update dependencies to be able to fully integrate with chia-gaming and bump for a new release by prozacchiwawa · Pull Request #535 · Chia-Network/chialisp

prozacchiwawa · 2026-07-27T19:40:10Z

Note

Medium Risk
clvmr 0.17 and crypto dependency shifts affect CLVM evaluation and BLS paths; broad lockfile and compiler dialect changes warrant thorough regression via existing CI and chia-gaming tests.

Overview
chialisp 0.5.0 bumps clvmr to 0.17.x and refreshes the lockfile (including chia-bls 0.38.2, rand 0.10, pinned tempfile) so the crate lines up with chia-gaming.

Compiler integration follows clvmr 0.17’s Dialect API: run flags use ClvmFlags instead of raw bitmask constants, with choose_run_flags and per-run flag sync in CompilerOperatorsInternal. OriginalDialect and related paths implement flags(), gc_candidate(), and the updated operator calling convention.

CI and packaging pin Rust 1.97.1, set wasm RUSTFLAGS for getrandom / mvp CPU, move npm builds to Node 24, and update chia-gaming integration tests (new pin, cargo test with sim-tests). Test helpers adopt rand 0.10 APIs.

^{Reviewed by Cursor Bugbot for commit 17892aa. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-07-27T19:42:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality
cargo/getrandom@0.3.1 ⏵ 0.3.4	^-1
cargo/wasm-bindgen@0.2.108 ⏵ 0.2.126
cargo/serde@1.0.228 ⏵ 1.0.229
cargo/serde_json@1.0.104 ⏵ 1.0.151
cargo/js-sys@0.3.85 ⏵ 0.3.103	^-16	⁺²
cargo/chia-bls@0.42.0 ⏵ 0.38.2
cargo/hashlink@0.11.0 ⏵ 0.11.1
cargo/num-bigint@0.4.6 ⏵ 0.4.8
cargo/rand@0.9.4 ⏵ 0.10.2
cargo/rand_chacha@0.3.1 ⏵ 0.10.0
cargo/rand_core@0.9.0 ⏵ 0.10.1
cargo/regex@1.12.3 ⏵ 1.13.1
cargo/subprocess@1.1.0 ⏵ 1.2.0
cargo/tempfile@3.27.0 ⏵ 3.24.0	⁺²
cargo/clvmr@0.16.2 ⏵ 0.17.7

View full report

socket-security · 2026-07-27T19:42:16Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

cargo/bytemuck@1.25.2
cargo/cmov@0.5.4
cargo/cpubits@0.1.1
cargo/ctutils@0.4.2
cargo/find-msvc-tools@0.1.9
cargo/libm@0.2.16
cargo/malachite-base@0.9.2
cargo/malachite-bigint@0.9.2
cargo/malachite-nz@0.9.2
cargo/paste@1.0.15
cargo/primefield@0.14.0
cargo/r-efi@5.3.0
cargo/r-efi@6.0.0
cargo/safe_arch@1.1.0
cargo/serdect@0.4.3
cargo/shlex@2.0.1
cargo/wasip2@1.0.4%2Bwasi-0.2.12
cargo/wide@1.5.0
cargo/windows-link@0.2.1
cargo/wit-bindgen@0.57.1
cargo/wnaf@0.14.0
cargo/chacha20@0.10.1
cargo/futures-core@0.3.33
cargo/futures-task@0.3.33
cargo/futures-util@0.3.33
cargo/pin-project-lite@0.2.17
cargo/slab@0.4.12
cargo/hmac@0.13.0
cargo/itertools@0.14.0
cargo/thiserror@2.0.19
cargo/thiserror-impl@2.0.19
cargo/aho-corasick@1.1.4
cargo/autocfg@1.5.1
cargo/base16ct@1.0.0
cargo/base64ct@1.8.3
cargo/bitflags@2.13.1
cargo/bitvec@1.1.1
cargo/blst@0.3.17
cargo/bumpalo@3.20.3
cargo/cc@1.4.0
cargo/cfg-if@1.0.4
cargo/chia-bls@0.38.2
cargo/chia-sha2@0.38.2
cargo/chia-traits@0.38.2
cargo/chia_streamable_macro@0.38.2
cargo/clvmr@0.17.7
cargo/cpufeatures@0.2.17
cargo/crypto-bigint@0.7.5
cargo/crypto-common@0.1.7
cargo/der@0.8.1
cargo/ecdsa@0.17.0
cargo/either@1.17.0
cargo/elliptic-curve@0.14.1
cargo/equivalent@1.0.2
cargo/errno@0.3.14
cargo/fastrand@2.5.0
cargo/ff@0.14.0
cargo/getrandom@0.3.4
cargo/getrandom@0.4.3
cargo/glob@0.3.4
cargo/group@0.14.0
cargo/hashbrown@0.17.1
cargo/hashlink@0.11.1
cargo/hermit-abi@0.5.2
cargo/hybrid-array@0.4.13
cargo/indexmap@2.14.0
cargo/itoa@1.0.18
cargo/js-sys@0.3.103
cargo/k256@0.14.0
cargo/libc@0.2.189
cargo/memchr@2.8.3
cargo/num-bigint@0.4.8
cargo/num-iter@0.1.46
cargo/num_cpus@1.17.0
cargo/p256@0.14.0
cargo/pem-rfc7468@1.0.0
cargo/pkcs8@0.11.0
cargo/portable-atomic@1.14.0
cargo/ppv-lite86@0.2.21
cargo/primeorder@0.14.0
cargo/proc-macro2@1.0.107
cargo/quote@1.0.47
cargo/rand@0.9.5
cargo/rand@0.10.2
cargo/rand_chacha@0.10.0
cargo/rand_core@0.10.1
cargo/rand_core@0.9.5
cargo/regex@1.13.1
cargo/regex-automata@0.4.16
cargo/rfc6979@0.6.0
cargo/rustversion@1.0.23
cargo/sec1@0.8.1
cargo/serde@1.0.229
cargo/serde_core@1.0.229
cargo/serde_derive@1.0.229
cargo/serde_json@1.0.151
cargo/sha1@0.10.7
cargo/sha3@0.10.9
cargo/signature@3.0.0
cargo/spki@0.8.0
cargo/subprocess@1.2.0
cargo/subtle@2.6.1
cargo/syn@2.0.119
cargo/syn@3.0.3
cargo/tempfile@3.24.0
cargo/toml_datetime@0.6.11
cargo/unicode-ident@1.0.24
cargo/version_check@0.9.5
cargo/wasm-bindgen@0.2.126
cargo/wasm-bindgen-macro@0.2.126
cargo/wasm-bindgen-macro-support@0.2.126
cargo/wasm-bindgen-shared@0.2.126
cargo/windows-sys@0.61.2
cargo/winnow@0.5.40
cargo/zerocopy@0.8.55
cargo/zerocopy-derive@0.8.55
cargo/zeroize@1.9.0
cargo/zeroize_derive@1.5.0
cargo/zmij@1.0.23
cargo/lock_api@0.4.14
cargo/log@0.4.33
cargo/ryu@1.0.23
cargo/spin@0.9.9

View full report

prozacchiwawa · 2026-07-27T19:42:56Z

@SocketSecurity ignore-all

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c9392d4. Configure here.}

prozacchiwawa added 2 commits July 27, 2026 12:37

update

92cfe0b

Pull in full change (remake pr)

c12036e