From cc0a7f299c96353a808cfcedbd5ea73a767cd36b Mon Sep 17 00:00:00 2001
From: Drew Stone <drewstone329@gmail.com>
Date: Fri, 24 Jul 2026 14:51:48 -0600
Subject: [PATCH] fix(bindings): declare the real MSRV (rust-version 1.81 ->
 1.91)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Dependabot security sweep (#198) bumped alloy 1.1.2 -> 1.8.3 — load-bearing
for the lru 0.16 RUSTSEC fix (alloy-provider moves its lru pin ^0.13 -> ^0.16) —
and alloy 1.8.3 declares rustc >= 1.91. The locked graph's true max MSRV is 1.91
(verified via cargo metadata), but bindings/ and fixtures/ still declared 1.81,
so tnt-core-bindings — a published crate — advertised an MSRV it no longer met;
a consumer on 1.81-1.90 hits 'rustc is unsupported' from alloy/ruint.

Fixes the sole blocking finding on #198's multi-shot review. Verified the crate
builds on exactly 1.91 (cargo +1.91 check -p tnt-core-bindings --locked, green).

CHANGELOG documents the MSRV bump and the two accepted build-environment
consequences of the alloy bump: aws-lc-rs now needs cmake + a C toolchain, and
the TLS trust root moved from bundled webpki-roots to the OS-native store.
---
 bindings/CHANGELOG.md | 20 ++++++++++++++++++++
 bindings/Cargo.toml   |  2 +-
 fixtures/Cargo.toml   |  2 +-
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/bindings/CHANGELOG.md b/bindings/CHANGELOG.md
index c4f0ddd..38fcafe 100644
--- a/bindings/CHANGELOG.md
+++ b/bindings/CHANGELOG.md
@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- **MSRV raised to Rust 1.91** (`rust-version`, was `1.81`). The Dependabot
+  security sweep (#198) bumped `alloy` 1.1.2 → 1.8.3 — required to pull the
+  `lru` 0.16 fix (RUSTSEC) via `alloy-provider`, which moves its `lru` pin
+  `^0.13` → `^0.16` — and `alloy` 1.8.3 declares `rustc >= 1.91`. The declared
+  MSRV now matches what the locked dependency graph actually requires; the
+  previous `1.81` no longer built. CI builds on `stable`, which satisfies it.
+
+### Build environment (consequences of the `alloy` 1.8.3 bump — noted, accepted)
+
+- **cmake + a C toolchain are now build-time requirements.** `alloy` 1.8.3
+  pulls `reqwest` 0.13 → `rustls` 0.23.41, whose default crypto provider is
+  `aws-lc-rs` (`aws-lc-sys` compiles a C/C++ crypto library via `cmake`).
+  Minimal build images must install `cmake` and a C compiler.
+- **TLS trust root moved to the OS-native store.** `reqwest` 0.13 replaced the
+  bundled `webpki-roots` Mozilla store with `rustls-platform-verifier`, so RPC
+  over HTTPS now trusts the host OS certificate store (Keychain / `/etc/ssl` /
+  Windows cert store) rather than a pinned root set.
+
 ## [0.18.0] - 2026-07-02
 
 Event-sourced blueprint definitions and operator endpoints: `createBlueprint`
diff --git a/bindings/Cargo.toml b/bindings/Cargo.toml
index c529b54..a6d54c3 100644
--- a/bindings/Cargo.toml
+++ b/bindings/Cargo.toml
@@ -2,7 +2,7 @@
 name = "tnt-core-bindings"
 version = "0.19.0"
 edition = "2021"
-rust-version = "1.81"
+rust-version = "1.91"
 description = "Rust bindings for TNT Core Solidity contracts (Tangle staking protocol)"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/tangle-network/tnt-core"
diff --git a/fixtures/Cargo.toml b/fixtures/Cargo.toml
index d1b0917..9b5d729 100644
--- a/fixtures/Cargo.toml
+++ b/fixtures/Cargo.toml
@@ -2,7 +2,7 @@
 name = "tnt-core-fixtures"
 version = "0.17.1"
 edition = "2021"
-rust-version = "1.81"
+rust-version = "1.91"
 description = "Local testnet fixture data for TNT Core"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/tangle-network/tnt-core"