What the developer wrote
Authored by Adam Tucker
Use released UR crates 1.0.8
What changed, and why it matters
This commit simply switches two software building blocks (called 'crates') from a development Git snapshot to a published release version (1.0.8) on the official Rust package registry. The change itself does not add, remove, or modify any program logic in the firmware. It only changes where the code is downloaded from and which exact released version is used. There is nothing in the commit message, title, or diff that says this fixes a security problem.
No immediate security action is required based on this commit alone. As a routine hygiene step, review the upstream 1.0.8 release notes of ur-registry/ur-parse-lib to confirm whether that release contains any security fixes not mentioned in this commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff updates rust/Cargo.toml and rust/Cargo.lock for ur-registry and ur-parse-lib from git-sourced revision abc72f08 of valargroup/keystone-sdk-rust (version 1.0.7) to crates.io release 1.0.8. It also removes the [patch.crates-io] override that forced the git versions. No source code, API usage, feature flags, or firmware logic is changed. The commit message is purely a dependency/source switch: ‘Use released UR crates 1.0.8’.
Changed components
rust/Cargo.tomlrust/Cargo.lockur-registry dependency source/versionur-parse-lib dependency source/versionInspect captured patch +8 / −10
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 29d8220..a0eee4b 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -4797,8 +4797,9 @@ checksum = "6d49784317cd0d1ee7ec5c716dd598ec5b4483ea832a2dced265471cc0f690ae"
[[package]]
name = "ur-parse-lib"
-version = "1.0.7"
-source = "git+https://github.com/valargroup/keystone-sdk-rust.git?rev=abc72f085f4c42e0ad048c60c1102f24a16e1f68#abc72f085f4c42e0ad048c60c1102f24a16e1f68"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecf06a6ea8b869cbbb4c9cba0f7271c94d53185b5bbbfc5847dbb77b68ea9a92"
dependencies = [
"hex",
"keystone-ur",
@@ -4807,8 +4808,9 @@ dependencies = [
[[package]]
name = "ur-registry"
-version = "1.0.7"
-source = "git+https://github.com/valargroup/keystone-sdk-rust.git?rev=abc72f085f4c42e0ad048c60c1102f24a16e1f68#abc72f085f4c42e0ad048c60c1102f24a16e1f68"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3e5fdee1510fe809ceaecdf7e3ab75b58b4c578e3f436217cd03132f0596698"
dependencies = [
"bs58",
"hex",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 74d15aa..a3168a8 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -76,8 +76,8 @@ core2 = { version = "0.9.4", package = "no_std_io2", default-features = false }
thiserror = { version = "1.0", package = "thiserror-core", default-features = false }
rsa = { version = "0.8.2", default-features = false }
sha1 = { version = "0.10.5", default-features = false }
-ur-registry = "=1.0.7"
-ur-parse-lib = "1.0.7"
+ur-registry = "=1.0.8"
+ur-parse-lib = "1.0.8"
sui-transaction-types-core = { git = "https://github.com/KeystoneHQ/sui.git", tag = "mainnet-nostd-v1.69.2.1", default-features = false, features = ["alloc"] }
ed25519-bip32-core = { version = "0.1.1", default-features = false }
cryptoxide = "0.4"
@@ -120,7 +120,3 @@ getrandom = "0.2"
minicbor = { version = "0.19", features = ["alloc"] }
zeroize = { version = "1.8.2", default-features = false }
# third party dependencies end
-
-[patch.crates-io]
-ur-registry = { git = "https://github.com/valargroup/keystone-sdk-rust.git", rev = "abc72f085f4c42e0ad048c60c1102f24a16e1f68" }
-ur-parse-lib = { git = "https://github.com/valargroup/keystone-sdk-rust.git", rev = "abc72f085f4c42e0ad048c60c1102f24a16e1f68" }
Why this scored 3/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.