internals, hashes, primivties: clean up optional deps
What the developer wrote
Authored by Nick Johnson
internals, hashes, primivties: clean up optional deps
If you use the `dep:OPTIONAL_DEP` syntax in a package's feature, then
the implicit feature flag for the optional dependency is disabled. No need
to tell end users to avoid it.
What changed, and why it matters
This commit is a routine cleanup of how optional dependencies are declared in three Rust package configuration files. It changes feature flags to use the modern `dep:` syntax and updates comments to be clearer. There is no change to actual program logic, no security fix, and no vulnerability.
No security action required. This is a benign build-configuration cleanup.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies hashes/Cargo.toml, internals/Cargo.toml, and primitives/Cargo.toml. In internals, the test-serde feature now explicitly uses dep:serde_json and dep:bincode, which suppresses the implicit feature flags for those optional dependencies. Comments in hashes and primitives are updated to clarify that the optional hex-stable/hex-unstable dependencies are gated by the hex feature. No source code, API behavior, or dependency versions are changed.
Changed components
hashes/Cargo.tomlinternals/Cargo.tomlprimitives/Cargo.tomlInspect captured patch +4 / −4
diff --git a/hashes/Cargo.toml b/hashes/Cargo.toml
index 276c17f2..57540037 100644
--- a/hashes/Cargo.toml
+++ b/hashes/Cargo.toml
@@ -30,7 +30,7 @@ arbitrary = { version = "1.4.1", optional = true}
serde = { version = "1.0.195", default-features = false, optional = true }
cpufeatures = { version = "0.2", optional = true }
-# You likely don't want to enable these directly, use hex instead.
+# Both optional hex dependencies are behind the `hex` feature.
hex-stable = { package = "hex-conservative", version = "1.0.0", default-features = false, optional = true }
hex-unstable = { package = "hex-conservative", version = "0.3.2", default-features = false, optional = true }
diff --git a/internals/Cargo.toml b/internals/Cargo.toml
index 6b0a247b..bcac0a0b 100644
--- a/internals/Cargo.toml
+++ b/internals/Cargo.toml
@@ -18,13 +18,13 @@ default = []
std = ["alloc", "hex?/std"]
alloc = ["hex?/alloc"]
-test-serde = ["serde", "serde_json", "bincode"]
+test-serde = ["serde", "dep:serde_json", "dep:bincode"]
[dependencies]
hex = { package = "hex-conservative", version = "0.3.2", default-features = false, optional = true }
serde = { version = "1.0.195", default-features = false, optional = true }
-# Don't enable these directly, use `test-serde` feature instead.
+# Behind the test-serde feature.
serde_json = { version = "1.0.68", optional = true }
bincode = { version = "1.3.1", optional = true }
diff --git a/primitives/Cargo.toml b/primitives/Cargo.toml
index 7afe561e..6c5c8996 100644
--- a/primitives/Cargo.toml
+++ b/primitives/Cargo.toml
@@ -28,7 +28,7 @@ units = { package = "bitcoin-units", path = "../units", version = "0.3.0", defau
arbitrary = { version = "1.4.1", optional = true }
serde = { version = "1.0.195", default-features = false, features = ["derive", "alloc"], optional = true }
-# You probably don't want to use these directly, consider using the `hex` feature.
+# Both optional hex dependencies are behind the `hex` feature.
hex-stable = { package = "hex-conservative", version = "1.0.0", default-features = false, optional = true }
hex-unstable = { package = "hex-conservative", version = "0.3.2", default-features = false, optional = true }
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.