20260413 update clvmr main 0 17 5

[prozacchiwawa]

Note

Medium Risk
Medium risk from a major clvmr bump and crypto/BLS dependency realignment (chia-bls downgrade), which can change CLVM evaluation and compilation behavior; CI pinning reduces toolchain drift but does not eliminate semantic risk.

Overview
Bumps the crate to 0.5.0 and upgrades clvmr to 0.17.5, aligning classic compiler/runtime code with clvmr’s ClvmFlags API (replacing raw u32 flags), new Dialect methods (flags, gc_candidate), and operators that take max_cost + flags. Adds choose_run_flags and keeps compiler-operator run flags in sync per nested run_program call.

Dependency refresh: chia-bls moves to 0.38.2, rand to 0.10, getrandom to 0.3.4 (non-wasm), with matching test RNG updates (TryRng, ChaChaRng::from_rng). tempfile is pinned to 3.24.0.

CI/release: Rust is pinned to 1.97.1 everywhere; NPM wasm builds use RUSTFLAGS for unsupported getrandom on wasm, Node 24, and refreshed lockfiles for main and wasm crates.

^{Reviewed by Cursor Bugbot for commit 569d285. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​getrandom@​0.3.1 ⏵ 0.3.4	-1
	cargo/​wasm-bindgen@​0.2.108 ⏵ 0.2.126
	cargo/​serde@​1.0.228 ⏵ 1.0.229
	cargo/​serde_json@​1.0.104 ⏵ 1.0.151
	cargo/​js-sys@​0.3.85 ⏵ 0.3.103	-16		+2
	cargo/​chia-bls@​0.42.0 ⏵ 0.38.2
	cargo/​hashlink@​0.11.0 ⏵ 0.11.1
	cargo/​num-bigint@​0.4.6 ⏵ 0.4.8
	cargo/​rand@​0.9.4 ⏵ 0.10.2
	cargo/​rand_chacha@​0.3.1 ⏵ 0.10.0
	cargo/​rand_core@​0.9.0 ⏵ 0.10.1
	cargo/​regex@​1.12.3 ⏵ 1.13.1
	cargo/​subprocess@​1.1.0 ⏵ 1.2.0
	cargo/​tempfile@​3.27.0 ⏵ 3.24.0	+2
	cargo/​clvmr@​0.16.2 ⏵ 0.17.7

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: cargo unicode-ident under Unicode-3.0 License: Unicode-3.0 - The applicable license policy does not permit this license (5) (unicode-ident-1.0.24/LICENSE-UNICODE) From: ? → cargo/rand_chacha@0.10.0 → cargo/chia-bls@0.38.2 → cargo/sha2@0.11.0 → cargo/clvmr@0.17.7 → cargo/pyo3@0.29.0 → cargo/wasm-bindgen@0.2.126 → cargo/serde@1.0.229 → cargo/serde_json@1.0.151 → cargo/wasm-bindgen@0.2.100 → cargo/unicode-ident@1.0.24 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/unicode-ident@1.0.24. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/rand_chacha@0.10.0 → cargo/clvmr@0.17.7 → cargo/zerocopy@0.8.55 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.55. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Native binaries present: cargo cc Location: Package overview From: ? → cargo/chia-bls@0.38.2 → cargo/cc@1.4.0 ℹ Read more on: This package | This alert | Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/cc@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• cargo/libm@0.2.16
• cargo/malachite-nz@0.9.2
• cargo/paste@1.0.15
• cargo/r-efi@5.3.0
• cargo/wit-bindgen@0.57.1
• cargo/js-sys@0.3.103
• cargo/quote@1.0.47
• cargo/zerocopy-derive@0.8.55

View full report

[prozacchiwawa]

@SocketSecurity ignore cargo/libm@0.2.16

[prozacchiwawa]

@SocketSecurity ignore cargo/malachite-nz@0.9.1

[prozacchiwawa]

@SocketSecurity ignore cargo/paste@1.0.15

[prozacchiwawa]

@SocketSecurity ignore cargo/anyhow@1.0.102

[aqk]

@SocketSecurity ignore cargo/prettyplease@0.2.34 cargo/wasmparser@0.244.0 cargo/wit-bindgen-rust-macro@0.51.0 cargo/wit-bindgen-rust@0.51.0 cargo/wit-bindgen@0.57.1

[aqk]

@SocketSecurity ignore cargo/prettyplease@0.2.34 cargo/wasmparser@0.244.0 cargo/wit-bindgen-rust-macro@0.51.0 cargo/wit-bindgen-rust@0.51.0 cargo/wit-bindgen@0.57.1 cargo/prettyplease@0.2.36 cargo/wit-bindgen@0.51.0

[prozacchiwawa]

@SocketSecurity ignore cargo/wit-component@0.244.0

[prozacchiwawa]

@SocketSecurity ignore cargo/js-sys@0.3.103

[prozacchiwawa]

@SocketSecurity ignore cargo/malachite-nz@0.9.2

[prozacchiwawa]

@SocketSecurity ignore cargo/quote@1.0.47

[prozacchiwawa]

@SocketSecurity ignore cargo/r-efi@5.3.0

[prozacchiwawa]

@SocketSecurity ignore cargo/zerocopy-derive@0.8.55

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8e0ea6f. Configure here.}