chore: update keystone-sdk-rust version
What the developer wrote
Authored by soralit
chore: update keystone-sdk-rust version
What changed, and why it matters
This commit simply updates two Rust library versions (ur-registry and ur-parse-lib) used by the Keystone 3 firmware and removes a temporary patch that pointed to a specific Git commit. There is no information in the commit itself saying this fixes a security problem, and no independent references were provided. It looks like a routine dependency maintenance change.
No immediate security action is required based on this commit alone. If the newer versions of ur-registry or ur-parse-lib contain security fixes, the project should document them in a changelog or security advisory and verify whether the firmware is affected.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff bumps ur-registry from 1.0.5 to 1.0.7 and ur-parse-lib from 1.0.4 to 1.0.7 in rust/Cargo.toml and rust/Cargo.lock. It also removes a [patch.crates-io] override that had pinned ur-registry to a specific Git revision of keystone-sdk-rust. The commit message calls this a ‘chore’. No vulnerability details, CVE, security advisory, or bug description is included in the commit or supplied references.
Changed components
rust/Cargo.tomlrust/Cargo.lockur-registry dependencyur-parse-lib dependencyInspect captured patch +9 / −13
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 109ba77..0e84895 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -2558,7 +2558,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
dependencies = [
"cfg-if",
- "windows-targets 0.48.5",
+ "windows-targets 0.53.2",
]
[[package]]
@@ -4797,9 +4797,9 @@ checksum = "6d49784317cd0d1ee7ec5c716dd598ec5b4483ea832a2dced265471cc0f690ae"
[[package]]
name = "ur-parse-lib"
-version = "1.0.4"
+version = "1.0.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cb78039ff8b5bf065b43348aaa231d5909bc8d1f5c09541c25ea259d2048c1f"
+checksum = "d8a5ab613e7067ed9fdda88c981928bfbe4c27266c1e6966c764a3acb55bc984"
dependencies = [
"hex",
"keystone-ur",
@@ -4808,8 +4808,9 @@ dependencies = [
[[package]]
name = "ur-registry"
-version = "1.0.5"
-source = "git+https://github.com/KeystoneHQ/keystone-sdk-rust.git?rev=4131bae5407e31633c01edf9c324094aca69341a#4131bae5407e31633c01edf9c324094aca69341a"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2a09a3a773ec71b906f833193b2a81fd872daa2909f9d5fbd20686761d4e0c0"
dependencies = [
"bs58",
"hex",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 8d370a6..485b3cd 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -76,8 +76,8 @@ core2 = { version = "0.9.4", package = "no_std_io2", default-features = false }
thiserror = { version = "1.0", package = "thiserror-core", default-features = false }
rsa = { version = "0.8.2", default-features = false }
sha1 = { version = "0.10.5", default-features = false }
-ur-registry = "=1.0.5"
-ur-parse-lib = "1.0.4"
+ur-registry = "=1.0.7"
+ur-parse-lib = "1.0.7"
sui-transaction-types-core = { git = "https://github.com/KeystoneHQ/sui.git", tag = "mainnet-nostd-v1.69.2.1", default-features = false, features = ["alloc"] }
ed25519-bip32-core = { version = "0.1.1", default-features = false }
cryptoxide = "0.4"
@@ -119,9 +119,4 @@ blake2b_simd = { version = "1.0.2", default-features = false }
getrandom = "0.2"
minicbor = { version = "0.19", features = ["alloc"] }
zeroize = { version = "1.8.2", default-features = false }
-# third party dependencies end
-
-[patch.crates-io]
-# The published crate does not yet include the PCZT-owned batch messages or
-# firmware version in batch results.
-ur-registry = { git = "https://github.com/KeystoneHQ/keystone-sdk-rust.git", rev = "4131bae5407e31633c01edf9c324094aca69341a" }
+# third party dependencies end
\ No newline at end of file
Why this scored 3/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.