Repository navigation
deps: Bump dependencies to fix RustSec advisories - #6746
Draft
dimitrovmaksim wants to merge 2 commits into
Draft
dimitrovmaksim wants to merge 2 commits into
dimitrovmaksim wants to merge 2 commits into
Conversation
alloy >= 2.1.1 (alloy-rs/alloy#4052) serializes `BlockId::Hash` without `requireCanonical` as a bare hash instead of `{"blockHash": hash}`. Accept both forms in the eth_call, eth_getBalance and eth_getCode mocks.
- alloy 2.0.5 -> 2.5.0, alloy-rpc-types 2.0.0 -> 2.5.0 - arrow, arrow-flight, parquet 59.0.0 -> 60.0.0 (arrow-flight feature `flight-sql-experimental` -> `flight-sql`) - diesel: drop unused `numeric` feature - rust-toolchain 1.94.0 -> 1.94.1 - Cargo.lock: targeted `cargo update -p` for advisory fixes Fixes 28 RustSec advisories (46 -> 18 matched in Cargo.lock).
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency bumps that fix 28 RustSec advisories. Scanning
Cargo.lockagainst advisory-db as of 2026-10-22: master matches 46 advisories, this branch matches 18.The only source change is in
gnd's test mock transport, which has to accept the new block-hash param format from alloy ≥ 2.1.1. See Behavior change.Closes
proc-macro-error2unmaintainedSqliteConnection::deserialize_readonly_database#6619 — RUSTSEC-2026-0172dieselUAF in SQLitedeserialize_readonly_databasepostgres-protocolunbounded SCRAM iterationshstorevalue allows denial of service #6624 — RUSTSEC-2026-0180postgres-protocolhstore panicDataRowwith fewer fields than columns allows denial of service #6625 — RUSTSEC-2026-0178tokio-postgresDataRow panicquinn-protoout-of-order reassembly memory exhaustionfmt::Pointerimpl forAtomicandSharedwhen the underlying pointer is invalid #6672 — RUSTSEC-2026-0204crossbeam-epochinvalid pointer derefquick-xmlquadratic duplicate-attribute checkNsReaderenables memory-exhaustion denial of service #6674 — RUSTSEC-2026-0195quick-xmlNsReadermemory exhaustionThis also resolves Dependabot alerts #546, #559, #581, #582 and #583.
It also fixes #5835:
eth_getBlockReceiptsnow sends a plain block hash, via alloy-rs/alloy#4052. #6647 was closed so we could "pick the fix up for free on the next alloy bump", and this is that bump.Supersedes
Every open Dependabot PR targets a version that this branch matches or exceeds:
Changes
Cargo.tomlalloy2.0.5 → 2.5.0,alloy-rpc-types2.0.0 → 2.5.0proc-macro-error2withproc-macro-error3(RUSTSEC-2026-0173). It also pullslru0.18.5 viaalloy-provider(RUSTSEC-2026-0253) andruint1.20.1 (RUSTSEC-2026-0220). Supersedes #6692.arrow,arrow-flight,parquet=59.0.0→=60.0.0flight-sql-experimentalfeature toflight-sql.diesel: drop thenumericfeatureToSql/FromSql<Numeric, Pg>for its ownBigDecimal(graph/src/data/store/scalar/bigdecimal.rs), so diesel's bigdecimal/num-bigint impls were unused. After the bump, lock re-resolution pointed diesel'snum-bigintedge at a version incompatible with graph's pinnednum-bigint =0.2.6, which caused an E0308 type mismatch. Dropping the feature removes that edge.rust-toolchain.tomlCargo.lock— security fixes (cargo update -p …)Cargo.lock— transitive changes pulled in by the abovealloy-*2.0.5 → 2.5.0;alloy-corefamily 1.6.0 → 1.7.3alloy-rlp0.3.16,alloy-trie0.9.8,alloy-eip79280.4.11alloy-eip8141,alloy-ens,fixed-cacheproptest-derive0.7.0 (viaalloy-trie)tokio-tungstenite/tungstenite0.28 dropped;alloy-transport-wsnow shares 0.29 with axum.utf-8is removed with it.ark-*0.6.0 appear in the lock only, via ruint's optional features. They are not compiled.arrow-*60.0.0, newarrow-cmpatoi3.1.1base640.23.1.graph-chain-ethereum'sbase64 = "0"requirement now also resolves to 0.23.1.brotli9,lz4_flex0.14,zstd0.14 /zstd-safe8 /zstd-sys2.1.2num-bigint0.5.1, used by arrow-buffer and parquet only. graph stays on 0.2.6.postgres-types0.2.14,md-50.11,hmac0.13 (+ctutils,cmov)whoami1.5.1 → 2.1.3 (required by tokio-postgres 0.7.18), withwasite1.0.2,objc2-system-configurationandlibredox0.1.25.redox_syscall0.4.1 is dropped.aws-lc-rs1.16.3 → 1.18.2,aws-lc-sys0.40.0 → 0.46.0,pkg-config0.3.34.rand_pcg0.10.2.cranelift-*0.133.3,pulley-*46.0.3,wasmtime-internal-*46.0.3.thiserror2.0.21;thiserror-impl2.0.21 addssyn3.0.9 to the build graphhttp-body-util0.1.5,indicatif0.18.6,open5.4.5gnd/src/commands/test/mock_transport.rsparse_block_hashhelper that accepts both a bare hash and{"blockHash": hash}.eth_call,eth_getBalanceandeth_getCodemocks all use it.gnd testwhose handlers calleth_call,eth_getBalanceoreth_getCodefails withmissing blockHash. In this repo,gnd_test::test_token_transferandgnd_test::test_templatesfailed. Both test cases pass with the helper.Behavior change: block hash param format
alloy-rs/alloy#4052 (alloy ≥ 2.1.1) serializes
BlockId::Hashwithrequire_canonical: Noneas a bare hash instead of{"blockHash": hash}. With EIP-1898 enabled, which is the default unless a provider sets theno_eip1898feature, these requests change:eth_getBlockReceipts[{"blockHash":"0x…"}]["0x…"](fixes #5835)eth_call[tx, {"blockHash":"0x…"}][tx, "0x…"]eth_getCode[addr, {"blockHash":"0x…"}][addr, "0x…"]eth_getBalance[addr, {"blockHash":"0x…"}][addr, "0x…"]Spec: execution-apis
BlockNumberOrTagOrHashexplicitly allows a plainhash32for all four methods.Clients: the parsing code in each of these accepts a bare 66-char hash for all four methods and treats it as
requireCanonical = false. That is the same as the old object withoutrequireCanonical, so call results and PoI are unaffected.rpc.BlockNumberOrHash.UnmarshalJSONrpc.BlockNumberOrHash.UnmarshalJSONBlockParameterConverterBlockParameterOrBlockHashBlockIddeserializerNot verified: hosted providers/proxies and chain-specific client forks.
eth_getBlockReceiptsalready falls back.check_block_receipt_supportprobes it once per adapter. If the probe fails, graph-node uses per-txeth_getTransactionReceipt.eth_call/eth_getCode/eth_getBalancehave no fallback. If a node rejected bare hashes, these calls would fail with a non-revert RPC error. That error is treated as non-deterministic, so the subgraph retries/stalls rather than producing a wrong PoI. The operator workaround is theno_eip1898provider feature, which makes calls use the block number.Not addressed here
br_tablemiscompile)recursion_limitworkaround in 3 test targets, and new clippy lints fixed. Coming as a separate PR. The other 13 are mostly component-model/async-lifted paths, which graph-node doesn't use (it runs core modules only).derivative(RUSTSEC-2024-0388, unmaintained)ark-ff0.3/0.4 features. Not compiled.paste(RUSTSEC-2024-0436, unmaintained)unsafe-libyaml(RUSTSEC-2024-0449, unmaintained)serde_yaml(deprecated). Fixing it means swapping crates, not bumping.parity-wasm(RUSTSEC-2022-0061, unmaintained)wasm-instrument. Replacing it affects gas costs and therefore determinism/PoI.num-bigint0.2.6 → 0.4.6 (#6669, closed)old_bigdecimal =0.1.2(seegraph/Cargo.toml), and upgrading both changesBigDecimalresults and therefore PoI.Testing
cargo fmt --all --check: cleanjust lint: 0 warningsjust check --release: okjust test-unit: 60 suites, 1478 passed, 0 failed, 8 ignored