Bump bindgen from 0.72.1 to 0.73.2

[dependabot]

Bumps bindgen from 0.72.1 to 0.73.2.

Changelog

Sourced from bindgen's changelog.

0.73.2 (2026-09-08)

Added

Changed

Removed

Fixed

• Fixed various regressions with over/underaligned types with respect to 0.72 (#3449,#3453,#3458).
• Fixed a codegen regression with bitfields with enum types in some circumstances (#3455).

Security

0.73.1 (2026-09-05)

Added

Changed

• Widened acceptable prettyplease / syn dependency versions (#3447).

Removed

Fixed

Security

0.73.0 (2026-09-05)

Added

• Add Debug, Clone and Eq traits to ParseCallbacks info types (#3233).
• Include the source location in discovery ParseCallbacks (#3244).
• Report constants and variables in ParseCallbacks::new_item_found (#3249).
• Allow adding custom attributes to extern function blocks (#3257).
• Support new-type-alias constants (#3288, #3390).
• Support nested flexible array members (#3306).
• Add support for custom per-field attributes (#3307).
• Add const-generic bitfield accessors for compile-time optimization (#3325, #3374).
• Allow renaming struct and union fields (#3358).
• Add a libcpp feature to link libclang against libc++ (#3375).
• Prebuilt binaries for aarch64 Linux (#3217).

Changed

• Guarantee opaque type layout across all architectures (#3280).
• Use NonNull for C++ references (#3292).
• Bindings::write now takes impl Write instead of Box<dyn Write> (#3317, #3324).
• Optimize bitfield unit get/set with byte-wise operations (#3325).
• Emit const __BindgenUnionField accessors and comply with Rust 2024 unsafe_op_in_unsafe_fn (#3337).
• Generate a doc comment pointing at the aliased type when a type alias is hidden (#3122).
• dyngen: convert the library path to OsStr before opening it (#3315).
• Return a NoHeadersProvided error instead of generating empty bindings when no input headers are provided (#3391).
• Bump the MSRV to 1.71 (#3401).
• Bump syn to v3 (#3401) and shlex to v2 (#3380).

Removed

• Removed support for generating code for rustc versions < 1.51, along with

... (truncated)

Commits

• 73c69d6 chore: Release
• 77cbc72 codegen: Pad bitfields to field offset if applicable.
• dc61531 ty: More struct layout fixes for overaligned integers / aliases.
• 4348523 codegen: Revert some bitfield codegen changes and silence unnecessary_transmu...
• efb6e0c ty: Use underlying layout of typedefs if available.
• 18fc3ac codegen: Simplify bitfield merging code.
• 910679f codegen: Remove hack that is no longer needed now that we have repr(align) ev...
• 38ebc48 codegen: Don't force padding to be aligned.
• 64f0939 codegen: Don't force padding for over-aligned fields.
• cf8faab codegen: Simplify some conditions about repr(align).
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Build-time-only dependency bump with no source changes; regenerated bindings could differ slightly due to bindgen codegen fixes, but runtime behavior should be unchanged if CI passes.

Overview
Bumps the bindgen build dependency in rust_bindings from 0.72.1 to 0.73.2, with matching Cargo.lock updates (including bindgen’s trimmed transitive deps and shlex 2.0.1 alongside shlex 1.3.0 for other crates).

No application or build.rs changes—only the version used at compile time to generate C++ FFI bindings from wrapper.h.

^{Reviewed by Cursor Bugbot for commit 637bf7a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​bindgen@​0.72.1 ⏵ 0.73.2	+1

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the bindgen 0.72.1 → 0.73.2 update for supply-chain risk, starting with local usage, the malware scan, and upstream diffs.I'll inspect workflow diffs, new lockfile packages, and whether process-spawn code is new versus pre-existing.Verdict: benign

This is a normal rust-lang/rust-bindgen 0.72.1 → 0.73.2 release (codegen/layout fixes, syn/shlex bumps, MSRV 1.71). Tags v0.72.1 / v0.73.2 match the scanned commits. No obfuscation, hidden Unicode, IOCs, unexpected network clients, or install-time scripts in the crate.

Scanner (warn) vs this review: the 9 heuristic hits are false positives, not compromise.

• Process spawn: pre-existing, documented use — clang preprocess (dump_preprocessed_input) and rustfmt. One hit is thread::spawn. Test harness spawns ci/no-includes.sh.
• Workflow edits: upstream CI only (aarch64 runners, LLVM 16→20, cargo-dist → dist, persist-credentials: false). This is not a chiavdf workflow injection. Installer still comes from github.com/axodotdev/cargo-dist.
• ~201 lockfile packages: bindgen workspace Cargo.lock after syn 2→3 / prettyplease widen / shlex 1→2. Expected graph churn, not a new runtime payload.
• Maintainer drift: version-bump heuristic. Top authors remain known bindgen/Servo/Mozilla/Google contributors; crates.io authors field was dropped, not replaced by a new publisher.

For chiavdf: bindgen is a build-dependency. Risk is generated FFI layout, not runtime malware. Confirm cargo test / bindgen output still matches after the bump (0.73.x specifically fixed over/underaligned types vs 0.72).

Compatibility Analysis

I'll analyze bindgen usage in this repo and compare it with the 0.72.1 → 0.73.2 upstream changes.The usage hints mostly point at upstream bindgen itself. I'll search this repo's own manifests and build scripts next.Recommendation: merge-with-caveats

bindgen is a build-time crate. This repo’s call sites do not use the 0.73 breaking Builder/callback APIs. Gate on the existing Rust CI matrix (especially Windows MSVC + libclang). No consumer code change is expected.

1) Where it is used

Local bindgen hits in malware notes / upstream_changed_files.txt are from the cloned rust-lang/rust-bindgen tree, not chiavdf.

Real adoption:

Site	Role
rust_bindings/Cargo.toml	bindgen = "0.73.2" under [build-dependencies]
Cargo.lock	Locked to 0.73.2
rust_bindings/build.rs	Only call site
rust_bindings/wrapper.h → src/c_bindings/c_wrapper.h	Input headers
rust_bindings/src/lib.rs	Includes generated OUT_DIR/bindings.rs

build.rs uses: Builder::default(), .header(), .clang_arg(), .allowlist_function(...) (five C functions + free), CargoCallbacks::new(), .generate(), .write_to_file(). Bindings are not checked in.

Headers are a small extern "C" surface: functions plus ByteArray { uint8_t* data; size_t length; }. No bitfields, C++ references, opaque blobs, unions, or custom ParseCallbacks.

Fuzz targets depend on chiavdf only, so they pick this up via the same build.rs.

2) Intersection with 0.72.1 → 0.73.2 changes

0.73 change	Hits this repo?
Bindings::write now takes impl Write	No — uses write_to_file
ParseCallbacks extras / new_item_found	No — stock CargoCallbacks
NonNull for C++ references	No — C pointers, not C++ refs
Bitfield / over-align / enum-bitfield codegen	No — no bitfields
Opaque layout / nested FAM / field rename / per-field attrs	No
NoHeadersProvided	No — always passes wrapper.h
syn v3 / shlex v2 / MSRV 1.71	Internal to bindgen; chiavdf has no rust-version, CI is stable/nightly
Drop rustc generated targets < 1.51	Irrelevant for current CI

Codegen still can change bindings.rs (layout tests, padding, comments). For this ABI that is low risk; ByteArray is two scalar fields.

3) Risks / unknowns

• Build, not runtime crate, but generated FFI is compiled into the crate. A bindgen layout bug would be a real ABI issue; 0.73.2 specifically reverted 0.73 layout regressions vs 0.72.
• Bindgen still needs libclang at build time (unchanged; Windows is the usual flake).
• No pinned MSRV here; 1.71 is below stable in .github/workflows/rust.yml.
• Generated output is not reviewed in git; CI compile + cargo test / fuzz is the check.

4) Verdict

Merge-with-caveats: merge once Rust bindings tests (Ubuntu/macOS/Windows) are green. No build.rs / lib.rs edits needed unless CI shows a generate/compile failure.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 323
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 1
• Resolved upstream range: d874de8d646d9b8a3e7ba2db2bcd52f2fba8f1f5..73c69d681eec90b84ffba4f993b5fb2f19580781
• Resolved refs: from=d874de8d646d9b8a3e7ba2db2bcd52f2fba8f1f5 to=73c69d681eec90b84ffba4f993b5fb2f19580781
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 9

Top findings

• bindgen/lib.rs:451 shell_process_spawn :: let mut child = cmd.spawn()?;
• bindgen/lib.rs:1042 shell_process_spawn :: let mut child = cmd.spawn()?;
• bindgen/lib.rs:1051 shell_process_spawn :: let stdin_handle = ::std::thread::spawn(move || {
• bindgen-tests/tests/tests.rs:712 shell_process_spawn :: .spawn()
• bindgen-tests/tests/tests.rs:713 shell_process_spawn :: .expect("should spawn ../ci/no-includes.sh OK")
• .github/workflows/bindgen.yml:0 workflow_path_touch :: path-touch
• .github/workflows/release.yml:0 workflow_path_touch :: path-touch
• Cargo.lock:0 transitive_dependencies_added :: 201
• bindgen:0 maintainer_drift :: 0.72.1->0.73.2