[illuzen]

Summary

Result of a full sweep over the workspace's dependencies (cargo-machete, cargo-audit, cargo tree --duplicates, crates.io for every direct dep). This PR contains the changes that are low-risk and verifiable here; wgpu 27 → 30 is a separate PR stacked on this one, and the remaining items (criterion 0.5 → 0.8, upstream qp-plonky2 pins) are listed at the bottom as follow-ups.

Lockfile: 265 → 246 packages. cargo audit is down to one advisory (paste, macOS-only via metal ← wgpu-hal 27; fixed by the wgpu PR).

Removed

Crate / feature	Where	Why
rand	common (optional, enabled by std)	never referenced
hex	wormhole/circuit	never referenced
anyhow, hex, qp-ownership-inputs	ownership/tests	never referenced
rayon (as optional prod dep)	wormhole/aggregator	the rayon code paths were removed in #94; the only remaining user is the public_batch_compare example, so it moved to dev-deps
multithread feature	wormhole/aggregator	was a no-op after #94 (parallelism comes from qp-plonky2/parallel). Breaking for downstream manifests that enable it — they need to drop the feature.
futures (executor only)	aggregator, gpu dev-deps	only used for block_on in tests/benches/examples; replaced with zero-dependency pollster 1.0.1, dropping five futures-* crates from the native build

Upgraded

Crate	From	To	Notes
rand	0.8.6 / 0.9.4	0.10.1	Matches the exact pin in qp-plonky2; removes the 0.8 and 0.9 lineages (rand, rand_core, rand_chacha, getrandom ×2, ppv-lite86, wasi, r-efi 5). API renames only (thread_rng() → rng(), Rng → RngExt, gen() → random()). StdRng output is unchanged across 0.8 → 0.10, so seeded test vectors are unaffected.
proptest	1.11.0	1.12.0	First release on rand 0.10. Its bit-vec 0.10 dep has weak features that make borsh/toml_edit appear in Cargo.lock without ever being built (cargo tree --target all confirms).
zeroize	1.8.2	1.9.1	Security-relevant: 1.9.x reworked the optimisation barrier and fixed a double-zeroize of Vec elements. wormhole/circuit/tests/heap_zeroization.rs passes.
clap	4.6.1	4.6.7
serde_json	1.0.150	1.0.154
libc	0.2.186	0.2.191
transitive (cargo update)			replaces the yanked chacha20 0.10.0 with 0.10.2; everything qp-plonky2 pins is unchanged

Held back on purpose

• env_logger 0.11.10+ needs log ^0.4.29, but qp-plonky2 pins log =0.4.28. Stays at 0.11.9.
• serde 1.0.229 and rand 0.10.3: qp-plonky2 pins =1.0.228 / =0.10.1.
• criterion 0.8.2 compiles with no code changes and removes the itertools 0.10 duplicate, but pulls in alloca (C via cc), page_size, shlex into the dev tree. Left as an opt-in.

Verification

• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings clean
• cargo +nightly fmt --all -- --check, taplo format --check clean
• cargo doc warnings identical to main
• cargo audit: only RUSTSEC-2024-0436 (paste, pre-existing) remains
• Release tests: qp-wormhole-circuit (heap_zeroization, formal_trace), tests (encoding_safety, spec_differential), ownership-tests, qp-wormhole-circuit-builder, qp-wormhole-aggregator --lib circuit_logic dummy all pass; qp-wormhole-gpu --features constraint-export compiles (no GPU here to run it)
• qp-wormhole-verifier, qp-ownership-verifier, *-inputs still build --no-default-features --target wasm32v1-none

  

[n13]

Verdict: Approve
Reviewer: GPT-6.1 Sol

Reviewed the complete diff from 080bc897108e4aed3e315ccd9229bbbbcdb1c9f2 to 40b323452ed2b46a90ff3709fccf77d4a29601d8. No blocking correctness, security, or compatibility findings.

The removed dependencies have no remaining code consumers. The rand migration retains the cryptographic thread-local generator for dummy nullifier preimages and proof shuffling, and the explicit thread_rng feature includes the required generator/seeding features. The executor replacement covers all former futures::executor::block_on calls. The aggregator keeps multithread available, with its remaining direct rayon use correctly covered by the example's dev-dependency. Dependency requirements fit the pinned Rust 1.93 toolchain.

Validation in an isolated detached worktree:

• cargo check --workspace --all-targets --all-features --locked passed, including GPU-enabled examples, benches, and tests.
• Release tests passed: qp-wormhole-circuit heap zeroization and formal trace (3); tests encoding safety and spec differential (19); ownership-tests (11); qp-wormhole-circuit-builder (11). Total: 44 passed.
• cargo check --locked --no-default-features --target wasm32v1-none passed for both verifier crates and both inputs crates.
• cargo +nightly fmt --all -- --check, taplo format --check --config taplo.toml, locked workspace metadata, and git diff --check passed. cargo tree --locked --target all -i borsh confirms borsh is not in the active dependency graph.

Limits: the broader release aggregation run (--lib -- circuit_logic dummy) was terminated by timeout 60 after many passing tests; no failure was observed, but that run is incomplete. GPU hardware execution was not tested. cargo audit could not run because cargo-audit is not installed. At the latest CI check, format, Clippy/docs, Lean, formal bridge, security audit, and Actions CodeQL passed; workspace tests, slow crypto tests, and Rust CodeQL were still running.