What the developer wrote
Authored by Shing Him Ng
Bump honggfuzz to 0.5.57
This is the latest release, which was getting pulled in since the
version was previously set as "0.5.56", which gets interpreted as a
carat requirement ("^0.5.56")
What changed, and why it matters
This commit simply updates a fuzz-testing helper library called honggfuzz from version 0.5.56 to 0.5.57 in the project's lock files and fuzz-testing configuration. It does not change any production Bitcoin code, wallet logic, or network handling. There is no indication this is a security fix.
No security action needed. Treat as routine dependency maintenance for the fuzz-testing harness.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff bumps the honggfuzz dependency from 0.5.56 to 0.5.57 in fuzz/Cargo.toml, fuzz/generate-files.sh, Cargo-minimal.lock, and Cargo-recent.lock. The lock files also record a new transitive dependency on the semver crate and a minor lazy_static bump. honggfuzz is only used in the fuzz/ testing workspace, not in shipped library code. No security advisory, CVE, or vulnerability description is present in the commit or supplied references.
Changed components
fuzz/Cargo.tomlfuzz/generate-files.shCargo-minimal.lockCargo-recent.lockInspect captured patch +10 / −8
diff --git a/Cargo-minimal.lock b/Cargo-minimal.lock
index ce193674..52e66766 100644
--- a/Cargo-minimal.lock
+++ b/Cargo-minimal.lock
@@ -251,13 +251,14 @@ checksum = "3011d1213f159867b13cfd6ac92d2cd5f1345762c63be3554e84092d85a50bbd"
[[package]]
name = "honggfuzz"
-version = "0.5.56"
+version = "0.5.57"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c76b6234c13c9ea73946d1379d33186151148e0da231506b964b44f3d023505"
+checksum = "fc563d4f41b17364d5c48ded509f2bcf1c3f6ae9c7f203055b4a5c325072d57e"
dependencies = [
"lazy_static",
"memmap2",
"rustc_version",
+ "semver",
]
[[package]]
@@ -268,9 +269,9 @@ checksum = "1306f3464951f30e30d12373d31c79fbd52d236e5e896fd92f96ec7babbbe60b"
[[package]]
name = "lazy_static"
-version = "1.4.0"
+version = "1.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
[[package]]
name = "libc"
diff --git a/Cargo-recent.lock b/Cargo-recent.lock
index 6f190a46..2b377a56 100644
--- a/Cargo-recent.lock
+++ b/Cargo-recent.lock
@@ -253,13 +253,14 @@ checksum = "3011d1213f159867b13cfd6ac92d2cd5f1345762c63be3554e84092d85a50bbd"
[[package]]
name = "honggfuzz"
-version = "0.5.56"
+version = "0.5.57"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c76b6234c13c9ea73946d1379d33186151148e0da231506b964b44f3d023505"
+checksum = "fc563d4f41b17364d5c48ded509f2bcf1c3f6ae9c7f203055b4a5c325072d57e"
dependencies = [
"lazy_static",
"memmap2",
"rustc_version",
+ "semver",
]
[[package]]
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index e58c756b..03569e20 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -10,7 +10,7 @@ publish = false
cargo-fuzz = true
[dependencies]
-honggfuzz = { version = "0.5.56", default-features = false }
+honggfuzz = { version = "0.5.57", default-features = false }
bitcoin = { path = "../bitcoin", features = [ "serde", "arbitrary" ] }
p2p = { path = "../p2p", package = "bitcoin-p2p-messages", features = ["arbitrary"] }
arbitrary = { version = "1.4.1" }
diff --git a/fuzz/generate-files.sh b/fuzz/generate-files.sh
index 4ceb5e75..ed14f6c0 100755
--- a/fuzz/generate-files.sh
+++ b/fuzz/generate-files.sh
@@ -22,7 +22,7 @@ publish = false
cargo-fuzz = true
[dependencies]
-honggfuzz = { version = "0.5.56", default-features = false }
+honggfuzz = { version = "0.5.57", default-features = false }
bitcoin = { path = "../bitcoin", features = [ "serde", "arbitrary" ] }
p2p = { path = "../p2p", package = "bitcoin-p2p-messages", features = ["arbitrary"] }
arbitrary = { version = "1.4.1" }
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.