[illuzen]

Summary

• Bumps rpassword to 7.5.4 (alert Integrate scheduler to reversible transfers #53) and serde_with to 3.22.0 (alert Docker install update 3 #62).
• Bumps ws to 8.22.0 and bn.js to 5.2.5 in scripts/js, in both package-lock.json and yarn.lock (alerts docker push latest tag #60, Revert "make container package public (#58)" #59, make container package public #58, add binary docker file build #57, feat: vest airdrop rewards #22, and Feature/installer script #21).
• lru stays at 0.7.8 and 0.12.5. The fix is in 0.16.3, and tracing-log 0.2 plus smoldot-light 0.17 do not allow that major. Alert Rename quantus #14 needs a dismiss, not a version bump.

Test plan

• cargo check --locked -p sc-network-types -p sc-cli -p quantus-node
• ./clippy.sh (taplo is not installed locally, so that step was skipped; clippy passed)
• Confirm Dependabot clears the six JS alerts and the rpassword and serde_with alerts after merge

Made with Cursor

[n13]

Verdict: Approve
Reviewer: GPT-6.1 Sol

Reviewed head 2c4918ba22cb08f6439fdf62da68d227420f82d8 against base 9e6d01f8bbefd126d87be6325e8cfc1f09825ae9 in an isolated detached worktree.

No blocking findings. The Rust minimum-version constraints exclude the affected advisory ranges, and all four locked updates cover the eight Dependabot alerts listed in the PR. The updated Rust dependencies support the pinned Rust 1.93 toolchain. Both JavaScript lockfiles agree on versions, URLs, and integrity hashes; the affected callers and dependency ranges remain compatible.

Validation:

• git diff --check, Taplo on Cargo.toml, and cargo metadata --locked --offline: passed.
• cargo test --locked --offline -p sc-network-types: 9 unit tests and 1 doctest passed.
• Additional temporary checks passed for peer-ID/address Serde traits and deserialization, including malformed-input rejection.
• cargo check --locked --offline -p rpassword: passed.
• SKIP_WASM_BUILD=1 cargo check --locked --offline -p sc-cli -p quantus-node: passed (Wasm build skipped).
• npm ci --ignore-scripts --no-audit --no-fund and Yarn 1.22.22 install --frozen-lockfile --ignore-scripts --non-interactive: passed without tracked-file changes.
• JavaScript smoke checks passed for the bn.js zero-bit mask regression and arithmetic, Polkadot signing/verification, a local WsProvider JSON-RPC roundtrip, and WebSocket close-reason validation.

CI: formatting and Clippy/documentation passed; the Linux and macOS build/test jobs are still in progress. Both dependency-cooldown runs failed because ws@8.22.0 was 29 days old at check time, below the required 30 days. Before merging, rerun after the full cooldown elapses or use the established emergency-bypass process. Full CI has not yet passed.