[pablodeymo]

🗒️ Description / Motivation

cargo audit against main reports 14 advisories in the root lockfile and
11 in tooling/event-monitor's. This PR is the follow-up #718 announced:
the rustls set has cleared the 14-day publish-age cooldown, and so have
fixes for quick-xml, zstd-sys and ruint. It also stops compiling
libp2p's DNS, mDNS, websocket, relay, kad and upnp transports, which the
swarm never builds from, so hickory-dns leaves the build graph instead
of waiting on a fork rebase.

What Changed

Lockfiles, via make update UPDATE_ARGS="-p ..." so the cooldown is applied:

Crate	From → to	Advisories fixed	Reachable here?
rustls (both lockfiles)	0.23.40 → 0.23.46	0285 (TLS 1.3 handshake messages accepted across encryption levels), 0346, 0348, 0349	Yes: libp2p-quic/libp2p-tls on every QUIC peer, plus reqwest
quick-xml via inferno 0.12.6 → 0.12.8	0.39.4 → 0.41.0	0194, 0195 (CVSS 7.5)	No: only inferno's flamegraph SVG under jemalloc_pprof
zstd-sys	2.0.16 → 2.1.2	0410	No: wasm allocator shim
ruint	1.18.0 → 1.20.1	0220	Reached through leanVM's xmss → ethereum_ssz; adds ark-ff 0.6 to the lock as an inactive optional dep
quinn-proto (event-monitor only)	0.11.16 → 0.11.19	0185, 0338, 0339, 0340, 0342	Same set #718 fixed on the root lockfile

rustls-webpki, rustls-pki-types, webpki-roots and aws-lc-rs/aws-lc-sys move to the newest version the cooldown allows, which is what lets rustls reach 0.23.46.

crates/net/p2p/Cargo.toml: libp2p goes from features = ["full"] to the eleven features the swarm is built from (ed25519, gossipsub, identify, macros, noise, quic, request-response, secp256k1, tcp, tokio, yamux). That removes ~40 crates from the lock: the unsound rand 0.7 family, webpki-roots 0.26, soketto, sysinfo, libp2p-{autonat,dcutr,floodsub,kad,ping,plaintext,pnet,relay,rendezvous,uds,websocket,...}.

Correctness / Behavior Guarantees

• No Rust source touched. Every lockfile bump is semver-compatible; make cooldown-check passes on both manifests.
• The libp2p feature list is derived from the libp2p:: modules the p2p crate imports and the SwarmBuilder calls in build_swarm (with_tcp, with_quic, with_behaviour); cargo check and the p2p tests confirm nothing else was in use.
• hickory-proto and libp2p-{dns,mdns,metrics,upnp} still appear in Cargo.lock, so cargo audit keeps reporting RUSTSEC-2026-0118/0119. That is cargo's lock resolver keeping optional deps that a weak feature (libp2p-dns?/tokio) names; cargo tree -i hickory-proto shows no dependent, and nothing links it.

After this PR cargo audit reports 6 advisories on the root lockfile (down
from 14) and 2 on event-monitor's (down from 11): rustls-webpki,
webpki-roots/webpki-root-certs and libz-sys fixes still inside the
cooldown (until 2026-11-03 and 2026-11-11), crypto-bigint (needs k256
0.14 upstream), and the lock-only hickory-proto entry described above.

Tests Added / Run

None added: no source touched.

• make cooldown-check (resolver probe on both manifests): passes
• make lint: clean
• cargo test -p ethlambda-p2p: 362 passed
• make test: 2868 passed, 0 failed
• cargo audit: 14 → 6 (root), 11 → 2 (event-monitor)

Related Issues / PRs

• Follow-up to chore(deps): bump quinn-proto, h2, rkyv and crossbeam-epoch past RustSec advisories #718
• Next follow-up: rustls-webpki / webpki-roots / webpki-root-certs after 2026-11-03, libz-sys after 2026-11-11

✅ Verification Checklist

• Ran make fmt — clean
• Ran make lint (clippy with -D warnings) — clean
• Ran make test (test-consensus plus test-node, at release-fast) — all passing

[github-actions]

🤖 Codex Code Review

No correctness or consensus-risk issues stand out in this PR. It is effectively a dependency-surface reduction in crates/net/p2p/Cargo.toml:25, plus lockfile churn.

• crates/net/p2p/Cargo.toml:25 switches libp2p from "full" to an explicit feature list that matches the code paths used by build_swarm in crates/net/p2p/src/lib.rs:962 (tcp, quic, noise, yamux, gossipsub, identify, request-response, tokio, macros, identity key types). That looks correct and should reduce attack surface, compile time, and transitive dependency load.
• I do not see any consensus-layer logic changes: no fork choice, attestation validation, justification/finalization, state transition, XMSS, or SSZ implementation changes are touched in this PR.
• Security-wise, removing unused libp2p features is a net positive. In particular, not pulling in unused networking stacks like DNS/MDNS/websocket/relay/Kademlia reduces exposed code and dependency risk.
• Performance-wise, this should help build times and binary size. I do not see runtime regressions from the manifest change itself.

Minor note

• Cargo.lock and tooling/event-monitor/Cargo.lock contain a fair amount of unrelated version churn. That is not necessarily wrong, but it makes review/audit harder. If this was not intentional, consider minimizing lockfile updates to just the libp2p feature-driven resolution changes for easier reproducibility and review.

Validation

• I attempted cargo check -p ethlambda-p2p, but the environment blocks rustup temp-file creation under /home/runner/.rustup, so I could not complete a compile check here. If you want, I can still do a deeper static review of the resolved libp2p feature set against the exact APIs used in crates/net/p2p/src/lib.rs:962.

---

Automated review by OpenAI Codex · gpt-5.4 · custom prompt

[github-actions]

🤖 Claude Code Review

Review of PR 751: lockfile bumps and libp2p feature trim

This PR touches only Cargo.lock, tooling/event-monitor/Cargo.lock and crates/net/p2p/Cargo.toml, and it looks good. I read the manifest change and searched the source. I did not build or test the PR, and I did not read the whole lockfile diff.

libp2p feature trim (crates/net/p2p/Cargo.toml:32-44)

• The eleven remaining features cover every libp2p:: path the crate imports: gossipsub, identify, identity, quic, tcp, yamux, noise, request_response, swarm, core and connection_limits. core and swarm come with the facade.
• connection_limits has no feature flag in the facade, which is consistent with it still being used after the change.
• Nothing in the source references libp2p::ping, dns, mdns, kad, relay or upnp, so removing those features is safe.
• libp2p-mplex is a separate direct dependency pinned to the same rev (Cargo.toml:50), and it stays in the lock. The TCP mplex fallback for mainnet peers is therefore unaffected.
• libp2p-tls stays as a dependency of libp2p-quic, so the QUIC transport still has TLS.
• libp2p-metrics is still in the lock, so the feature set the code compiles against looks intact.
• Gossipsub peer scoring and the connection-limit enforcement the swarm relies on don't use any of the removed behaviours.

Lockfile bumps

• The rustls bump to 0.23.46 is the substantive security fix. It is reachable through QUIC and reqwest.
• The ruint bump (1.18 to 1.20.1) is reached through leanVM's xmss and ethereum_ssz, which is on the SSZ path. It is a semver-compatible patch and the new ark-ff 0.6 is an inactive optional dependency. The PR reports make test at 2868 passed, which includes the SSZ and spec tests. This is the bump I would watch most closely.
• Dropping the rand 0.7 family and getrandom 0.1 is a plus.

Nits

• hickory-proto and libp2p-{dns,mdns,upnp} remain in the lock only through weak-feature resolution, so cargo audit will keep flagging RUSTSEC-2026-0118/0119. If that noise matters, a cargo audit ignore entry with a comment linking the explanation would help. The PR description already documents it.
• The make cooldown-check and make test results come from the PR description. I'd confirm CI is green before merging.

No blocking issues.

---

Automated review by Claude (Anthropic) · sonnet · custom prompt

[github-actions]

🤖 Kimi Code Review

I'll review this PR which appears to be a dependency cleanup focused on reducing the libp2p feature set and updating related crates.

Summary

This PR reduces the libp2p feature set from "full" to a minimal set of required features, and updates several dependencies. The Cargo.lock changes show significant dependency tree pruning (removing ~20+ crates including libp2p-kad, libp2p-relay, libp2p-websocket, etc.).

Issues Found

1. Potential Runtime Panic: Missing wasm-bindgen-futures in libp2p-swarm

File: Cargo.lock, libp2p-swarm entry (line ~4280 in new lockfile)

The upstream libp2p-swarm crate at your fork revision may conditionally depend on wasm-bindgen-futures for WASM targets. By removing "full" features, you might lose WASM-specific dependencies that were transitively included. However, looking at the lockfile diff, wasm-bindgen-futures is removed from libp2p-swarm dependencies.

Verification needed: Check if your fork's libp2p-swarm has wasm-bindgen-futures as an optional dependency gated by a feature that was previously enabled by "full". If you target WASM browsers, this could break compilation.

2. Feature Flag Consistency: libp2p-identity Cryptographic Primitives

File: crates/net/p2p/Cargo.toml, lines 28-40

libp2p = { ..., features = [
    "ed25519",
    "gossipsub",
    "identify",
    "macros",
    "noise",
    "quic",
    "request-response",
    "secp256k1",
    "tcp",
    "tokio",
    "yamux",
] }

You enable both "ed25519" and "secp256k1" for libp2p-identity key types. Verify:

• Your beacon chain spec requires specific key types (likely secp256k1 for Ethereum mainnet compatibility)
• The "noise" feature implicitly requires one of these; if mismatched, handshake failures occur at runtime

Suggestion: Add a comment explaining why both key types are needed, or document which peer types use which.

3. Missing dns Feature — Intentional?

File: crates/net/p2p/Cargo.toml

The "dns" feature is excluded despite being commonly needed for resolving multiaddrs with DNS names (e.g., /dns4/bootstrap.example.com/tcp/9000). The comment says "Only the transports, muxers and behaviours the swarm is built from" but dns is a transport enhancement.

Check: Does your node only connect to peers via raw IP addresses? If DNS resolution is needed anywhere (bootnodes, ENR, discv5), you'll need "dns" or "dns-tokio".

4. Security: rustls Update (0.23.40 → 0.23.46)

File: Cargo.lock (multiple locations), tooling/event-monitor/Cargo.lock

The rustls bump includes security fixes. Good. However, note that aws-lc-rs is now the default crypto provider in rustls 0.23+.

Concern: aws-lc-rs (AWS LibCrypto) is a new dependency with C code (via aws-lc-sys). Verify:

• FIPS compliance requirements for your use case
• Cross-compilation targets still work (especially musl, aarch64)
• The cc and cmake build dependencies in tooling/event-monitor/Cargo.lock line 88-95 indicate this builds C code

5. ruint Update (1.18.0 → 1.20.1) — ark-ff 0.6.0 Addition

File: Cargo.lock, ruint entry (line ~5928)

ruint now pulls in ark-ff 0.6.0 alongside 0.3.0, 0.4.2, 0.5.0. This quadruples the arkworks field arithmetic code in your binary.

Performance concern: Each ark-ff version is ~2-3MB of monomorphized generics. Check if ruint's feature flags allow disabling unused ark-ff versions. Your Cargo.toml doesn't directly depend on ruint, so this is transitive.

Suggestion: Check if any direct dependency enables all ark-ff features unnecessarily.

6. libp2p-gossipsub Metrics Feature Removal

File: Cargo.lock, libp2p-gossipsub entry (line ~4030)

- "prometheus-client",
  ...
- "serde",

The "full" feature previously enabled prometheus-client and serde in gossipsub. If your code uses:

• gossipsub::Config::with_metrics() — now fails to compile
• gossipsub::Message::serialize() via serde — now fails

Verification needed: Search for prometheus_client or serde usage with gossipsub types in crates/net/p2p/.

7. Lockfile Divergence: Root vs. tooling/event-monitor

File: Cargo.lock vs tooling/event-monitor/Cargo.lock

The root Cargo.lock and tooling/event-monitor/Cargo.lock now have different versions for shared crates:

• rustls: root has 0.23.46, but check if event-monitor also updated
• aws-lc-rs: 1.18.2 in event-monitor, verify root lockfile matches

Risk: If tooling/event-monitor is built independently, it may resolve different crate versions than the main workspace, causing subtle behavior differences in crypto or networking.

8. Removed libp2p-ping — Protocol Negotiation Impact

File: Cargo.lock, removed libp2p-ping entry

libp2p-ping was previously used for keepalive and RTT measurement. With "full", it was included but perhaps unused.

Confirm: Your swarm builder doesn't call .with_behaviour(|_| ping::Behaviour::new(...)). If it does, this PR breaks compilation.

Positive Observations

1. Good dependency pruning: Removing cuckoofilter, bimap, soketto, sha1, sysinfo, ntapi, memory-stats reduces attack surface and compile times
2. Clean removal of WASM/browser transports: libp2p-webrtc-websys, libp2p-websocket-websys, libp2p-webtransport-websys were appropriately removed for a server-side beacon client
3. getrandom 0.1.x and rand 0.7.x removal: Eliminates duplicate crypto RNG versions, reducing binary size and potential CSPRNG behavior differences

Recommended Actions

Priority	Action
Block	Verify compilation succeeds with cargo check --all-targets and cargo build --release
Block	Run full sync test to confirm peer connectivity (noise + yamux + quic handshake)
High	Audit crates/net/p2p/src/ for any use of removed features: libp2p::ping, libp2p::kad, prometheus_client with gossipsub
Medium	Add CI check that tooling/event-monitor/Cargo.lock stays in sync with workspace
Low	Document why "ed25519" is needed alongside "secp256k1"

Code Quality

The Cargo.toml comment at lines 28-30 is helpful. Consider extending it to explicitly list what was removed and why:

# Removed from "full": dns, mdns, websocket, relay, kad, ping, autonat, dcutr,
# floodsub, memory-limits, uds, webrtc, webtransport — not needed for beacon
# chain consensus networking (gossipsub + req-resp over quic/tcp only)

---

Automated review by Kimi (Moonshot AI) · kimi-k2.6 · custom prompt

[MegaRedHand]

We should delete the event-monitor and move to using Xatu