Informational 15 Bitcoin Committed Aug 19, 2025 · 21:43 UTC

fix: upgrade deps for min version checks

b75fa0be View source ↗

Public commit record

What the developer wrote

Authored by Nick Johnson

100/100 · Strong

fix: upgrade deps for min version checks

* Standardizing the minimal versions of `serde_json` and `serde_test` in
the workspace. This allows the unstable "direct-minimal-versions" flag
of cargo to be used since it requires one minimal version in a
workspace. Since these are all dev dependencies (including the fuzz
crate) there shouldn't be any change for external consumers.
* arrayvec needs a small bump due to its version in hex.
* Arbitrary 1.4.0 does not work with the current 1.63.0 MSRV due to some
core::error usage.
* Update serde's contraint to the minimum version which the
workspace has been using due to implicit upgrades. Attempts were first
made to see if 1.0.103 could be used, but at the very least, would
require a fair amount of lint settings to be overridden due to the old
code. 1.0.195 is used because it also irons out an issue where old
versions of serde pulled in old proc_macro2 versions which use a nightly
feature, `proc_macro_span_shrink`, that has been dropped.

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification

The short version

What changed, and why it matters

This commit only updates the minimum required versions of development and optional third-party dependencies (like serde, arbitrary, arrayvec, and serde_json) across workspace Cargo.toml files and the minimal lockfile. It does not change any application code, cryptographic logic, or network handling. The stated purpose is to make the project's automated minimum-version checks work reliably with newer Cargo tooling, not to fix a security vulnerability.

Recommended action

No security action needed. Treat as routine build/CI hygiene. Reviewers may verify that the new minimum versions still compile against the project's declared MSRV (1.63.0) and that CI passes.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The diff is a pure dependency-version bump. It raises lower bounds for optional/dev crates: serde 1.0.103→1.0.195, arbitrary 1.4→1.4.1, arrayvec 0.7→0.7.2, serde_json 1.0.0/1.0→1.0.68, serde_test 1.0→1.0.19, and refreshes Cargo-minimal.lock accordingly. The commit message explains these are all dev or optional dependencies and that the serde bump avoids pulling in old proc-macro2 versions that reference a removed nightly feature. No source code, API, or behavior changes are present.

Changed components

Cargo.toml workspace dependency constraintsCargo-minimal.lock

Inspect captured patch +28 / −28

diff --git a/Cargo-minimal.lock b/Cargo-minimal.lock
index 06fb6646..f8631a94 100644
--- a/Cargo-minimal.lock
+++ b/Cargo-minimal.lock
@@ -284,18 +284,18 @@ checksum = "237a5ed80e274dbc66f86bd59c1e25edc039660be53194b5fe0a482e0f2612ea"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.63"
+version = "1.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b368fba921b0dce7e60f5e04ec15e565b3303972b42bcfde1d0713b881959eb"
+checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.9"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
@@ -384,18 +384,18 @@ checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"
 
 [[package]]
 name = "serde"
-version = "1.0.156"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "314b5b092c0ade17c00142951e50ced110ec27cea304b1037c6969246c2469a4"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.156"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7e29c4601e36bcec74a223228dce795f4cd3616341a4af93520ca1a837c087d"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -424,9 +424,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/bitcoin/Cargo.toml b/bitcoin/Cargo.toml
index acaaf85a..b131d389 100644
--- a/bitcoin/Cargo.toml
+++ b/bitcoin/Cargo.toml
@@ -36,15 +36,15 @@ primitives = { package = "bitcoin-primitives", path = "../primitives", default-f
 secp256k1 = { version = "0.30.0", default-features = false, features = ["hashes", "alloc", "rand"] }
 units = { package = "bitcoin-units", path = "../units", default-features = false, features = ["alloc"] }
 
-arbitrary = { version = "1.4", optional = true }
+arbitrary = { version = "1.4.1", optional = true }
 base64 = { version = "0.22.0", optional = true, default-features = false, features = ["alloc"] }
 # `bitcoinconsensus` version includes metadata which indicates the version of Core. Use `cargo tree` to see it.
 bitcoinconsensus = { version = "0.106.0", default-features = false, optional = true }
-serde = { version = "1.0.103", default-features = false, features = [ "derive", "alloc" ], optional = true }
+serde = { version = "1.0.195", default-features = false, features = [ "derive", "alloc" ], optional = true }
 
 [dev-dependencies]
 internals = { package = "bitcoin-internals", path = "../internals", features = ["test-serde"] }
-serde_json = "1.0.0"
+serde_json = "1.0.68"
 serde_test = "1.0.19"
 bincode = "1.3.1"
 hex_lit = "0.1.1"
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index e2e955e6..0f1bcda5 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -13,10 +13,10 @@ cargo-fuzz = true
 honggfuzz = { version = "0.5.56", default-features = false }
 bitcoin = { path = "../bitcoin", features = [ "serde", "arbitrary" ] }
 p2p = { path = "../p2p", package = "bitcoin-p2p-messages" }
-arbitrary = { version = "1.4" }
+arbitrary = { version = "1.4.1" }
 
-serde = { version = "1.0.103", features = [ "derive" ] }
-serde_json = "1.0"
+serde = { version = "1.0.195", features = [ "derive" ] }
+serde_json = "1.0.68"
 
 [lints.rust]
 unexpected_cfgs = { level = "deny", check-cfg = ['cfg(fuzzing)'] }
diff --git a/hashes/Cargo.toml b/hashes/Cargo.toml
index 5134e82f..fe55e9d7 100644
--- a/hashes/Cargo.toml
+++ b/hashes/Cargo.toml
@@ -25,10 +25,10 @@ small-hash = []
 internals = { package = "bitcoin-internals", path = "../internals" }
 
 hex = { package = "hex-conservative", version = "0.3.0", default-features = false, optional = true }
-serde = { version = "1.0.103", default-features = false, optional = true }
+serde = { version = "1.0.195", default-features = false, optional = true }
 
 [dev-dependencies]
-serde_test = "1.0"
+serde_test = "1.0.19"
 
 [package.metadata.docs.rs]
 all-features = true
diff --git a/internals/Cargo.toml b/internals/Cargo.toml
index 374fe62d..68e8f012 100644
--- a/internals/Cargo.toml
+++ b/internals/Cargo.toml
@@ -22,7 +22,7 @@ test-serde = ["serde", "serde_json", "bincode"]
 
 [dependencies]
 hex = { package = "hex-conservative", version = "0.3.0", default-features = false, optional = true }
-serde = { version = "1.0.103", default-features = false, optional = true }
+serde = { version = "1.0.195", default-features = false, optional = true }
 
 # Don't enable these directly, use `test-serde` feature instead.
 serde_json = { version = "1.0.68", optional = true }
diff --git a/primitives/Cargo.toml b/primitives/Cargo.toml
index cf553c47..76d459a5 100644
--- a/primitives/Cargo.toml
+++ b/primitives/Cargo.toml
@@ -26,14 +26,14 @@ hex = ["dep:hex", "hashes/hex", "internals/hex"]
 hashes = { package = "bitcoin_hashes", path = "../hashes", default-features = false }
 internals = { package = "bitcoin-internals", path = "../internals" }
 units = { package = "bitcoin-units", path = "../units", default-features = false }
-arrayvec = { version = "0.7", default-features = false }
+arrayvec = { version = "0.7.2", default-features = false }
 
-arbitrary = { version = "1.4", optional = true }
+arbitrary = { version = "1.4.1", optional = true }
 hex = { package = "hex-conservative", version = "0.3.0", default-features = false, optional = true }
-serde = { version = "1.0.103", default-features = false, features = ["derive", "alloc"], optional = true }
+serde = { version = "1.0.195", default-features = false, features = ["derive", "alloc"], optional = true }
 
 [dev-dependencies]
-serde_json = "1.0.0"
+serde_json = "1.0.68"
 bincode = "1.3.1"
 
 [package.metadata.docs.rs]
diff --git a/units/Cargo.toml b/units/Cargo.toml
index 48fadd01..c095cde6 100644
--- a/units/Cargo.toml
+++ b/units/Cargo.toml
@@ -20,15 +20,15 @@ alloc = ["internals/alloc","serde?/alloc"]
 [dependencies]
 internals = { package = "bitcoin-internals", path = "../internals", version = "0.4.0" }
 
-serde = { version = "1.0.103", default-features = false, features = ["derive"], optional = true }
-arbitrary = { version = "1.4", optional = true }
+serde = { version = "1.0.195", default-features = false, features = ["derive"], optional = true }
+arbitrary = { version = "1.4.1", optional = true }
 
 [dev-dependencies]
 internals = { package = "bitcoin-internals", path = "../internals", version = "0.4.0", features = ["test-serde"] }
 bincode = "1.3.1"
-serde = { version = "1.0.103", default-features = false, features = ["derive"] }
-serde_test = "1.0"
-serde_json = "1.0"
+serde = { version = "1.0.195", default-features = false, features = ["derive"] }
+serde_test = "1.0.19"
+serde_json = "1.0.68"
 
 [package.metadata.docs.rs]
 all-features = true

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

Merge rust-bitcoin/rust-bitcoin#6678: units: Add `Weight::to_vb_*` functions, deprecating `to_vbytes_*`

Merge rust-bitcoin/rust-bitcoin#6597: Release tracking PR: `crypto 0.3.0`

Update API files

Merge rust-bitcoin/rust-bitcoin#6678: units: Add `Weight::to_vb_` functions, deprecating `to_vbytes_`