Bump clvmr from 0.17.7 to 0.19.0

[dependabot]

Bumps clvmr from 0.17.7 to 0.19.0.

Release notes

Sourced from clvmr's releases.

0.19.0

What's Changed

• restore LIMITS flag, for testnet11 by @​arvidn in Chia-Network/clvm_rs#826
• [CHIA-3987] New cost model for 3.0 hard fork by @​arvidn in Chia-Network/clvm_rs#818
• bump version to 0.19.0 by @​arvidn in Chia-Network/clvm_rs#828

Full Changelog: Chia-Network/clvm_rs@0.18.0...0.19.0

0.18.0

What's Changed

• make sure the generated test cases are up-to-date by @​arvidn in Chia-Network/clvm_rs#779
• add build feature that disable fast-path optimizations in operators by @​arvidn in Chia-Network/clvm_rs#780
• prepare test_ops() to support more flags by @​arvidn in Chia-Network/clvm_rs#783
• minor simplification of op_sha256 by @​arvidn in Chia-Network/clvm_rs#784
• [CHIA-3823] 2026 serde format by @​richardkiss in Chia-Network/clvm_rs#708
• Fix benchmarks to exclude allocator-reset setup time from measurements by @​richardkiss in Chia-Network/clvm_rs#789
• [CHIA-4249] limit nesting depth of softfork in mempool mode by @​arvidn in Chia-Network/clvm_rs#794
• make modpow also honor the LIMITS flag by @​arvidn in Chia-Network/clvm_rs#799
• Upgrades by @​arvidn in Chia-Network/clvm_rs#801
• Update Managed Files by @​ChiaAutomation in Chia-Network/clvm_rs#800
• LIMITS have activated by @​arvidn in Chia-Network/clvm_rs#803
• bump version to 0.18.0 by @​arvidn in Chia-Network/clvm_rs#804

Full Changelog: Chia-Network/clvm_rs@0.17.7...0.18.0

Commits

• f00ad6c Merge pull request #828 from Chia-Network/bump-0-19-0
• 5eecddf address cargo audit
• 9f501a4 bump version to 0.19.0
• 9bb61d6 Merge pull request #818 from Chia-Network/new-cost-model
• a996d6f fix MEMPOOL_MODE and add some defenses around mutually exclusive flags
• a84cd13 fix cargo audit workflow
• 6239355 extend sha256tree-benching to cover the new cost model
• 3f530e3 raise cost for softfork operator
• 2dabb26 add test coverage for keccak with the new cost model
• b4a52ac apply new cost per byte and DST byt to op_bls_map_to_g1, op_bls_map_to_g2 and...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Bumping the core CLVM interpreter can change execution costs and validation behavior for compile-time and tooling runs, which may surface as test or workflow differences even though no application logic in this repo changed.

Overview
This PR only updates the clvmr dependency from 0.17.7 to 0.19.0 in Cargo.toml, with the matching lockfile entry. The pre-eval feature stays enabled.

That version span pulls in upstream CLVM runtime changes (not edits in this repo), including the 3.0 hard-fork cost model, LIMITS flag behavior, and related operator/mempool limits from clvm_rs 0.18–0.19. Anything here that runs CLVM through clvmr—classic stage_2 tooling, constant folding, run/brun/repl—will use the new runtime semantics and costing.

^{Reviewed by Cursor Bugbot for commit 88095da. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​clvmr@​0.19.0

View full report