Skip to content

Fix security vulnerabilities, fix MSRV, migrate structopt to clap v4#90

Merged
ma2bd merged 5 commits intozefchain:mainfrom
ma2bd:vuln
Feb 23, 2026
Merged

Fix security vulnerabilities, fix MSRV, migrate structopt to clap v4#90
ma2bd merged 5 commits intozefchain:mainfrom
ma2bd:vuln

Conversation

@ma2bd
Copy link
Copy Markdown
Contributor

@ma2bd ma2bd commented Feb 23, 2026

Summary

  • Migrate serde-generate-bin from structopt (which depends on clap v2 and atty) to clap v4 with derive, removing the atty vulnerability (GHSA Upgrade Rust Toolchain to 1.60 #4)
  • Update transitive dev-dependencies: keccak 0.1.5 to 0.1.6 (GHSA Fix copyright with Ocaml-related files #8), bytes 1.9.0 to 1.11.1 (GHSA Dart utf8 #6)
  • Bump rust-version for serde-generate-bin from 1.70 to 1.88
  • Downgrade MSRV to 1.82 with a comment related to the feature solidity
  • Remove solidity and typescript from the default features

Addresses all 4 open Dependabot alerts:

Alert Package Severity Fix
#8 keccak Low cargo update
#7 tracing-subscriber Low Already resolved
#6 bytes Medium cargo update
#4 atty Low Replaced structopt with clap v4

Test plan

  • cargo clippy --locked --workspace --all-features --all-targets passes clean
  • cargo test --locked --no-default-features --no-run passes clean
  • serdegen --help works correctly with clap v4
  • atty and structopt no longer appear in cargo tree

🤖 Generated with Claude Code

@ma2bd ma2bd changed the title Fix security vulnerabilities: migrate structopt to clap v4 Fix security vulnerabilities, fix MSRV, migrate structopt to clap v4 Feb 23, 2026
@ma2bd ma2bd merged commit 2a23bc2 into zefchain:main Feb 23, 2026
14 checks passed
@ma2bd ma2bd deleted the vuln branch February 23, 2026 06:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant