improvement(dep-stack): security bumps

Cargo.toml

@@ -74,21 +74,20 @@ byteorder = "1.3"
 cbc = "0.1.2"
 cc = "1.0"
 cipher = "0.4.4"
-chrono = "0.4.23"
+chrono = { version = "0.4.41", default-features = false }
 cfg-if = "1.0"
-clap = { version = "4.2", features = ["derive"] }
+clap = { version = "4.5", default-features = false, features = ["derive", "std"] }
 cosmrs = { version = "0.16", default-features = false }
 crossbeam = "0.8"
 crossbeam-channel = "0.5.1"
 compatible-time = { version = "1.1.0", package = "web-time" }
 crc32fast = { version = "1.3.2", features = ["std", "nightly"] }
 derive_more = "0.99.20"
 directories = "5.0"
-dirs = "1"
 ed25519-dalek = { version = "1.0.1", features = ["serde"] }
 either = "1.6"
 enum-primitive-derive = "0.2"
-env_logger = "0.9.3"
+env_logger = { version = "0.11", default-features = false }
 ethabi = "17.0.0"
 ethcore-transaction = { git = "https://github.com/KomodoPlatform/mm2-parity-ethereum.git", rev = "mm2-v2.1.1" }
 ethereum-types = { version = "0.13", default-features = false, features = ["std", "serialize"] }
@@ -103,7 +102,7 @@ futures01 = { version = "0.1", package = "futures" }
 futures-rustls = { version = "0.24", default-features = false }
 futures-ticker = "0.0.3"
 futures-timer = "3.0"
-futures-util = { version = "0.3", default-features = false, features = ["sink", "std"] }
+futures-util = { version = "0.3.31", default-features = false, features = ["sink", "std"] }
 fnv = "1.0.6"
 group = "0.8.0"
 gstuff = { version = "0.7" }
@@ -132,7 +131,6 @@ lightning = "0.0.113"
 lightning-background-processor = "0.0.113"
 lightning-invoice = { version = "0.21.0", features = ["serde"] }
 lightning-net-tokio = "0.0.113"
-instant = "0.1.12"
 log = "0.4"
 metrics = "0.21"
 metrics-exporter-prometheus = "0.12.1"
@@ -191,15 +189,15 @@ sp-trie = { version = "6.0", default-features = false }
 sql-builder = "3.1.1"
 syn = "1.0"
 sysinfo = "0.28"
-tempfile = "3.4.0"
+tempfile = "3.7.1"
 # using the same version as cosmrs
 tendermint-rpc = { version = "0.35", default-features = false }
 testcontainers = "0.15.0"
 tiny-bip39 = "0.8.0"
 thiserror = "1.0.40"
 time = "0.3.36"
 timed-map = { version = "1.5", features = ["rustc-hash", "serde", "wasm"] }
-tokio = { version = "1.20",  default-features = false }
+tokio = { version = "1.47",  default-features = false }
 tokio-rustls = { version = "0.24", default-features = false }
 tokio-tungstenite-wasm = { git = "https://github.com/KomodoPlatform/tokio-tungstenite-wasm", rev = "8fc7e2f", default-features = false, features = ["rustls-tls-native-roots"]}
 tonic = { version = "0.10", default-features = false }

mm2src/coins/Cargo.toml

@@ -138,7 +138,6 @@ web-sys = { workspace = true, features = ["console", "Headers", "Request", "Requ
 zcash_proofs = { workspace = true, features = ["local-prover"] }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-dirs.workspace = true
 bitcoin.workspace = true
 hyper = { workspace = true, features = ["client", "http2", "server", "tcp"] }
 hyper-rustls = { workspace = true, default-features = false, features = ["http1", "http2", "webpki-tokio"] }

mm2src/coins/qrc20.rs

@@ -275,7 +275,7 @@ impl UtxoCoinBuilderCommonOps for Qrc20CoinBuilder<'_> {
         };
 
         if rel_to_home {
-            let home = dirs::home_dir().or_mm_err(|| UtxoCoinBuildError::CantDetectUserHome)?;
+            let home = std::env::home_dir().or_mm_err(|| UtxoCoinBuildError::CantDetectUserHome)?;
             Ok(home.join(confpath))
         } else {
             Ok(confpath.into())

mm2src/coins/tendermint/ibc/transfer_v1.rs

@@ -31,10 +31,10 @@ impl MsgTransfer {
         sender: AccountId,
         receiver: AccountId,
         token: Coin,
-    ) -> Self {
-        let timestamp_as_nanos = common::get_utc_timestamp_nanos() as u64;
+    ) -> Result<Self, String> {
+        let timestamp_as_nanos = common::get_utc_timestamp_nanos()? as u64;
 
-        Self {
+        Ok(Self {
             source_port: IBC_OUT_SOURCE_PORT.to_owned(),
             source_channel,
             sender,
@@ -43,7 +43,7 @@ impl MsgTransfer {
             timeout_height: None,
             timeout_timestamp: timestamp_as_nanos + IBC_OUT_TIMEOUT_IN_NANOS,
             // memo: Some(memo.clone()),
-        }
+        })
     }
 }
 

mm2src/coins/tendermint/tendermint_coin.rs

@@ -4330,6 +4330,7 @@ pub(crate) async fn create_withdraw_msg_as_any(
                 amount: amount.into(),
             },
         )
+        .map_to_mm(|e| WithdrawError::InternalError(e.to_string()))?
         .to_any()
     } else {
         MsgSend {

mm2src/coins/utxo.rs

@@ -57,8 +57,6 @@ use common::log::LogOnError;
 use common::{now_sec, now_sec_u32};
 use crypto::{DerivationPath, HDPathToCoin, Secp256k1ExtendedPublicKey};
 use derive_more::Display;
-#[cfg(not(target_arch = "wasm32"))]
-use dirs::home_dir;
 use futures::channel::mpsc::{Receiver as AsyncReceiver, Sender as AsyncSender};
 use futures::compat::Future01CompatExt;
 use futures::lock::{Mutex as AsyncMutex, MutexGuard as AsyncMutexGuard};
@@ -92,6 +90,8 @@ use spv_validation::storage::BlockHeaderStorageError;
 use std::array::TryFromSliceError;
 use std::collections::{HashMap, HashSet};
 use std::convert::TryInto;
+#[cfg(not(target_arch = "wasm32"))]
+use std::env::home_dir;
 use std::hash::Hash;
 use std::num::{NonZeroU64, TryFromIntError};
 use std::ops::Deref;
@@ -1465,7 +1465,7 @@ pub fn zcash_params_path() -> PathBuf {
 #[cfg(not(target_arch = "wasm32"))]
 pub fn coin_daemon_data_dir(name: &str, is_asset_chain: bool) -> PathBuf {
     // komodo/util.cpp/GetDefaultDataDir
-    let mut data_dir = match dirs::home_dir() {
+    let mut data_dir = match std::env::home_dir() {
         Some(hd) => hd,
         None => Path::new("/").to_path_buf(),
     };

mm2src/coins/utxo/utxo_builder/utxo_coin_builder.rs

@@ -48,7 +48,7 @@ use std::sync::Mutex;
 cfg_native! {
     use crate::utxo::coin_daemon_data_dir;
     use crate::utxo::rpc_clients::{ConcurrentRequestMap, NativeClient, NativeClientImpl};
-    use dirs::home_dir;
+    use std::env::home_dir;
     use std::path::{Path, PathBuf};
     use std::sync::Arc;
 }

mm2src/common/common.rs

@@ -1201,8 +1201,10 @@ pub fn get_utc_timestamp() -> i64 {
 }
 
 #[inline(always)]
-pub fn get_utc_timestamp_nanos() -> i64 {
-    Utc::now().timestamp_nanos()
+pub fn get_utc_timestamp_nanos() -> Result<i64, String> {
+    Utc::now()
+        .timestamp_nanos_opt()
+        .ok_or("Failed to get timestamp in nanoseconds; the system clock may be unreliable.".to_owned())
 }
 
 #[inline(always)]

mm2src/mm2_bin_lib/Cargo.toml

@@ -41,7 +41,7 @@ num-traits.workspace = true
 serde_json = { workspace = true, features = ["preserve_order", "raw_value"] }
 
 [build-dependencies]
-chrono.workspace = true
+chrono = { workspace = true, features = ["now"] }
 gstuff.workspace = true
 regex.workspace = true
 

mm2src/mm2_main/Cargo.toml

@@ -111,7 +111,7 @@ uuid.workspace = true
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 # TODO: Removing this causes `wasm-pack` to fail when starting a web session (even though we don't use this crate).
 # Investigate why.
-instant = { workspace = true, features = ["wasm-bindgen"] }
+instant = { version = "0.1.12", features = ["wasm-bindgen"] }
 js-sys.workspace = true
 mm2_db = { path = "../mm2_db" }
 mm2_test_helpers = { path = "../mm2_test_helpers" }
@@ -122,7 +122,6 @@ wasm-bindgen-test.workspace = true
 web-sys = { workspace = true, features = ["console"] }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-dirs.workspace = true
 futures-rustls.workspace = true
 hyper = { workspace = true, features = ["client", "http2", "server", "tcp"] }
 rcgen.workspace = true

mm2src/mm2_test_helpers/Cargo.toml

@@ -30,9 +30,9 @@ serde_json = { version = "1", features = ["preserve_order", "raw_value"] }
 uuid = { version = "1.2.2", features = ["fast-rng", "serde", "v4"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
-chrono = { version = "0.4", features = ["wasmbind"] }
+chrono = { version = "0.4.41", default-features = false, features = ["wasmbind"] }
 gstuff = { version = "0.7" }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-chrono = "0.4"
+chrono = { version = "0.4.41", default-features = false }
 gstuff = { version = "0.7" }