From: merge-script <hello@evanlinjin.me>
Date: Mon, 19 Oct 2026 12:33:12 +0000 (+1100)
Subject: Merge bitcoindevkit/bdk#2354: docs(core): document hashbrown feature's fixed-key... 
X-Git-Url: http://internal-gitweb-vhost/-client-interface/%22https:/v2-transport.html?a=commitdiff_plain;h=HEAD;p=bdk

Merge bitcoindevkit/bdk#2354: docs(core): document hashbrown feature's fixed-key hashing

360898e08226482b0ed4951f28b63f53053b89da docs(core): document hashbrown feature's fixed-key hashing (Romansage6)

Pull request description:

  ### Description

  With the `hashbrown` feature, `bdk_core`'s `HashMap`/`HashSet` are hashbrown's, on `std` builds too. These hash with `ahash`, which uses fixed, publicly known keys unless `ahash`'s `runtime-rng` or `compile-time-rng` feature is enabled somewhere in the dependency graph. With fixed keys, a malicious chain source can send transactions whose txids collide in the hash table and make `TxGraph` insertion quadratic.

  This adds a `# Features` section to `bdk_core`'s crate docs listing every feature: `std` (default), `serde` and `hashbrown`. The `hashbrown` entry documents the fixed keys and how to randomize them: depend on `ahash = { version = "0.8", features = ["runtime-rng"] }` (or `compile-time-rng`) directly.

  Docs only; no behaviour change.

  ### Changelog notice

  - `bdk_core`: Document the crate's features, including that `hashbrown` hashes with fixed keys unless `ahash`'s `runtime-rng`/`compile-time-rng` is enabled. #2354

  ### Checklists

  #### All Submissions:

  * [x] I followed the contribution guidelines

  Fixes #2342

ACKs for top commit:
  evanlinjin:
    ACK 360898e08226482b0ed4951f28b63f53053b89da

Tree-SHA512: f3032bb917820ee57970e48cc367d3baca0afaecda3404302d607bd1b684814d025b5cb2a611bba2260d420ee3e100994e2e77fc6fc29aa4bb04907ae47801bf
---

0ff6ade70b9a7c3d3288519aff69a01240794ece