[QuantumExplorer]

Basic explanation

What this does: Moves Platform's Rust ABCI library, rs-tenderdash-abci, from git tag v1.8.0 to v1.8.1. The only code change in that release is that its proto build helper (tenderdash-proto-compiler) uses zip 9 instead of zip 8 to unpack the Tenderdash .proto files while building. Three Cargo.toml lines and the matching Cargo.lock entries change.

Value: The nightly "Security: Rust Crates" audit loses the three zip 8.6.0 advisories (RUSTSEC-2026-0367 / 0368 / 0369), so 5.0.0 does not ship with them in its lockfile. Together with #5582 the audit goes from 7 vulnerabilities to 1.

Risks: Very low. zip runs only inside the tenderdash-proto build script; Drive, DAPI and the SDKs never call it at runtime. v1.8.1 still downloads the same Tenderdash v1.8.0 protos and the lockfile keeps the same prost-build / tonic-prost-build, so the generated Rust code is unchanged. No consensus code or behaviour changes. The only plausible failure is a build error while unpacking the proto archive, which cargo check and CI would show.

Issue being fixed or feature implemented

The nightly cargo audit job (.github/workflows/security-audit-rust.yml) is red on v5.0-dev. Three of its findings are zip 8.6.0, reached only through tenderdash-proto-compiler, a build dependency of tenderdash-proto:

Advisory	Crate	Locked	Fixed in
RUSTSEC-2026-0367	zip	8.6.0	9.0.0
RUSTSEC-2026-0368	zip	8.6.0	9.0.0
RUSTSEC-2026-0369	zip	8.6.0	9.0.0

The fix landed upstream first: dashpay/rs-tenderdash-abci#221 (zip 8.5 -> 9.0 in proto-compiler), released as tag v1.8.1 on 2026-10-23.

What was done?

Tag v1.8.0 -> v1.8.1 in:

• packages/rs-drive-abci/Cargo.toml (tenderdash-abci)
• packages/rs-drive-proof-verifier/Cargo.toml (tenderdash-abci)
• packages/dapi-grpc/Cargo.toml (tenderdash-proto)

These are the only places the repository depends on rs-tenderdash-abci (the v1.5.0 line in book/src/architecture/overview.md is a docs example, left alone).

What v1.8.1 changes compared to v1.8.0, outside .github/ and CHANGELOG.md:

# Cargo.toml (workspace version)
-version = "1.8.0"
+version = "1.8.1"
# abci/Cargo.toml
-anyhow = { version = "1.0.82" }
+anyhow = { version = "1.0.104" }
# proto-compiler/Cargo.toml
-zip = { version = "8.5", default-features = false, features = ["deflate"] }
+zip = { version = "9.0", default-features = false, features = ["deflate"] }

proto/build.rs still has DEFAULT_VERSION = "v1.8.0", so the same Tenderdash protos are downloaded.

Cargo.lock before and after:

tenderdash-abci            1.8.0 (tag v1.8.0, 2e78da6f) -> 1.8.1 (tag v1.8.1, eebfc46c)
tenderdash-proto           1.8.0 (tag v1.8.0, 2e78da6f) -> 1.8.1 (tag v1.8.1, eebfc46c)
tenderdash-proto-compiler  1.8.0 (tag v1.8.0, 2e78da6f) -> 1.8.1 (tag v1.8.1, eebfc46c)
zip 8.6.0                  removed

zip 9.0.5 was already in the lockfile as a grovedb dependency, so tenderdash-proto-compiler now shares it and no crate is added. The only other lockfile line is grovedb's dependency entry going from "zip 9.0.5" to "zip", because only one zip version is left.

Note for anyone regenerating the lockfile: cargo update -p tenderdash-abci -p tenderdash-proto -p tenderdash-proto-compiler (cargo 1.98.1) also re-points some range dependencies between versions that are already locked (windows-sys 0.61.2 -> 0.59.0, itertools 0.10.5 -> 0.13.0, socket2 0.6.4 -> 0.5.10, heck 0.4.1 -> 0.5.0, across 15 dependency lists). Those are unrelated to this bump, so they are left out. cargo metadata --locked and cargo check --locked accept the minimal lockfile.

cargo audit (0.22.2, advisory DB 2026-10-26)

Before (v5.0-dev at 7ea82c7):

crypto-bigint      0.5.5     RUSTSEC-2026-0387
rustls-webpki      0.103.15  RUSTSEC-2026-0382
webpki-root-certs  1.0.7     RUSTSEC-2026-0383
webpki-roots       1.0.7     RUSTSEC-2026-0381
zip                8.6.0     RUSTSEC-2026-0367
zip                8.6.0     RUSTSEC-2026-0368
zip                8.6.0     RUSTSEC-2026-0369
error: 7 vulnerabilities found!
warning: 4 allowed warnings found

After (this PR):

crypto-bigint      0.5.5     RUSTSEC-2026-0387
rustls-webpki      0.103.15  RUSTSEC-2026-0382
webpki-root-certs  1.0.7     RUSTSEC-2026-0383
webpki-roots       1.0.7     RUSTSEC-2026-0381
error: 4 vulnerabilities found!
warning: 4 allowed warnings found

After this PR and #5582 together (the two merge cleanly):

crypto-bigint      0.5.5     RUSTSEC-2026-0387
error: 1 vulnerability found!
warning: 4 allowed warnings found

What remains

• crypto-bigint 0.5.5 (RUSTSEC-2026-0387). Fixed only in 0.7.6+, with no 0.5.x release. It comes from elliptic-curve 0.13.8 through the BLS stack (blstrs_plus -> dashpay/agora-blsful -> rust-dashcore), and no compatible release removes it (details in chore: bump rustls-webpki and webpki-roots for RUSTSEC-2026-0381/0382/0383 #5582). The fix has to start upstream in blstrs_plus.
• The three TLS advisories are fixed by chore: bump rustls-webpki and webpki-roots for RUSTSEC-2026-0381/0382/0383 #5582.
• Warnings (atomic-polyfill 1.0.3, lru 0.16.4, scc 2.4.0, tokio 1.52.3) are unchanged and do not fail the job.

No audit.toml ignore is added.

How Has This Been Tested?

• cargo audit before and after, as above.
• cargo metadata --locked passes with the new lockfile.
• cargo check --locked -p dapi-grpc -p drive-proof-verifier -p drive-abci passes; the tenderdash-proto build script downloads and unpacks the Tenderdash v1.8.0 protos with zip 9.0.5 and generates the tendermint.* modules.
• cargo tree -i zip@9.0.5 -e normal,build --target all shows tenderdash-proto-compiler v1.8.1 as a build dependency of tenderdash-proto v1.8.1.

Breaking Changes

None.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
• I have made corresponding changes to the documentation if needed
• If I added or changed GroveDB structure, I described it in the area's structure.rs, regenerated grovedb-structure.json, and checked the structure viewer link posted on this pull request

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

🤖 Generated with Claude Code

PR Hygiene · 365cd98

• Bots — coderabbitai ✓ · thepastaclaw ✓
• Self-review — post /self-reviewed
• Build green
• Approvals — you own every area touched; none needed

When every merge requirement is met, the PR Hygiene check passes. Reviewer limits do not block merging; other required GitHub checks and protections still apply.

Summary by CodeRabbit

• Chores
  • Updated underlying protocol components to version 1.8.1. No end-user-facing behavior changes are noted.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: dashpay/platform
• Branch: chore/bump-tenderdash-abci-v1.8.1
• File: .coderabbit.yaml
• Commit: 365cd98
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 781fcd62-8717-4804-8c94-6dad5e672813

Commits

Reviewing files that changed from the base of the PR and between 7ea82c7 and 365cd98.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 3

• packages/dapi-grpc/Cargo.toml
• packages/rs-drive-abci/Cargo.toml
• packages/rs-drive-proof-verifier/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

Three package manifests update Tenderdash dependency tags from v1.8.0 to v1.8.1. Existing feature settings remain unchanged.

Changes: Tenderdash dependency updates

Layer / File(s)	Summary
Update Tenderdash dependency tags packages/dapi-grpc/Cargo.toml, packages/rs-drive-abci/Cargo.toml, packages/rs-drive-proof-verifier/Cargo.toml	The manifests now reference Tenderdash dependencies at tag v1.8.1. Existing feature settings remain unchanged.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: claudius-maginificent

Merge Risk: Minimal · up to 365cd

No actionable merge-blocking risk is identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the main change: bumping the rs-tenderdash-abci dependency from v1.8.0 to v1.8.1 across rs-drive-abci, rs-drive-proof-verifier, and dapi-grpc. The summary confirms the tag change in al…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: bumping the rs-tenderdash-abci dependency from v1.8.0 to v1.8.1 across rs-drive-abci, rs-drive-proof-verifier, and dapi-grpc. The summary confirms the tag change in all three Cargo.toml files, and the objectives explain the zip RUSTSEC advisory motivation. The title is specific, short, and matches the changeset.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Waiting for bot review — coderabbitai ✓ · thepastaclaw not yet. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

[thepastaclaw]

✅ Final review complete — no blockers (commit 365cd98) · triage: low

[thepastaclaw]

Final validation — Phase 1 + Phase 2

The dependency bump is correctly limited to the three direct Tenderdash consumers and the corresponding Cargo.lock entries. The upstream v1.8.1 change updates only the proto compiler's zip dependency while retaining the same proto sources, and no in-scope correctness or security issues were identified. The Rust workspace test check was still in progress in the supplied CI snapshot, with no failed code checks.

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: glm-5.3-flash (agent: phase1-reviewer, role: rust-quality); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: low by gpt-6.1-sol (effort low) — This is a small, contained dependency and lockfile update limited to build-time ZIP handling, with no runtime, consensus, or critical-surface behavior changes.
• Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer, glm-5.3-flash — rust-quality (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 99% left, weekly 99% left; passed over gemini-3.8-flash-high (antigravity quota lookup failed)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort medium); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort medium); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort medium); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort medium); agent phase2-reviewer

Out-of-scope follow-up suggestions (1)

These are valid observations, but they are outside this PR's scope and should be handled in separate issues or author/maintainer-requested PRs rather than blocking this review.

• Update the stale Tenderdash dependency example in the architecture book — The illustrative Cargo.toml snippet in book/src/architecture/overview.md:159 still shows rs-tenderdash-abci v1.5.0, while the actual dependency is now v1.8.1. This predates the PR and is not part of the dependency bump's functional change, but it can mislead readers about the current pinned version.
  • Follow-up: Open a small documentation PR to update the example to v1.8.1 or remove the version-specific tag.

[github-actions]

Bots are done — your move: post /self-reviewed.
Full checklist in the description.