improvement(dep-stack): security bumps by onur-ozkan · Pull Request #2562 · GLEECBTC/komodo-defi-framework

onur-ozkan · 2025-07-31T05:01:17Z

Following vulnerabilities are avoided:

- [RUSTSEC-2024-0404](https://rustsec.org/advisories/RUSTSEC-2024-0404.html)
- [RUSTSEC-2024-0375](https://rustsec.org/advisories/RUSTSEC-2024-0375.html)
- [RUSTSEC-2021-0145](https://rustsec.org/advisories/RUSTSEC-2021-0145.html)
- [RUSTSEC-2024-0019](https://rustsec.org/advisories/RUSTSEC-2024-0019.html)
- [RUSTSEC-2020-0071](https://rustsec.org/advisories/RUSTSEC-2020-0071.html)
- [RUSTSEC-2025-0023](https://rustsec.org/advisories/RUSTSEC-2025-0023.html)

Additionally, a lot of dependencies are removed (36 less dependencies on cargo build compare to dev branch) and some yanked dependencies are updated.

Signed-off-by: Onur Özkan <work@onurozkan.dev>

… into sec-bumps

Signed-off-by: Onur Özkan <work@onurozkan.dev>

shamardy

LGTM! Only nits / questions!

mm2src/mm2_main/Cargo.toml

shamardy · 2025-08-04T13:57:30Z

Cargo.lock

+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+


To remove this duplication we have to remove async_std which has been discontinued btw ref. https://github.com/async-rs/async-std?tab=readme-ov-file#async-std-has-been-discontinued-use-smol-instead we can use smol instead for async fs operations

This should be done in another PR though

* dev: chore(rust 1.89): make CI clippy/fmt pass (wasm32, all-targets) (#2581) fix(utxo): deserialize sapling root for PIVX block headers (#2572) improvement(dep-stack): security bumps (#2562) fix(utxo): correct block header deserialization for AuxPow and KAWPOW coins (#2563)

* dev: chore(rust 1.89): make CI clippy/fmt pass (wasm32, all-targets) (#2581) fix(utxo): deserialize sapling root for PIVX block headers (#2572) improvement(dep-stack): security bumps (#2562) fix(utxo): correct block header deserialization for AuxPow and KAWPOW coins (#2563) # Conflicts: # mm2src/mm2_main/tests/docker_tests/eth_docker_tests.rs

* dev: fix(Trezor): fix utxo and eth calls due to firmware changes (#2565) fix(utxo): calculate min_trading_vol based on fixed tx fees (#2564) feat(protocol): [0] solana support (#2586) fix(utxo): fix header deserialization; guard AuxPoW (#2583) chore(rust 1.89): make CI clippy/fmt pass (wasm32, all-targets) (#2581) fix(utxo): deserialize sapling root for PIVX block headers (#2572) improvement(dep-stack): security bumps (#2562) # Conflicts: # mm2src/mm2_main/tests/docker_tests/eth_docker_tests.rs

* dev: fix(ordermatch): ignore loop-back; clear on null root; reject stale keep-alives (#2580) fix(clippy): fix clippy warnings for #2565 (#2589) fix(Trezor): fix utxo and eth calls due to firmware changes (#2565) fix(utxo): calculate min_trading_vol based on fixed tx fees (#2564) feat(protocol): [0] solana support (#2586) fix(utxo): fix header deserialization; guard AuxPoW (#2583) chore(rust 1.89): make CI clippy/fmt pass (wasm32, all-targets) (#2581) fix(utxo): deserialize sapling root for PIVX block headers (#2572) improvement(dep-stack): security bumps (#2562) fix(utxo): correct block header deserialization for AuxPow and KAWPOW coins (#2563)

* dev: (24 commits) fix(ordermatch): ignore loop-back; clear on null root; reject stale keep-alives (#2580) fix(clippy): fix clippy warnings for #2565 (#2589) fix(Trezor): fix utxo and eth calls due to firmware changes (#2565) fix(utxo): calculate min_trading_vol based on fixed tx fees (#2564) feat(protocol): [0] solana support (#2586) fix(utxo): fix header deserialization; guard AuxPoW (#2583) chore(rust 1.89): make CI clippy/fmt pass (wasm32, all-targets) (#2581) fix(utxo): deserialize sapling root for PIVX block headers (#2572) improvement(dep-stack): security bumps (#2562) fix(utxo): correct block header deserialization for AuxPow and KAWPOW coins (#2563) feat(wallet-connect): impl BTC (UTxO) activation via WalletConnect (#2499) feat(utxo): add new fixed txfee option for DINGO-like coins (#2454) ci(pull-requests): review notification bot (#2468) improvement(walletconnect): return the `pairing_topic` in `new_connection` response (#2538) bless clippy (#2560) refactor(toolchain): use latest available stable compiler (#2557) feat(wallet): implement unified offline private key export API (#2542) improve note for docker test start failure (#2550) fix(DOCS): add note for macos to fix docker containers startup failure (#2544) refactor(toolchain): general stabilization for stable rust (#2528) ... # Conflicts: # mm2src/coins/eth.rs # mm2src/coins/eth/eth_swap_v2/eth_maker_swap_v2.rs # mm2src/coins/eth/eth_swap_v2/eth_taker_swap_v2.rs # mm2src/coins/eth/eth_tests.rs # mm2src/coins/eth/eth_withdraw.rs # mm2src/coins/eth/v2_activation.rs # mm2src/coins/nft.rs # mm2src/coins/qrc20.rs # mm2src/mm2_main/src/rpc/dispatcher/dispatcher.rs # mm2src/mm2_main/src/rpc/lp_commands/one_inch/rpcs.rs # mm2src/mm2_main/src/rpc/lp_commands/tokens.rs # mm2src/mm2_main/tests/docker_tests/eth_docker_tests.rs

* dev: improvement(`static mut`s): `static mut` removal (#2590) fix(orders): set subscription on kickstart and skip GC of own pubkeys (#2597) fix(ordermatch): ignore loop-back; clear on null root; reject stale keep-alives (#2580) fix(clippy): fix clippy warnings for #2565 (#2589) fix(Trezor): fix utxo and eth calls due to firmware changes (#2565) fix(utxo): calculate min_trading_vol based on fixed tx fees (#2564) feat(protocol): [0] solana support (#2586) fix(utxo): fix header deserialization; guard AuxPoW (#2583) chore(rust 1.89): make CI clippy/fmt pass (wasm32, all-targets) (#2581) fix(utxo): deserialize sapling root for PIVX block headers (#2572) improvement(dep-stack): security bumps (#2562) fix(utxo): correct block header deserialization for AuxPow and KAWPOW coins (#2563) feat(wallet-connect): impl BTC (UTxO) activation via WalletConnect (#2499) feat(utxo): add new fixed txfee option for DINGO-like coins (#2454) ci(pull-requests): review notification bot (#2468) improvement(walletconnect): return the `pairing_topic` in `new_connection` response (#2538) bless clippy (#2560) refactor(toolchain): use latest available stable compiler (#2557) feat(wallet): implement unified offline private key export API (#2542) chore(release): v2.3.0-beta (#2284) # Conflicts: # mm2src/mm2_main/tests/docker_tests/eth_docker_tests.rs

* dev: (28 commits) fix build script failing to find .git/HEAD (GLEECBTC#2601) refactor(EVM): rename fn, fix timeouts, add activation req validation (GLEECBTC#2543) improvement(`static mut`s): `static mut` removal (GLEECBTC#2590) fix(orders): set subscription on kickstart and skip GC of own pubkeys (GLEECBTC#2597) fix(ordermatch): ignore loop-back; clear on null root; reject stale keep-alives (GLEECBTC#2580) fix(clippy): fix clippy warnings for GLEECBTC#2565 (GLEECBTC#2589) fix(Trezor): fix utxo and eth calls due to firmware changes (GLEECBTC#2565) fix(utxo): calculate min_trading_vol based on fixed tx fees (GLEECBTC#2564) feat(protocol): [0] solana support (GLEECBTC#2586) fix(utxo): fix header deserialization; guard AuxPoW (GLEECBTC#2583) chore(rust 1.89): make CI clippy/fmt pass (wasm32, all-targets) (GLEECBTC#2581) fix(utxo): deserialize sapling root for PIVX block headers (GLEECBTC#2572) improvement(dep-stack): security bumps (GLEECBTC#2562) fix(utxo): correct block header deserialization for AuxPow and KAWPOW coins (GLEECBTC#2563) feat(wallet-connect): impl BTC (UTxO) activation via WalletConnect (GLEECBTC#2499) feat(utxo): add new fixed txfee option for DINGO-like coins (GLEECBTC#2454) ci(pull-requests): review notification bot (GLEECBTC#2468) improvement(walletconnect): return the `pairing_topic` in `new_connection` response (GLEECBTC#2538) bless clippy (GLEECBTC#2560) refactor(toolchain): use latest available stable compiler (GLEECBTC#2557) ... # Conflicts: # mm2src/coins/eth.rs # mm2src/coins/eth/eth_rpc.rs # mm2src/coins/eth/eth_swap_v2/eth_maker_swap_v2.rs # mm2src/coins/eth/eth_swap_v2/eth_taker_swap_v2.rs # mm2src/coins/eth/eth_withdraw.rs # mm2src/coins/eth/v2_activation.rs # mm2src/coins/lightning.rs # mm2src/coins/lp_coins.rs # mm2src/coins/nft.rs # mm2src/coins/qrc20.rs # mm2src/coins/siacoin.rs # mm2src/coins/tendermint/tendermint_token.rs # mm2src/coins/test_coin.rs # mm2src/coins/utxo/bch.rs # mm2src/coins/utxo/qtum.rs # mm2src/coins/utxo/slp.rs # mm2src/coins/utxo/utxo_standard.rs # mm2src/coins/z_coin.rs # mm2src/coins_activation/src/bch_with_tokens_activation.rs # mm2src/coins_activation/src/erc20_token_activation.rs # mm2src/coins_activation/src/eth_with_token_activation.rs # mm2src/coins_activation/src/init_erc20_token_activation.rs # mm2src/coins_activation/src/init_token.rs # mm2src/coins_activation/src/platform_coin_with_tokens.rs # mm2src/coins_activation/src/slp_token_activation.rs # mm2src/coins_activation/src/tendermint_with_assets_activation.rs # mm2src/coins_activation/src/token.rs # mm2src/mm2_main/src/lp_swap.rs # mm2src/mm2_main/src/lp_swap/check_balance.rs # mm2src/mm2_main/src/lp_swap/maker_swap.rs # mm2src/mm2_main/src/lp_swap/max_maker_vol_rpc.rs # mm2src/mm2_main/src/lp_swap/swap_v2_rpcs.rs # mm2src/mm2_main/src/lp_swap/taker_swap.rs # mm2src/mm2_main/src/lp_swap/trade_preimage.rs # mm2src/mm2_main/src/rpc/dispatcher/dispatcher.rs # mm2src/mm2_main/src/rpc/lp_commands/legacy.rs # mm2src/mm2_main/src/rpc/lp_commands/lr_swap.rs # mm2src/mm2_main/src/rpc/lp_commands/lr_swap/lr_impl.rs # mm2src/mm2_main/src/rpc/lp_commands/one_inch/errors.rs # mm2src/mm2_main/src/rpc/lp_commands/one_inch/rpcs.rs # mm2src/mm2_main/src/rpc/lp_commands/tokens.rs # mm2src/mm2_main/tests/docker_tests/docker_tests_common.rs # mm2src/mm2_main/tests/docker_tests/docker_tests_inner.rs # mm2src/mm2_main/tests/docker_tests/eth_docker_tests.rs # mm2src/mm2_main/tests/integration_tests_common/mod.rs # mm2src/trading_api/src/one_inch_api/client.rs

This commit performs an update of the project's dependencies to enhance security, improve maintainability, and reduce the overall dependency footprint. The primary motivation is to address several security advisories identified by `cargo audit`: - **RUSTSEC-2025-0023 (tokio):** Mitigates an unsoundness issue in the broadcast channel where `clone` was called in parallel without requiring a `Sync` bound. [1, 11, 13] - **RUSTSEC-2024-0404 (anstream):** Fixes an unsoundness issue related to incorrect UTF-8 string parsing. [8] - **RUSTSEC-2024-0375 (atty):** Replaces the unmaintained `atty` crate with the standard library's `IsTerminal` trait. [6, 9, 10] - **RUSTSEC-2021-0145 (atty):** Addresses a potential unaligned memory read on Windows. [4] - **RUSTSEC-2024-0019 (mio):** Fixes a bug where tokens for deregistered named pipes could be delivered on Windows. [3, 5] - **RUSTSEC-2020-0071 (time):** Resolves a potential segfault in the `time` crate by updating `chrono`, which transitively depended on a vulnerable version. [7, 12] Key changes include: - **Dependency Bumps:** Upgraded numerous crates, including `chrono`, `clap`, `syn`, `tokio`, and `futures-util`, to their latest secure versions. - **Dependency Pruning:** Removed 36 unused or redundant dependencies, such as `anstream`, `colorchoice`, and `dirs`, simplifying the dependency tree and reducing build times. - **`dirs` Crate Removal:** Replaced all usages of the `dirs` crate with the standard library's `std::env::home_dir()`, removing an unnecessary dependency.

onur-ozkan added 7 commits July 30, 2025 08:49

remove instant

deec1c4

Signed-off-by: Onur Özkan <work@onurozkan.dev>

remove dirs

005a70d

Signed-off-by: Onur Özkan <work@onurozkan.dev>

bump tokio

9aae9be

Signed-off-by: Onur Özkan <work@onurozkan.dev>

re-org clap dep stack

5dbb130

Signed-off-by: Onur Özkan <work@onurozkan.dev>

bump env_logger and reduce dep-stack

50ea8c4

Signed-off-by: Onur Özkan <work@onurozkan.dev>

bump from yanked futures-util

2906e99

Signed-off-by: Onur Özkan <work@onurozkan.dev>

bump chrono

4faffea

Signed-off-by: Onur Özkan <work@onurozkan.dev>

onur-ozkan added improvement: security Improvements made on runtime security status: pending review bug: security labels Jul 31, 2025

Merge branch 'dev' of github.com:KomodoPlatform/komodo-defi-framework…

c2a32d2

… into sec-bumps

onur-ozkan added status: in progress and removed status: pending review labels Jul 31, 2025

onur-ozkan marked this pull request as draft July 31, 2025 07:58

onur-ozkan added 2 commits August 4, 2025 09:06

drop various duplicated dependencies

cf69452

Signed-off-by: Onur Özkan <work@onurozkan.dev>

fix wasm test

bcd6cb1

Signed-off-by: Onur Özkan <work@onurozkan.dev>

onur-ozkan marked this pull request as ready for review August 4, 2025 07:50

onur-ozkan added status: pending review and removed status: in progress labels Aug 4, 2025

shamardy approved these changes Aug 4, 2025

View reviewed changes

shamardy merged commit 6691950 into dev Aug 4, 2025
24 of 36 checks passed

shamardy deleted the sec-bumps branch August 4, 2025 15:03

shamardy mentioned this pull request Nov 25, 2025

chore(release): v2.6.0-beta #2696

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

improvement(dep-stack): security bumps#2562

improvement(dep-stack): security bumps#2562
shamardy merged 10 commits intodevfrom
sec-bumps

onur-ozkan commented Jul 31, 2025 •

edited

Loading

Uh oh!

shamardy left a comment

Uh oh!

Uh oh!

shamardy Aug 4, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

onur-ozkan commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shamardy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shamardy Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

onur-ozkan commented Jul 31, 2025 •

edited

Loading

shamardy Aug 4, 2025 •

edited

Loading