_from_slice_unbounded<T: Decode>`
- `decode_from_hex<T: Decode>`
- `decode_from_read<T: Decode>`
- `decode_from_read_unbuffered<T: Decode>`
- `decode_from_read_unbuffered_with<T: Decode>`
- `check_decode<T: Decode>`

One type is bound to `Decode`.

- `VecDecoder<T: Decode>`

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedhashes: update API filesby Andrew Poelstra · 44552e3a · Jul 31, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Andrew Poelstra

hashes: update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · cebefd5c · Jul 31, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · 8356c542 · Jul 30, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedunits: Implement serde traits for relative lock timesby Tobin C. Harding · f6d22308 · Jul 30, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Tobin C. Harding

units: Implement serde traits for relative lock times

To satisfy the API guideline
[C-SERDE](https://rust-lang.github.io/api-guidelines/interoperability.html#data-structures-implement-serdes-serialize-deserialize-c-serde),
data types in a crate must implement serde's `Serialize` and
`Deserialize` traits.

Add custom impls for the relative lock time subtypes. Note we use 512
second intervals for the `NumberOf512Seconds` type and not seconds so
that there is no error path.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedImplement serde traits for absolute locktime typesby Tobin C. Harding · 0252bea5 · Jul 30, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Tobin C. Harding

Implement serde traits for absolute locktime types

To satisfy the API guideline
[C-SERDE](https://rust-lang.github.io/api-guidelines/interoperability.html#data-structures-implement-serdes-serialize-deserialize-c-serde),
data types in a crate must implement serde's `Serialize` and
`Deserialize` traits.

Add custom impls for the absolute lock time sub types.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedunits: make Sequence inner field privateby satsfy (Renato Britto) · 30f280da · Jul 29, 2026 · 6 filesMessage 68 · AdequateTriage 12Details
Commit message · satsfy (Renato Britto)

units: make Sequence inner field private

The public inner field violates C-STRUCT-PRIVATE. The value is already
accessible through `from_consensus` and `to_consensus_u32` so nothing
is lost by hiding the field.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedUpdate API filesby Mitchell Bagot · 76b1f333 · Jul 28, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedconsensus_encoding: Loosen serde_as_consensus trait boundsby Mitchell Bagot · 91a09335 · Jul 28, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Mitchell Bagot

consensus_encoding: Loosen serde_as_consensus trait bounds

The trait bounds in serde_as_consensus currently require Encode + Decode
for either serialize or deserialize. In the case of types which can be
Encoded but not Decoded (e.g. primitives' Block<Checked>) these
over-constrained bounds prevent serde serialisation, or vice-versa.

While this code has been released, removing trait bounds is not breaking
as it loosens the requirements on the type. That is, any Encode + Decode
type is also Encode alone or Decode alone.

Loosen trait bounds in serde_as_consensus to only Encode or Decode as
needed for each function.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedAdd encoding dep to taproot-primitivesby Mitchell Bagot · a291c3a2 · Jul 28, 2026 · 4 filesMessage 68 · AdequateTriage 0Details
Commit message · Mitchell Bagot

Add encoding dep to taproot-primitives

As a first step to introducing encoding for the hash types in
taproot-primitives, the encoding dependency needs to be added to the
crate.

Add consensus_encoding dependency to taproot-primitives.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedUpdate API filesby Mitchell Bagot · d166d57e · Jul 28, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedbuild(deps): bump github/codeql-action/upload-sarifby dependabot[bot] · 69e50bb3 · Jul 27, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump github/codeql-action/upload-sarif

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.35.5 to 4.36.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/9e0d7b8d25671d64c341c19c0152d693099fb5ba...7211b7c8077ea37d8641b6271f6a365a22a5fbfa)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedbuild(deps): bump taiki-e/install-action from 2.79.3 to 2.79.12by dependabot[bot] · d953dccc · Jul 27, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump taiki-e/install-action from 2.79.3 to 2.79.12

Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.3 to 2.79.12.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/65851e10cd6c377f11a60e600abc07cb08643468...6ed6112eb9893c58dd600eebccdf6e77ab7bfa9c)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
dependency-version: 2.79.12
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedUpdate API filesby Mitchell Bagot · a487f942 · Jul 27, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedUpdate API filesby Mitchell Bagot · 85943c5a · Jul 27, 2026 · 3 filesMessage 28 · OpaqueTriage 0Details
Commit message · Mitchell Bagot

Update API files

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message