chore(deps): bump ed25519-dalek from 2.2.0 to 3.0.0 - #827
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
requested review from
0xForerunner,
0xOsiris,
Dzejkop and
Kemperino
as code owners
July 9, 2026 00:00
dependabot
Bot
requested review from
karankurbur,
kilianglas and
murph
as code owners
July 9, 2026 00:00
dependabot
Bot
requested review from
alessandromazza98,
cichaczem and
piohei
as code owners
July 9, 2026 00:00
0xOsiris
approved these changes
Jul 9, 2026
dependabot
Bot
force-pushed
the
dependabot/cargo/ed25519-dalek-3.0.0
branch
from
July 25, 2026 00:01
37e9eae to
b0f4240
Compare
dependabot
Bot
force-pushed
the
dependabot/cargo/ed25519-dalek-3.0.0
branch
from
July 28, 2026 11:42
b0f4240 to
fac7ee7
Compare
Bumps [ed25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) from 2.2.0 to 3.0.0. - [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases) - [Changelog](https://github.com/dalek-cryptography/curve25519-dalek/blob/3.0.0/CHANGELOG.md) - [Commits](dalek-cryptography/curve25519-dalek@ed25519-2.2.0...3.0.0) --- updated-dependencies: - dependency-name: ed25519-dalek dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/cargo/ed25519-dalek-3.0.0
branch
from
August 5, 2026 15:09
fac7ee7 to
2eb6ea7
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2eb6ea7. Configure here.
| arbitrary = { version = "=1.4.2", features = ["derive"] } | ||
| blake3 = "1.8.4" | ||
| ed25519-dalek = { version = "2", features = ["serde"] } | ||
| ed25519-dalek = { version = "3", features = ["serde"] } |
There was a problem hiding this comment.
Serde break for Authorization RPC
High Severity
Bumping ed25519-dalek to 3 with serde switches VerifyingKey and Signature JSON encoding to serdect hex strings. Authorization is passed as a JSON-RPC argument to flashblocks_forkchoiceUpdatedV3, so clients still on dalek 2 (for example rollup-boost) that emit the old byte-array form will fail to deserialize, breaking flashblocks authorization delivery.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 2eb6ea7. Configure here.
Contributor
Benchmark ResultsBase and PR measured on the same runner in the same workflow run.
Raw
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps ed25519-dalek from 2.2.0 to 3.0.0.
Changelog
Sourced from ed25519-dalek's changelog.
... (truncated)
Commits
6d96eb7Bump version to 3.0.0.c68b30fMerge pull request #330 from isislovecruft/fix/move-coc2ee6193Merge pull request #327 from huitseeker/digests-0.991a0faeMove CoC section from CONTRIBUTING.md to new file.5038fcfMerge pull request #308 from isislovecruft/fix/pippenger-typo6afd8ffUpdate sha2, digest to 0.93cc13a7Merge branch 'master' into developc4824e1Merge branch 'release/2.1.0'3fc47efBump version to 2.1.0f04b830Merge branch 'master' into developNote
Medium Risk
Touches Ed25519 signing/verification used across node, P2P, and flashblocks paths via a major crate bump (including digest-related public API changes in upstream 3.0), though behavior should be unchanged if tests pass.
Overview
Bumps the workspace
ed25519-dalekdependency from 2 to 3 (withserdestill enabled) and refreshesCargo.lockso World Chain crates resolveed25519-dalek 3.0.0instead of 2.x.The lockfile also pulls in the 3.x crypto stack (
curve25519-dalek5,ed255193,signature3,sha20.11, etc.) for those workspace members, while some transitive crates (e.g.enr,libp2p-identity) remain oned25519-dalek 2.2.0. There are no Rust source changes—only the version pin and lock resolution.Reviewed by Cursor Bugbot for commit 2eb6ea7. Bugbot is set up for automated code reviews on this repo. Configure here.