What the developer wrote
Authored by dependabot[bot]
Bump jsonrpc from 0.18.0 to 0.20.1
Bumps [jsonrpc](https://github.com/rust-bitcoin/corepc) from 0.18.0 to 0.20.1.
- [Commits](https://github.com/rust-bitcoin/corepc/commits/jsonrpc-0.20.1)
---
updated-dependencies:
- dependency-name: jsonrpc
dependency-version: 0.20.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine dependency update by Dependabot that upgrades the jsonrpc library used by the electrs Bitcoin server from version 0.18.0 to 0.20.1. The change also removes an older copy of the base64 library from the dependency tree. Dependency updates can sometimes fix security bugs, but the commit message itself does not say this update fixes any vulnerability, and no security advisory was provided.
Review the jsonrpc 0.19.0/0.20.0/0.20.1 changelogs and the base64 upgrade notes for any security fixes. If the project tracks known vulnerabilities, check whether base64 0.13.1 or jsonrpc 0.18.0 were affected by any published advisory. Otherwise treat this as a normal maintenance update.
Security signals we found
Dependency version bump of a networking/RPC crate
Removal of an older transitive dependency (base64 0.13.1) in favor of a newer version (base64 0.22.1)
No explicit security claim or CVE reference in commit or supplied materials
Evidence from the diff
The commit updates Cargo.toml and Cargo.lock to bump jsonrpc 0.18.0 → 0.20.1. The new jsonrpc release depends on base64 0.22.1 instead of base64 0.13.1, so the lockfile drops the old base64 0.13.1 entry and deduplicates base64 references. The feature flags remain the same (default-features = false, simple_http enabled). No application code is changed.
Changed components
Cargo.toml dependency declarationCargo.lock dependency graphjsonrpc crate (Bitcoin Core JSON-RPC client)base64 transitive dependencyInspect captured patch +6 / −12
diff --git a/Cargo.lock b/Cargo.lock
index f61ee3c..21e71cc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -45,12 +45,6 @@ dependencies = [
"bitcoin_hashes",
]
-[[package]]
-name = "base64"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
[[package]]
name = "base64"
version = "0.22.1"
@@ -559,11 +553,11 @@ dependencies = [
[[package]]
name = "jsonrpc"
-version = "0.18.0"
+version = "0.20.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3662a38d341d77efecb73caf01420cfa5aa63c0253fd7bc05289ef9f6616e1bf"
+checksum = "f106cca655869522988b976127096f0aa36e0f1a8ff1f1f425a5c85b61e59391"
dependencies = [
- "base64 0.13.1",
+ "base64",
"serde",
"serde_json",
]
@@ -1161,7 +1155,7 @@ version = "3.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d39cb1dbab692d82a977c0392ffac19e188bd9186a9f32806f0aaa859d75585a"
dependencies = [
- "base64 0.22.1",
+ "base64",
"log",
"percent-encoding",
"ureq-proto",
@@ -1174,7 +1168,7 @@ version = "0.5.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d81f9efa9df032be5934a46a068815a10a042b494b6a58cb0a1a97bb5467ed6f"
dependencies = [
- "base64 0.22.1",
+ "base64",
"http",
"httparse",
"log",
diff --git a/Cargo.toml b/Cargo.toml
index a5d1a8c..b944803 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,7 +28,7 @@ configure_me = "0.4"
crossbeam-channel = "0.5"
dirs-next = "2.0"
env_logger = "0.10"
-jsonrpc = { version = "0.18.0", default-features = false, features = ["simple_http"]}
+jsonrpc = { version = "0.20.1", default-features = false, features = ["simple_http"]}
log = "0.4"
prometheus = { version = "0.14", optional = true }
rayon = "1.12"
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.