Skip to content

Conversation

@la10736
Copy link
Contributor

@la10736 la10736 commented Jan 7, 2026

To fix cargo audit issue we upgraded ruint crate from 1.16.000 to 1.17.2. This crate was used just by yperbridge modules in the old zkverify's tag and with the newer tag we discovered that also the last risc0 circuit use it.

mdamico@miklap:~/devel/zkVerify-EVM-Parachain$ cargo tree -i ruint
ruint v1.17.2
├── alloy-primitives v0.7.7
│   ├── alloy-sol-types v0.7.7
│   │   ├── pallet-token-gateway v2412.0.0
│   │   │   └── zkv-runtime v1.3.1 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
│   │   │       ├── vk-hash v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
│   │   │       │   └── zkv-service v11.0.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
│   │   │       │       ├── cumulus-relay-chain-inprocess-interface v0.22.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
│   │   │       │       │   └── cumulus-client-service v0.22.0
│   │   │       │       │       └── vflow-node v1.0.2 (/home/mdamico/devel/zkVerify-EVM-Parachain/node)
│   │   │       │       ├── cumulus-relay-chain-minimal-node v0.22.1 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
│   │   │       │       │   └── cumulus-client-service v0.22.0 (*)
│   │   │       │       └── zkv-cli v11.0.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
│   │   │       │           ├── cumulus-relay-chain-inprocess-interface v0.22.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
│   │   │       │           └── vflow-node v1.0.2 (/home/mdamico/devel/zkVerify-EVM-Parachain/node)
│   │   │       ├── zkv-cli v11.0.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
│   │   │       └── zkv-service v11.0.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
│   │   └── token-gateway-primitives v2412.0.0
│   │       └── pallet-token-gateway v2412.0.0 (*)
│   ├── pallet-token-gateway v2412.0.0 (*)
│   └── token-gateway-primitives v2412.0.0 (*)
├── alloy-primitives v0.8.26
│   ├── alloy-dyn-abi v0.8.26
│   │   └── pallet-hyperbridge-aggregations v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
│   │       └── zkv-runtime v1.3.1 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
│   ├── alloy-json-abi v0.8.26
│   │   └── alloy-dyn-abi v0.8.26 (*)
│   ├── alloy-sol-types v0.8.26
│   │   └── alloy-dyn-abi v0.8.26 (*)
│   └── pallet-hyperbridge-aggregations v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
├── alloy-primitives v1.4.1
│   ├── alloy-core v1.4.1
│   │   └── alloy v1.0.30
│   │       [dev-dependencies]
│   │       └── vflow-runtime v1.1.0 (/home/mdamico/devel/zkVerify-EVM-Parachain/runtime/vflow)
│   │           └── vflow-node v1.0.2 (/home/mdamico/devel/zkVerify-EVM-Parachain/node)
│   └── alloy-sol-types v1.4.1
│       [dev-dependencies]
│       └── vflow-runtime v1.1.0 (/home/mdamico/devel/zkVerify-EVM-Parachain/runtime/vflow) (*)
└── risc0-binfmt v3.0.3
    └── risc0-circuit-rv32im v4.0.3
        └── risc0-verifier v0.11.0 (https://github.com/zkVerify/risc0-verifier.git?tag=v0.11.0#24626895)
            ├── native v0.3.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
            │   ├── pallet-ezkl-verifier v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
            │   │   ├── vk-hash v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   │   └── zkv-runtime v1.3.1 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   ├── pallet-groth16-verifier v0.2.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
            │   │   ├── vk-hash v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   │   └── zkv-runtime v1.3.1 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   ├── pallet-risc0-verifier v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
            │   │   └── zkv-runtime v1.3.1 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   ├── pallet-ultrahonk-verifier v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
            │   │   ├── vk-hash v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   │   └── zkv-runtime v1.3.1 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   ├── pallet-ultraplonk-verifier v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a)
            │   │   ├── vk-hash v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   │   └── zkv-runtime v1.3.1 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   ├── zkv-cli v11.0.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            │   └── zkv-service v11.0.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)
            └── pallet-risc0-verifier v0.1.0 (https://github.com/zkVerify/zkVerify.git?tag=v1.1.0-20251212#f267913a) (*)

Anyway, vflow-runtime doesn't depend on it in release mode.

@la10736 la10736 requested review from 95DDB and drgora January 7, 2026 12:02
Copy link
Contributor

@drgora drgora left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@la10736 la10736 merged commit a64c885 into main Jan 12, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants