[rayyan224]

Motivation

deny / cargo deny check fails on every PR against base-anvil-fork (red on #91 and #92, which merged with it red). All other CI checks on #92 passed (clippy, test all, test external, docs, doctest, crate-checks, forge-fmt, rustfmt, typos, shellcheck, CodeQL Analyze).

The failure is not caused by the base/base pin bump. Between 541626f and 2549ee7 Cargo.lock only changed the base-* git source revs. The failing crates are unchanged. RustSec published new advisories against them between 2026-10-09 and 2026-10-23 and CI uses the latest advisory DB. The last green CI run on the repo was 2026-10-11, before most of them.

Advisories reported by cargo deny --all-features check all (reproduced locally with cargo-deny 0.19.4, identical to the CI log):

Advisory	Crate (old version)	Fixed in
RUSTSEC-2026-0346/0347/0348/0349	rustls 0.23.45	>=0.23.46
RUSTSEC-2026-0382	rustls-webpki 0.103.14	>=0.103.16
RUSTSEC-2026-0381	webpki-roots 1.0.9	>=1.0.10
RUSTSEC-2026-0383	webpki-root-certs 1.0.9	>=1.0.10
RUSTSEC-2026-0386 (unsound)	tokio 1.53.1	>=1.53.3
RUSTSEC-2026-0385	ctutils 0.3.1 and 0.4.2	>=0.4.4
RUSTSEC-2026-0367/0368/0369	zip 4.6.1 (via soldeer-core) and zip 8.6.0 (via svm-rs)	>=9.0.0

Solution

Targeted lockfile bumps, plus two manifest-level moves where a dependent pinned the vulnerable major:

Crate	Before	After	Why
rustls	0.23.45	0.23.46	cargo update --precise
rustls-webpki	0.103.14	0.103.16	--precise
webpki-roots	1.0.9	1.0.10	--precise
webpki-root-certs	1.0.9	1.0.10	--precise
tokio	1.53.1	1.53.3	--precise
ctutils	0.4.2 and 0.3.1	0.4.4 only	0.4.2 bumped; 0.3.1 was required by commonware-cryptography 2026.7.1 (^0.3.1), which has no fixed 0.3.x
commonware-{codec,codec-macros,cryptography,formatting,macros,macros-impl,math,parallel,utils}	2026.7.1	2026.9.0	semver-compatible with tempo's 2026.7.0 requirement; 2026.9.0 uses ctutils ^0.4.2. Pulls chacha20poly1305 0.10.1 -> 0.11.0, poly1305 0.8 -> 0.9.1, aead 0.5.2 -> 0.6.1, universal-hash 0.5.1 -> 0.6.1
chacha20	0.10.1 / 0.9.1	0.10.2	0.10.1 is yanked (would add a new yanked warning)
svm-rs, svm-rs-builds	0.5.26	0.5.30	first release using zip ^9 (0.5.27-0.5.29 use ^8)
zip	4.6.1 and 8.6.0	9.0.5 only	consequence of the two rows above and below
soldeer-core, soldeer-commands	=0.10.0	=0.12.1	0.10.x/0.11.x use zip ^4 + zip-extract. 0.12.1 uses zip ^9 and drops zip-extract. Same version upstream foundry pins. Workspace Cargo.toml change
cliclack	0.3.8	0.5.6	soldeer-commands 0.12.1 dependency
dirs (adds 7.0.0), digest-io, inout, cipher (adds 0.5.2)			new transitive deps
zip-extract, env_filter, env_logger, opaque-debug, toml_edit 0.23.10, wasm-streams 0.4.2, cmov 0.4.6	removed		no longer in the tree

deny.toml: removed the RUSTSEC-2025-0172 (zip-extract unmaintained) ignore. zip-extract is gone, so the entry only produced an advisory-not-detected warning. No new ignores were added. The base/base pin and DEFAULT_BASE_UPGRADE are untouched. No Rust source changed.

Verification (local, rust 1.96.0):

• cargo deny --all-features check all: advisories ok, bans ok, licenses ok, sources ok
• cargo check --workspace --all-targets: ok
• cargo test -p foundry-evm-networks: ok
• cargo test -p anvil --lib base: 4 passed
• cargo test -p forge --test cli -- soldeer: 11 passed (exercises the soldeer 0.12.1 upgrade)
• cargo fmt --check: ok

Left as is: cargo deny still prints warnings that do not fail the job: unmatched license exception/allowance (tiny-keccak, OpenSSL), 7 unmatched allow-git sources, and yanked clipboard-win 5.4.1 / wnaf 0.14.0.

Not addressed here: the scheduled test-flaky and test-isolate workflows have failed every day since at least 2026-09-14, long before #91/#92. They fail on network-dependent tests (RPC free-plan limits, solc download, etherscan/blockscout). They are unrelated to cargo-deny and this PR.

PR Checklist

• Added Tests
• Added Documentation
• Breaking changes