Skip to content

deps: bump alloy 2.4.0/1.6.1, revm 42.0.1, op-revm for reth 2.5.0 compat (Beryl) - #70

Merged
rayyan224 merged 8 commits into
release/v1.1.xfrom
backport/beryl-reth-2.5.0-deps
Aug 20, 2026
Merged

deps: bump alloy 2.4.0/1.6.1, revm 42.0.1, op-revm for reth 2.5.0 compat (Beryl)#70
rayyan224 merged 8 commits into
release/v1.1.xfrom
backport/beryl-reth-2.5.0-deps

Conversation

@rayyan224

@rayyan224 rayyan224 commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Summary

This is the Beryl-line counterpart of #69, which fixed the same issue on
mainline (Cobalt).

base/base is on reth 2.5.0 (base/base#4390), which bumped its workspace
alloy-* family to 2.4.0 (and alloy-primitives/alloy-sol-types to
1.6.1, alloy-evm to 0.38.0, revm to 42.0.1). The base-std-fork-tests.yml
CI job in base/base runs the same "patch base-common-precompiles /
base-common-chains into the pinned base-anvil snapshot" build step for
both the Beryl and Cobalt matrix rows. Since release/v1.1.x still
locks the older 1.x/41.x dependency set, that patch step fails Cargo's
resolver for the Beryl row exactly the way it did for Cobalt before #69
(error: failed to select a version for alloy-primitives...).

This follows the same pattern as #55 → mainline, and #58 → #59 for the
Beryl line: bump this branch's pinned deps to match, without pulling in
any Cobalt-only precompile-install semantics.

Changes

Cherry-picked from #69 (9df661bc3), plus one Beryl-specific correction:

  • alloy-* 2.0.5 -> 2.4.0; alloy-primitives/alloy-sol-types/alloy-dyn-abi/alloy-json-abi/alloy-sol-macro-* 1.6.0 -> 1.6.1; op-alloy-* 0.24.0 -> 2.0.0; alloy-evm 0.37.0 -> 0.38.0
  • revm 41.0.0 -> 42.0.1, revm-inspectors 0.41.1 -> 0.42.2; op-revm switched to a git dependency on foundry-rs/optimism (moved out of the standalone foundry-rs/op-revm repo)
  • foundry-fork-db and tempo-primitives git pins bumped to revm-42-compatible revisions
  • Re-pinned base-common-precompiles/base-common-chains to base/base cea79451170a576cd9fd7d8189b660daceb45001 (same rev as mainline — this bump landed after the Beryl→Cobalt retarget on mainline, purely to pick up a ChainConfig/bogota_time field addition in base-common-chains; Beryl-line code still calls ActivationRegistry::install with BaseUpgrade::Beryl and is unaffected by which base/base commit is pinned)
  • Source-level API-break fixes (revm-handler GasTracker param, CreateOutcome::new, OpHardfork mapping, EIP-2780 param, NamedChain::VARIANT_NAMES, StateGasTracer tracer arm) and a BlueOak-1.0.0 license allowance, matching deps: bump alloy 2.4.0/1.6.1, revm 42.0.1, op-revm for reth 2.5.0 compat #69
  • Beryl-specific fix not needed on mainline: manually bumped alloy-chains 0.2.34 -> 0.2.37 to pick up the NamedChain::VARIANT_NAMES rename — cargo check alone kept the older semver-compatible 0.2.34 since nothing else in this branch's graph forced the bump
  • Dropped the #69 commit updating the -j/--threads alias help snapshot to clap 4.6's singular [alias: X] wording — this branch's lockfile resolves clap to 4.5.54 (pre-4.6 plural [aliases: X] behavior), so that snapshot change doesn't apply here; picking it up would have made the test fail

Verification

  • cargo check --no-default-features --features anvil/cli -p anvil -p forge — clean
  • cargo clippy --no-default-features --features anvil/cli -p anvil -p forge --workspace -- -D warnings — clean

Note on release versioning

release/v1.1.x is currently tagged through v1.1.1 (at #54, before the
Beryl activation-install fix in #59 and the RPC fallback fixes already on
this branch). Once this merges, the next release cut from this branch
should be tagged v1.1.2 — a patch bump, consistent with this being a
pure dependency-compat fix with no behavior change.

Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

meyer9 and others added 7 commits August 20, 2026 11:13
@meyer9 @rayyan224
deps: bump alloy 2.4.0/1.6.1, revm 42.0.1, op-revm for reth 2.5.0 compat
ac2eae0 
Bumps the alloy-* family (2.0.5 -> 2.4.0, alloy-primitives/alloy-sol-types
1.6.0 -> 1.6.1), alloy-evm 0.37.0 -> 0.38.0, and revm 41.0.0 -> 42.0.1 to
match the dependency set required by base/base's reth 2.5.0 upgrade.

op-revm moved from the standalone foundry-rs/op-revm repo into the
foundry-rs/optimism monorepo (rust/op-revm); switched to a direct git
dependency at foundry-rs/optimism@566d19e, matching the [patch.crates-io]
pins for alloy-op-evm/op-alloy-*/alloy-op-hardforks. Also bumped
foundry-fork-db and tempo-primitives pins to revisions compatible with
revm 42, since the previous pins pulled stray older revm versions into
the lockfile.

Version combination validated against upstream foundry-rs/foundry's
master branch Cargo.toml, which already carries this exact dependency
set.

Source changes required by the resulting API breaks:
- revm-handler: Handler::last_frame_result gained a GasTracker parameter
  (crates/evm/core/src/evm.rs)
- revm-interpreter: CreateOutcome gained charged_create_state_gas; switch
  all call sites to the new CreateOutcome::new(result, address)
  constructor (evm.rs, cheatcodes/inspector.rs, inspectors/stack.rs)
- alloy-op-hardforks 0.5.0 removed OpHardfork::Interop in favor of
  Karst/Lagoon; update the OpHardfork -> OpSpecId mapping and its test
  (crates/evm/core/src/hardfork.rs)
- revm-context-interface: calculate_initial_tx_gas gained an EIP-2780
  eip2780 parameter; pass None to preserve prior semantics in the
  reporting-only gas recomputation (executors/mod.rs)
- strum 0.28 renamed NamedChain::VARIANTS to NamedChain::VARIANT_NAMES
  (cli/opts/chain.rs, forge/cmd/cache.rs)
- alloy-rpc-types-trace 2.4.1 added GethDebugBuiltInTracerType::StateGasTracer;
  bundle it into the existing 'unsupported tracer' arms, matching
  upstream foundry-rs/foundry (anvil/eth/backend/mem/mod.rs)

Verified anvil and forge build and run (--version) with:
  cargo build --release --no-default-features --features anvil/cli -p anvil -p forge

(cherry picked from commit dd63c96)
@meyer9 @rayyan224
deps: bump pinned base/base rev to main HEAD
a836b66 
base/base#4390 (reth 2.5.0 upgrade) has merged to main, which bumped
alloy-genesis and added a bogota_time field to ChainConfig literals in
base-common-chains. The previously pinned base/base commit predates that
change and fails to compile against this repo's now-newer alloy-genesis
version (missing-field E0063 on ChainConfig).

Repoint crates/evm/networks/Cargo.toml at base/base main HEAD
(cea79451170a576cd9fd7d8189b660daceb45001), via ./script/bump-base.sh main.

Verified: cargo build --release -p anvil -p forge succeeds, both binaries
run --version successfully.

(cherry picked from commit 33efc58)
@meyer9 @rayyan224
chore: allow BlueOak-1.0.0 license
48ee191 
The alloy 2.4.0 bump pulls in a newer evmole (via cast), which now
depends on minicbor v2.3.0, licensed BlueOak-1.0.0 (OSI-approved
permissive license). Allow it in deny.toml, matching upstream
foundry-rs/foundry's deny.toml which already allows this license.

Verified: cargo deny --all-features check all now reports
'licenses ok' (previously failed with license-rejected).

(cherry picked from commit b6c214f)
@meyer9 @rayyan224
fix: satisfy clippy -D warnings after alloy/revm bump
f1bbb04 
Two issues surfaced only under CI's clippy job (which runs with
RUSTFLAGS=-Dwarnings, unlike a plain cargo build):

- crates/cli and crates/forge declared a direct 'strum' dependency that
  became unused once NamedChain::VARIANTS was renamed to
  NamedChain::VARIANT_NAMES (a strum 0.28 rename, re-exported via
  alloy-chains) and the 'use strum::VariantNames' import was dropped.
  Removed the now-unused dependency from both crates' Cargo.toml,
  matching upstream foundry-rs/foundry, which does not declare strum in
  either crate.
- The alloy/revm bump pulled a newer transitive 'time' crate (0.3.47 ->
  0.3.55), crossing the version where 'format_description::parse' was
  deprecated in favor of 'format_description::parse_borrowed::<VERSION>'.
  Switched crates/chisel/src/session.rs to parse_borrowed::<1>, which is
  exactly what the deprecated function forwarded to internally, so
  behavior is unchanged.

(cherry picked from commit 9dd5be1)
@meyer9 @rayyan224
test: update --jobs alias snapshot for clap 4.6 singular wording
413574c 
clap 4.6 renders [alias: X] (singular) instead of [aliases: X] when a
flag has exactly one alias. Update the -j/--threads help snapshots in
forge and cast to match.

(cherry picked from commit b0004b8)
@rayyan224
Revert "test: update --jobs alias snapshot for clap 4.6 singular word…
5393cb9 
…ing"

This reverts commit 413574c.
@rayyan224 @claude
deps: regenerate Cargo.lock for reth 2.5.0 dep bump (Beryl)
4a2d931 
The alloy/revm/op-revm/base-common-* Cargo.toml bumps in the preceding
commits left Cargo.lock unresolved for this branch's dependency graph
(release/v1.1.x diverged from mainline before those bumps landed).
Regenerated via `cargo check` against the new constraints.

alloy-chains additionally needed a manual bump (0.2.34 -> 0.2.37) to
pick up the `NamedChain::VARIANT_NAMES` rename that
crates/cli/src/opts/chain.rs now calls; `cargo check` alone kept the
older semver-compatible 0.2.34 since nothing else forced the bump.

Verified: `cargo check --no-default-features --features anvil/cli -p anvil -p forge`
and `cargo clippy` (same flags, -D warnings) both pass.

Co-Authored-By: Claude <noreply@anthropic.com>
@rayyan224
rayyan224 requested review from haardikk21 and refcell and removed request for haardikk21 August 20, 2026 15:24
@rayyan224 @claude
fix(deps): resolve cargo-deny advisory failures on the Beryl line
4478e74 
release/v1.1.x hadn't picked up mainline's ruint security fix (#63,
73d1546), and had otherwise drifted enough that `cargo deny check
advisories` now fails outright:

- ruint 1.17.2: RUSTSEC-2026-0220 (incorrect overflow flags / truncated
  shift amounts in Uint shift ops). Same fix as #63, never backported.
- h2 0.4.13: RUSTSEC-2026-0258 (unbounded empty DATA frames, low severity).
- webbrowser 1.0.6: RUSTSEC-2026-0257 (BROWSER-template argument injection
  on Unix).
- The RUSTSEC-2025-0141 (bincode unmaintained) ignore entry in deny.toml
  is now stale on this branch too — nothing in the resolved graph matches
  it anymore, so cargo-deny's advisory-not-detected check fails on the
  unused entry. Removed, matching #63.

Fixed via `cargo update -p h2 --precise 0.4.16 -p ruint --precise 1.20.0
-p webbrowser --precise 1.2.2` plus the deny.toml edit.

Verified: `cargo deny --all-features check all` reports
'advisories ok, bans ok, licenses ok, sources ok'.

Co-Authored-By: Claude <noreply@anthropic.com>
@rayyan224

rayyan224 commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Pushed a follow-up commit: the initial dep bump left `cargo deny check advisories` failing on this branch. Turned out to be unrelated to the alloy/revm bump itself — `release/v1.1.x` had never picked up mainline's ruint security fix (#63), plus two more recently-published advisories (`h2`, `webbrowser`) that apply regardless of this PR:

`cargo deny --all-features check all` now reports `advisories ok, bans ok, licenses ok, sources ok` locally.

@rayyan224
rayyan224 merged commit 8d0f5b8 into release/v1.1.x Aug 20, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@refcell refcell refcell approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rayyan224 @refcell @meyer9