Repository navigation
deps(deps): bump revm from 42.0.1 to 43.0.2 - #2658
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependabot
dependencies
dependabot
Bot
added
dependencies
![cloudwalk-review-agent[bot]](https://avatars.githubusercontent.com/u/6581007?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
Blocking: this dependency bump introduces a mixed revm major-version graph in the root crate (revm at 43.0.0 while revm-inspectors still pulls revm 42.0.1, and direct revm-state remains 42.0.0). For an EVM execution stack, running two incompatible major lines in one binary is high risk for semantic divergence and integration breakage; this should be aligned before merge.
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
0774b32 to
90cf702
Compare
There was a problem hiding this comment.
Summary
Blocking: this bump still leaves a mixed revm major-version graph in the same binary (revm 43.x alongside revm-inspectors/revm-state on 42.x). For core EVM execution components, keeping two major lines is high-risk for semantic divergence and integration breakage; these should be aligned to the same major before merge.
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
90cf702 to
ae73b13
Compare
There was a problem hiding this comment.
Summary
Blocking: this dependency bump still leaves a mixed revm major-version graph in the same binary. stratus now depends on revm 43.0.0 directly, but revm-inspectors remains pinned to =0.42.0 and resolves to revm 42.0.1, while revm-state remains 42.0.0.
For core EVM execution components, running 42.x and 43.x side-by-side is high risk for semantic divergence (state transitions, precompile behavior, fork logic) and integration breakage across shared types. Please align the revm* family to a single major line before merge.
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
|
we need to deal with codehashes in this version. We don't store them anywhere so it would rely on either migrating rocks or creating a new CF/type version, or computing them as they are read. The latter is not so bad since hot contracts are always loaded onto the cache anyways, so we'd really only be computing the codehash once (when it is read on perm) |
ae73b13 to
12e1cbd
Compare
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
There was a problem hiding this comment.
Blocking: the PR still resolves two major revm lines in the same binary.
From Cargo.lock:
stratusnow depends onrevm 43.0.0revm-inspectorsremains onrevm 42.0.1- direct dep is still
revm-state 42.0.0
This is a concrete risk for an execution engine path (state/account model, codehash handling, precompile/fork semantics, and type interop drift between major versions). Even if it compiles, semantic divergence across 42.x vs 43.x in one runtime can produce hard-to-diagnose behavior differences.
Please align the revm* family to a single major before merge (either all 42.x or all 43.x), including transitive anchors like revm-inspectors and direct revm-state.
Given the thread mention about codehashes in this version, if moving to 43.x is intended, add/point to the migration strategy in this PR (persisted codehash, DB version bump, or deterministic lazy recompute + tests) so behavior is explicit and auditable.
12e1cbd to
9f97b0b
Compare
There was a problem hiding this comment.
Summary
Blocking: this dependency bump still leaves two revm major lines in the same runtime dependency graph (42.x and 43.x), which is high risk for execution-path semantic divergence.
Cargo.lock shows stratus now using revm 43.0.0, while revm-inspectors remains tied to revm 42.0.1 and direct revm-state remains 42.0.0. For EVM core components, this split can produce inconsistent behavior across state/bytecode/codehash handling and tracing paths even if compilation succeeds.
Please align the revm* family to a single major version before merge (including revm-inspectors and direct revm-state), and validate the migration path for state/codehash semantics in tests.
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
dependabot
Bot
changed the title
9f97b0b to
96ca247
Compare
There was a problem hiding this comment.
Summary
Blocking: this update still resolves two different revm major lines in the same runtime dependency graph.
From Cargo.lock, stratus now pulls revm 43.0.2, while revm-inspectors is still pinned to =0.42.0 and resolves through revm 42.0.1; direct revm-state also remains on 42.0.0 in stratus dependencies. Keeping 42.x and 43.x execution-stack crates together is a concrete risk for semantic drift in EVM behavior (state/codehash/precompile/fork handling) and hard-to-debug integration mismatches.
Please align the revm* family to a single major version before merge (including revm-inspectors and revm-state).
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
carneiro-cw
left a comment
carneiro-cw
left a comment
There was a problem hiding this comment.
this requires either computing the codehash on load, or saving codehash (migration)
96ca247 to
f158856
Compare
There was a problem hiding this comment.
Summary
Blocking: this PR still resolves mixed revm major lines in the same runtime dependency graph (42.x and 43.x), so the core EVM stack is not yet aligned to a single major.
From Cargo.toml/Cargo.lock at this head:
- direct
revmmoved to43.0.2 revm-inspectorsremains=0.42.0and is locked againstrevm 42.0.1- direct
revm-stateremains on42.0.0
For execution-path components, this is a concrete semantic-risk split (state/account/codehash/precompile/fork behavior across two major lines) even if it compiles. Please align the revm* family to one major before merge.
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
Bumps [revm](https://github.com/bluealloy/revm) from 42.0.1 to 43.0.2. - [Release notes](https://github.com/bluealloy/revm/releases) - [Changelog](https://github.com/bluealloy/revm/blob/main/CHANGELOG.md) - [Commits](https://github.com/bluealloy/revm/commits) --- updated-dependencies: - dependency-name: revm dependency-version: 43.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
f158856 to
94d7909
Compare
There was a problem hiding this comment.
Summary
Blocking: this PR still resolves a mixed revm major-version runtime graph (42.x and 43.x together), which is a concrete risk in core EVM execution paths.
Cargo.toml bumps direct revm to =43.0.2, but keeps revm-inspectors = "=0.42.0" and revm-state = "42.0.0". Cargo.lock confirms both families are present simultaneously (revm 43.0.2 and revm 42.0.1), with revm-inspectors tied to revm 42.0.1 and stratus still depending on revm-state 42.0.0.
Please align the revm* stack to a single major line before merge (including transitive anchors like inspectors/state), then re-lock and rerun tests relevant to execution/state semantics.
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
|
Superseded by #2716. |
Bumps revm from 42.0.1 to 43.0.2.
Changelog
Sourced from revm's changelog.
... (truncated)
Commits
Most Recent Ignore Conditions Applied to This Pull Request