CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 18 Bitcoin

rust: update to toolchain 1.90.0

BBee47c5f0 View source ↗
Public commit record

What the developer wrote

Authored by Marko Bencun

80/100 · Strong
rust: update to toolchain 1.90.0

This saves ~2-3kB in binary space in the multi firmware.

`clippy::collapsible-if` is disabled because I didn't like some of the
collapse suggestions. Readability seems worse rather than better.

Applied this to remove duplicate deps, choosing the higher of version
each time.
```
cargo update --precise 0.1.74 --package libc
cargo update --precise 1.0.1 --package cfg-if
```

Rust vendoring now for some reason adds Cargo.toml.orig files, which
part part of the crate checksum, so they are removed from the
.gitignore and committed.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This is a routine maintenance update that upgrades the Rust compiler toolchain from an older version to Rust 1.90.0 for the BitBox02 hardware wallet firmware. It refreshes many third-party Rust libraries (vendored dependencies), adjusts build configuration files, and saves a small amount of firmware space. There is no direct evidence in the commit of a security vulnerability being fixed or introduced. The main security consideration is that compiler and library updates can change generated code behavior, so thorough testing is warranted, but nothing in the diff points to an active security issue.

Recommended action

Treat as a standard dependency/toolchain update. Verify that the firmware builds reproducibly, passes the existing test suite, and that binary size/behavior match expectations. Review release notes for Rust 1.90.0 and the updated vendored crates for any known security advisories, but no immediate security response is indicated by this commit.

Security signals we found

01

Routine toolchain and dependency update with no explicit security fix

02

Vendored crate refresh changes many checksums and Cargo.toml files

03

No project-level cryptographic or memory-safety code changes visible

04

No CVE or advisory references present in commit message or diff

Risk score

Why this scored 18/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from BitBox02 firmware

Related watches

Low 39 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

rust: initialize C output buffers

This commit fixes a class of low-level memory-safety bugs where Rust code was given buffers containing uninitialized bytes. Rust's rules require every byte of a slice to be initialized, even if the function will overwrite them. Passing uni…

Undefined behavior at C/Rust FFI due to uninitialized buffers being treated as Rust slicesPotential optimizer-dependent behavior from violating Rust slice initialization rulesHardening of cryptographic output paths (SHA-256, HMAC-SHA256, HMAC-SHA512)
511018eaby benma's agent+52−2713 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 69 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Limit SD erase file size

This commit fixes a bug in how the BitBox02 hardware wallet wipes files from its SD card. Before erasing a file, the device now checks the file's reported size against a safe maximum. Without this check, a tampered SD card could claim a fi…

CVE-2026-6682 referenced in commit messageMalformed FAT directory entry could cause excessive overwrite loopDenial-of-service via SD card tampering
2453f528by Marko Bencun+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 70 AI analysisMessage 66 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Validate mounted FAT geometry

This update adds a safety check when the BitBox02 hardware wallet mounts a microSD card. A malicious or deliberately malformed FAT filesystem could trick the device's file-system library into placing user data inside attacker-controlled bo…

Fixes integer-wrap / geometry confusion in FAT mount logicAdds explicit post-mount validation of filesystem metadataPrevents data area from landing inside attacker-controlled FAT sectors
01c017d6by Marko Bencun+21−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗