From 1c17b1d81fc1308290acb62c791796e6e46fb415 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 00:25:16 +0000
Subject: [PATCH 1/2] fix(deps): update rust-major

---
 Cargo.lock                                   | 150 ++++++++++---------
 Cargo.toml                                   |   4 +-
 crates/morphir-common/Cargo.toml             |   2 +-
 crates/morphir-distribution/Cargo.toml       |   2 +-
 crates/morphir-package/Cargo.toml            |   2 +-
 third_party/morphir-package-tough/Cargo.lock | 137 ++++-------------
 third_party/morphir-package-tough/Cargo.toml |   2 +-
 7 files changed, 114 insertions(+), 185 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 80e1757c6..fb4f23c69 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -32,6 +32,7 @@ dependencies = [
  "cipher",
  "cpubits",
  "cpufeatures 0.3.1",
+ "zeroize",
 ]
 
 [[package]]
@@ -853,12 +854,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -867,9 +862,12 @@ checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
 [[package]]
 name = "constant_time_eq"
-version = "0.4.2"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+checksum = "9eb6feb175df65d0a3ccd3e73484e940d0ac664e8034f0519fd49a93db3071d9"
+dependencies = [
+ "rustversion",
+]
 
 [[package]]
 name = "convert_case"
@@ -1197,22 +1195,6 @@ dependencies = [
  "regex-syntax",
 ]
 
-[[package]]
-name = "curve25519-dalek"
-version = "4.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "curve25519-dalek-derive",
- "digest 0.10.7",
- "fiat-crypto 0.2.9",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "curve25519-dalek"
 version = "5.0.0"
@@ -1222,7 +1204,8 @@ dependencies = [
  "cfg-if",
  "cpufeatures 0.3.1",
  "curve25519-dalek-derive",
- "fiat-crypto 0.3.0",
+ "digest 0.11.3",
+ "fiat-crypto",
  "rustc_version",
  "subtle",
  "zeroize",
@@ -1352,11 +1335,11 @@ dependencies = [
 
 [[package]]
 name = "der"
-version = "0.7.10"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+checksum = "6a996a108feb8b427a6e12fcf6af4aa83409b79d72c15337d7741368131ee004"
 dependencies = [
- "const-oid 0.9.6",
+ "const-oid",
  "pem-rfc7468",
  "zeroize",
 ]
@@ -1424,7 +1407,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
- "const-oid 0.10.2",
+ "const-oid",
  "crypto-common 0.2.2",
  "ctutils",
  "zeroize",
@@ -1503,9 +1486,9 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "ed25519"
-version = "2.2.3"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
 dependencies = [
  "pkcs8",
  "signature",
@@ -1513,16 +1496,16 @@ dependencies = [
 
 [[package]]
 name = "ed25519-zebra"
-version = "4.2.0"
+version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "775765289f7c6336c18d3d66127527820dd45ffd9eb3b6b8ee4708590e6c20f5"
+checksum = "aa764ad1bb0a84aaed1575b6d426ce927f610225bd9aeee88d02e08a6fea8215"
 dependencies = [
- "curve25519-dalek 4.1.3",
+ "curve25519-dalek",
  "ed25519",
  "hashbrown 0.16.1",
  "pkcs8",
- "rand_core 0.6.4",
- "sha2 0.10.9",
+ "rand_core 0.10.1",
+ "sha2 0.11.0",
  "subtle",
  "zeroize",
 ]
@@ -1774,12 +1757,6 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "fiat-crypto"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
 [[package]]
 name = "fiat-crypto"
 version = "0.3.0"
@@ -2130,9 +2107,9 @@ dependencies = [
 
 [[package]]
 name = "granit-parser"
-version = "1.3.0"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e20f99e46474f56bd905c56e817ebddcf377a611f94c53ac4649e4d3fa3c0cd0"
+checksum = "da55feca5d1625466bae068f9fd4b87892caeae70c3fe671ddb0f50d41aebf37"
 dependencies = [
  "arraydeque",
  "smallvec",
@@ -3220,9 +3197,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
 [[package]]
 name = "lzma-rust2"
-version = "0.16.5"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca93e534d1142d1d0dcca6d25fe302508a5dfb40b302802904577725ea0b695b"
+checksum = "f1c46f3fcd2e888afdb01a07efc071cb21300e07c68d32c3e8b01b5c8cb1fcaa"
 dependencies = [
  "sha2 0.11.0",
 ]
@@ -3695,7 +3672,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "cucumber",
- "curve25519-dalek 5.0.0",
+ "curve25519-dalek",
  "ed25519-zebra",
  "fs2",
  "futures",
@@ -3848,6 +3825,18 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -4164,9 +4153,9 @@ dependencies = [
 
 [[package]]
 name = "pem-rfc7468"
-version = "0.7.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
 dependencies = [
  "base64ct",
 ]
@@ -4268,9 +4257,9 @@ dependencies = [
 
 [[package]]
 name = "pkcs8"
-version = "0.10.2"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
 dependencies = [
  "der",
  "spki",
@@ -4340,9 +4329,9 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppmd-rust"
-version = "1.4.0"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efca4c95a19a79d1c98f791f10aebd5c1363b473244630bb7dbde1dc98455a24"
+checksum = "cd4acc8d264ea385db64ccfdcdfd5909ee9eda0975666723d59f3bfec80b3611"
 
 [[package]]
 name = "ppv-lite86"
@@ -5237,9 +5226,9 @@ dependencies = [
 
 [[package]]
 name = "serde-saphyr"
-version = "1.3.0"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8050abb251097357e24aff63ba2c52a6309ecb7d23a5474023df960a02694d8"
+checksum = "a253edfdea34032da21af84e16fcc94f4c7a6ba237f9f3bc2dbf43cea8535c44"
 dependencies = [
  "annotate-snippets",
  "base64 0.23.1",
@@ -5448,12 +5437,9 @@ dependencies = [
 
 [[package]]
 name = "signature"
-version = "2.2.0"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "rand_core 0.6.4",
-]
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
 
 [[package]]
 name = "simd-adler32"
@@ -5585,9 +5571,9 @@ dependencies = [
 
 [[package]]
 name = "spki"
-version = "0.7.3"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
 dependencies = [
  "base64ct",
  "der",
@@ -6265,9 +6251,9 @@ checksum = "82205ffd44a9697e34fc145491aa47310f9871540bb7909eaa9365e0a9a46607"
 
 [[package]]
 name = "typed-path"
-version = "0.12.3"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
 
 [[package]]
 name = "typenum"
@@ -6793,7 +6779,7 @@ dependencies = [
  "toml 0.9.12+spec-1.1.0",
  "wasmtime-environ",
  "windows-sys 0.61.2",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -7805,9 +7791,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "3f5b58784007ff6e5f280ec82c8596686a3b9b5dd5836c63288d4479f84728b9"
 dependencies = [
  "aes",
  "bzip2",
@@ -7820,14 +7806,16 @@ dependencies = [
  "indexmap",
  "lzma-rust2",
  "memchr",
+ "nix",
  "pbkdf2",
  "ppmd-rust",
  "sha1 0.11.0",
  "time",
- "typed-path 0.12.3",
+ "typed-path 0.13.0",
+ "windows-sys 0.61.2",
  "zeroize",
  "zopfli",
- "zstd",
+ "zstd 0.14.3",
 ]
 
 [[package]]
@@ -7860,7 +7848,16 @@ version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
 dependencies = [
- "zstd-safe",
+ "zstd-safe 7.2.4",
+]
+
+[[package]]
+name = "zstd"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
+dependencies = [
+ "zstd-safe 8.2.0",
 ]
 
 [[package]]
@@ -7872,11 +7869,20 @@ dependencies = [
  "zstd-sys",
 ]
 
+[[package]]
+name = "zstd-safe"
+version = "8.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
+dependencies = [
+ "zstd-sys",
+]
+
 [[package]]
 name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index c9761e2e2..7b0d65283 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -59,7 +59,7 @@ anyhow = "1.0"
 thiserror = "2.0"
 miette = { version = "7", features = ["fancy"] }
 vfs = "0.13"
-serde-saphyr = { version = "1", default-features = false, features = ["deserialize", "serialize"] }
+serde-saphyr = { version = "2", default-features = false, features = ["deserialize", "serialize"] }
 # The YAML profile reader walks this parser's event stream directly, and `serde-saphyr` re-exports
 # the same crate to `morphir-config`, so the pin lives here and is exact: one parser version links
 # into the workspace, and the version the message assertions are written against is the version
@@ -67,7 +67,7 @@ serde-saphyr = { version = "1", default-features = false, features = ["deseriali
 #
 # `error_messages` is what gives a `ScanError` its human-readable text; without it an
 # `invalid_yaml` diagnostic would carry an empty message.
-granit-parser = { version = "=1.3.0", default-features = false, features = ["std", "error_messages"] }
+granit-parser = { version = "=2.0.0", default-features = false, features = ["std", "error_messages"] }
 stacker = "0.1"
 
 # Structured logging
diff --git a/crates/morphir-common/Cargo.toml b/crates/morphir-common/Cargo.toml
index 546f985fb..c27ebb116 100644
--- a/crates/morphir-common/Cargo.toml
+++ b/crates/morphir-common/Cargo.toml
@@ -46,7 +46,7 @@ reqwest = { version = "0.13", default-features = false, features = [
     "json",
 ] }
 flate2 = "1.0"
-zip = "8.0"
+zip = "9.0"
 tar = "0.4"
 tempfile = "3"
 
diff --git a/crates/morphir-distribution/Cargo.toml b/crates/morphir-distribution/Cargo.toml
index b8072f45c..e592f6373 100644
--- a/crates/morphir-distribution/Cargo.toml
+++ b/crates/morphir-distribution/Cargo.toml
@@ -29,4 +29,4 @@ tracing = "0.1"
 unicode-casefold = { workspace = true }
 unicode-normalization = { workspace = true }
 url = "2.5.8"
-zip = "8.0"
+zip = "9.0"
diff --git a/crates/morphir-package/Cargo.toml b/crates/morphir-package/Cargo.toml
index 5ea732c4f..bc28ce51a 100644
--- a/crates/morphir-package/Cargo.toml
+++ b/crates/morphir-package/Cargo.toml
@@ -17,7 +17,7 @@ sha2 = "0.11"
 jsonschema = { version = "0.56", default-features = false }
 thiserror.workspace = true
 # Preserve Noble zip215:false: canonical points, non-small-order A, cofactored equation.
-ed25519-zebra = { version = "4.2", default-features = false, features = ["std"] }
+ed25519-zebra = { version = "5.0", default-features = false, features = ["std"] }
 curve25519-dalek = { version = "5.0", default-features = false, features = ["alloc"] }
 base64 = "0.22"
 
diff --git a/third_party/morphir-package-tough/Cargo.lock b/third_party/morphir-package-tough/Cargo.lock
index 99417fea9..92f399b79 100644
--- a/third_party/morphir-package-tough/Cargo.lock
+++ b/third_party/morphir-package-tough/Cargo.lock
@@ -135,15 +135,6 @@ version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "block-buffer"
 version = "0.12.1"
@@ -233,12 +224,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -261,15 +246,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.3.1"
@@ -294,16 +270,6 @@ version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
 
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.2.2"
@@ -315,14 +281,14 @@ dependencies = [
 
 [[package]]
 name = "curve25519-dalek"
-version = "4.1.3"
+version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "curve25519-dalek-derive",
- "digest 0.10.7",
+ "digest",
  "fiat-crypto",
  "rustc_version",
  "subtle",
@@ -373,34 +339,24 @@ dependencies = [
 
 [[package]]
 name = "der"
-version = "0.7.10"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+checksum = "6a996a108feb8b427a6e12fcf6af4aa83409b79d72c15337d7741368131ee004"
 dependencies = [
- "const-oid 0.9.6",
+ "const-oid",
  "pem-rfc7468",
  "zeroize",
 ]
 
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer 0.10.4",
- "crypto-common 0.1.7",
-]
-
 [[package]]
 name = "digest"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "block-buffer 0.12.1",
- "const-oid 0.10.2",
- "crypto-common 0.2.2",
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
 ]
 
 [[package]]
@@ -428,9 +384,9 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "ed25519"
-version = "2.2.3"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
 dependencies = [
  "pkcs8",
  "signature",
@@ -438,16 +394,16 @@ dependencies = [
 
 [[package]]
 name = "ed25519-zebra"
-version = "4.2.0"
+version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "775765289f7c6336c18d3d66127527820dd45ffd9eb3b6b8ee4708590e6c20f5"
+checksum = "aa764ad1bb0a84aaed1575b6d426ce927f610225bd9aeee88d02e08a6fea8215"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
  "hashbrown 0.16.1",
  "pkcs8",
  "rand_core",
- "sha2 0.10.9",
+ "sha2",
  "subtle",
  "zeroize",
 ]
@@ -494,9 +450,9 @@ checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "fiat-crypto"
-version = "0.2.9"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
 
 [[package]]
 name = "find-msvc-tools"
@@ -619,16 +575,6 @@ dependencies = [
  "slab",
 ]
 
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -1237,7 +1183,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_plain",
- "sha2 0.11.0",
+ "sha2",
  "snafu",
  "tempfile",
  "tokio",
@@ -1294,9 +1240,9 @@ dependencies = [
 
 [[package]]
 name = "pem-rfc7468"
-version = "0.7.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
 dependencies = [
  "base64ct",
 ]
@@ -1335,9 +1281,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pkcs8"
-version = "0.10.2"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
 dependencies = [
  "der",
  "spki",
@@ -1409,12 +1355,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand_core"
-version = "0.6.4"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.17",
-]
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
 [[package]]
 name = "regex"
@@ -1748,17 +1691,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
 [[package]]
 name = "sha2"
 version = "0.11.0"
@@ -1766,8 +1698,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.1",
- "digest 0.11.3",
+ "cpufeatures",
+ "digest",
 ]
 
 [[package]]
@@ -1784,12 +1716,9 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "signature"
-version = "2.2.0"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "rand_core",
-]
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
 
 [[package]]
 name = "simd_cesu8"
@@ -1854,9 +1783,9 @@ dependencies = [
 
 [[package]]
 name = "spki"
-version = "0.7.3"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
 dependencies = [
  "base64ct",
  "der",
@@ -2182,12 +2111,6 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
 [[package]]
 name = "walkdir"
 version = "2.5.0"
diff --git a/third_party/morphir-package-tough/Cargo.toml b/third_party/morphir-package-tough/Cargo.toml
index 24784b436..6db6d6529 100644
--- a/third_party/morphir-package-tough/Cargo.toml
+++ b/third_party/morphir-package-tough/Cargo.toml
@@ -238,7 +238,7 @@ version = "=0.40.2"
 features = ["bundled"]
 
 [dev-dependencies.ed25519-zebra]
-version = "4.2"
+version = "5.0"
 default-features = false
 features = ["std"]
 

From ba345f9a4a55a79e62b38677bf3c485b81bf9148 Mon Sep 17 00:00:00 2001
From: Damian Reeves <957246+DamianReeves@users.noreply.github.com>
Date: Thu, 29 Oct 2026 03:06:49 -0500
Subject: [PATCH 2/2] fix(deps): adapt to granit-parser 2, serde-saphyr 2 and
 zip 9

granit-parser 2.0 and serde-saphyr 2.0 put comment support behind a
default `comments` feature. The workspace builds both without default
features and never kept comments, so:

- the YAML profile reader drops its Event::Comment arm: without the
  feature the parser skips and validates comments and emits no event;
- morphir-config drops serde-saphyr's emit_comments option, which no
  longer exists without the feature, and replaces the deprecated
  reject_non_finite_typeless_float with
  non_finite_float_policy: NonFiniteFloatPolicy::Reject, the same
  behavior. granit-parser's own emit_comments option is unchanged.

zip 9 returns ZipResult<Cow<str>> from ZipFile::name(), because a name
can fail to decode. The tool archive reader now refuses such an entry
as an invalid ZIP entry, like the other entry errors it reports.

ed25519-zebra 5 needed no changes. Verified with cargo clippy
--all-targets --all-features -D warnings, cargo test --workspace
--all-features (4012 passed) and the vendored tough crate's locked
tests (98 passed, plus experimental_storage).

Beads: morphir-x4ep.4

Claude-Session: https://claude.ai/code/session_016vWNpLC7n2Fat4wgyZR75p
---
 crates/morphir-config/src/parse.rs              | 5 ++---
 crates/morphir-core/src/ir/yaml/read.rs         | 2 +-
 crates/morphir-distribution/src/tool_archive.rs | 5 ++++-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/crates/morphir-config/src/parse.rs b/crates/morphir-config/src/parse.rs
index f474498f6..3c162bb65 100644
--- a/crates/morphir-config/src/parse.rs
+++ b/crates/morphir-config/src/parse.rs
@@ -5,7 +5,7 @@ use serde_json::Value;
 use serde_saphyr::budget::BudgetBreach;
 use serde_saphyr::granit_parser::{Event, Parser, ScalarStyle};
 use serde_saphyr::options::{DuplicateKeyPolicy, MergeKeyPolicy};
-use serde_saphyr::{Error as YamlError, alias_limits, budget, options};
+use serde_saphyr::{Error as YamlError, NonFiniteFloatPolicy, alias_limits, budget, options};
 use thiserror::Error;
 
 const MAX_YAML_INPUT_BYTES: usize = 512 * 1024 * 1024;
@@ -126,10 +126,9 @@ fn yaml_options() -> serde_saphyr::Options {
             max_replay_stack_depth: 0,
             max_alias_expansions_per_anchor: 0,
         },
-        emit_comments: false,
         strict_booleans: true,
         legacy_octal_numbers: false,
-        reject_non_finite_typeless_float: true,
+        non_finite_float_policy: NonFiniteFloatPolicy::Reject,
         with_snippet: false,
     }
 }
diff --git a/crates/morphir-core/src/ir/yaml/read.rs b/crates/morphir-core/src/ir/yaml/read.rs
index fd16f21da..9aa3b9419 100644
--- a/crates/morphir-core/src/ir/yaml/read.rs
+++ b/crates/morphir-core/src/ir/yaml/read.rs
@@ -235,7 +235,7 @@ fn read_with_policy<B: YamlBudget>(
             ))
         })?;
         match event {
-            Event::StreamStart | Event::StreamEnd | Event::DocumentEnd | Event::Comment(..) => {}
+            Event::StreamStart | Event::StreamEnd | Event::DocumentEnd => {}
             Event::DocumentStart(_, version) => {
                 r.documents += 1;
                 if version.is_some() {
diff --git a/crates/morphir-distribution/src/tool_archive.rs b/crates/morphir-distribution/src/tool_archive.rs
index fcfd66359..a9b117fa4 100644
--- a/crates/morphir-distribution/src/tool_archive.rs
+++ b/crates/morphir-distribution/src/tool_archive.rs
@@ -58,7 +58,10 @@ pub(crate) fn extract_zip(
         let mut entry = archive
             .by_index(index)
             .map_err(|source| unsafe_archive("", format!("invalid ZIP entry: {source}")))?;
-        let raw_name = entry.name().to_owned();
+        let raw_name = entry
+            .name()
+            .map_err(|source| unsafe_archive("", format!("invalid ZIP entry name: {source}")))?
+            .into_owned();
         let enclosed = entry.enclosed_name().ok_or_else(|| {
             unsafe_archive(&raw_name, "entry escapes the package root".to_owned())
         })?;