From ba78092269071ccb3b95f0708212e9b8aade3878 Mon Sep 17 00:00:00 2001 From: Stephan Cilliers Date: Wed, 15 Jul 2026 18:02:49 +0200 Subject: [PATCH 1/2] chore(ci): fix deny advisories and nightly rustdoc lints base-anvil-fork CI is red on two deterministic checks, independent of any feature work: deny / cargo deny check: - RUSTSEC-2026-0204 (crossbeam-epoch <0.9.20): bump via Cargo.lock to 0.9.20. - RUSTSEC-2026-0194 / -0195 (quick-xml <0.41 DoS): ignore. quick-xml 0.18/0.38 are transitive and the fix (>=0.41) isn't reachable via cargo update given foundry's dep tree; matches the existing ignore convention. docs / docs (nightly rustdoc -D warnings): - rustdoc::redundant_explicit_links now flags [revm](foundry_evm::revm) in crates/anvil/src/eth/backend/{mod.rs,db.rs}; drop the redundant explicit target so the label resolves via intra-doc. Verified locally: 'cargo deny --all-features check all' and 'cargo +nightly doc --workspace --all-features --no-deps --document-private-items' both pass. Not addressed here (non-deterministic, upstream/env): test / test all (forge CLI tests) and test / test external (mainnet-fork tests over public RPC). Co-authored-by: OpenCode --- Cargo.lock | 4 ++-- crates/anvil/src/eth/backend/db.rs | 2 +- crates/anvil/src/eth/backend/mod.rs | 2 +- deny.toml | 6 ++++++ 4 files changed, 10 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a013e51a2..9d8a99f3e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3401,9 +3401,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] diff --git a/crates/anvil/src/eth/backend/db.rs b/crates/anvil/src/eth/backend/db.rs index d223421f3..77d3bd3a5 100644 --- a/crates/anvil/src/eth/backend/db.rs +++ b/crates/anvil/src/eth/backend/db.rs @@ -1,4 +1,4 @@ -//! Helper types for working with [revm](foundry_evm::revm) +//! Helper types for working with [`revm`] use std::{ collections::BTreeMap, diff --git a/crates/anvil/src/eth/backend/mod.rs b/crates/anvil/src/eth/backend/mod.rs index be2c90b57..d73394e8e 100644 --- a/crates/anvil/src/eth/backend/mod.rs +++ b/crates/anvil/src/eth/backend/mod.rs @@ -1,6 +1,6 @@ //! blockchain Backend -/// [revm](foundry_evm::revm) related types +/// [`revm`] related types pub mod db; /// In-memory Backend pub mod mem; diff --git a/deny.toml b/deny.toml index e2187d60d..319afb063 100644 --- a/deny.toml +++ b/deny.toml @@ -11,6 +11,12 @@ ignore = [ "RUSTSEC-2025-0141", # proc-macro-error2 is currently still pulled in through alloy's proc-macro stack. "RUSTSEC-2026-0173", + # quick-xml <0.41 DoS advisories (quadratic dup-attr check / unbounded namespace + # allocation). Pulled in transitively; foundry's dep tree still pins quick-xml + # <0.41, so the fix (>=0.41.0) isn't reachable via `cargo update`. Not exploitable + # in normal CLI usage. Remove once the tree reaches quick-xml >=0.41. + "RUSTSEC-2026-0194", + "RUSTSEC-2026-0195", ] # This section is considered when running `cargo deny check bans`. From 818ace5b4c7ae3b16fc0dcf0b0b9bdfd8d723005 Mon Sep 17 00:00:00 2001 From: Stephan Cilliers Date: Wed, 15 Jul 2026 18:56:44 +0200 Subject: [PATCH 2/2] test: sync testdata/forge-std-rev to forge-std v1.16.2 (bf647bd6) The shared test template ('forge init' in crates/test-utils/src/util.rs) writes a foundry.lock pinning forge-std at bf647bd6 (v1.16.2) and then force-checks-out FORGE_STD_REVISION (= testdata/forge-std-rev). Our pin was stale at 620536fa (Apr 2026), so 'forge build' warned about the revision mismatch, breaking the no-warning / snapshot CLI tests (build_no_warning_without_soldeer_lock, cmd::can_clean_without_warnings, test_cmd::repros::issue_9272). Sync the pin to upstream foundry-rs/foundry's testdata/forge-std-rev so the checkout matches the lock. Co-authored-by: OpenCode --- testdata/forge-std-rev | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testdata/forge-std-rev b/testdata/forge-std-rev index 977c31eec..508abbd67 100644 --- a/testdata/forge-std-rev +++ b/testdata/forge-std-rev @@ -1 +1 @@ -620536fa5277db4e3fd46772d5cbc1ea0696fb43 \ No newline at end of file +bf647bd6046f2f7da30d0c2bf435e5c76a780c1b \ No newline at end of file