update clvmr to 1.17.5

[prozacchiwawa]

Note

Medium Risk
Updates a core execution dependency (clvmr) and adapts dialect/flag handling, which could subtly change CLVM evaluation behavior across operator versions. Also pins CI/toolchains, so build failures are possible if the repo relied on newer stable behavior.

Overview
Upgrades the clvmr dependency to 0.17.5 (including lockfile updates for new/transitive crates) for both the main crate and the WASM build.

Refactors classic runner/dialect integration to match clvmr’s new ClvmFlags API: introduces choose_run_flags, stores flags on CompilerOperatorsInternal, threads flags through dialect ops, and ensures flags are restored after nested run_program calls.

Pins Rust toolchains to 1.94.1 across rust-toolchain.toml, wasm/rust-toolchain.toml, and GitHub Actions workflows to keep builds consistent.

^{Reviewed by Cursor Bugbot for commit 5cd9d9a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​clvmr@​0.16.2 ⏵ 0.17.5

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Install-time scripts: cargo malachite-nz Install script: Package overview Source: undefined From: ? → cargo/clvmr@0.17.5 → cargo/malachite-nz@0.9.1 ℹ Read more on: This package | This alert | What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/malachite-nz@0.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Install-time scripts: cargo paste Install script: Package overview Source: undefined From: ? → cargo/clvmr@0.17.5 → cargo/paste@1.0.15 ℹ Read more on: This package | This alert | What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/paste@1.0.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Native binaries present: cargo malachite-nz Location: Package overview From: ? → cargo/clvmr@0.17.5 → cargo/malachite-nz@0.9.1 ℹ Read more on: This package | This alert | Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/malachite-nz@0.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Native binaries present: cargo paste Location: Package overview From: ? → cargo/clvmr@0.17.5 → cargo/paste@1.0.15 ℹ Read more on: This package | This alert | Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/paste@1.0.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• cargo/libm@0.2.16

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: OriginalDialect::flags() panics with todo!() at runtime
  • Replaced the todo!() implementation of OriginalDialect::flags() with self.flags, eliminating the runtime panic during operator dispatch.

Or push these changes by commenting:

@cursor push 6a72fd6f82

Preview (6a72fd6f82)

diff --git a/src/classic/clvm_tools/stages/stage_0.rs b/src/classic/clvm_tools/stages/stage_0.rs
--- a/src/classic/clvm_tools/stages/stage_0.rs
+++ b/src/classic/clvm_tools/stages/stage_0.rs
@@ -164,7 +164,7 @@
     }
 
     fn flags(&self) -> ClvmFlags {
-        todo!();
+        self.flags
     }
 
     fn gc_candidate(&self, _allocator: &Allocator, _node: NodePtr) -> bool {

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[prozacchiwawa]

@SocketSecurity ignore cargo/libm@0.2.16

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5cd9d9a. Configure here.}

[cursor]

CI uses wrong Rust toolchain for fmt and clippy

Medium Severity

The toolchain setup steps were changed from stable to 1.94.1, but the cargo +stable commands on lines 44 and 46 still reference the stable toolchain. Since stable is no longer explicitly installed by the action, these commands will either fail or silently use a pre-installed stable toolchain on the GitHub runner that differs from the intended version 1.94.1, defeating the purpose of pinning the toolchain.

 

^{Reviewed by Cursor Bugbot for commit 5cd9d9a. Configure here.}