chore: bump deps and migrate to nostr-sdk 0.45.1

[arkanoider]

Summary

• Bump security-sensitive dependencies, notably nostr-sdk / nostr to 0.45.1, plus related crates (sqlx, secp256k1, etc.).
• Adapt chat, NIP-59, and transport code to 0.45 APIs: EventBuilder::finalize / finalize_unsigned, GiftWrapSealBuilder, local ECDH (generate_shared_key), UnsignedEvent::mine for PoW, and Message::{sign,verify_signature} against secp256k1 0.30 digests.
• Refresh rustdoc and docs/NIP59_TRANSPORT.md so they match the new builders and private NIP-59 timestamp helpers.

Summary by CodeRabbit

• Improvements

  • Improved compatibility and reliability for encrypted chats, direct messages, gift-wrapped messages, signing, verification, and proof-of-work.
  • Strengthened shared-key generation and conversation validation while preserving identity separation and message-handling behavior.

• Documentation

  • Updated NIP-59 transport guidance, encryption details, timestamp handling, and dependency information.

• Maintenance

  • Updated supporting libraries and refreshed tests for current Nostr and cryptography APIs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3477daba-d925-4583-b3ec-aca1f324ab8c

📥 Commits

Reviewing files that changed from the base of the PR and between 821ba1c and 55f3a15.

📒 Files selected for processing (1)

• src/chat/wrap.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• src/chat/wrap.rs

---

Walkthrough

The pull request updates dependencies to Nostr 0.45. It replaces deprecated event-building and signing APIs, adds local secp256k1 ECDH, updates NIP-59 timestamp and PoW handling, and simplifies rating tag serialization.

Changes

Nostr API migration

Layer / File(s)	Summary
Dependency and cryptographic type alignment Cargo.toml, src/message.rs, src/dispute.rs, src/order.rs, src/rating.rs	Dependencies and direct Nostr types are updated. Schnorr signing uses SHA-256 digest bytes. Rating::to_tags returns Tags directly.
Chat key derivation and event updates src/chat/keys.rs, src/chat/shared_key.rs, src/chat/wrap.rs, src/chat/unwrap.rs, src/chat/mod.rs	Chat ECDH uses a local helper. Chat event construction, tag checks, and validation tests use current Nostr APIs.
NIP-59 and NIP-44 wrapping flow src/nip59.rs, src/transport.rs, docs/NIP59_TRANSPORT.md	GiftWrap and direct-message construction use unsigned finalization, optional PoW mining, current signing APIs, and local timestamp jitter. Documentation describes the updated flow.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Possibly related PRs

• MostroP2P/mostro-core#139: Updated NIP-59 GiftWrap behavior that this migration adapts.
• MostroP2P/mostro-core#141: Shares the NIP-59 identity/trade-key wrapping flow updated here.
• MostroP2P/mostro-core#142: Shares the chat key and wrapping code adapted to newer APIs.

Suggested reviewers: grunch, andreadiazcorreia, catrya

Poem

A rabbit checks keys in the moonlit night,
Nostr events finalize right.
GiftWrap seals gleam,
Chat secrets stream,
And PoW hops into flight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency updates and migration to nostr-sdk 0.45.1, which are the main changes in the pull request.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/deps-version-bump

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/nip59.rs`:
- Around line 33-35: Update the documentation for
RANGE_RANDOM_TIMESTAMP_TWEAK_SECS in nip59.rs from an inclusive to an exclusive
range, stating 0..2 days, and make the matching comment change in wrap.rs. Do
not alter the constant or its behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 417579ad-602b-4826-9df7-0db5814bfd6b

📥 Commits

Reviewing files that changed from the base of the PR and between 5063746 and 4af846b.

📒 Files selected for processing (13)

• Cargo.toml
• docs/NIP59_TRANSPORT.md
• src/chat/keys.rs
• src/chat/mod.rs
• src/chat/shared_key.rs
• src/chat/unwrap.rs
• src/chat/wrap.rs
• src/dispute.rs
• src/message.rs
• src/nip59.rs
• src/order.rs
• src/rating.rs
• src/transport.rs

[ermeme]

Reviewed the nostr-sdk/nostr 0.45.1 migration against the security-audit context. The PR removes the vulnerable 0.44 Nostr stack from mostro-core, preserves the custom Mostro NIP-59 identity/trade-key split, and the local ECDH/timestamp/PoW replacements match the 0.45 APIs. Local validation passed: cargo test, cargo fmt --check, cargo clippy --all-targets --all-features -D warnings, and cargo audit. CI is green on the current head.

Only non-blocking note: CodeRabbit's existing comment about documenting the timestamp tweak as an exclusive range is valid but cosmetic.

[grunch]

LGTM