Bump dependency versions in fuzz file generation
What the developer wrote
Authored by Shing Him Ng
Bump dependency versions in fuzz file generation
These were updated in the actual files earlier, but should be updated in
the file generation script
What changed, and why it matters
This commit updates version numbers inside a script that automatically generates fuzz-testing configuration files. It does not change any actual library code, cryptographic logic, or user-facing behavior. It simply keeps the generated files in sync with dependency versions that were already updated elsewhere in the project.
No security action required. Treat as routine maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies fuzz/generate-files.sh to bump rust-version from 1.63.0 to 1.74.0, arbitrary from 1.4 to 1.4.1, serde from 1.0.103 to 1.0.195, serde_json from 1.0 to 1.0.68, and GitHub Actions checkout from v4 to v5. These are build/test infrastructure and fuzz harness dependency pins, not runtime code changes. No security vulnerability is introduced or fixed by this diff.
Changed components
fuzz/generate-files.shInspect captured patch +6 / −6
diff --git a/fuzz/generate-files.sh b/fuzz/generate-files.sh
index 4f0db060..4ceb5e75 100755
--- a/fuzz/generate-files.sh
+++ b/fuzz/generate-files.sh
@@ -13,7 +13,7 @@ cat > "$REPO_DIR/fuzz/Cargo.toml" <<EOF
[package]
name = "bitcoin-fuzz"
edition = "2021"
-rust-version = "1.63.0"
+rust-version = "1.74.0"
version = "0.0.1"
authors = ["Generated by fuzz/generate-files.sh"]
publish = false
@@ -25,10 +25,10 @@ cargo-fuzz = true
honggfuzz = { version = "0.5.56", default-features = false }
bitcoin = { path = "../bitcoin", features = [ "serde", "arbitrary" ] }
p2p = { path = "../p2p", package = "bitcoin-p2p-messages", features = ["arbitrary"] }
-arbitrary = { version = "1.4" }
+arbitrary = { version = "1.4.1" }
-serde = { version = "1.0.103", features = [ "derive" ] }
-serde_json = "1.0"
+serde = { version = "1.0.195", features = [ "derive" ] }
+serde_json = "1.0.68"
[lints.rust]
unexpected_cfgs = { level = "deny", check-cfg = ['cfg(fuzzing)'] }
@@ -71,7 +71,7 @@ $(for name in $(listTargetNames); do echo " $name,"; done)
steps:
- name: Install test dependencies
run: sudo apt-get update -y && sudo apt-get install -y binutils-dev libunwind8-dev libcurl4-openssl-dev libelf-dev libdw-dev cmake gcc libiberty-dev
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- uses: actions/cache@v4
id: cache-fuzz
with:
@@ -101,7 +101,7 @@ $(for name in $(listTargetNames); do echo " $name,"; done)
needs: fuzz
runs-on: ubuntu-24.04
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- uses: actions/download-artifact@v5
- name: Display structure of downloaded files
run: ls -R
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.