diff --git a/Cargo.lock b/Cargo.lock index a1efe2a4..d3eadde5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -393,7 +393,7 @@ dependencies = [ "rustc-hash", "secp256k1 0.31.1", "serde", - "sha3 0.11.0", + "sha3", ] [[package]] @@ -598,7 +598,7 @@ dependencies = [ "proc-macro-error3", "proc-macro2", "quote", - "sha3 0.11.0", + "sha3", "syn 2.0.119", "syn-solidity", ] @@ -1714,9 +1714,9 @@ dependencies = [ [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", @@ -1886,6 +1886,12 @@ version = "0.9.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" +[[package]] +name = "const-oid" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" + [[package]] name = "const-str" version = "0.4.3" @@ -2243,7 +2249,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c54e03a951783e8b327515db3f2a2fd0e3bed362a96b066f341ce66ed49b4ead" dependencies = [ "data-encoding", - "syn 3.0.3", + "syn 1.0.109", ] [[package]] @@ -2301,7 +2307,7 @@ version = "0.7.10" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" dependencies = [ - "const-oid", + "const-oid 0.9.6", "zeroize", ] @@ -2378,7 +2384,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" dependencies = [ "block-buffer 0.10.4", - "const-oid", + "const-oid 0.9.6", "crypto-common 0.1.7", "subtle", ] @@ -2390,6 +2396,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" dependencies = [ "block-buffer 0.12.1", + "const-oid 0.10.2", "crypto-common 0.2.2", ] @@ -3833,15 +3840,6 @@ dependencies = [ "signature", ] -[[package]] -name = "keccak" -version = "0.1.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653" -dependencies = [ - "cpufeatures 0.2.17", -] - [[package]] name = "keccak" version = "0.2.1" @@ -5448,7 +5446,7 @@ dependencies = [ "serde_json", "serde_with", "sha2", - "sha3 0.10.9", + "sha3", "tempfile", "test-case", "thiserror 2.0.20", @@ -6130,7 +6128,7 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "chacha20 0.10.1", + "chacha20 0.10.2", "getrandom 0.4.3", "rand_core 0.10.1", ] @@ -6965,16 +6963,6 @@ dependencies = [ "digest 0.10.7", ] -[[package]] -name = "sha3" -version = "0.10.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874" -dependencies = [ - "digest 0.10.7", - "keccak 0.1.6", -] - [[package]] name = "sha3" version = "0.11.0" @@ -6982,7 +6970,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "be176f1a57ce4e3d31c1a166222d9768de5954f811601fb7ca06fc8203905ce1" dependencies = [ "digest 0.11.3", - "keccak 0.2.1", + "keccak", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index f7eb20ab..654e1db6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -38,16 +38,16 @@ license = "BUSL-1.1" publish = false [workspace.dependencies] -async-trait = "0.1.89" +async-trait = "0.1" alloy = { version = "2.4", features = ["essentials"] } -built = { version = "0.8.0", features = ["git2", "chrono", "cargo-lock"] } +built = { version = "0.8", features = ["git2", "chrono", "cargo-lock"] } blst = "0.3" bytes = "1" anyhow = "1" -axum = "0.8.6" +axum = "0.8" cancellation = "0.1.0" chrono = { version = "0.4", features = ["serde"] } -clap = { version = "4.5.53", features = ["derive", "env", "cargo"] } +clap = { version = "4.5", features = ["derive", "env", "cargo"] } crossbeam = "0.8.4" dyn-clone = "1.0" dyn-eq = "0.1.3" @@ -61,6 +61,12 @@ hex-literal = "0.4" prost = "0.14" prost-build = "0.14" prost-types = "0.14" +# Deliberately pinned to 0.8/0.6: rand 0.9 and rand_core 0.9 are already in the +# graph, but the old generation is held there by the entire libp2p, alloy, and +# k256/elliptic-curve stack (which still depend on rand 0.8 / rand_core 0.6). +# Bumping our pins would not drop those transitive copies, only add a second +# generation to our crates, and the 0.8->0.9 API break is non-trivial across the +# 14 crates that use it. Revisit once those ecosystems move to rand 0.9. rand = { version = "0.8", features = ["std_rng"] } rand_core = "0.6" regex = "1.12" @@ -69,7 +75,7 @@ serde_json = { version = "1.0" } thiserror = "2.0" tokio = { version = "1", features = ["full"] } tokio-stream = { version = "0.1", features = ["sync"] } -tokio-util = "0.7.11" +tokio-util = "0.7" # Explicit feature list (not "full"): only the protocols Pluto actually wires. # Dropping "full" removes unused stacks (floodsub/gossipsub/kad/mdns/dcutr/ # websocket/webrtc/…) and, with them, `cuckoofilter`→`rand 0.7.3` (RUSTSEC-2026-0097). @@ -90,13 +96,19 @@ libp2p = { version = "0.56", features = [ ] } url = "2.5" percent-encoding = "2.3" -aes = "0.8.4" -ctr = "0.9.2" -cipher = "0.4.4" -pbkdf2 = "0.12.2" +# RustCrypto stack deliberately held at this generation (digest 0.10 / +# cipher 0.4 era): the newer generation exists but sha2 0.10, digest 0.10, and +# cipher 0.4 are pinned there by k256, elliptic-curve, ecdsa, curve25519-dalek, +# hmac/hkdf, ethereum_hashing, and ethereum_ssz. Bumping our pins would add a +# second generation rather than drop the shared one, and the bump is API- +# breaking. Revisit when the alloy/k256/ssz stack moves to digest 0.11. +aes = "0.8" +ctr = "0.9" +cipher = "0.4" +pbkdf2 = "0.12" pin-project = "1" -sha2 = "0.10.9" -scrypt = "0.11.0" +sha2 = "0.10" +scrypt = "0.11" subtle = "2.6" unicode-normalization = "0.1.25" zeroize = "1.8.2" @@ -105,16 +117,16 @@ uuid = { version = "1.19", features = ["serde", "v4"] } unsigned-varint = { version = "0.8", features = ["futures"] } serde_with = { version = "3.16", features = ["hex", "base64"] } base64 = "0.22" -sha3 = "0.10" +sha3 = "0.11" walkdir = "2" k256 = { version = "0.13.4", features = ["ecdsa", "sha256"] } -tracing = "0.1.32" -tracing-subscriber = { version = "0.3.9", features = ["env-filter"] } +tracing = "0.1" +tracing-subscriber = { version = "0.3", features = ["env-filter"] } tracing-loki = { version = "0.2", default-features = false, features = ["compat-0-2-1", "rustls"] } # todo: remove this once vise is published https://github.com/NethermindEth/pluto/issues/126 vise = { git = "https://github.com/matter-labs/vise", rev = "73c654303d8190023cf30034d627b74cf3101b23" } vise-exporter = { git = "https://github.com/matter-labs/vise", rev = "73c654303d8190023cf30034d627b74cf3101b23" } -criterion = "0.8.0" +criterion = "0.8" reqwest = "0.13" http = "1.4" tempfile = "3.24" diff --git a/deny.toml b/deny.toml index 28aaad6a..5a520514 100644 --- a/deny.toml +++ b/deny.toml @@ -9,7 +9,6 @@ targets = [ { triple = "x86_64-apple-darwin" }, { triple = "x86_64-pc-windows-msvc" }, { triple = "wasm32-unknown-unknown" }, - { triple = "wasm32-wasi" }, { triple = "aarch64-linux-android" }, { triple = "aarch64-apple-ios" }, ] @@ -67,7 +66,7 @@ allow = [ "Xnet", "Zlib", ] -exceptions = [{ crate = "attohttpc", allow = ["MPL-2.0"] }, { crate = "dyn-eq", allow = ["MPL-2.0"] }] +exceptions = [{ crate = "dyn-eq", allow = ["MPL-2.0"] }] confidence-threshold = 0.8 unused-allowed-license = "allow"