From 49e4fc810509674f44fb77e6a1f8c621921cf4ae Mon Sep 17 00:00:00 2001 From: Louise Poole Date: Tue, 18 Aug 2026 12:42:06 +0200 Subject: [PATCH] deps: update h2, anyhow, event-listener; drop actix http2 feature Co-Authored-By: Claude Opus 5 (1M context) --- .cargo/audit.toml | 2 - Cargo.lock | 100 +++++++++++++++++++++++++--------------------- Cargo.toml | 14 ++++++- 3 files changed, 67 insertions(+), 49 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 8cb3b54f4..30d4dafbe 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -1,9 +1,7 @@ [advisories] -# rustls-webpki 0.101.7 is locked by tonic 0.9; fix requires tonic 0.11+ (prost 0.11 -> 0.12). # RUSTSEC-2025-0055: tracing-subscriber ^0.2 log poisoning via ANSI escapes # Dep chain: tycho-simulation <- revm <- ark-bn254 <- ark-r1cs-std <- ark-relations <- tracing-subscriber ^0.2 # We need ark to update their dependencies to fix this. ignore = [ - "RUSTSEC-2026-0104", "RUSTSEC-2025-0055", ] diff --git a/Cargo.lock b/Cargo.lock index 3b9ef05f9..a50b954c8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -39,7 +39,6 @@ dependencies = [ "flate2", "foldhash 0.1.5", "futures-core", - "h2 0.3.27", "http 0.2.12", "httparse", "httpdate", @@ -1101,9 +1100,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "arbitrary" @@ -2087,20 +2086,40 @@ version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7" +[[package]] +name = "bitcoin-consensus-encoding" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6712f9c6fd6785b3b270884e57c441c403dc5d7e19ca45368c97c7a1de3000ec" +dependencies = [ + "bitcoin-internals", + "hex-conservative 1.2.0", + "serde", +] + +[[package]] +name = "bitcoin-internals" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d573f4cf32996a8dce612e4348cece65a241f1882ed594047c9ba348e8869fa5" + [[package]] name = "bitcoin-io" -version = "0.1.100" +version = "0.1.101" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11301df0b06f22dea7bb1916403fdd88a371031e495c49b8f96931b28189e175" +checksum = "bb5de036369d1ac59d3c1819ebc4d850f89466f5401c571a285b6ed564a4cb78" +dependencies = [ + "bitcoin-consensus-encoding", +] [[package]] name = "bitcoin_hashes" -version = "0.14.100" +version = "0.14.101" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c9901a56e133a1fc86eeb1113e2591f45f4682451ca893bff494d2f88918e3f" +checksum = "bca4c7abb40c8817d77403c880988cfd484f23ab2365726afb2f798363e2c4a2" dependencies = [ "bitcoin-io", - "hex-conservative", + "hex-conservative 0.2.2", ] [[package]] @@ -3131,16 +3150,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] name = "event-listener" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" dependencies = [ - "concurrent-queue", "parking", "pin-project-lite", ] @@ -3774,28 +3792,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.3.27" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d" -dependencies = [ - "bytes", - "fnv", - "futures-core", - "futures-sink", - "futures-util", - "http 0.2.12", - "indexmap 2.14.0", - "slab", - "tokio", - "tokio-util", - "tracing", -] - -[[package]] -name = "h2" -version = "0.4.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155" +checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" dependencies = [ "atomic-waker", "bytes", @@ -3887,6 +3886,15 @@ dependencies = [ "arrayvec", ] +[[package]] +name = "hex-conservative" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35431185f361ccf3ffc58254628af5f1f5d5f28531da2e02e5d6c82bbc282a10" +dependencies = [ + "arrayvec", +] + [[package]] name = "hex-literal" version = "0.4.1" @@ -4059,7 +4067,7 @@ dependencies = [ "bytes", "futures-channel", "futures-core", - "h2 0.4.15", + "h2", "http 1.4.2", "http-body 1.0.1", "httparse", @@ -4134,7 +4142,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.4", + "socket2 0.5.10", "system-configuration", "tokio", "tower-service", @@ -4936,7 +4944,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -5683,7 +5691,7 @@ dependencies = [ "quinn-udp", "rustc-hash", "rustls", - "socket2 0.6.4", + "socket2 0.5.10", "thiserror 2.0.18", "tokio", "tracing", @@ -5721,7 +5729,7 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.6.4", + "socket2 0.5.10", "tracing", "windows-sys 0.59.0", ] @@ -5981,7 +5989,7 @@ dependencies = [ "futures-channel", "futures-core", "futures-util", - "h2 0.4.15", + "h2", "http 1.4.2", "http-body 1.0.1", "http-body-util", @@ -6025,7 +6033,7 @@ dependencies = [ "bytes", "futures-core", "futures-util", - "h2 0.4.15", + "h2", "http 1.4.2", "http-body 1.0.1", "http-body-util", @@ -6476,7 +6484,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6535,7 +6543,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -7259,7 +7267,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -7567,7 +7575,7 @@ dependencies = [ "axum 0.7.9", "base64", "bytes", - "h2 0.4.15", + "h2", "http 1.4.2", "http-body 1.0.1", "http-body-util", @@ -7596,7 +7604,7 @@ dependencies = [ "axum 0.8.9", "base64", "bytes", - "h2 0.4.15", + "h2", "http 1.4.2", "http-body 1.0.1", "http-body-util", @@ -8539,7 +8547,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index bb7046542..f1e3a164f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -104,7 +104,19 @@ alloy = { version = "1", features = [ "rpc-types-eth", ] } # HTTP -actix-web = "4" +# Default features minus "http2": that feature is the only thing pulling h2 ^0.3, which has no +# patch for RUSTSEC-2026-0258. The server binds plain TCP with no TLS, so HTTP/2 was only ever +# reachable via h2c prior knowledge. Re-enable once actix-http moves to h2 0.4. +actix-web = { version = "4", default-features = false, features = [ + "macros", + "compress-brotli", + "compress-gzip", + "compress-zstd", + "cookies", + "unicode", + "compat", + "ws", +] } reqwest = { version = "0.12", features = ["json"] } # Async