chore(deps): bump ruint to 1.20.0 for RUSTSEC-2026-0220 - #292
Conversation
cargo audit fails on main, so every open PR inherits a red check for a problem that is not in its diff. ruint 1.17.2 carries RUSTSEC-2026-0220: Uint shift operations report incorrect overflow flags and truncate shift amounts. It reaches us transitively through alloy-primitives, which alloy pulls into both gitlawb-node and gl for the on-chain operator client. Our own U256 use in operator.rs is pow, mul, div, and comparison rather than shifts, so the direct exposure looks limited, but alloy's internals are not audited here and the fix is a semver-compatible bump. Lockfile only; no manifest change. The bump adds six arkworks crates (ark-ff, ark-ff-asm, ark-ff-macros, ark-serialize, ark-serialize-derive, ark-std), taking the tree from 715 to 721 dependencies. That surface increase is the cost of the fix and is worth noting rather than passing over: it arrives through ruint's own feature set, not through anything we asked for. None of it reaches gitlawb-core, so the dependency purity check still passes at 83 allowlisted normal deps. Verified: cargo audit exits 0, cargo build --locked --release, 564 node tests and 83 core tests pass.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
@kevincodex1 ready when you are. Lockfile only, and it clears Worth knowing that the other open PRs are stale-green rather than unaffected: main and their head branches all carry ruint 1.17.2, and their audit checks passed on runs from 07-28 to 07-30, before the advisory landed in the fetched database. They go red on their next push. The tradeoff to look at before merging is the six arkworks crates the bump drags in (715 to 721 deps). Those come from ruint's own features rather than anything we asked for. None of them reach gitlawb-core, so the purity check still passes at 83 allowlisted deps. |
3 participants
cargo auditfails onmain, so every open PR inherits a red check for a problem that is not in its diff.ruint1.17.2 carries RUSTSEC-2026-0220: Uint shift operations report incorrect overflow flags and truncate shift amounts. It reaches us transitively throughalloy-primitives, whichalloypulls into bothgitlawb-nodeandglfor the on-chain operator client.Our own
U256use inoperator.rsispow,mul,div, and comparison rather than shifts, so the direct exposure looks limited. I did not audit alloy's internals, and the fix is a semver-compatible bump, so this is not worth reasoning about further.Lockfile only, no manifest change.
The cost, since it is not free
The bump adds six arkworks crates (
ark-ff,ark-ff-asm,ark-ff-macros,ark-serialize,ark-serialize-derive,ark-std), taking the tree from 715 to 721 dependencies. That arrives throughruint's own feature set rather than anything we asked for. Flagging it rather than passing over it, since a dependency-surface increase is exactly the kind of thing a lockfile-only diff hides.None of it reaches
gitlawb-core: the dependency purity check still passes at 83 allowlisted normal deps.Verification
cargo auditexits 0 (was: 1 vulnerability)cargo build --locked --release -p gitlawb-nodescripts/check-gitlawb-core-deps.shOKThe three remaining advisories are unmaintained-crate warnings (
core2,derivative,paste,proc-macro-error2), which do not fail the check and are out of scope here.