pezkuwichain/revive
1
Fork 0
mirror of https://github.com/pezkuwichain/revive.git synced 2026-10-20 18:56:17 +00:00
Code Releases Activity
560 Commits 40 Branches 30 Tags
ca3c770228825e3c035bd83b777348eec05d495f
Commit Graph
560 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
xermicus ca3c770228 release resolc v1.4.0 (#573) 
resolc v1.4.0

Supported `polkadot-sdk` rev: `2604.2.0`

### Added
- Support for solc v0.8.36 and the "Amsterdam" EVM version.
### Fixed
- Restored the top-level `revive_version` field in `--standard-json`
output and the `resolc_version` field in `--combined-json` output, both
of which stopped being populated in `v0.4.0`.
[#557](https://github.com/paritytech/revive/pull/557)
- ICE triggered by `--disable-solc-optimizer --newyork` where inlined
loops could emit an unterminated basic block in the inlined entrypoint.
[#561](https://github.com/paritytech/revive/pull/561)
- `--newyork`: dead-store elimination could drop a store whose memory
expansion an intervening `msize()` observes, so `msize()` read a stale
(unexpanded) value.
[#565](https://github.com/paritytech/revive/pull/565)
- `--newyork`: dead-store elimination could drop a store that a later
overlapping unaligned `mload` reads, returning zeroed memory instead of
the stored bytes. [#563](https://github.com/paritytech/revive/pull/563)
- `--newyork`: an unaligned full-word `mload`/`mstore` overlapping a
word kept native (little-endian) by the heap optimization returned
byte-swapped bytes.
[#562](https://github.com/paritytech/revive/pull/562)
- `--newyork`: a `calldatacopy`/`codecopy`/`returndatacopy` to a dynamic
destination that could overwrite the free-memory-pointer word truncated
a subsequent `mload(0x40)` to `0`.
[#564](https://github.com/paritytech/revive/pull/564)
- `--newyork`: a full-width value stored to the free-memory-pointer slot
(e.g. a function parameter `>= 2^64`) was narrowed to 64 bits, inserting
a checked truncation that consumed all gas.
[#567](https://github.com/paritytech/revive/pull/567)
- `--newyork`: an unaligned `mstore` corrupting the free-memory-pointer
word let a later store through the corrupted pointer silently succeed
where EVM runs out of gas.
[#566](https://github.com/paritytech/revive/pull/566)
- Fixed a bytecode divergence (yet functionally equivalent) between the
resolc Linux/macOS builds and the Windows build for contracts with loops
indexing array elements at constant offsets from a `uint8` loop variable
(e.g. `array[i]`/`array[i + 1]`), compiled with `--newyork` at `-Oz`
with the solc optimizer disabled.
[#570](https://github.com/paritytech/revive/pull/570)

Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
 2026-07-11 10:27:54 +02:00
xermicus d1c00c2147 support solc v0.8.36 (#572) 
Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
 2026-07-10 12:06:11 +02:00
xermicus e7c761c068 new clippies (#571) 
Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
 2026-07-10 10:43:36 +02:00
LJ 32763fedf2 Fix Windows bytecode divergence during LLVM LSR (#570) 
## Description

Our differential bytecode comparison tests detected a bytecode mismatch
between the Linux/macOS builds and the Windows build for a
[contract](https://github.com/paritytech/resolc-compiler-tests/blob/4647018d64eab6ccff30d22c753f02b90e9fc7e3/fixtures/solidity/simple/internal_function_pointers/sort/bubble.sol)
implementing recursive bubble sort, specifically with these opt
settings:
* Solc optimizer disabled
* Newyork enabled
* `-Oz`

This PR applies an [LLVM
patch](https://github.com/llvm/llvm-project/pull/190587) which fixes the
divergence for contracts with loops that index array elements at
constant offsets from a Solidity `uint8` loop variable, observed with
the above opt settings.

## Cause

The first divergence occurs in an LLVM Loop Strength Reduction (LSR)
decision, on `bubbleSort`'s loop (`for (uint8 i = 0; i < ARRAY_SIZE -
start - 1; i++)` with `array[i]`/`array[i+1]` accesses):

```diff
-  %lsr.iv = phi i32 [ 0, %for_cond.preheader153 ], [ %lsr.iv.next, %if_join64 ]   ; Linux/macOS
+  %lsr.iv = phi i32 [ 1, %for_cond.preheader153 ], [ %lsr.iv.next, %if_join64 ]   ; Windows
+  %3 = add i32 %lsr.iv, -1                                                        ; Windows
 ...
-  %3 = add i32 %lsr.iv, 1                                                         ; Linux/macOS
 ...
   %lsr.iv.next = add nuw nsw i32 %lsr.iv, 1   ; identical on both platforms: step is +1 either way
```

In LLVM's `{Start,+,Step}` recurrence notation (value starts at `Start`,
changes by `Step` per loop iteration), the three constants in the diff
represent: recurrence *start*, use-site *offset*, and recurrence *step*.
Only the first two differ between the platforms:

**Linux/macOS** (the `array[i]` calls take `%lsr.iv` directly; the
`array[i+1]` calls take `%3`):

| Line | Constant | Role |
|---|---|---|
| `%lsr.iv = phi i32 [ 0, … ]` | `0` | **Start**: the register's value
on loop entry (`i`) (holds 0, 1, 2, …) |
| `%3 = add i32 %lsr.iv, 1` | `+1` | **Use-site offset**: derives the
*other* index (`i + 1`) from the register each iteration. (No register
is dedicated to `%3`) |
| `%lsr.iv.next = add … , 1` | `+1` | **Step**: how much the register
advances each iteration |

**Windows** (mirrored: the `array[i+1]` calls take `%lsr.iv` directly;
the `array[i]` calls take `%3`):

| Line | Constant | Role |
|---|---|---|
| `%lsr.iv = phi i32 [ 1, … ]` | `1` | **Start**: the register's value
on loop entry (`i + 1`) (holds 1, 2, 3, …) |
| `%3 = add i32 %lsr.iv, -1` | `-1` | **Use-site offset**: derives the
*other* index (`i`) from the register each iteration. (No register is
dedicated to `%3`) |
| `%lsr.iv.next = add … , 1` | `+1` | **Step**: identical |

The two solutions are mirror images with exactly equal cost, because
`getSetupCost()` (the patched function) rated *any* constant induction
variable (IV) start equally (a 0-start and a 1-start IV cost the same).
LSR keeps the first solution it enumerates, and the enumeration order
derives from walking SSA use-lists, whose in-memory order differed
between our Linux/macOS and Windows builds of LLVM.

Thus both platforms compute the indices `i` and `i + 1` each iteration
(functionally identical), but the LSR decision of which of the two
recurrences becomes the loop-carried value (the phi) differs, which
affects register allocation.

> [!NOTE]
> The equal cost tie can only arise if LSR processes the loop at all,
and LSR only forms uses for induction variables of a 32-bit or 64-bit
integer in our case.

## Partial solution

The [upstream fix](https://github.com/llvm/llvm-project/pull/190587)
updates `getSetupCost()` to return `0` for constant IV starts whose
materialization is `TCC_Free` (which immediate `0` on RISC-V is), which
is now cheaper than non-zero starts, resulting in the same LSR decision
(no tie to decide on) on Windows as well.

As zero-start IVs are most common, this fix addresses the most common
scenarios, but it is still only a partial fix as it specifically solves
only the zero-start case. (I'm currently writing up another issue
regarding this.)

## Verification

I created a draft LLVM release that was built with the patch applied,
then reran all workflows using the draft release, including temporarily
testing more opt settings for the bytecode comparisons which ran
successfully (no mismatches) with the following `retester` modes (see
[this
run](https://github.com/paritytech/revive/actions/runs/28970814016/job/85982029937)):
* `NY M0 S+`
* `NY M0 S-`
* `NY M3 S+`
* `NY M3 S-`
* `NY Mz S+`
* `NY Mz S-`
* `Y M0 S+`
* `Y M0 S-`
* `Y M3 S+`
* `Y M3 S-`
* `Y Mz S+`
* `Y Mz S-`

All E2E tests also ran as it does today (allowing all Yul and newyork IR
`retester` modes), completing successfully.
 2026-07-09 13:17:28 +02:00
xermicusandClaude Opus 4.8 16c255bf18 Fix/ny unaligned store fmp oog (#566) 
Bug found by @jubnzv:

`--newyork`: an unaligned `mstore` corrupting the free-memory-pointer
word let a later store through the corrupted pointer silently succeed
where EVM runs out of gas.

---------

Signed-off-by: xermicus <bigcyrill@hotmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 09:13:59 +02:00
xermicusandClaude Opus 4.8 61b7ab8521 Fix/ny fn native fmp oog (#567) 
Bug found by @jubnzv:

`--newyork`: a full-width value stored to the free-memory-pointer slot
(e.g. a function parameter `>= 2^64`) was narrowed to 64 bits, inserting
a checked truncation that consumed all gas.

---------

Signed-off-by: xermicus <bigcyrill@hotmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 17:41:05 +02:00
xermicusandClaude Opus 4.8 e2e6514953 Fix/ny msize dse expansion (#565) 
Bug found by @jubnzv:

`--newyork`: dead-store elimination could drop a store whose memory
expansion an intervening `msize()` observes, so `msize()` read a stale
(unexpanded) value.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 16:31:01 +02:00
xermicusClaude Opus 4.8Agent
 		9adfd9db24 Fix/ny dynamic calldatacopy fmp (#564) 
Bug found by @jubnzv:

`--newyork`: a `calldatacopy`/`codecopy`/`returndatacopy` to a dynamic
destination that could overwrite the free-memory-pointer word truncated
a subsequent `mload(0x40)` to `0`.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Agent <agent@local>
 2026-07-08 15:44:11 +02:00
LJ 066c6d26f0 Fix rate-limited cloning of LLVM submodule (#569) 
## Description

We started seeing rate-limit `429` errors when cloning LLVM (as seen in
e.g. [this failed
run](https://github.com/paritytech/revive/actions/runs/28924583524/job/85809154518)
and [this failed
run](https://github.com/paritytech/revive/actions/runs/28926259175/job/85821336465?pr=564)).
`llvm/llvm-project` now seems to be heavily rate-limited by GitHub.
(Authenticating the clone did not seem to have much effect.)

Even though our resolc build steps only do a treeless clone, all build
steps still did the same clone.

### Changes

* I've instead introduced a `.llvm-version` file that the `get-llvm`
action reads from, eliminating the network request all together.
* `.llvm-version` is meant to be kept in sync with the LLVM submodule
version we use. This is enforced by:
  * Introduced a `check-llvm-version.yml` workflow
* Runs once to check that the recorded version in `.llvm-version`
coincides with the version detected from the submodule.
* The submodule version detection *does* perform a network request as
before, but this is only run once now (when relevant files change),
rather than for all our resolc build jobs.
* Since the differential test jobs require checking out our
revive-differential-tests (rdt) submodule, those checkout steps cloned
not only rdt, but also LLVM. I've updated this to not clone LLVM at all.
 2026-07-08 14:31:39 +02:00
xermicusandClaude Opus 4.8 da547e9dd9 Fix/ny dse overlapping load (#563) 
Another bug found by @jubnzv:

`--newyork`: dead-store elimination could drop a store that a later
overlapping unaligned `mload` reads, returning zeroed memory instead of
the stored bytes.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 09:12:30 +02:00
xermicusandClaude Opus 4.8 c18d29b861 Fix/ny unaligned mload native byteorder (#562) 
Another bug found by @jubnzv:

`--newyork`: an unaligned full-word `mload`/`mstore` overlapping a word
kept native (little-endian) by the heap optimization returned
byte-swapped bytes.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-07 19:38:21 +02:00
xermicus 9b177f6400 Fix NY codegen wth folded guard + inlined for-loop (#561) 
Fixes a ICE wth folded guard in inlined for-loop in NY.

Closes #560

---------

Signed-off-by: xermicus <bigcyrill@hotmail.com>
 2026-07-06 12:37:55 +02:00
LJ 5b92391c57 Restore resolc long version onto standard JSON and combined JSON output (#557) 
## Description

The resolc long version stopped being populated on the standard JSON and
combined JSON output. This PR restores these fields and populates them.
 2026-07-02 15:10:26 +02:00
LJ a87bc81e4c Extend differential tests with newyork optimizer (#555) 
## Description

Extends our differential tests such that the compile+compare bytecode
hashes and the E2E tests also exercise the newyork IR pipeline.

The requested compiler modes that E2E test cases run with are still
controlled by the metadata in the corpus, but the related PR listed
below also enables support for an allow-list to optionally narrow the
set of modes run, via an input to the GH action used.

The changes to the workflow in this PR allows all newyork retester
compiler modes (all LLVM opt levels + solc optimizer on/off) to run for
the E2E tests since they still complete fast.

## Related

The PRs implemented as prerequisites alongside this PR are:
* `revive-differential-tests`
* [Support optimized newyork IR compiler
pipeline](https://github.com/paritytech/revive-differential-tests/pull/308)
* `resolc-compiler-tests`
* [Add newyork IR pipeline counterparts for explicitly-listed Yul
modes](https://github.com/paritytech/resolc-compiler-tests/pull/15)

## Resolved issues

Closes #553
 2026-07-02 11:56:38 +02:00
xermicus 5e218252ea update CLAUDE.md (#558) 
Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
 2026-07-02 10:22:32 +02:00
xermicus 541955d31b add integration test for i32 operand overflow in PVM linker const fold (#552) 
Closes #551

---------

Signed-off-by: xermicus <cyrill@parity.io>
 2026-06-25 18:01:54 +02:00
LJ 3d70def08c ci: Add Foundry tooling integration test (#511) 
## Description

Adds a CI workflow that builds and tests a small Foundry project with
`foundry-polkadot`'s `forge`, exercising the standard JSON interface
between `resolc` and `foundry-polkadot` end-to-end.

## Resolved Issues

Closes #513
 2026-06-24 10:38:07 +02:00
xermicus fb0e9e6a30 release resolc v1.3.0 (#548) 
## v1.3.0

Supported `polkadot-sdk` rev: `2604.2.0`

### Added

- The newyork IR code size optimization pipeline, selectable via the
`--newyork` CLI flag or the `settings.polkavm.newyork` standard JSON
input field.
This can reduce code size by up to 50%. Considered a new and
experimental feature, switched off by default.
[#519](https://github.com/paritytech/revive/pull/519)

### Changed

- The latest supported `polkadot-sdk` version is now `2604.2.0`

Signed-off-by: xermicus <cyrill@parity.io>
 2026-06-19 11:50:41 +02:00
xermicus d7407fe138 remove ambiguous ny opt configuration (#550) 
Otherwise the std json input settings aren't succint.

Signed-off-by: xermicus <cyrill@parity.io>
 2026-06-18 19:12:27 +02:00
LJ 6e0dfdcbb1 Update newyork optimizer in compiler book (#549) 
## Description

Updates the compiler book to reflect the state of the newyork optimizer
as of resolc `v1.3.0`.
 2026-06-18 16:39:15 +02:00
xermicusClaude Opus 4.6neoLJ
 		98d818f958 The new Yul optimizer toolkit (#519) 
This PR introduces powerful code size optimizations. This is achieved
with an additional IR layer in between Yul and LLVM IR. It works quite
well (see below for a comparison) because it captures optimization gains
that neither solc nor LLVM can realize.

The feature is gated behind `--newyork` or a corresponding standard JSON
input setting and **off by default**.

### How it works

We implemented an SSA IR modelled after or inspired by the [MLIR SCF
dialect](https://mlir.llvm.org/docs/Dialects/SCFDialect/). Yul is
translated into this IR and the IR implements mainly the following
optimizations:

- **Type narrowing**: narrows 256-bit values to I1..I160 where provable
(bidirectional + interprocedural), so LLVM emits native 32/64-bit ops
instead
    of software 256-bit arithmetic.
- **FMP range proof**: exposes the `mload(0x40) < heap_size` bound to
LLVM
IPSCCP, eliminating trailing overflow checks on FMP-derived offsets.
Single
    largest code-size contributor.
- **Heap analysis**: skips big-endian byte-swaps where native
little-endian
    layout is safe.
  - **mem_opt / keccak fusion+folding**, **compound outlining** (mapping
sload/sstore), **guard narrowing**, **inlining** tuned for PolkaVM, and
    **exact + fuzzy function dedup**.

### Results
The optimizations implemented with the newyork IR bring substantial code
size improvements.
  - Integration contracts: approximately **-20% to -50%** code size.
  - OpenZeppelin Wizard corpus: around **-47%** code size.

This table shows the code size improvements on various OpenZeppelin ERC
implementations, taken from their [contracts
wizard](https://wizard.openzeppelin.com/), with almost all features
enabled.

| Contract | Default: (bytes) | With `--newyork`: (bytes) | Reduction |
|---|---:|---:|---:|
| erc1155 | 59,206 | 30,649 | -48.2% |
| erc20 | 81,697 | 42,893 | -47.5% |
| erc721 | 92,052 | 49,423 | -46.3% |
| oz_gov | 141,861 | 81,159 | -42.8% |
| oz_rwa | 77,274 | 37,975 | -50.9% |
| oz_simple_erc20 | 29,950 | 16,554 | -44.7% |
| oz_stable | 82,117 | 39,032 | -52.5% |
| **Total** | **564,157** | **297,685** | **-47.2%** |

We believe this to be a reasonably representative dataset and conclude
that the newyork IR achieves drastic code size reductions on real world
dApp implementations.

### Methodology, security and runtime performance

Since the main contributors to these improvements are the FMP range
proofs and the type narrowing, we don't expect big runtime performance
regressions (it may even benefit runtime performance in some cases).

The PR also includes docs
(`book/src/developer_guide/newyork_{optimizer,ir}.md`) and many new
integration tests, including regression tests for known FMP soundness
traps.

The PR was authored collaboratively and reviewed extensively by the
`revive` maintainers, as well as Claude Opus, Claude Fable, Qwen,
Minimax and Deepseek LLMs, over a span of many months.

The `newyork` compiler pipeline introduces no new regressions over our
integration and differential test suites (containing over 30000 test
cases). This was achieved by careful manual reviews and many LLM bughunt
loops. Additionally, a final security review by Anthropic's Fable 5 LLM
found no remaining soundness issues. Nonetheless, like any brand new
software, please consider this an experimental feature upon release.

---------

Signed-off-by: xermicus <bigcyrill@hotmail.com>
Signed-off-by: xermicus <cyrill@parity.io>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: neo <me@90f9.org>
Co-authored-by: LJ <81748770+elle-j@users.noreply.github.com>
 2026-06-17 12:35:16 +02:00
dependabot[bot]andxermicus d178110a81 Bump js-yaml from 4.1.1 to 4.2.0 (#546) 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's
changelog</a>.</em></p>
<blockquote>
<h2>[4.2.0] - 2026-06-01</h2>
<h3>Added</h3>
<ul>
<li>Added <code>docs/safety.md</code> with notes about processing
untrusted YAML.</li>
<li>Added <code>maxDepth</code> (100) loader option. Not a problem, but
gives a better
exception instead of RangeError on stack overflow.</li>
<li>Added <code>maxMergeSeqLength</code> (20) loader option. Not a
problem after <code>merge</code> fix,
but an additional restriction for safety.</li>
<li>Added sourcemaps to <code>dist/</code> builds.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Stop resolving numbers with underscores as numeric scalars, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/627">#627</a>.</li>
<li>Switched dev toolchains to Vite / neostandard.</li>
<li>Updated demo.</li>
<li>Reorganized tests.</li>
<li><code>dist/</code> files are no longer kept in the repository.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix parsing of properties on the first implicit block mapping key,
<a
href="https://redirect.github.com/nodeca/js-yaml/issues/62">#62</a>.</li>
<li>Fix trailing whitespace handling when folding flow scalar lines, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li>
<li>Reject top-level block scalars without content indentation, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/280">#280</a>.</li>
<li>Ensure numbers survive round-trip, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/737">#737</a>.</li>
<li>Fix test coverage for issue <a
href="https://redirect.github.com/nodeca/js-yaml/issues/221">#221</a>.</li>
<li>Fix flow scalar trailing whitespace folding, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li>
<li>Fix digits in YAML named tag handles.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Fix potential DoS via quadratic complexity in merge - deduplicate
repeated
elements (makes sense for malformed files &gt; 10K).</li>
</ul>
<h2>[3.14.2] - 2025-11-15</h2>
<h3>Security</h3>
<ul>
<li>Backported v4.1.1 fix to v3</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/nodeca/js-yaml/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=js-yaml&package-manager=npm_and_yarn&previous-version=4.1.1&new-version=4.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: xermicus <cyrill@parity.io>
 2026-06-17 09:21:35 +02:00
dependabot[bot] 825d3c123f Bump form-data from 4.0.5 to 4.0.6 (#547) 
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to
4.0.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/form-data/form-data/blob/master/CHANGELOG.md">form-data's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">v4.0.6</a>
- 2026-06-12</h2>
<h3>Commits</h3>
<ul>
<li>[Fix] escape CR, LF, and <code>&quot;</code> in field names and
filenames <a
href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>auto-changelog</code>, <code>tape</code> <a
href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a></li>
<li>[Deps] update <code>hasown</code>, <code>mime-types</code> <a
href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a></li>
<li>[Dev Deps] update <code>js-randomness-predictor</code> <a
href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"><code>64190db</code></a>
v4.0.6</li>
<li><a
href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a>
[Deps] update <code>hasown</code>, <code>mime-types</code></li>
<li><a
href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>auto-changelog</code>, <code>tape</code></li>
<li><a
href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a>
[Fix] escape CR, LF, and <code>&quot;</code> in field names and
filenames</li>
<li><a
href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a>
[Dev Deps] update <code>js-randomness-predictor</code></li>
<li>See full diff in <a
href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=form-data&package-manager=npm_and_yarn&previous-version=4.0.5&new-version=4.0.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 08:28:33 +02:00
xermicus 998ec823d5 bump cargo dependencies (#545) 
- Update PVM to fix a downstream bug.
- Update the polkadot-sdk to get rid of most retester exceptions.

Signed-off-by: xermicus <cyrill@parity.io>
 2026-06-17 07:45:59 +02:00
LJ 11e2ea1be4 Fix Wasm build cache collision (#544) 
## Description

Before the CI refactor, the Wasm builds initiated by `release.yml` and
`test-wasm.yml` ran in parallel, building duplicate builds. After the CI
refactor, those workflows shared the build cache key to instead reuse
the build. In both cases, the resolc Wasm URI baked into `resolc_web.js`
depends on whether it is a release or not.

If the Wasm build step initiated by `release.yml` started *before*
`test-wasm.yml`, `test-wasm.yml` would use an incorrect cache due to the
invalid resolc Wasm URI (seen by [this failed
run](https://github.com/paritytech/revive/actions/runs/27178950108/job/80235255116?pr=529)).

This PR updates the workflow input `is_release` to only pertain to ref
names starting with `v` (which is what the `create-release` step guards
on), and updates the cache key and concurrency group to include
`is_release`, solving the cache collision. (Thus, the workflows needing
a Wasm build for non-v-releases will still reuse the now-correct cache.)
 2026-06-10 10:06:43 +02:00
LJ 1e6a631bc0 Fix resolc-bin push auth (#543) 
Pushes to `resolc-bin` 403ed after bumping `actions/checkout` to `v6`
(detected by [failure of the nightly
release](https://github.com/paritytech/revive/actions/runs/27049132601/job/79841157330)).
This PR now passes the app token to the resolc-bin checkout via
[`token:`](https://github.com/actions/checkout/blob/df4cb1c069e1874edd31b4311f1884172cec0e10/README.md?plain=1#L66-L76)
and drops the remote-URL/sed workaround.
 2026-06-06 11:45:35 +02:00
LJ 229ce55bd6 Reduce total CI duration (#536) 
## Description

Improves overall time spent for our CI checks to complete. For cache
hits, total time decreases from ~70min to ~29min.

## Overview

```mermaid
gantt
    title CI on a PR — BEFORE ~70m vs NOW ~29m
    dateFormat HH:mm
    axisFormat %M

    section BEFORE ~70m
    [release] build-wasm 20m                      :r1, 00:00, 20m
    [release] build-x86_64-apple-darwin 17m       :r2, 00:00, 17m
    [release] build-x86_64-pc-windows-msvc 11m    :r3, 00:00, 11m
    [release] build-x86_64-unknown-linux-musl 10m :r4, 00:00, 10m
    [release] build-aarch64-apple-darwin 8m       :r5, 00:00, 8m
    [release] create-macos-universal 14s          :r6, 00:17, 1m
    [test-wasm] own duplicate wasm build 19m      :w1, 00:00, 19m
    [test-wasm] test matrix 3m                    :w2, 00:19, 3m
    [test] required 12m                                            :crit, t1, 00:00, 12m
    [differential-tests] build matrix waits 8m for release         :crit, t2, 00:12, 8m
    [differential-tests] macos-x86_64 compile and hash 44m         :crit, t3, 00:20, 44m
    [differential-tests] windows-x86_64 compile and hash 26m       :t4, 00:20, 26m
    [differential-tests] linux-x86_64 compile and hash 20m         :t5, 00:20, 20m
    [differential-tests] macos-arm64 compile and hash 15m          :t6, 00:20, 15m
    [differential-tests] run-e2e-tests parallel 43m                :t7, 00:22, 43m
    [differential-tests] compare-hashes 5m                         :crit, t8, 01:04, 5m
    [hardhat] use-hardhat chained 1m                               :crit, t9, 01:09, 1m

    section NOW ~29m
    [release] build-windows 3m              :nr1, 00:00, 3m
    [release] build-x86_64-apple-darwin 7m  :nr2, 00:00, 7m
    [release] build-linux 2m                :nr3, 00:00, 2m
    [release] build-aarch64-apple-darwin 2m :nr4, 00:00, 2m
    [release] create-macos-universal 23s    :nr5, 00:07, 1m
    [release] build-wasm cache hit ~11s     :nr6, 00:15, 1m
    [test-wasm] shared wasm build 15m       :nw1, 00:00, 15m
    [test-wasm] test matrix 3m              :nw2, 00:15, 3m
    [test] required 6m                                              :crit, nt1, 00:00, 6m
    [test] check-changes 2s parallel                                :nt2, 00:00, 1m
    [differential-tests] per-target cache hits ~1m 30s              :crit, nt3, 00:06, 2m
    [differential-tests] windows-x86_64 compile and hash 19m        :crit, nt4, 00:08, 19m
    [differential-tests] linux-x86_64 compile and hash 16m          :nt5, 00:08, 16m
    [differential-tests] macos-arm64 compile and hash 13m           :nt6, 00:08, 13m
    [differential-tests] run-e2e-tests 16m                          :nt7, 00:08, 16m
    [differential-tests] compare-hashes 2m                          :crit, nt8, 00:27, 2m
    [hardhat] use-hardhat parallel 1m                               :nt9, 00:07, 1m
```

## Measurements

| Metric | Before | Now | Improvement |
|---|---|---|---|
| **PR CI wall-clock** | 70m 15s | 28m 47s | **−41m 28s (−59%)** |
| `test` job (required check) | 12m 10s | 6m 17s | −5m 53s (faster LLVM
download) |
| `compile-and-hash` build phase | ~7m 30s (waiting on release builds) |
~30s (builds already available) to ~1m 30s (if waiting for macos) |
−6-7m (per-target build split + faster LLVM download) |
| `run-e2e-tests` build phase | ~7m 30s (waiting on release builds) |
~30s (`linux-x86_64` already available) | −7m (per-target build split) |
| Longest `compile-and-hash` job | 44m 05s (`macos-x86_64`) | 19m 08s
(`windows-x86_64`) | −24m 57s (`macos-x86_64` excluded on PRs) |
| `compile-and-hash` matrix start time | 20m 13s | 7m 54s | −12m 19s
(per-target build split + faster LLVM download) |
| `run-e2e-tests` start time | 21m 50s | 7m 36s | −14m 14s (per-target
build split + faster LLVM download) |
| `run-e2e-tests` duration | 43m 28s | 16m 22s | −27m 06s (concurrency
bump + flakiness fix) |

## Changes

| Change | Before | Now |
|---|---|---|
| **Per-target build sub-workflows** | <ul><li>Getting a reusable build
depended on all builds completing.</li><li>Even if e.g. a macOS build is
cached, the waiting workflow with macOS runners could be queued for a
long time just to get the status and cache of the other workflow, since
macOS runners are more scarce than e.g. Ubuntu.</li></ul> |
<ul><li>Split umbrella `reusable-build.yml` into
`reusable-build-{linux,macos,windows,wasm}.yml`.</li><li>Consumers can
wait on a specific target and start earlier instead of blocking on the
whole matrix.</li><li>E.g. E2E and the compile-and-hash matrix start
earlier (gate only on the targets needed).</li></ul> |
| **Bottleneck macOS Intel only running on `main`** | macOS Intel
runners are 2-3× slower than macOS ARM for the contract compilation
tests. Ran on each PR, being the bottleneck. | This build is now
excluded from the matrix for PR runs, and only included for pushes to
`main`. |
| **E2E tests use higher concurrency** | `run-e2e-tests` duration:
~43min.</li></ul> | <ul><li>Uses higher number of concurrent tasks, made
possible by retester flakiness fix.</li><li>`run-e2e-tests` duration:
~16min.</li></ul> |
| **Faster LLVM downloads** | Building resolc took ~8-13min (~16 min on
macOS intel). | `get-llvm/action.yml` uses more efficient version
detection. Building resolc now takes ~2min (~4-7 min on macOS intel). |
| **Wasm tests use cached artifacts** | `test-wasm.yml` ran its own
duplicate build. | `test-wasm.yml` uses the reusable Wasm build. |
| **Skip unnecessary polkadot-sdk package** | For E2E tests,
`polkadot-omni-node` was unconditionally downloaded (~3-4min). | Only
`pallet-revive-eth-rpc` and `revive-dev-node` are downloaded from the
cache. |
| **Cache `report-processor`** | Only `retester` was cached. |
`report-processor` is cached for the compilations and export hashes
jobs. |
| **Hardhat unblocked from differential tests** | Started after the
differential tests succeeded in order to reuse the Linux build. | Starts
as soon as the required `test` job succeeds, using the reusable Linux
build. |
| **Conditionally skip workflows** | <ul><li>Some workflows
conditionally skipped for md-only changes.</li><li>Tooling-only changes
also ran e.g. `test-wasm.yml` and `differential-tests.yml`.</ul></li> |
<ul><li>Most workflows are skipped for doc-only
updates.</li><li>Tooling-only updates trigger only the respective
tooling test (Hardhat), apart from the required `test`
job.</li><li>Differential tests are skipped for js-only
updates.</li></ul> |
| **Miscellaneous** | <ul><li>Used actions running on soon-deprecated
Node 20.</li><li>Difficult to debug Playwright `test-wasm`
failures.</li></ul> | <ul><li>Upgraded actions that used Node
20.</li><li>Added Playwright debug traces uploaded on `test-wasm`
failures.</li></ul> |

## Resolved Issues

Closes #533
 2026-06-05 09:59:17 +02:00
Omar 3a20436ddb Fix Retester Flakiness (#540) 
# Description

Fixes issues with retester and some flakiness in tests. Issue is
described in detail in
https://github.com/paritytech/revive-differential-tests/pull/296
 2026-06-02 13:34:48 +03:00
dependabot[bot] 99d57b1790 Bump tar from 0.4.45 to 0.4.46 (#538) 
Bumps [tar](https://github.com/composefs/tar-rs) from 0.4.45 to 0.4.46.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/composefs/tar-rs/releases">tar's
releases</a>.</em></p>
<blockquote>
<h2>0.4.46</h2>
<h2>Security</h2>
<ul>
<li>archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by <a
href="https://github.com/cgwalters"><code>@​cgwalters</code></a> in <a
href="https://redirect.github.com/composefs/tar-rs/pull/454">composefs/tar-rs#454</a></li>
</ul>
<p>See also <a
href="https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3cv2-h65g-fgmm">https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3cv2-h65g-fgmm</a></p>
<h2>Other changes</h2>
<ul>
<li>ci: Fix and re-enable reverse dependency testing by <a
href="https://github.com/cgwalters"><code>@​cgwalters</code></a> in <a
href="https://redirect.github.com/composefs/tar-rs/pull/444">composefs/tar-rs#444</a></li>
<li>Update astral-tokio-tar requirement from 0.5 to 0.6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/composefs/tar-rs/pull/446">composefs/tar-rs#446</a></li>
<li>Update some links by <a
href="https://github.com/atouchet"><code>@​atouchet</code></a> in <a
href="https://redirect.github.com/composefs/tar-rs/pull/445">composefs/tar-rs#445</a></li>
<li>Add support of absolute paths by <a
href="https://github.com/zxvfc"><code>@​zxvfc</code></a> in <a
href="https://redirect.github.com/composefs/tar-rs/pull/426">composefs/tar-rs#426</a></li>
<li>docs: Expand notes on concurrent mutations and following symlinks by
<a href="https://github.com/cgwalters"><code>@​cgwalters</code></a> in
<a
href="https://redirect.github.com/composefs/tar-rs/pull/453">composefs/tar-rs#453</a></li>
<li>Update repo links by <a
href="https://github.com/cgwalters"><code>@​cgwalters</code></a> in <a
href="https://redirect.github.com/composefs/tar-rs/pull/451">composefs/tar-rs#451</a></li>
<li>ci: Add crates.io trusted publishing workflow by <a
href="https://github.com/cgwalters"><code>@​cgwalters</code></a> in <a
href="https://redirect.github.com/composefs/tar-rs/pull/456">composefs/tar-rs#456</a></li>
<li>Release 0.4.46 by <a
href="https://github.com/cgwalters"><code>@​cgwalters</code></a> in <a
href="https://redirect.github.com/composefs/tar-rs/pull/455">composefs/tar-rs#455</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
made their first contribution in <a
href="https://redirect.github.com/composefs/tar-rs/pull/446">composefs/tar-rs#446</a></li>
<li><a href="https://github.com/atouchet"><code>@​atouchet</code></a>
made their first contribution in <a
href="https://redirect.github.com/composefs/tar-rs/pull/445">composefs/tar-rs#445</a></li>
<li><a href="https://github.com/zxvfc"><code>@​zxvfc</code></a> made
their first contribution in <a
href="https://redirect.github.com/composefs/tar-rs/pull/426">composefs/tar-rs#426</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/composefs/tar-rs/compare/0.4.45...0.4.46">https://github.com/composefs/tar-rs/compare/0.4.45...0.4.46</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/composefs/tar-rs/commit/fc459c149f83bf4daceaa52e17d351989002e1a9"><code>fc459c1</code></a>
Release 0.4.46</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/43e05a85e053d5e64eeda0b04e279be8686419b6"><code>43e05a8</code></a>
ci: Add crates.io trusted publishing workflow</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/bba5666997d95dcd89a9d38235709a1d5e44565b"><code>bba5666</code></a>
Update repo links</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/cd94c46e0d74fbcc50eea3f30665a1b1159254cc"><code>cd94c46</code></a>
docs: Document TOCTOU / concurrent-mutation threat model</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/1b4997cf5ef115f8d82680016c28490b5645b9c7"><code>1b4997c</code></a>
builder: Expand docs for follow_symlinks and append_dir_all</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838"><code>bab14dd</code></a>
archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm)</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/2349b494827807791473f3c6ca9b2fc5ef274cdb"><code>2349b49</code></a>
Add support of absolute paths</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/39d031184127427bd9a740b7e20afd31deead928"><code>39d0311</code></a>
Update some links</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/59d803e2f1ed39272c4c1d1cdb04d799280b3335"><code>59d803e</code></a>
Update astral-tokio-tar requirement from 0.5 to 0.6</li>
<li><a
href="https://github.com/composefs/tar-rs/commit/8296b9a88cfcdbdd1e3b59cd820899b35e6151e1"><code>8296b9a</code></a>
ci: Fix and re-enable reverse dependency testing (<a
href="https://redirect.github.com/composefs/tar-rs/issues/444">#444</a>)</li>
<li>See full diff in <a
href="https://github.com/composefs/tar-rs/compare/0.4.45...0.4.46">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=cargo&previous-version=0.4.45&new-version=0.4.46)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-01 08:28:56 +02:00
xermicus 9b22bcdc7c CI: Do not trigger release workflow on pushes to main (#537) 
Drop main push trigger from release workflow to avoid tag-run
cancellation.

---------

Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
 2026-05-29 17:20:26 +02:00
xermicus c3599b8c4c bump the resolc js version to 1.2.0 (#535) 
Signed-off-by: xermicus <cyrill@parity.io>
 2026-05-29 08:08:44 +02:00
xermicus b2c025faad release resolc v1.2.0 (#534) 
Supported `polkadot-sdk` rev: `2603`

### Changed

- Updated `LLVM` from `21.1.8` to LLVM `22.1.4`

### Added

- Support for solc v0.8.35.

### Fixed

- A constant folding bug causing incorrect translation of a signed
remainder edge case. The affected pattern (Solidity % or Yul smod):
  - SREM over the two constant operands `type(int256).min` and `-1`.
- At least one of the two constants needs folding (i.e. not just
`type(int256).min % -1`),
and is written specifically such that solc doesn't fold but LLVM does,
resulting in UB (signed-overflow).
- Fix `mulmod` returning out-of-range result for large moduli.

---------

Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
 2026-05-28 23:20:11 +02:00
xermicus ae8033130b Fix __ulongrem stdlib edge case (#531) 
The implementation is off-by-one.

---------

Signed-off-by: xermicus <cyrill@parity.io>
 2026-05-28 17:25:23 +02:00
dependabot[bot]andxermicus c67b95805c Bump fast-uri from 3.1.0 to 3.1.2 in /tooling-projects/hardhat/erc20 (#525) 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to
3.1.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fastify/fast-uri/releases">fast-uri's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.2</h2>
<h2>⚠️ Security Release</h2>
<ul>
<li>Fix for <a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc">https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Handle malformed fragment decoding as a parse error by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/171">fastify/fast-uri#171</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2">https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2</a></p>
<h2>v3.1.1</h2>
<h2>⚠️ Security Release</h2>
<ul>
<li>Fix for <a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6">https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/fastify/fast-uri/pull/148">fastify/fast-uri#148</a></li>
<li>build(deps): bump actions/checkout from 4 to 5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/fastify/fast-uri/pull/149">fastify/fast-uri#149</a></li>
<li>chore(.npmrc): ignore scripts by <a
href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/150">fastify/fast-uri#150</a></li>
<li>build(deps-dev): remove <code>@​fastify/pre-commit</code> by <a
href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/151">fastify/fast-uri#151</a></li>
<li>build(deps): bump actions/setup-node from 4 to 5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/fastify/fast-uri/pull/152">fastify/fast-uri#152</a></li>
<li>ci(ci): add concurrency config by <a
href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/153">fastify/fast-uri#153</a></li>
<li>build(deps): bump actions/setup-node from 5 to 6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/fastify/fast-uri/pull/154">fastify/fast-uri#154</a></li>
<li>build(deps): bump actions/checkout from 5 to 6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/fastify/fast-uri/pull/156">fastify/fast-uri#156</a></li>
<li>chore(license): standardise license notice by <a
href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/159">fastify/fast-uri#159</a></li>
<li>style: remove trailing whitespace by <a
href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/161">fastify/fast-uri#161</a></li>
<li>ci: remove unused github files by <a
href="https://github.com/Tony133"><code>@​Tony133</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li>
<li>chore: update readme by <a
href="https://github.com/Tony133"><code>@​Tony133</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/164">fastify/fast-uri#164</a></li>
<li>build(deps): bump
fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from
5 to 6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/fastify/fast-uri/pull/165">fastify/fast-uri#165</a></li>
<li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml
from 5 to 6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/fastify/fast-uri/pull/166">fastify/fast-uri#166</a></li>
<li>build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/fastify/fast-uri/pull/167">fastify/fast-uri#167</a></li>
<li>ci: add lock-threads workflow by <a
href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/169">fastify/fast-uri#169</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Tony133"><code>@​Tony133</code></a> made
their first contribution in <a
href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1">https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fastify/fast-uri/commit/919dd8ea7689fcc220d0d9b71307f5095e723ef9"><code>919dd8e</code></a>
Bumped v3.1.2</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/c65ba573714af6b8e19e481d9444c27bc4355d07"><code>c65ba57</code></a>
fixup: linting</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/6c86c17c3d76fb93aa3700ec6c0fa00faeb97293"><code>6c86c17</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/a95158ad308df4d92bbde4eba699ce5165e9f796"><code>a95158a</code></a>
Handle malformed fragment decoding without throwing (<a
href="https://redirect.github.com/fastify/fast-uri/issues/171">#171</a>)</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/cea547c91c6aae610041b17b75792ca4aa035a6d"><code>cea547c</code></a>
Bumped v3.1.1</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/876ce79b662c3e5015e4e7dffe6f37752ad34f35"><code>876ce79</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/dcdf690b71a7bb3a19887ada65a9ab160d83bcc0"><code>dcdf690</code></a>
ci: add lock-threads workflow (<a
href="https://redirect.github.com/fastify/fast-uri/issues/169">#169</a>)</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/c860e6589b1ac346f66e114b4eadb9613768108c"><code>c860e65</code></a>
build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (<a
href="https://redirect.github.com/fastify/fast-uri/issues/167">#167</a>)</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/9b4c6dc82fde0ca44e674403ece9185d85bb6d5f"><code>9b4c6dc</code></a>
build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (<a
href="https://redirect.github.com/fastify/fast-uri/issues/166">#166</a>)</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/85d09a9f7aa76b32c2bb005a90a71e144c361d24"><code>85d09a9</code></a>
build(deps): bump
fastify/workflows/.github/workflows/plugins-ci-package-mana...</li>
<li>Additional commits viewable in <a
href="https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.0&new-version=3.1.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: xermicus <cyrill@parity.io>
 2026-05-28 11:52:38 +02:00
LJandxermicus a9509d9a96 Bump playwright/test to fix hanging test (#532) 
Bumps `@playwright/test` from ^1.59.1 to ^1.60.0 in an attempt to fix
the flaky install-step hang in test-wasm.yml.

Co-authored-by: xermicus <cyrill@parity.io>
 2026-05-28 09:37:21 +02:00
xermicus 40e97d11eb Fix optimization specific SREM edge case (#527) 
Existing test coverage didn't catch a signed remainder overflow
semantics edge case behavior where at least one the operators is being
constant folded by LLVM instead of solc. This PR fixes the SREM
translation bug and adds missing test coverage for division ops with
constants.

Closes #524

---------

Signed-off-by: xermicus <cyrill@parity.io>
 2026-05-28 09:01:41 +02:00
dependabot[bot]andxermicus 62a62770e3 Bump qs from 6.15.1 to 6.15.2 (#523) 
Bumps [qs](https://github.com/ljharb/qs) from 6.15.1 to 6.15.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.15.2</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: skip null/undefined entries in
<code>arrayFormat: 'comma'</code> + <code>encodeValuesOnly</code>
instead of crashing in <code>encoder</code></li>
<li>[Fix] <code>stringify</code>: use configured <code>delimiter</code>
after <code>charsetSentinel</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/555">#555</a>)</li>
<li>[Fix] <code>stringify</code>: apply <code>formatter</code> to
encoded key under <code>strictNullHandling</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/554">#554</a>)</li>
<li>[Fix] <code>stringify</code>: skip null/undefined filter-array
entries instead of crashing in <code>encoder</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/551">#551</a>)</li>
<li>[Fix] <code>parse</code>: handle nested bracket groups and add
regression tests (<a
href="https://redirect.github.com/ljharb/qs/issues/530">#530</a>)</li>
<li>[readme] fix grammar (<a
href="https://redirect.github.com/ljharb/qs/issues/550">#550</a>)</li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li>[Tests] add regression tests for keys containing percent-encoded
bracket text</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ljharb/qs/commit/9aca4076fe788338c67cf7e115f0be6bc58d85a8"><code>9aca407</code></a>
v6.15.2</li>
<li><a
href="https://github.com/ljharb/qs/commit/5e33d33447ed0bf1ddab9abc41d27dea4687d992"><code>5e33d33</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"><code>21f80b3</code></a>
[Fix] <code>stringify</code>: skip null/undefined entries in
<code>arrayFormat: 'comma'</code> + `e...</li>
<li><a
href="https://github.com/ljharb/qs/commit/a0a81ea2071acce3eff41a040f719ac8f5c4f64c"><code>a0a81ea</code></a>
[Fix] <code>stringify</code>: use configured <code>delimiter</code>
after <code>charsetSentinel</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/e3062f78f5233b338ceeb8e8dfa5a07dea4b32a8"><code>e3062f7</code></a>
[Fix] <code>stringify</code>: apply <code>formatter</code> to encoded
key under <code>strictNullHandling</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/0c180a40adb8c6703fffc85b2ff06ca209f5c1e0"><code>0c180a4</code></a>
[Fix] <code>stringify</code>: skip null/undefined filter-array entries
instead of crashi...</li>
<li><a
href="https://github.com/ljharb/qs/commit/3a8b94aec19bd664720f6f6b1e66c4a0dfe4b656"><code>3a8b94a</code></a>
[Tests] add regression tests for keys containing percent-encoded bracket
text</li>
<li><a
href="https://github.com/ljharb/qs/commit/96755abd357c0e534dd3442a84a04d08864bfe0d"><code>96755ab</code></a>
[readme] fix grammar</li>
<li><a
href="https://github.com/ljharb/qs/commit/a419ce5bbfcdb98a299f1a0bb47ea055baef20e6"><code>a419ce5</code></a>
[Fix] <code>parse</code>: handle nested bracket groups and add
regression tests</li>
<li>See full diff in <a
href="https://github.com/ljharb/qs/compare/v6.15.1...v6.15.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=qs&package-manager=npm_and_yarn&previous-version=6.15.1&new-version=6.15.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: xermicus <cyrill@parity.io>
 2026-05-27 21:08:16 +02:00
LJ a3d5058b1d Configure concurrency for e2e tests to fix flakiness (#530) 
We experienced flakiness in the e2e tests after bumping the
revive-differential-tests submodule which included changes to the global
RPC concurrency limiter and batching layer. This PR attempts to fix the
flakiness by lowering the number of concurrent tasks spawned.
 2026-05-27 16:15:21 +02:00
LJ 28a9010096 Fix CI cache issue (#528) 
Fixes retester cache-related issue (e.g. see [this failed
run](https://github.com/paritytech/revive/actions/runs/26437807037/job/77838993770)).
 2026-05-26 20:32:05 +02:00
dependabot[bot] a59298ea18 Bump qs from 6.15.1 to 6.15.2 in /tooling-projects/hardhat/erc20 (#526) 
Bumps [qs](https://github.com/ljharb/qs) from 6.15.1 to 6.15.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.15.2</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: skip null/undefined entries in
<code>arrayFormat: 'comma'</code> + <code>encodeValuesOnly</code>
instead of crashing in <code>encoder</code></li>
<li>[Fix] <code>stringify</code>: use configured <code>delimiter</code>
after <code>charsetSentinel</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/555">#555</a>)</li>
<li>[Fix] <code>stringify</code>: apply <code>formatter</code> to
encoded key under <code>strictNullHandling</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/554">#554</a>)</li>
<li>[Fix] <code>stringify</code>: skip null/undefined filter-array
entries instead of crashing in <code>encoder</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/551">#551</a>)</li>
<li>[Fix] <code>parse</code>: handle nested bracket groups and add
regression tests (<a
href="https://redirect.github.com/ljharb/qs/issues/530">#530</a>)</li>
<li>[readme] fix grammar (<a
href="https://redirect.github.com/ljharb/qs/issues/550">#550</a>)</li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li>[Tests] add regression tests for keys containing percent-encoded
bracket text</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ljharb/qs/commit/9aca4076fe788338c67cf7e115f0be6bc58d85a8"><code>9aca407</code></a>
v6.15.2</li>
<li><a
href="https://github.com/ljharb/qs/commit/5e33d33447ed0bf1ddab9abc41d27dea4687d992"><code>5e33d33</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"><code>21f80b3</code></a>
[Fix] <code>stringify</code>: skip null/undefined entries in
<code>arrayFormat: 'comma'</code> + `e...</li>
<li><a
href="https://github.com/ljharb/qs/commit/a0a81ea2071acce3eff41a040f719ac8f5c4f64c"><code>a0a81ea</code></a>
[Fix] <code>stringify</code>: use configured <code>delimiter</code>
after <code>charsetSentinel</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/e3062f78f5233b338ceeb8e8dfa5a07dea4b32a8"><code>e3062f7</code></a>
[Fix] <code>stringify</code>: apply <code>formatter</code> to encoded
key under <code>strictNullHandling</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/0c180a40adb8c6703fffc85b2ff06ca209f5c1e0"><code>0c180a4</code></a>
[Fix] <code>stringify</code>: skip null/undefined filter-array entries
instead of crashi...</li>
<li><a
href="https://github.com/ljharb/qs/commit/3a8b94aec19bd664720f6f6b1e66c4a0dfe4b656"><code>3a8b94a</code></a>
[Tests] add regression tests for keys containing percent-encoded bracket
text</li>
<li><a
href="https://github.com/ljharb/qs/commit/96755abd357c0e534dd3442a84a04d08864bfe0d"><code>96755ab</code></a>
[readme] fix grammar</li>
<li><a
href="https://github.com/ljharb/qs/commit/a419ce5bbfcdb98a299f1a0bb47ea055baef20e6"><code>a419ce5</code></a>
[Fix] <code>parse</code>: handle nested bracket groups and add
regression tests</li>
<li>See full diff in <a
href="https://github.com/ljharb/qs/compare/v6.15.1...v6.15.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=qs&package-manager=npm_and_yarn&previous-version=6.15.1&new-version=6.15.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-26 09:09:20 +02:00
LJ c70efb2c2a ci: Add Hardhat tooling integration test (#516) 
## Description

Adds a CI workflow that builds a small Hardhat project with
`hardhat-polkadot`, exercising the standard JSON interface between
`resolc` and `hardhat-polkadot` end-to-end.

## Resolved Issues

Closes #514
 2026-05-25 14:59:31 +02:00
dependabot[bot] dd39bb8198 Bump openssl from 0.10.79 to 0.10.80 (#521) 
Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from
0.10.79 to 0.10.80.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-openssl/rust-openssl/releases">openssl's
releases</a>.</em></p>
<blockquote>
<h2>openssl-v0.10.80</h2>
<h2>What's Changed</h2>
<ul>
<li>Prefer Homebrew openssl@4 and stop looking for openssl@1.1 by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2633">rust-openssl/rust-openssl#2633</a></li>
<li>Fix output buffer overflow in cipher_update_inplace for AES
key-wrap-with-padding by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2638">rust-openssl/rust-openssl#2638</a></li>
<li>Release openssl 0.10.80 and openssl-sys 0.9.116 by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2639">rust-openssl/rust-openssl#2639</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.79...openssl-v0.10.80">https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.79...openssl-v0.10.80</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/35be7ae43b207fc0448a648a21e9156bc360c9af"><code>35be7ae</code></a>
Release openssl 0.10.80 and openssl-sys 0.9.116 (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2639">#2639</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7"><code>19eceb2</code></a>
Fix output buffer overflow in cipher_update_inplace for AES
key-wrap-with-pad...</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/b460eb378c335610df5395a251408ad70bb60d42"><code>b460eb3</code></a>
Prefer Homebrew openssl@4 and stop looking for openssl@1.1 (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2633">#2633</a>)</li>
<li>See full diff in <a
href="https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.79...openssl-v0.10.80">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=openssl&package-manager=cargo&previous-version=0.10.79&new-version=0.10.80)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-22 11:06:50 +02:00
dependabot[bot] 34c40406fb Bump brace-expansion from 5.0.5 to 5.0.6 (#520) 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion)
from 5.0.5 to 5.0.6.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/juliangruber/brace-expansion/commit/46317b5d8779c151d24f65c9c139cd076f91a1c3"><code>46317b5</code></a>
5.0.6</li>
<li><a
href="https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5"><code>c0b095b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/juliangruber/brace-expansion/commit/ec5602085a81ca7c954f6780c6a3aef0b1e200cf"><code>ec56020</code></a>
Bump picomatch from 4.0.3 to 4.0.4 (<a
href="https://redirect.github.com/juliangruber/brace-expansion/issues/93">#93</a>)</li>
<li>See full diff in <a
href="https://github.com/juliangruber/brace-expansion/compare/v5.0.5...v5.0.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=brace-expansion&package-manager=npm_and_yarn&previous-version=5.0.5&new-version=5.0.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-21 11:32:34 +02:00
dependabot[bot] 7fe8d41702 Bump axios from 1.15.0 to 1.16.0 (#518) 
Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.16.0 — May 2, 2026</h2>
<p>This release adds support for the QUERY HTTP method and a new
<code>ECONNREFUSED</code> error constant, lands a substantial wave of
HTTP, fetch, and XHR adapter bug fixes around redirects, aborts,
headers, and timeouts, and welcomes 23 new contributors.</p>
<h2>⚠️ Notable Changes</h2>
<p>A handful of fixes in this release are either security-adjacent or
change observable behaviour. Please review before upgrading:</p>
<ul>
<li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and
<code>maxContentLength</code>.</strong> These limits were silently
ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as
a safety net (DoS protection, accidental large uploads) had no
protection. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li>
<li><strong>Proxy requests now preserve user-supplied <code>Host</code>
headers.</strong> Previously, the proxy path could overwrite a custom
<code>Host</code>. Virtual-host-style routing through a proxy will now
behave correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li>
<li><strong>Basic auth credentials embedded in URLs are now
URL-decoded.</strong> If you have percent-encoded credentials in a URL
(e.g. <code>https://user:p%40ss@host</code>), the decoded value is what
now goes on the wire. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong><code>parseProtocol</code> now strictly requires a colon in
the protocol separator.</strong> Strings that loosely parsed as
protocols before may no longer match. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Deprecated <code>unescape()</code> replaced with modern
UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct;
consumers depending on legacy <code>unescape()</code> quirks may see
different output bytes. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong><code>transformRequest</code> input typing change was
reverted.</strong> The typing change introduced in <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
was reverted in <a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a>
after follow-up review — net behavior is unchanged from 1.15.2.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP
method across adapters and type definitions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li>
<li><strong>ECONNREFUSED Error Constant:</strong> Exposed
<code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so
callers can match connection-refused failures without comparing string
literals (closes <a
href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>).
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong>Encode Helper Export:</strong> Exported the internal
<code>encode</code> helper from <code>buildURL</code> so userland param
serializers can reuse the same encoding logic that axios uses
internally. (<strong><a
href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>HTTP Adapter — Redirects &amp; Headers:</strong> Cleared
stale headers when a redirect targets a no-proxy host, fixed the
redirect listener chain so listeners no longer stack across hops,
restored the missing <code>requestDetails</code> argument on
<code>beforeRedirect</code>, preserved user-supplied <code>Host</code>
headers when forwarding through a proxy, and properly URL-decoded basic
auth credentials. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong>HTTP Adapter — Streams &amp; Timeouts:</strong> Preserved
the partial response object on <code>AxiosError</code> when a stream is
aborted after headers arrive, honoured the <code>timeout</code> option
during the connect phase when redirects are disabled, and resolved an
unsettled-promise hang when an aborted request was combined with
compression and <code>maxRedirects: 0</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li>
<li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code>
/ <code>maxContentLength</code> in the fetch adapter, set the
<code>User-Agent</code> header to match the HTTP adapter, preserved the
original abort reason instead of replacing it with a generic error, and
deferred global access so importing the module no longer throws a
<code>TypeError</code> in restricted environments. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li>
<li><strong>XHR Adapter:</strong> Unsubscribed the
<code>cancelToken</code> and <code>AbortSignal</code> listeners on the
error, timeout, and abort code paths to prevent leaked subscriptions.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong>Error Handling:</strong> Attached the parsed response to
<code>AxiosError</code> when <code>JSON.parse</code> fails inside
<code>dispatchRequest</code>, prevented <code>settle</code> from
emitting <code>undefined</code> error codes, and tightened the
<code>parseProtocol</code> regex to require a colon in the protocol
separator. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Types &amp; Exports:</strong> Aligned the CommonJS
<code>CancelToken</code> typings with the ESM build, fixed a compiler
error caused by <code>RawAxiosHeaders</code>, and re-exported
<code>create</code> from the package index. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li>
<li><strong>UTF-8 Encoding:</strong> Replaced the deprecated
<code>unescape()</code> call with a modern UTF-8 encoding
implementation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong>Misc Cleanup:</strong> Resolved a batch of small
inconsistencies and gadget-level issues across the codebase. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Refactor — ES6 Modernisation:</strong> Modernised the
<code>utils</code> module and XHR adapter to use ES6 features, and
tidied the multipart boundary error message. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to
fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform
support for the pipe tests, and corrected an incorrect test assumption.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li>
<li><strong>Docs:</strong> Documented
<code>paramsSerializer.encode</code> for strict RFC 3986 query encoding,
updated the <code>parseReviver</code> TypeScript definitions and
configuration docs for ES2023, added timeout guidance to the README's
first async example, and expanded notes around the recent type changes.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li>
<li><strong>Reverted:</strong> Reverted the
<code>transformRequest</code> input typing change from <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
after follow-up review. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped
<code>actions/setup-node</code>, the <code>github-actions</code> group,
and <code>postcss</code> (in <code>/docs</code>) to their latest
versions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li>
<li><strong>Release:</strong> Updated changelog and packages, and
prepared the 1.16.0 release. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/singhankit001"><code>@​singhankit001</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li>
<li><strong><a
href="https://github.com/cuiweixie"><code>@​cuiweixie</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong><a
href="https://github.com/iruizsalinas"><code>@​iruizsalinas</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong><a
href="https://github.com/MarcosNocetti"><code>@​MarcosNocetti</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong><a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.16.0 — May 2, 2026</h2>
<p>This release adds support for the QUERY HTTP method and a new
<code>ECONNREFUSED</code> error constant, lands a substantial wave of
HTTP, fetch, and XHR adapter bug fixes around redirects, aborts,
headers, and timeouts, and welcomes 23 new contributors.</p>
<h2>⚠️ Notable Changes</h2>
<p>A handful of fixes in this release are either security-adjacent or
change observable behaviour. Please review before upgrading:</p>
<ul>
<li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and
<code>maxContentLength</code>.</strong> These limits were silently
ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as
a safety net (DoS protection, accidental large uploads) had no
protection. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li>
<li><strong>Proxy requests now preserve user-supplied <code>Host</code>
headers.</strong> Previously, the proxy path could overwrite a custom
<code>Host</code>. Virtual-host-style routing through a proxy will now
behave correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li>
<li><strong>Basic auth credentials embedded in URLs are now
URL-decoded.</strong> If you have percent-encoded credentials in a URL
(e.g. <code>https://user:p%40ss@host</code>), the decoded value is what
now goes on the wire. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong><code>parseProtocol</code> now strictly requires a colon in
the protocol separator.</strong> Strings that loosely parsed as
protocols before may no longer match. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Deprecated <code>unescape()</code> replaced with modern
UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct;
consumers depending on legacy <code>unescape()</code> quirks may see
different output bytes. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong><code>transformRequest</code> input typing change was
reverted.</strong> The typing change introduced in <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
was reverted in <a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a>
after follow-up review — net behavior is unchanged from 1.15.2.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP
method across adapters and type definitions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li>
<li><strong>ECONNREFUSED Error Constant:</strong> Exposed
<code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so
callers can match connection-refused failures without comparing string
literals (closes <a
href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>).
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong>Encode Helper Export:</strong> Exported the internal
<code>encode</code> helper from <code>buildURL</code> so userland param
serializers can reuse the same encoding logic that axios uses
internally. (<strong><a
href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>HTTP Adapter — Redirects &amp; Headers:</strong> Cleared
stale headers when a redirect targets a no-proxy host, fixed the
redirect listener chain so listeners no longer stack across hops,
restored the missing <code>requestDetails</code> argument on
<code>beforeRedirect</code>, preserved user-supplied <code>Host</code>
headers when forwarding through a proxy, and properly URL-decoded basic
auth credentials. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong>HTTP Adapter — Streams &amp; Timeouts:</strong> Preserved
the partial response object on <code>AxiosError</code> when a stream is
aborted after headers arrive, honoured the <code>timeout</code> option
during the connect phase when redirects are disabled, and resolved an
unsettled-promise hang when an aborted request was combined with
compression and <code>maxRedirects: 0</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li>
<li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code>
/ <code>maxContentLength</code> in the fetch adapter, set the
<code>User-Agent</code> header to match the HTTP adapter, preserved the
original abort reason instead of replacing it with a generic error, and
deferred global access so importing the module no longer throws a
<code>TypeError</code> in restricted environments. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li>
<li><strong>XHR Adapter:</strong> Unsubscribed the
<code>cancelToken</code> and <code>AbortSignal</code> listeners on the
error, timeout, and abort code paths to prevent leaked subscriptions.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong>Error Handling:</strong> Attached the parsed response to
<code>AxiosError</code> when <code>JSON.parse</code> fails inside
<code>dispatchRequest</code>, prevented <code>settle</code> from
emitting <code>undefined</code> error codes, and tightened the
<code>parseProtocol</code> regex to require a colon in the protocol
separator. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Types &amp; Exports:</strong> Aligned the CommonJS
<code>CancelToken</code> typings with the ESM build, fixed a compiler
error caused by <code>RawAxiosHeaders</code>, and re-exported
<code>create</code> from the package index. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li>
<li><strong>UTF-8 Encoding:</strong> Replaced the deprecated
<code>unescape()</code> call with a modern UTF-8 encoding
implementation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong>Misc Cleanup:</strong> Resolved a batch of small
inconsistencies and gadget-level issues across the codebase. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Refactor — ES6 Modernisation:</strong> Modernised the
<code>utils</code> module and XHR adapter to use ES6 features, and
tidied the multipart boundary error message. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to
fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform
support for the pipe tests, and corrected an incorrect test assumption.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li>
<li><strong>Docs:</strong> Documented
<code>paramsSerializer.encode</code> for strict RFC 3986 query encoding,
updated the <code>parseReviver</code> TypeScript definitions and
configuration docs for ES2023, added timeout guidance to the README's
first async example, and expanded notes around the recent type changes.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li>
<li><strong>Reverted:</strong> Reverted the
<code>transformRequest</code> input typing change from <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
after follow-up review. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped
<code>actions/setup-node</code>, the <code>github-actions</code> group,
and <code>postcss</code> (in <code>/docs</code>) to their latest
versions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li>
<li><strong>Release:</strong> Updated changelog and packages, and
prepared the 1.16.0 release. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/singhankit001"><code>@​singhankit001</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li>
<li><strong><a
href="https://github.com/cuiweixie"><code>@​cuiweixie</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong><a
href="https://github.com/iruizsalinas"><code>@​iruizsalinas</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong><a
href="https://github.com/MarcosNocetti"><code>@​MarcosNocetti</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong><a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"><code>df53d7d</code></a>
chore(release): prepare release 1.16.0 (<a
href="https://redirect.github.com/axios/axios/issues/10834">#10834</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/9d92bcd32639d1eea5b89f03ae45f248d3bb058e"><code>9d92bcd</code></a>
fix: gadgets and smaller issues (<a
href="https://redirect.github.com/axios/axios/issues/10833">#10833</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/5107ee69aee527b19eabaf80000ca65752135435"><code>5107ee6</code></a>
fix: prevent undefined error codes in settle (<a
href="https://redirect.github.com/axios/axios/issues/7276">#7276</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/e57349992f230b6b13e80613eb84302560aa5ba8"><code>e573499</code></a>
fix(fetch): defer global access in fetch adapter (<a
href="https://redirect.github.com/axios/axios/issues/7260">#7260</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/ad68e1a484b50086af427f767bbd7d6e3aab7ac3"><code>ad68e1a</code></a>
fix(http): honor timeout during connect without redirects (<a
href="https://redirect.github.com/axios/axios/issues/10819">#10819</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/2a51828213128691d2e37502b5eb2cf4965a737d"><code>2a51828</code></a>
fix(http): decode URL basic auth credentials (<a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/0e8b6bbb542131bae9940618d84d5286255d4db1"><code>0e8b6bb</code></a>
fix(http): preserve user-supplied Host header when forwarding through a
proxy...</li>
<li><a
href="https://github.com/axios/axios/commit/79f39e1d041dca87173226d0255f90eaf252564b"><code>79f39e1</code></a>
docs: document paramsSerializer.encode for strict RFC 3986 query
encoding (<a
href="https://redirect.github.com/axios/axios/issues/1">#1</a>...</li>
<li><a
href="https://github.com/axios/axios/commit/0fe3a5fc14829535e1d517c662d448e86c33438e"><code>0fe3a5f</code></a>
[Docs/Types] Update <code>parseReviver</code> TypeScript definitions for
ES2023 and add ...</li>
<li><a
href="https://github.com/axios/axios/commit/cd6737fd84bdb7caf2a319d3579573a49f9d238d"><code>cd6737f</code></a>
chore: matches the sibling responseStream.on(aborted) handler and added
tests...</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.15.0...v1.16.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=1.15.0&new-version=1.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 14:07:43 +02:00
dependabot[bot] 5042c14973 Bump openssl from 0.10.78 to 0.10.79 (#517) 
Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from
0.10.78 to 0.10.79.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-openssl/rust-openssl/releases">openssl's
releases</a>.</em></p>
<blockquote>
<h2>openssl-v0.10.79</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump actions/cache from 5.0.4 to 5.0.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2610">rust-openssl/rust-openssl#2610</a></li>
<li>Try to fix OpenSSL 1.1.0l download by <a
href="https://github.com/botovq"><code>@​botovq</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2614">rust-openssl/rust-openssl#2614</a></li>
<li>Require &amp;mut BigNumContextRef for EcPointRef mul/invert by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2615">rust-openssl/rust-openssl#2615</a></li>
<li>Fix UB in EcGroupRef::generator on groups without a generator by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2617">rust-openssl/rust-openssl#2617</a></li>
<li>Replace <code>use libc::*;</code> with targeted imports in
openssl-sys by <a href="https://github.com/alex"><code>@​alex</code></a>
in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2618">rust-openssl/rust-openssl#2618</a></li>
<li>Add PKeyRef::is_a and KeyType for name-based key identification by
<a href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in
<a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2619">rust-openssl/rust-openssl#2619</a></li>
<li>Add PKey::{public,private}_key_from_raw_bytes_ex by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2620">rust-openssl/rust-openssl#2620</a></li>
<li>Bump MSRV to 1.80 by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2622">rust-openssl/rust-openssl#2622</a></li>
<li>Drop once_cell in favor of std::sync::{LazyLock, OnceLock} by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2623">rust-openssl/rust-openssl#2623</a></li>
<li>Add PKey::private_key_from_seed for ML-DSA/ML-KEM key import by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2621">rust-openssl/rust-openssl#2621</a></li>
<li>parallelize more builds in CI for cold caches by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2625">rust-openssl/rust-openssl#2625</a></li>
<li>Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2626">rust-openssl/rust-openssl#2626</a></li>
<li>Fix process abort when verify/PSK callbacks fire after SSL_CTX swap
by <a href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2624">rust-openssl/rust-openssl#2624</a></li>
<li>Bind OSSL_PARAM_modified and use it for seed_into by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2628">rust-openssl/rust-openssl#2628</a></li>
<li>Add PkeyCtxRef::set_context_string for ML-DSA by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2629">rust-openssl/rust-openssl#2629</a></li>
<li>Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders by
<a href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2631">rust-openssl/rust-openssl#2631</a></li>
<li>Fix output buffer overflow for AES key-wrap-with-padding ciphers by
<a href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2630">rust-openssl/rust-openssl#2630</a></li>
<li>Release openssl 0.10.79 and openssl-sys 0.9.115 by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2632">rust-openssl/rust-openssl#2632</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.78...openssl-v0.10.79">https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.78...openssl-v0.10.79</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/649f2d9e37f3aa701e20bd8ab5cd7eb5afa0a90f"><code>649f2d9</code></a>
Release openssl 0.10.79 and openssl-sys 0.9.115 (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2632">#2632</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/257f9b20c001b888986f93579f118fa2a57d4f45"><code>257f9b2</code></a>
Fix output buffer overflow for AES key-wrap-with-padding ciphers (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2630">#2630</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/d43e9179b1885fc66269a42361cc7a80f631ac8f"><code>d43e917</code></a>
Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2631">#2631</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/f46519c8694a3e121091dafe38aab77c2f756546"><code>f46519c</code></a>
Add PkeyCtxRef::set_context_string for ML-DSA (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2629">#2629</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/ad9ae312771f898749a9471549519d45eba6a033"><code>ad9ae31</code></a>
Bind OSSL_PARAM_modified and use it for seed_into (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2628">#2628</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/4e25c9be20dae1e78f1a3815950cd0973addae82"><code>4e25c9b</code></a>
Fix process abort when verify/PSK callbacks fire after SSL_CTX swap (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2624">#2624</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/3dd8f425ef34a069b5bec46f3971b67db1c295c7"><code>3dd8f42</code></a>
Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2626">#2626</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/2c5e5a8f1483d5ec85580c07f721de9057d58e69"><code>2c5e5a8</code></a>
parallelize more builds in CI for cold caches (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2625">#2625</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/668559171168538cd190574373abfc9e120263ca"><code>6685591</code></a>
Add PKey::private_key_from_seed for ML-DSA/ML-KEM key import (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2621">#2621</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/8f8fdce627fb3c553673b8c688d9f1dc10ea0cc8"><code>8f8fdce</code></a>
Drop once_cell in favor of std::sync::{LazyLock, OnceLock} (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2623">#2623</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.78...openssl-v0.10.79">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=openssl&package-manager=cargo&previous-version=0.10.78&new-version=0.10.79)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-07 08:37:37 +02:00
LJ f2eb9f7ccf ci: Update deprecated Node 20 on GHA runners (#515) 
Updates workflows to use Node 24 as Node 20 is [being
deprecated](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/).
 2026-05-04 13:01:37 +02:00
xermicus ee869cdd18 Support solc v0.8.35 (#512) 
- Support solc v0.8.35
- The new `erc7201` is comptime (already translated to a constant in
Yul)

Didn't spot any relevant breakage or addition in the release notes so
should be no-brainer.

---------

Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
 2026-05-01 20:14:36 +02:00
kvpanchandLJ 1308b446f1 Update LLVM 22 to ca0698598261 and remove LLVM patches (#510) 
Co-authored-by: LJ <81748770+elle-j@users.noreply.github.com>
 2026-04-29 13:47:34 -04:00
kvpanch 8326aa3aed Update LLVM from 21 to 22 (#505) 2026-04-28 14:28:14 -04:00
dependabot[bot]andxermicus 72d47e4d26 Bump openssl from 0.10.77 to 0.10.78 (#508) 
Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from
0.10.77 to 0.10.78.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-openssl/rust-openssl/releases">openssl's
releases</a>.</em></p>
<blockquote>
<h2>openssl-v0.10.78</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix Suite B flag assignments in verify.rs by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2592">rust-openssl/rust-openssl#2592</a></li>
<li>Use cvt_p for OPENSSL_malloc error handling by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2593">rust-openssl/rust-openssl#2593</a></li>
<li>Mark BIO_get_mem_data on AWS-LC to be unsafe by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2594">rust-openssl/rust-openssl#2594</a></li>
<li>Set timeout for package installation step by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2595">rust-openssl/rust-openssl#2595</a></li>
<li>Panic in Crypter::new when IV is required but not provided by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2596">rust-openssl/rust-openssl#2596</a></li>
<li>openssl 4 support by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2591">rust-openssl/rust-openssl#2591</a></li>
<li>Avoid panic for overlong OIDs by <a
href="https://github.com/botovq"><code>@​botovq</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2598">rust-openssl/rust-openssl#2598</a></li>
<li>Fix dangling stack pointer in custom extension add callback by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2599">rust-openssl/rust-openssl#2599</a></li>
<li>Add support for LibreSSL 4.3.x by <a
href="https://github.com/botovq"><code>@​botovq</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2603">rust-openssl/rust-openssl#2603</a></li>
<li>fix inverted bounds assertion in AES key unwrap by <a
href="https://github.com/reaperhulk"><code>@​reaperhulk</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2604">rust-openssl/rust-openssl#2604</a></li>
<li>Reject oversized length returns from password callback trampoline by
<a href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2605">rust-openssl/rust-openssl#2605</a></li>
<li>Validate callback-returned lengths in PSK and cookie trampolines by
<a href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2607">rust-openssl/rust-openssl#2607</a></li>
<li>Error for short out in MdCtxRef::digest_final() by <a
href="https://github.com/botovq"><code>@​botovq</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2608">rust-openssl/rust-openssl#2608</a></li>
<li>Check derive output buffer length on OpenSSL 1.1.x by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2606">rust-openssl/rust-openssl#2606</a></li>
<li>Release openssl v0.10.78 and openssl-sys v0.9.114 by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2609">rust-openssl/rust-openssl#2609</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.77...openssl-v0.10.78">https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.77...openssl-v0.10.78</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/a6debf535674c9a073f455158743e6ba094cf1b4"><code>a6debf5</code></a>
Release openssl v0.10.78 and openssl-sys v0.9.114 (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2609">#2609</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/09b425e5f59a2466d806e71a83a9a449c914c596"><code>09b425e</code></a>
Check derive output buffer length on OpenSSL 1.1.x (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2606">#2606</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/826c3888b77add418b394770e2b2e3a72d9f92fe"><code>826c388</code></a>
Error for short out in MdCtxRef::digest_final() (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2608">#2608</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/1d109020d98fff2fb2e45c39a373af3dff99b24c"><code>1d10902</code></a>
Validate callback-returned lengths in PSK and cookie trampolines (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2607">#2607</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/5af6895c907773699f37f583f409b862284062b1"><code>5af6895</code></a>
Reject oversized length returns from password callback trampoline (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2605">#2605</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/718d07ff8ff7be417d5b7a6a0047f1607520b3b6"><code>718d07f</code></a>
fix inverted bounds assertion in AES key unwrap (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2604">#2604</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/53cc69d2f3f0d7f19e46fe49c5ffb523785a3664"><code>53cc69d</code></a>
Add support for LibreSSL 4.3.x (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2603">#2603</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/0b41e793d6740ed2d6f2395a0c074d02568f9f66"><code>0b41e79</code></a>
Fix dangling stack pointer in custom extension add callback (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2599">#2599</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/cbdedf8105bfcce218fcdc09440d090431914710"><code>cbdedf8</code></a>
Avoid panic for overlong OIDs (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2598">#2598</a>)</li>
<li><a
href="https://github.com/rust-openssl/rust-openssl/commit/1fc51efa3f63e38a3139e201edf3395e5a10f8ba"><code>1fc51ef</code></a>
openssl 4 support (<a
href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2591">#2591</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.77...openssl-v0.10.78">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=openssl&package-manager=cargo&previous-version=0.10.77&new-version=0.10.78)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/paritytech/revive/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: xermicus <cyrill@parity.io>
 2026-04-23 09:53:52 +02:00