From c5d3230ad76a0a3e03e45e2c296d0c563812d8a1 Mon Sep 17 00:00:00 2001
From: Vihiga Tyonum <withtvpeter@gmail.com>
Date: Wed, 28 Oct 2026 15:42:52 +0100
Subject: [PATCH 1/2] chore: update deps async-hwi and bdk_esplora

- update async-hwi to 0.0.35: moves async-hwi from reqwest 0.11 to 0.13.
That removes h2 0.3 (RUSTSEC-2026-0258), rustls-pemfile
(unmaintained warning RUSTSEC-2025-0134), hyper 0.14, and that copies
of rustls 0.21 and webpki-roots 0.25. It compiles with no code changes.
- bdk_esplora: default-features = false: the default feature,
blocking-https, pulls in minreq 2 with rustls 0.21 and webpki-roots
0.25. bdk-cli only uses the async client (async-https, tokio),
so this was unused code carrying the old TLS stack.
- targetted cargo update -p for quinn-ptoto to 0.11.19, rustls to 0.23.46,
rustls-webpki 0.103.16, webpki-roots 1.0.11, zstd-sys 2.1.2 and tokio
to 1.54.1
---
 CHANGELOG.md |   1 +
 Cargo.lock   | 453 +++++++++------------------------------------------
 Cargo.toml   |   4 +-
 3 files changed, 78 insertions(+), 380 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e984932a..eca00a16 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ page. See [DEVELOPMENT_CYCLE.md](DEVELOPMENT_CYCLE.md) for more details.
 - Removed the redundant `wallet` field from `wallets list` output; the wallet name is still available as the top-level key
 - Fixed `compile` silently accepting placeholder keys/hashes instead of validating them; added `--placeholders` to opt back into the old permissive behavior
 - Fixed `compile` panicking instead of returning an error when a key is valid on its own but the wrong shape for the requested script type (e.g. an x-only key under `sh`/`wsh`/`sh-wsh`, or an uncompressed key under `tr`)
+- Updated dependencies to resolve RUSTSEC advisories in rustls, rustls-webpki, webpki-roots, quinn-proto, h2 and zstd-sys; bumped async-hwi to 0.0.35.
 
 ## [4.0.0]
 
diff --git a/Cargo.lock b/Cargo.lock
index 25baa30c..29bd4886 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -194,9 +194,9 @@ dependencies = [
 
 [[package]]
 name = "async-hwi"
-version = "0.0.32"
+version = "0.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f30263bda4fbe2613e08989a2526d44ee0c13f19a3badd0d8d872cc233d6611"
+checksum = "111ca053ae10877d8e688c75d240302284eac494c447357e700c9a35819256c9"
 dependencies = [
  "async-trait",
  "bitbox-api",
@@ -210,7 +210,7 @@ dependencies = [
  "ledger-transport-hidapi",
  "ledger_bitcoin_client",
  "regex",
- "reqwest 0.11.27",
+ "reqwest 0.13.4",
  "serde",
  "serde_bytes",
  "serde_cbor",
@@ -1163,16 +1163,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
 
-[[package]]
-name = "core-foundation"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -1571,7 +1561,7 @@ dependencies = [
  "byteorder",
  "libc",
  "log",
- "rustls 0.23.45",
+ "rustls 0.23.46",
  "serde",
  "serde_json",
  "webpki-roots 0.25.4",
@@ -1597,15 +1587,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "encoding_rs"
-version = "0.8.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "env_filter"
 version = "2.0.0"
@@ -1654,7 +1635,6 @@ dependencies = [
  "bitcoin",
  "hex-conservative 0.2.2",
  "log",
- "minreq",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -1736,12 +1716,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -1941,25 +1915,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "h2"
-version = "0.3.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "half"
 version = "1.8.3"
@@ -2116,17 +2071,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http"
 version = "1.4.2"
@@ -2137,17 +2081,6 @@ dependencies = [
  "itoa",
 ]
 
-[[package]]
-name = "http-body"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
-dependencies = [
- "bytes",
- "http 0.2.12",
- "pin-project-lite",
-]
-
 [[package]]
 name = "http-body"
 version = "1.0.1"
@@ -2155,7 +2088,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.4.2",
+ "http",
 ]
 
 [[package]]
@@ -2166,8 +2099,8 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.2",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -2177,36 +2110,6 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
-[[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
-name = "hyper"
-version = "0.14.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2",
- "http 0.2.12",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2 0.5.10",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
 [[package]]
 name = "hyper"
 version = "1.10.1"
@@ -2217,8 +2120,8 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
- "http 1.4.2",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "httparse",
  "itoa",
  "pin-project-lite",
@@ -2227,34 +2130,20 @@ dependencies = [
  "want",
 ]
 
-[[package]]
-name = "hyper-rustls"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
-dependencies = [
- "futures-util",
- "http 0.2.12",
- "hyper 0.14.32",
- "rustls 0.21.12",
- "tokio",
- "tokio-rustls 0.24.1",
-]
-
 [[package]]
 name = "hyper-rustls"
 version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.2",
- "hyper 1.10.1",
+ "http",
+ "hyper",
  "hyper-util",
- "rustls 0.23.45",
+ "rustls 0.23.46",
  "tokio",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.8",
+ "webpki-roots 1.0.11",
 ]
 
 [[package]]
@@ -2265,7 +2154,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.10.1",
+ "hyper",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -2283,14 +2172,14 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.4.2",
- "http-body 1.0.1",
- "hyper 1.10.1",
+ "http",
+ "http-body",
+ "hyper",
  "ipnet",
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.4",
+ "socket2",
  "tokio",
  "tower-service",
  "tracing",
@@ -2826,12 +2715,6 @@ dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "mime"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
 [[package]]
 name = "miniscript"
 version = "12.3.7"
@@ -2859,7 +2742,6 @@ version = "2.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05015102dad0f7d61691ca347e9d9d9006685a64aefb3d79eecf62665de2153d"
 dependencies = [
- "base64 0.22.1",
  "rustls 0.21.12",
  "rustls-webpki 0.101.7",
  "serde",
@@ -3143,7 +3025,7 @@ dependencies = [
  "bitcoin-hpke",
  "bitcoin-ohttp",
  "bitcoin_uri",
- "http 1.4.2",
+ "http",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -3446,8 +3328,8 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash",
- "rustls 0.23.45",
- "socket2 0.5.10",
+ "rustls 0.23.46",
+ "socket2",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -3456,9 +3338,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "aws-lc-rs",
  "bytes",
@@ -3468,7 +3350,7 @@ dependencies = [
  "rand_pcg",
  "ring",
  "rustc-hash",
- "rustls 0.23.45",
+ "rustls 0.23.46",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.18",
@@ -3486,7 +3368,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.4",
+ "socket2",
  "tracing",
  "windows-sys 0.61.2",
 ]
@@ -3626,47 +3508,6 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
-[[package]]
-name = "reqwest"
-version = "0.11.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
-dependencies = [
- "base64 0.21.7",
- "bytes",
- "encoding_rs",
- "futures-core",
- "futures-util",
- "h2",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.32",
- "hyper-rustls 0.24.2",
- "ipnet",
- "js-sys",
- "log",
- "mime",
- "once_cell",
- "percent-encoding",
- "pin-project-lite",
- "rustls 0.21.12",
- "rustls-pemfile",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper 0.1.2",
- "system-configuration",
- "tokio",
- "tokio-rustls 0.24.1",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots 0.25.4",
- "winreg",
-]
-
 [[package]]
 name = "reqwest"
 version = "0.12.28"
@@ -3676,11 +3517,11 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-core",
- "http 1.4.2",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.10.1",
- "hyper-rustls 0.27.9",
+ "hyper",
+ "hyper-rustls",
  "hyper-tls",
  "hyper-util",
  "js-sys",
@@ -3689,15 +3530,15 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.45",
+ "rustls 0.23.46",
  "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper 1.0.2",
+ "sync_wrapper",
  "tokio",
  "tokio-native-tls",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tower",
  "tower-http",
  "tower-service",
@@ -3705,7 +3546,7 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots 1.0.8",
+ "webpki-roots 1.0.11",
 ]
 
 [[package]]
@@ -3717,23 +3558,25 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-core",
- "http 1.4.2",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.10.1",
- "hyper-rustls 0.27.9",
+ "hyper",
+ "hyper-rustls",
  "hyper-util",
  "js-sys",
  "log",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.45",
+ "rustls 0.23.46",
  "rustls-pki-types",
  "rustls-platform-verifier",
- "sync_wrapper 1.0.2",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
  "tokio",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tower",
  "tower-http",
  "tower-service",
@@ -3836,16 +3679,16 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.15",
+ "rustls-webpki 0.103.16",
  "subtle",
  "zeroize",
 ]
@@ -3862,15 +3705,6 @@ dependencies = [
  "security-framework",
 ]
 
-[[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
-dependencies = [
- "base64 0.21.7",
-]
-
 [[package]]
 name = "rustls-pki-types"
 version = "1.15.0"
@@ -3887,15 +3721,15 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
- "core-foundation 0.10.1",
+ "core-foundation",
  "core-foundation-sys",
  "jni",
  "log",
  "once_cell",
- "rustls 0.23.45",
+ "rustls 0.23.46",
  "rustls-native-certs",
  "rustls-platform-verifier-android",
- "rustls-webpki 0.103.15",
+ "rustls-webpki 0.103.16",
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
@@ -3920,9 +3754,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -4018,7 +3852,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
  "bitflags 2.13.0",
- "core-foundation 0.10.1",
+ "core-foundation",
  "core-foundation-sys",
  "libc",
  "security-framework-sys",
@@ -4132,7 +3966,7 @@ checksum = "a4d91116f97173694f1642263b2ff837f80d933aa837e2314969f6728f661df3"
 dependencies = [
  "bitflags 2.13.0",
  "cfg-if",
- "core-foundation 0.10.1",
+ "core-foundation",
  "core-foundation-sys",
  "io-kit-sys",
  "libudev",
@@ -4275,16 +4109,6 @@ dependencies = [
  "syn 1.0.109",
 ]
 
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "socket2"
 version = "0.6.4"
@@ -4345,12 +4169,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "sync_wrapper"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
-
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -4371,27 +4189,6 @@ dependencies = [
  "syn 2.0.118",
 ]
 
-[[package]]
-name = "system-configuration"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation 0.9.4",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
 [[package]]
 name = "tar"
 version = "0.4.46"
@@ -4526,9 +4323,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",
@@ -4536,7 +4333,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.4",
+ "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -4562,23 +4359,13 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls 0.21.12",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.45",
+ "rustls 0.23.46",
  "tokio",
 ]
 
@@ -4597,20 +4384,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-util"
-version = "0.7.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "libc",
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "toml"
 version = "0.5.11"
@@ -4668,7 +4441,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "pin-project-lite",
- "sync_wrapper 1.0.2",
+ "sync_wrapper",
  "tokio",
  "tower-layer",
  "tower-service",
@@ -4683,8 +4456,8 @@ dependencies = [
  "bitflags 2.13.0",
  "bytes",
  "futures-util",
- "http 1.4.2",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "pin-project-lite",
  "tower",
  "tower-layer",
@@ -4992,9 +4765,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.8"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
+checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -5007,9 +4780,9 @@ checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.8"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -5116,22 +4889,13 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -5140,7 +4904,7 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -5152,67 +4916,34 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
  "windows_i686_gnullvm",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -5225,48 +4956,24 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -5279,16 +4986,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
 
-[[package]]
-name = "winreg"
-version = "0.50.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
-dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
@@ -5486,9 +5183,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index d5f37680..9319864d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,7 +30,7 @@ serde= {version = "1.0", features = ["derive"]}
 # Optional dependencies
 bdk_bitcoind_rpc = { version = "0.22.0", features = ["std"], optional = true }
 bdk_electrum = { version = "0.24.0", optional = true }
-bdk_esplora = { version = "0.22.2", features = ["async-https", "tokio"], optional = true }
+bdk_esplora = { version = "0.22.2", default-features = false, features = ["async-https", "tokio"], optional = true }
 bdk_kyoto = { version = "0.17.0", optional = true }
 bdk_redb = { version = "0.2.0", optional = true }
 bdk_sp = { version = "0.2.0", optional = true }
@@ -40,7 +40,7 @@ reqwest = { version = "0.13.2", default-features = false, features = ["rustls"],
 url = { version = "2.5.8", optional = true }
 bdk_message_signer = { version = "0.2.0", optional = true }
 bitcoin-payment-instructions = { version = "0.7.0", optional = true}
-async-hwi = { version = "0.0.32", features = ["specter", "coldcard", "ledger", "jade", "bitbox", "service"], optional = true}
+async-hwi = { version = "0.0.35", features = ["specter", "coldcard", "ledger", "jade", "bitbox", "service"], optional = true}
 
 [features]
 default = ["repl", "sqlite"]

From d2317d2a6f549d22e312d73a120a643eaf69a2af Mon Sep 17 00:00:00 2001
From: Vihiga Tyonum <withtvpeter@gmail.com>
Date: Wed, 28 Oct 2026 15:59:46 +0100
Subject: [PATCH 2/2] fix(tests): wait for electrs to reach bitcoind's tip in
 online tests

bdk_testenv 0.13.1's `wait_until_electrum_sees_block` returns on the
first queued header notification, which can be a stale one left over
from an earlier `mine_blocks` call. A following `full_scan` could then
run before electrs had indexed the confirmation blocks, intermittently
failing tests such as `test_create_tx_multiple_recipients` with a
confirmed balance of 0.

Add a `wait_for_electrum_tip` helper to `tests/common` that reads
bitcoind's current block height and drains header notifications until
electrs reports that height, and use it in place of all calls to
`wait_until_electrum_sees_block` in the electrum and esplora online
tests.

The same bug is fixed upstream in bdk (a98cf7c4) but not yet released;
the helper can be dropped once a new bdk_testenv is published.
---
 tests/common/mod.rs         | 30 +++++++++++++++++++++++++++++
 tests/integration/online.rs | 38 +++++++++++++++----------------------
 2 files changed, 45 insertions(+), 23 deletions(-)

diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index d38edf8b..6832633b 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -11,7 +11,9 @@
 //! This module provides the necessary helper methods for tests
 //!
 use assert_cmd::Command;
+use bdk_testenv::{TestEnv, anyhow, bitcoincore_rpc::RpcApi, electrum_client::ElectrumApi};
 use std::path::PathBuf;
+use std::time::{Duration, Instant};
 
 /// The bdk-cli command struct
 #[allow(dead_code)]
@@ -84,3 +86,31 @@ impl BdkCli {
         cmd
     }
 }
+
+/// Waits until electrs has indexed up to bitcoind's current tip.
+///
+/// `TestEnv::wait_until_electrum_sees_block` returns on the first queued header
+/// notification, which may be a stale one left over from an earlier `mine_blocks`
+/// call, so a following scan can run before the latest blocks are indexed.
+#[allow(unused)]
+pub fn wait_for_electrum_tip(env: &TestEnv, timeout: Duration) -> anyhow::Result<()> {
+    let tip = env.rpc_client().get_block_count()? as usize;
+    let client = env.electrum_client();
+    client.block_headers_subscribe()?;
+    let start = Instant::now();
+
+    while start.elapsed() < timeout {
+        env.electrsd.trigger()?;
+        client.ping()?;
+        while let Some(notif) = client.block_headers_pop()? {
+            if notif.height >= tip {
+                return Ok(());
+            }
+        }
+        std::thread::sleep(Duration::from_millis(200));
+    }
+
+    Err(anyhow::anyhow!(
+        "electrs did not reach tip {tip} within {timeout:?}"
+    ))
+}
diff --git a/tests/integration/online.rs b/tests/integration/online.rs
index 4d3f11af..dc2399f2 100644
--- a/tests/integration/online.rs
+++ b/tests/integration/online.rs
@@ -1,6 +1,6 @@
 #[cfg(feature = "electrum")]
 mod test_online {
-    use crate::common::BdkCli;
+    use crate::common::{BdkCli, wait_for_electrum_tip};
     use assert_cmd::Command;
     use bdk_testenv::{TestEnv, bitcoincore_rpc::RpcApi};
     use bdk_wallet::bitcoin::{Address, Amount, Network, Txid};
@@ -60,7 +60,7 @@ mod test_online {
             .mine_blocks(101, Some(node_address))
             .expect("Failed to mine initial blocks");
         assert_eq!(mined_blocks.len(), 101, "expected exactly 101 blocks mined");
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
+        wait_for_electrum_tip(env, Duration::from_secs(10))
             .expect("Electrum did not catch up to initial blocks");
 
         let txid = env
@@ -71,7 +71,7 @@ mod test_online {
 
         env.mine_blocks(3, None)
             .expect("Failed to confirm funding tx");
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
+        wait_for_electrum_tip(env, Duration::from_secs(10))
             .expect("Electrum did not catch up to confirmation blocks");
 
         cli_full_scan(cli);
@@ -263,7 +263,7 @@ mod test_online {
 
         env.mine_blocks(1, None)
             .expect("Failed to mine drain confirmation block");
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
+        wait_for_electrum_tip(&env, Duration::from_secs(10))
             .expect("Electrum did not catch up to drain confirmation");
 
         cli_sync(&cli);
@@ -297,7 +297,7 @@ mod test_online {
         // Confirm the spend and verify the final balance
         env.mine_blocks(1, None)
             .expect("Failed to mine spend confirmation block");
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
+        wait_for_electrum_tip(&env, Duration::from_secs(10))
             .expect("Electrum did not catch up to spend confirmation");
 
         cli_sync(&cli);
@@ -446,7 +446,7 @@ mod test_online {
 
         env.mine_blocks(1, None)
             .expect("Failed to confirm bumped tx");
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
+        wait_for_electrum_tip(&env, Duration::from_secs(10))
             .expect("Electrum did not catch up after bump confirmation");
         cli_sync(&cli);
 
@@ -566,8 +566,7 @@ mod test_online {
             .unwrap()
             .assume_checked();
         env.mine_blocks(101, Some(node_addr)).unwrap();
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
-            .unwrap();
+        wait_for_electrum_tip(&env, Duration::from_secs(10)).unwrap();
         let a1 = cli_new_address(&cli);
         let t1 = env.send(&a1, Amount::from_btc(0.3).unwrap()).unwrap();
         env.wait_until_electrum_sees_txid(t1, Duration::from_secs(10))
@@ -577,8 +576,7 @@ mod test_online {
         env.wait_until_electrum_sees_txid(t2, Duration::from_secs(10))
             .unwrap();
         env.mine_blocks(3, None).unwrap();
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
-            .unwrap();
+        wait_for_electrum_tip(&env, Duration::from_secs(10)).unwrap();
         cli_full_scan(&cli);
 
         let unspent = run_wallet_json(&cli, &["unspent"]);
@@ -779,14 +777,12 @@ mod test_online {
                 .unwrap()
                 .assume_checked();
             env.mine_blocks(101, Some(node_address)).unwrap();
-            env.wait_until_electrum_sees_block(Duration::from_secs(10))
-                .unwrap();
+            wait_for_electrum_tip(&env, Duration::from_secs(10)).unwrap();
             let txid = env.send(&addr, Amount::from_btc(0.5).unwrap()).unwrap();
             env.wait_until_electrum_sees_txid(txid, Duration::from_secs(10))
                 .unwrap();
             env.mine_blocks(3, None).unwrap();
-            env.wait_until_electrum_sees_block(Duration::from_secs(10))
-                .unwrap();
+            wait_for_electrum_tip(&env, Duration::from_secs(10)).unwrap();
             cli.wallet_cmd(&["--wallet", WALLET, "full_scan"])
                 .assert()
                 .success();
@@ -874,14 +870,12 @@ mod test_online {
             .unwrap()
             .assume_checked();
         env.mine_blocks(101, Some(node_addr)).unwrap();
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
-            .unwrap();
+        wait_for_electrum_tip(&env, Duration::from_secs(10)).unwrap();
         let txid = env.send(&address, Amount::from_sat(5_000)).unwrap();
         env.wait_until_electrum_sees_txid(txid, Duration::from_secs(10))
             .unwrap();
         env.mine_blocks(3, None).unwrap();
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
-            .unwrap();
+        wait_for_electrum_tip(&env, Duration::from_secs(10)).unwrap();
         cli_full_scan(&cli);
 
         // The funded outpoint to prove control of.
@@ -1072,7 +1066,7 @@ mod test_online {
 
 #[cfg(feature = "esplora")]
 mod test_esplora {
-    use crate::common::BdkCli;
+    use crate::common::{BdkCli, wait_for_electrum_tip};
     use bdk_testenv::{TestEnv, bitcoincore_rpc::RpcApi};
     use bdk_wallet::bitcoin::{Address, Amount, Network};
     use serde_json::Value;
@@ -1132,14 +1126,12 @@ mod test_esplora {
             .unwrap()
             .assume_checked();
         env.mine_blocks(101, Some(node_addr)).unwrap();
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
-            .unwrap();
+        wait_for_electrum_tip(&env, Duration::from_secs(10)).unwrap();
         let txid = env.send(&address, Amount::from_btc(0.5).unwrap()).unwrap();
         env.wait_until_electrum_sees_txid(txid, Duration::from_secs(10))
             .unwrap();
         env.mine_blocks(3, None).unwrap();
-        env.wait_until_electrum_sees_block(Duration::from_secs(10))
-            .unwrap();
+        wait_for_electrum_tip(&env, Duration::from_secs(10)).unwrap();
 
         let scan = cli
             .wallet_cmd(&["--wallet", WALLET_NAME, "full_scan"])