Eliminate duplicate versions of dependent crates

[daira]

Duplicate versions make the executable larger and potentially could make debugging confusing, as well as hiding bugs in dependencies that have since been fixed. They are also a good heuristic for detecting indirect dependencies that may be lagging behind. The following is based on the output of cargo duplicates, with redundant information suppressed and some manual research on how to improve things.

• means that (I think) that the duplicate versions would now be resolved by a cargo update.

• rand 0.7.3 (could be rand 0.8.5):

  • Because of librustzcash 0.2.0 => clearscreen 2.0.0 => terminfo 0.7.3 => phf_codegen 0.8.0 => phf_generator 0.8.0 => rand 0.7.3
  • => Tell terminfo to depend on phf 0.11 (because phf_generator 0.11.1 depends on rand 0.8), instead of phf 0.8. done in meh/rust-terminfo@fe6de45; will be in terminfo 0.7.5

• rand_core 0.5.1 (could be rand_core 0.6.4):

  • Because of librustzcash 0.2.0 => ed25519-zebra 3.1.0 => curve25519-dalek 3.2.0 => rand_core 0.5.1
  • => Tell ZF to make ed25519-zebra depend on curve25519-dalek 4 (which depends on rand_core 0.6), instead of curve255-dalek 3. Note that this requires an MSRV bump of ed25519-zebra and librustzcash to at least 1.60.0. Requested in Please update dependencies to curve25519-dalek 4, sha2 0.10, and digest 0.10 ZcashFoundation/ed25519-zebra#66

• getrandom 0.1.16 (could be getrandom 0.2.8):

  • This would be fixed by the changes for rand 0.8 and rand_core 0.6.4.

• rand_chacha 0.2.2:

  • Because of librustzcash 0.2.0 => clearscreen 2.0.0 => terminfo 0.7.3 => phf_codegen 0.8.0 => phf_generator 0.8.0 => rand 0.7.3 => rand_chacha 0.2.2
  • This would be fixed by the changes for rand 0.8. done in meh/rust-terminfo@fe6de45; will be in terminfo 0.7.5

• digest 0.9.0 (could be digest 0.10.6, but note API changes):

  • Because of librustzcash 0.2.0 => ed25519-zebra 3.1.0 => curve25519-dalek 3.2.0 => digest 0.9.0
  • Because of librustzcash 0.2.0 => ed25519-zebra 3.1.0 => sha2 0.9.9 => digest 0.9.0
  • Because of librustzcash 0.2.0 => sha2 0.9.9 => digest 0.9.0
  • Because of librustzcash 0.2.0 => zcash_primitives 0.9.1 => bip0039 0.9.0 => hmac 0.11.0 => digest 0.9.0
  • Because of librustzcash 0.2.0 => zcash_primitives 0.9.1 => bip0039 0.9.0 => sha2 0.9.9 => digest 0.9.0
  • Because of librustzcash 0.2.0 => zcash_primitives 0.9.1 => sha2 0.9.9 => digest 0.9.0
  • Because of librustzcash 0.2.0 => zcash_proofs 0.9.0 => redjubjub 0.5.0 => digest 0.9.0
  • Because of librustzcash 0.2.0 => zcash_address 0.2.0 => bs58 0.4.0 => sha2 0.9.9 => digest 0.9.0
    => digest 0.9.0
  • => Make librustzcash depend on sha2 0.10 (which depends on digest 0.10.4).
  • => Make zcash_primitives depend on sha2 0.10 and bip0039 0.11 (which depends on sha2 0.10).
  • => Tell bs58 to do a release (their default "prīmum" branch depends on sha2 0.10, changed in May 2022 but unreleased), and make zcash_address depend on the updated bs58 if needed. Requested in crates release? Nullus157/bs58-rs#100
  • => Tell ZF to make redjubjub depend on digest 0.10, instead of digest 0.9. Requested in Please update the digest dependency to 0.10 ZcashFoundation/redjubjub#154; dependabot PR at Update digest requirement from 0.9 to 0.10 ZcashFoundation/redjubjub#140
  • => Tell ZF to make ed25519-zebra depend on curve25519-dalek 4 (we already said that above), which depends on digest 0.10, and also sha2 0.10 instead of 0.9. Requested in Please update dependencies to curve25519-dalek 4, sha2 0.10, and digest 0.10 ZcashFoundation/ed25519-zebra#66; the sha2 part has a dependabot PR Update sha2 requirement from 0.9 to 0.10 ZcashFoundation/ed25519-zebra#55

• cipher 0.3.0 (could be cipher 0.4.3, but note that cipher 0.4.x has a "major rework of traits"):

  • Because of librustzcash 0.2.0 => orchard 0.3.0 => aes 0.7.5 => cipher 0.3.0
  • Because of librustzcash 0.2.0 => orchard 0.3.0 => fpe 0.5.1 => cipher 0.3.0
  • Because of librustzcash 0.2.0 => orchard 0.3.0 => fpe 0.5.1 => block-modes 0.8.1 => cipher 0.3.0
  • Because of librustzcash 0.2.0 => zcash_primitives 0.9.1 => aes 0.7.5 => cipher 0.3.0
  • Because of librustzcash 0.2.0 => zcash_primitives 0.9.1 => fpe 0.5.1 => cipher 0.3.0
  • Because of librustzcash 0.2.0 => zcash_primitives 0.9.1 => fpe 0.5.1 => block-modes 0.8.1 => cipher 0.3.0
  • => Make orchard depend on aes 0.8 (which depends on cipher 0.4.2), instead of aes 0.7. Issue at Bump aes dependency to 0.8 orchard#369
  • => Make zcash_primitives depend on aes 0.8 instead of aes 0.7.
  • => (@str4d) Make fpe depend on:
    • cipher 0.4 instead of cipher 0.3
    • aes 0.8 instead of aes 0.7
    • a replacement for block-modes 0.8, which says: "This crate is deprecated. Use crates from https://github.com/RustCrypto/block-modes instead." Based on this I think it probably wants cbc 0.1 (which depends on cipher 0.4.2 and aes 0.8).
    • and make orchard and zcash_primitives depend on the updated fpe if needed.
    • all of these are requested at Update aes version str4d/fpe#26 (comment)

• block-buffer 0.9.0 (could be block-buffer 0.10.3):

  • This is a dependency of base58 0.4.0, which has not been updated. If base58 is updated, this will fix both block-buffer and the sha2 dependency duplication.

• cfg-if 0.1.10 (could be cfg-if 1.0.0):

  • Because of librustzcash 0.2.0 => clearscreen 2.0.0 => terminfo 0.7.3 => dirs 2.0.2 => cfg-if 0.1.10
  • => Tell terminfo to depend on dirs 4 (which no longer depends on cfg-if since version 3.0.1), instead of dirs 2. Note: There was a RUSTSEC advisory about dirs being unmaintained, but it has been withdrawn. done in meh/rust-terminfo@6281c6b; will be in terminfo 0.7.5

[nuttycom]

I just noticed that it appears that this ticket should be in the zcash/zcash repository? The wasi duplication doesn't affect this repo.

[nuttycom]

Completed in #856