Bump halfin to v0.4.0

.cargo/audit.toml

@@ -1,7 +1,11 @@
 [advisories]
 ignore = [
+    # Cargo.lock
+    "RUSTSEC-2026-0186", # blame: floresta-chain@v0.5.0 -> memmap2@v0.9.10
+
     # Cargo-recent.lock
     "RUSTSEC-2026-0097", # blame: floresta-wire@v0.5.0 -> bip324@v0.10.0 -> rand@v0.8.5
+    "RUSTSEC-2026-0186", # blame: floresta-chain@v0.5.0 -> memmap2@v0.9.10
 
     # Cargo-minimal.lock
     "RUSTSEC-2024-0421", # blame: floresta-wire@v0.5.0 -> ureq@v3.1.0 -> cookie_store@v0.22.0 -> url@v2.3.1 -> idna@v0.3.0

Cargo-minimal.lock

@@ -384,9 +384,9 @@ checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 
 [[package]]
 name = "bitreq"
-version = "0.3.6"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "212aa2d0cd15d0f5c24d42cdc48f87016660d78ac031bd84a1440a51b46cf7f6"
+checksum = "b65c2e1ab98050c93cc9ada070d5070e014329c65196d03f6f8f1f75c2666f37"
 dependencies = [
  "rustls",
  "rustls-webpki",
@@ -480,9 +480,9 @@ dependencies = [
 
 [[package]]
 name = "corepc-client"
-version = "0.13.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168e5075162cb8c253e8eea1575391c2ef8adde050bf9f3ef29d1cb109364388"
+checksum = "9f6120efc48c970c94978f846c3c1562cb5e3afa8b00039f3a03f9f68ce4b5d6"
 dependencies = [
  "bitcoin",
  "corepc-types",
@@ -494,9 +494,9 @@ dependencies = [
 
 [[package]]
 name = "corepc-types"
-version = "0.12.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1583872320eb2ac629c36753023fd072f1ca1b3b74b20cc62bab055b54278789"
+checksum = "f095534efdb8f2f43d48b9c3e9f35aefdf29ec6a5f1895064f575a67bc2a8dfe"
 dependencies = [
  "bitcoin",
  "serde",
@@ -608,6 +608,18 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5845bf77d497f79416df39462df26d4a8b71dd6440246848ee63709476dbb9a6"
 
+[[package]]
+name = "electrum-client"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1970c5d7bd9de6d4041cbfc3e46faa3e85fe7efcea2b0eb06750d3ae1ef577b7"
+dependencies = [
+ "bitcoin",
+ "log",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.0"
@@ -644,13 +656,13 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.1.0"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11faaf5a5236997af9848be0bef4db95824b1d534ebc64d0f0c6cf3e67bd38dc"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
- "libz-rs-sys",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -890,18 +902,20 @@ dependencies = [
 
 [[package]]
 name = "halfin"
-version = "0.3.7"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07d8fe72e08a2f5c95880ca97840449f7ace1e7ae59dbc0433667ba34c4f4562"
+checksum = "f087a4e5490520412816ab19f3103795045537815ddc1a28002ff4491b7404f4"
 dependencies = [
  "anyhow",
  "bitcoin_hashes 0.20.0",
  "bitreq",
  "corepc-client",
+ "electrum-client",
  "flate2",
  "serde_json",
  "tar",
  "tempfile",
+ "tracing",
  "which",
  "zip",
 ]
@@ -1252,15 +1266,6 @@ version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
-[[package]]
-name = "libz-rs-sys"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "902bc563b5d65ad9bba616b490842ef0651066a1a1dc3ce1087113ffcb873c8d"
-dependencies = [
- "zlib-rs",
-]
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.11"
@@ -1355,11 +1360,12 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b1c9bd4fe1f0f8b387f6eb9eb3b4a1aa26185e5750efb9140301703f62cd1b"
+checksum = "8e3e04debbb59698c15bacbb6d93584a8c0ca9cc3213cb423d31f760d8843ce5"
 dependencies = [
  "adler2",
+ "simd-adler32",
 ]
 
 [[package]]
@@ -1913,9 +1919,9 @@ dependencies = [
 
 [[package]]
 name = "tar"
-version = "0.4.45"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
 dependencies = [
  "filetime",
  "libc",
@@ -2432,9 +2438,9 @@ dependencies = [
 
 [[package]]
 name = "which"
-version = "8.0.0"
+version = "8.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3fabb953106c3c8eea8306e4393700d7657561cb43122571b172bbfb7c7ba1d"
+checksum = "81995fafaaaf6ae47a7d0cc83c67caf92aeb7e5331650ae6ff856f7c0c60c459"
 
 [[package]]
 name = "winapi"
@@ -2834,9 +2840,9 @@ dependencies = [
 
 [[package]]
 name = "zlib-rs"
-version = "0.4.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b20717f0917c908dc63de2e44e97f1e6b126ca58d0e391cee86d504eb8fbd05"
+checksum = "a7948af682ccbc3342b6e9420e8c51c1fe5d7bf7756002b4a3c6cabfe96a7e3c"
 
 [[package]]
 name = "zmij"

Cargo-recent.lock

@@ -459,9 +459,9 @@ dependencies = [
 
 [[package]]
 name = "corepc-client"
-version = "0.13.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168e5075162cb8c253e8eea1575391c2ef8adde050bf9f3ef29d1cb109364388"
+checksum = "9f6120efc48c970c94978f846c3c1562cb5e3afa8b00039f3a03f9f68ce4b5d6"
 dependencies = [
  "bitcoin",
  "corepc-types",
@@ -473,9 +473,9 @@ dependencies = [
 
 [[package]]
 name = "corepc-types"
-version = "0.12.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1583872320eb2ac629c36753023fd072f1ca1b3b74b20cc62bab055b54278789"
+checksum = "f095534efdb8f2f43d48b9c3e9f35aefdf29ec6a5f1895064f575a67bc2a8dfe"
 dependencies = [
  "bitcoin",
  "serde",
@@ -582,6 +582,18 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
+[[package]]
+name = "electrum-client"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1970c5d7bd9de6d4041cbfc3e46faa3e85fe7efcea2b0eb06750d3ae1ef577b7"
+dependencies = [
+ "bitcoin",
+ "log",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -868,18 +880,20 @@ dependencies = [
 
 [[package]]
 name = "halfin"
-version = "0.3.7"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07d8fe72e08a2f5c95880ca97840449f7ace1e7ae59dbc0433667ba34c4f4562"
+checksum = "f087a4e5490520412816ab19f3103795045537815ddc1a28002ff4491b7404f4"
 dependencies = [
  "anyhow",
  "bitcoin_hashes 0.20.0",
  "bitreq",
  "corepc-client",
+ "electrum-client",
  "flate2",
  "serde_json",
  "tar",
  "tempfile",
+ "tracing",
  "which",
  "zip",
 ]

Cargo.toml

@@ -47,7 +47,7 @@ dns-lookup = { version = "=2.1.1" } # blame: floresta-wire 55c563
 bitcoin-consensus-encoding = { version = "=1.0.0-rc.3" } # blame: bitcoin-io v0.3.0 (Encodable->Encode/Decodable->Decode)
 
 [dev-dependencies]
-halfin = { version = "=0.3.7" }
+halfin = { version = "=0.4.0" }
 anyhow = { version = "=1.0.102" }
 tokio = { version = "=1.52.3", features = ["macros", "rt-multi-thread"] }
 

contrib/run-cargo-audit.sh

@@ -8,7 +8,7 @@
 # Vulnerabilities and warnings which do not stem from direct
 # dependencies show the full dependency tree for the affected package.
 
-set -uo pipefail
+set -euo pipefail
 
 # Check if `cargo-audit`, `cargo-rbmt`, `jq`, and `python3` are installed
 command -v cargo-audit >/dev/null 2>&1 || { echo "cargo-audit was not found on \$PATH"; exit 1; }
@@ -17,6 +17,7 @@ command -v jq >/dev/null 2>&1 || { echo "jq was not found on \$PATH"; exit 1; }
 command -v python3 >/dev/null 2>&1 || { echo "python3 was not found on \$PATH"; exit 1; }
 
 WARNING_COUNTER=0
+WARNING_FAILURE_COUNTER=0
 VULNERABILITY_COUNTER=0
 
 LOCKFILES=("Cargo.lock" "Cargo-recent.lock" "Cargo-minimal.lock")
@@ -141,10 +142,17 @@ format_findings() {
         local package_name
         local package_version
         local title
-        advisory_id=$(echo "$finding" | jq -r '.advisory.id')
+        advisory_id=$(echo "$finding" | jq -r '.advisory.id // (.kind | ascii_upcase) // "UNKNOWN"')
         package_name=$(echo "$finding" | jq -r '.package.name')
         package_version=$(echo "$finding" | jq -r '.package.version')
-        title=$(echo "$finding" | jq -r '.advisory.title')
+        title=$(echo "$finding" | jq -r '
+            .advisory.title //
+            if .kind == "yanked" then
+                "crate version was yanked"
+            else
+                "non-advisory cargo-audit warning"
+            end
+        ')
 
         local branch
         local branch_transitive
@@ -170,6 +178,8 @@ format_findings() {
 
         [ "$index" -lt $((total - 1)) ] && echo "${indent}│"
     done
+
+    return 0
 }
 
 # Copy the given lockfile to `Cargo.lock`, run `cargo audit`,
@@ -183,14 +193,22 @@ process_lockfile() {
 
     local audit_output
     audit_output=$(cargo audit --json 2>/dev/null) || true
+    if [ -z "$audit_output" ] || ! jq -e . >/dev/null <<< "$audit_output"; then
+        echo "cargo audit failed for $lockfile" >&2
+        exit 1
+    fi
 
     local vulnerabilities
     vulnerabilities=$(echo "$audit_output" | jq '.vulnerabilities.count // 0')
 
     local warnings
     warnings=$(echo "$audit_output" | jq '[.warnings | to_entries[] | .value | length] | add // 0')
 
+    local warning_failures
+    warning_failures=$(echo "$audit_output" | jq '[.warnings | to_entries[] | .value[] | select(.kind != "yanked")] | length')
+
     WARNING_COUNTER=$((WARNING_COUNTER + warnings))
+    WARNING_FAILURE_COUNTER=$((WARNING_FAILURE_COUNTER + warning_failures))
     VULNERABILITY_COUNTER=$((VULNERABILITY_COUNTER + vulnerabilities))
 
     WARNING_COUNT[$lockfile]=$warnings
@@ -250,7 +268,7 @@ process_lockfile "Cargo-minimal.lock"
 
 echo ""
 
-if [ "$WARNING_COUNTER" -gt 0 ] || [ "$VULNERABILITY_COUNTER" -gt 0 ]; then
+if [ "$WARNING_FAILURE_COUNTER" -gt 0 ] || [ "$VULNERABILITY_COUNTER" -gt 0 ]; then
     echo "> Audit Status: FAILED"
 else
     echo "> Audit Status: SUCCESS"
@@ -282,6 +300,6 @@ for ((i=0; i<lockfile_total; i++)); do
     fi
 done
 
-if [ "$WARNING_COUNTER" -gt 0 ] || [ "$VULNERABILITY_COUNTER" -gt 0 ]; then
+if [ "$WARNING_FAILURE_COUNTER" -gt 0 ] || [ "$VULNERABILITY_COUNTER" -gt 0 ]; then
     exit 1
 fi