Bump chia-bls from 0.38.2 to 0.42.1

[dependabot]

Bumps chia-bls from 0.38.2 to 0.42.1.

Release notes

Sourced from chia-bls's releases.

0.42.1

What's Changed

• fixup benchmark-conditions-cost by @​arvidn in Chia-Network/chia_rs#1407
• fix stubtest for mypy 1.20: clean up unused allowlist entries by @​richardkiss in Chia-Network/chia_rs#1415
• Fix NFT metadata parsing for invalid keys by @​Rigidity in Chia-Network/chia_rs#1310
• [CHIA-3854] Alternative: pure storage cost model (12000/0) for generator identity HF by @​richardkiss in Chia-Network/chia_rs#1377
• Check time lock by @​arvidn in Chia-Network/chia_rs#1422
• bump clvmr to 0.17.7 by @​arvidn in Chia-Network/chia_rs#1425
• bump version to 0.42.1 by @​arvidn in Chia-Network/chia_rs#1426

Full Changelog: Chia-Network/chia_rs@0.42.0...0.42.1

0.42.0

What's Changed

• update testnet11 constants in validate-blockchain-db.rs by @​arvidn in Chia-Network/chia_rs#1410
• introduce a cost per spend, for the hard fork by @​arvidn in Chia-Network/chia_rs#1411
• expose Prover.get_meta_group() and get_plot_index() for V2 plot filter by @​almogdepaz in Chia-Network/chia_rs#1412
• bump version to 0.42.0 by @​arvidn in Chia-Network/chia_rs#1414

Full Changelog: Chia-Network/chia_rs@0.41.1...0.42.0

0.41.1

What's Changed

• bump clvm_rs dependency to 0.17.4 by @​arvidn in Chia-Network/chia_rs#1408
• bump version to 0.41.1 by @​arvidn in Chia-Network/chia_rs#1409

Full Changelog: Chia-Network/chia_rs@0.41.0...0.41.1

0.41.0

What's Changed

• [CHIA-3894] charge cost for every announce conditions by @​arvidn in Chia-Network/chia_rs#1351
• bump clvmrs dependency by @​arvidn in Chia-Network/chia_rs#1404
• introduce a soft-fork limit of 6000 spends per block by @​arvidn in Chia-Network/chia_rs#1405
• bump version to 0.41.0 by @​arvidn in Chia-Network/chia_rs#1406

Full Changelog: Chia-Network/chia_rs@0.40.0...0.41.0

0.40.0

What's Changed

• enable checks when running tests in release mode by @​arvidn in Chia-Network/chia_rs#1397
• fix issue with the ignore macro by @​arvidn in Chia-Network/chia_rs#1398
• add tool to run a stand-alone block-generator by @​arvidn in Chia-Network/chia_rs#1399
• improve tree-hash by @​arvidn in Chia-Network/chia_rs#1400
• soft-fork 2.7.0 by @​arvidn in Chia-Network/chia_rs#1401
• bump version number to 0.40.0 by @​arvidn in Chia-Network/chia_rs#1402

... (truncated)

Commits

• 746c688 Merge pull request #1426 from Chia-Network/bump-0.42.1
• 03e02c0 bump version to 0.42.1
• df18c3e Merge pull request #1425 from Chia-Network/bump-clvmrs
• a23dd08 harmonize versions of thiserror, p256, k256, rand, rand_chacha with clvm_rs. ...
• 695643c bump clvmr to 0.17.7
• a256e9d Merge pull request #1422 from Chia-Network/check-time-lock
• 1c51179 python test cases
• 787796b extend tests for check_time_lock()
• 1a00644 simplify check_time_lock() tests
• 0c1c6a6 [CHIA-3854] Alternative: pure storage cost model (12000/0) for generator iden...
• Additional commits viewable in compare view

---

Note

Medium Risk
Updates a core cryptography dependency (chia-bls) and its transitive crates, which can change signature/hash behavior and compatibility at runtime despite being a dependency-only change.

Overview
Upgrades the workspace dependency chia-bls from 0.38.2 to 0.42.1.

Regenerates Cargo.lock to reflect the new dependency graph, including newer chia-traits/chia_streamable_macro, introducing chia-sha2 0.42.1 alongside chia-sha2 0.38.2, and consolidating thiserror usage to the 2.x line.

^{Reviewed by Cursor Bugbot for commit 948d3b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​chia-sha2@​0.42.1
	cargo/​chia-bls@​0.38.2 ⏵ 0.42.1

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8673407. Configure here.}

[cursor]

Dependency bump creates duplicate chia-sha2 versions

Low Severity

Bumping chia-bls to 0.42.0 while leaving chia-sha2 at 0.36.1 in workspace dependencies introduces two copies of chia-sha2 in the dependency tree (0.36.1 used by clvmr and clvm-fuzzing directly, and 0.42.0 pulled transitively by chia-bls and chia-traits). This increases binary size and means the openssl feature on clvmr only accelerates the 0.36.1 copy, while BLS operations internally use the unaccelerated 0.42.0 copy.

Additional Locations (1)

• Cargo.lock#L192-L210

 

^{Reviewed by Cursor Bugbot for commit 8673407. Configure here.}

[coveralls-official]

Coverage Report for CI Build 25725315089

Coverage remained the same at 87.561%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	8554
Covered Lines:	7490
Line Coverage:	87.56%
Coverage Strength:	23943498.66 hits per line

---

💛 - Coveralls

[dependabot]

Superseded by #811.