crates: upgraded dependencies to latest 1.85 compatible versions as of the commit time

notable upgrades requiring code changes:

rcgen: signed_by now takes an Issuer instead of a Certificate and KeyPair

tonic/prost: prost feature was stripped out of tonic and moved into tonic_prost crates

rand: OsRng was renamed to SysRng

Changelog-None

cln-grpc/Cargo.toml

@@ -19,8 +19,9 @@ log = "0.4"
 cln-rpc = { workspace = true, optional = true }
 cfg-if = "1.0"
 serde = { version = "1.0", features = ["derive"] }
-tonic = { version = "0.11", features = ["tls", "transport"] }
-prost = "0.12"
+tonic = { version = "0.14", features = ["tls-ring", "transport"] }
+tonic-prost = "0.14"
+prost = "0.14"
 hex = "0.4.3"
 bitcoin = { version = "0.32.2", features = ["serde"] }
 tokio-stream = { version = "0.1.14", features = ["sync"] }
@@ -31,4 +32,4 @@ tokio-util = "0.7.10"
 serde_json = "1.0.72"
 
 [build-dependencies]
-tonic-build = "0.11"
+tonic-prost-build = "0.14"

cln-grpc/build.rs

@@ -1,8 +1,8 @@
 fn main() {
-    let builder = tonic_build::configure();
+    let builder = tonic_prost_build::configure();
     builder
         .type_attribute(".", "#[derive(serde::Serialize,serde::Deserialize)]")
         .protoc_arg("--experimental_allow_proto3_optional")
-        .compile(&["proto/node.proto"], &["proto"])
+        .compile_protos(&["proto/node.proto"], &["proto"])
         .unwrap();
 }

cln-rpc/Cargo.toml

@@ -26,6 +26,6 @@ tokio = { version = "1", features = ["net"] }
 tokio-util = { version = "0.7", features = ["codec"] }
 
 [dev-dependencies]
-env_logger = "0.10"
+env_logger = "0.11"
 tokio = { version = "1", features = ["net", "macros", "rt-multi-thread"] }
 tokio-test = "0.4.3"

plugins/currencyrate-plugin/Cargo.toml

@@ -32,7 +32,5 @@ rustls = { version = "0.23", default-features = false, features = [
 
 futures = "0.3"
 
-rand = "0.9"
-
 cln-plugin = { workspace = true }
 cln-rpc = { workspace = true }

plugins/grpc-plugin/Cargo.toml

@@ -16,8 +16,8 @@ path = "src/main.rs"
 [dependencies]
 anyhow = "1.0"
 log = "0.4"
-rcgen = { version = "0.13.1", features = ["pem", "x509-parser"] }
-prost = "0.12"
+rcgen = { version = "0.14", features = ["pem", "x509-parser"] }
+prost = "0.14"
 cln-grpc = { workspace = true, features = ["server"] }
 cln-plugin = { workspace = true }
 cln-rpc = { workspace = true }
@@ -28,5 +28,5 @@ features = ["net", "rt-multi-thread"]
 version = "1"
 
 [dependencies.tonic]
-features = ["tls", "transport"]
-version = "0.11"
+features = ["tls-ring", "transport"]
+version = "0.14"

plugins/grpc-plugin/src/tls.rs

@@ -1,7 +1,7 @@
 //! Utilities to manage TLS certificates.
 use anyhow::{Context, Result};
 use log::debug;
-use rcgen::{Certificate, KeyPair};
+use rcgen::{Issuer, KeyPair};
 use std::path::Path;
 
 /// Just a wrapper around a certificate and an associated keypair.
@@ -18,13 +18,6 @@ impl Identity {
         Ok(key)
     }
 
-    fn to_certificate(&self) -> Result<Certificate> {
-        let certstr = String::from_utf8_lossy(&self.certificate);
-        let params = rcgen::CertificateParams::from_ca_cert_pem(&certstr)?;
-        let cert = params.self_signed(&self.to_key()?)?;
-        Ok(cert)
-    }
-
     pub fn to_tonic_identity(&self) -> tonic::transport::Identity {
         tonic::transport::Identity::from_pem(&self.certificate, &self.key)
     }
@@ -72,8 +65,8 @@ fn generate_or_load_identity(
     // regenerate the certificate
     if !key_path.exists() || !cert_path.exists() {
         debug!(
-            "Generating a new keypair in {:?}, it didn't exist",
-            &key_path
+            "Generating a new keypair in {}, it didn't exist",
+            &key_path.display()
         );
         let keypair = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256)?;
 
@@ -89,8 +82,9 @@ fn generate_or_load_identity(
         drop(file);
 
         debug!(
-            "Generating a new certificate for key {:?} at {:?}",
-            &key_path, &cert_path
+            "Generating a new certificate for key {} at {}",
+            &key_path.display(),
+            &cert_path.display()
         );
 
         // Configure the certificate we want.
@@ -117,7 +111,11 @@ fn generate_or_load_identity(
         let cert = match parent {
             None => params.self_signed(&keypair),
             Some(parent) => {
-                params.signed_by(&keypair, &parent.to_certificate()?, &parent.to_key()?)
+                let key = parent.to_key()?;
+                let pem = String::from_utf8_lossy(&parent.certificate);
+
+                let issuer = Issuer::from_ca_cert_pem(&pem, &key)?;
+                params.signed_by(&keypair, &issuer)
             }
         }?;
         std::fs::write(&cert_path, cert.pem().as_bytes()).context("writing certificate to file")?;
@@ -125,5 +123,5 @@ fn generate_or_load_identity(
 
     let key = std::fs::read(&key_path)?;
     let certificate = std::fs::read(cert_path)?;
-    Ok(Identity { certificate, key })
+    Ok(Identity { key, certificate })
 }

plugins/lsps-plugin/Cargo.toml

@@ -22,7 +22,7 @@ cln-rpc = { workspace = true }
 hex = "0.4"
 log = "0.4"
 paste = "1.0.15"
-rand = "0.9"
+rand = "0.10"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["raw_value"] }
 thiserror = "2.0"

plugins/lsps-plugin/src/proto/jsonrpc.rs

@@ -1,4 +1,4 @@
-use rand::{TryRngCore as _, rngs::OsRng};
+use rand::{TryRng, rngs::SysRng};
 use serde::{Deserialize, Serialize, de::DeserializeOwned};
 use serde_json::{self, Value};
 use std::fmt;
@@ -43,7 +43,7 @@ pub trait JsonRpcRequest: Serialize {
 /// to a timestamp-based ID if random generation fails.
 fn generate_random_id() -> String {
     let mut bytes = [0u8; 10];
-    match OsRng.try_fill_bytes(&mut bytes) {
+    match SysRng.try_fill_bytes(&mut bytes) {
         Ok(_) => hex::encode(bytes),
         Err(_) => {
             // Fallback to a timestamp-based ID if random generation fails

plugins/lsps-plugin/src/proto/lsps2.rs

@@ -66,7 +66,7 @@ pub trait ShortChannelIdJITExt {
 
 impl ShortChannelIdJITExt for ShortChannelId {
     fn generate_jit(blockheight: u32, distance: u32) -> Self {
-        use rand::{Rng as _, rng};
+        use rand::{RngExt as _, rng};
 
         let mut rng = rng();
         let block = blockheight + distance;

plugins/rest-plugin/Cargo.toml

@@ -15,9 +15,9 @@ log = { version = "0.4", features = ['std'] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml_ng = "0.10.0"
-quick-xml = { version = "0.38", features = ["serialize"] }
+quick-xml = { version = "0.39", features = ["serialize"] }
 roxmltree_to_serde = "0.6"
-serde_qs = "0.15"
+serde_qs = "1"
 tokio-util = { version = "0.7", features = ["codec"] }
 tokio = { version = "1", features = [
     'io-std',
@@ -39,7 +39,7 @@ futures-util = { version = "0.3", default-features = false, features = [
     "sink",
     "std",
 ] }
-rcgen = "0.13"
+rcgen = "0.14"
 hyper = "1"
 tower = "0.5"
 tower-http = { version = "0.6", features = ["cors", "set-header"] }

plugins/rest-plugin/src/certs.rs

@@ -1,5 +1,5 @@
 use anyhow::Error;
-use rcgen::{CertificateParams, DistinguishedName, KeyPair};
+use rcgen::{CertificateParams, DistinguishedName, Issuer, KeyPair};
 use std::fs;
 use std::net::IpAddr;
 use std::path::{Path, PathBuf};
@@ -18,6 +18,7 @@ pub fn generate_certificates(certs_path: &PathBuf, rest_host: &str) -> Result<()
     ca_params.use_authority_key_identifier_extension = true;
     let ca_key = KeyPair::generate()?;
     let ca_cert = ca_params.self_signed(&ca_key)?;
+    let ca_issuer = Issuer::from_params(&ca_params, &ca_key);
 
     fs::create_dir_all(certs_path)?;
 
@@ -54,9 +55,7 @@ pub fn generate_certificates(certs_path: &PathBuf, rest_host: &str) -> Result<()
             .push(rcgen::SanType::IpAddress(ip));
     }
     let server_key = KeyPair::generate()?;
-    let server_pem = server_params
-        .signed_by(&server_key, &ca_cert, &ca_key)?
-        .pem();
+    let server_pem = server_params.signed_by(&server_key, &ca_issuer)?.pem();
 
     fs::write(certs_path.join("server.pem"), server_pem)?;
     fs::write(
@@ -76,9 +75,7 @@ pub fn generate_certificates(certs_path: &PathBuf, rest_host: &str) -> Result<()
         .distinguished_name
         .push(rcgen::DnType::CommonName, "cln rest client");
     let client_key = KeyPair::generate()?;
-    let client_pem = client_params
-        .signed_by(&client_key, &ca_cert, &ca_key)?
-        .pem();
+    let client_pem = client_params.signed_by(&client_key, &ca_issuer)?.pem();
 
     fs::write(certs_path.join("client.pem"), client_pem)?;
     fs::write(

plugins/wss-proxy-plugin/Cargo.toml

@@ -20,13 +20,13 @@ tokio = { version = "1", features = [
     'macros',
     'io-util',
 ] }
-rcgen = "0.13"
+rcgen = "0.14"
 futures-util = { version = "0.3", default-features = false, features = [
     "sink",
     "std",
 ] }
 
-tokio-tungstenite = { version = "0.26", features = ["tokio-rustls"] }
+tokio-tungstenite = { version = "0.29", features = ["tokio-rustls"] }
 
 rustls = { version = "0.23", default-features = false, features = [
     "ring",

plugins/wss-proxy-plugin/src/certs.rs

@@ -1,5 +1,6 @@
 use anyhow::{Error, anyhow};
-use rcgen::{CertificateParams, DistinguishedName, Ia5String, KeyPair};
+use rcgen::string::Ia5String;
+use rcgen::{CertificateParams, DistinguishedName, Issuer, KeyPair};
 use rustls::ServerConfig;
 use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
@@ -24,6 +25,7 @@ pub fn generate_certificates(certs_path: &PathBuf, wss_host: &[String]) -> Resul
     ca_params.use_authority_key_identifier_extension = true;
     let ca_key = KeyPair::generate()?;
     let ca_cert = ca_params.self_signed(&ca_key)?;
+    let ca_issuer = Issuer::from_params(&ca_params, &ca_key);
 
     fs::create_dir_all(certs_path)?;
 
@@ -74,9 +76,7 @@ pub fn generate_certificates(certs_path: &PathBuf, wss_host: &[String]) -> Resul
     }
 
     let server_key = KeyPair::generate()?;
-    let server_pem = server_params
-        .signed_by(&server_key, &ca_cert, &ca_key)?
-        .pem();
+    let server_pem = server_params.signed_by(&server_key, &ca_issuer)?.pem();
 
     fs::write(certs_path.join("server.pem"), server_pem)?;
     fs::write(
@@ -96,9 +96,7 @@ pub fn generate_certificates(certs_path: &PathBuf, wss_host: &[String]) -> Resul
         .distinguished_name
         .push(rcgen::DnType::CommonName, "cln wss-proxy client");
     let client_key = KeyPair::generate()?;
-    let client_pem = client_params
-        .signed_by(&client_key, &ca_cert, &ca_key)?
-        .pem();
+    let client_pem = client_params.signed_by(&client_key, &ca_issuer)?.pem();
 
     fs::write(certs_path.join("client.pem"), client_pem)?;
     fs::write(