build(deps): bump freenet-stdlib from 0.6.1 to 0.8.5

[dependabot]

Bumps freenet-stdlib from 0.6.1 to 0.8.5.

Changelog

Sourced from freenet-stdlib's changelog.

[0.8.5] - 2026-07-27

Fixed

• Related-contract decoding no longer panics on well-formed requests. RelatedStateUpdate.related_to, RelatedDeltaUpdate.related_to, RelatedStateAndDeltaUpdate.related_to and RelatedContract.instance_id were decoded with ContractInstanceId::from_bytes(..).unwrap(). That function is a base58 string decoder, and the wire carries the id as 32 raw bytes. This was not an edge case: a random 32-byte id essentially never consists solely of base58 characters (the alphabet is 58 of 256 byte values, so the odds are about 2e-21), so every FlatBuffers UPDATE carrying a related update, and every PUT carrying a related contract, panicked the client's connection task. The PUT case stayed hidden because the loop body only runs on a non-empty vector and the TypeScript suite's fixture passes an empty one.

  Stated plainly, because it is not purely a panic fix: those four fields are now raw-bytes-only. The old decoder did accept base58 text there (that is the one input base58 decoding handles), so a client that worked around the panic by sending text at exactly those fields is rejected now. Raw bytes is what the schema type carries everywhere else, including ContractKey.instance in the same request.

• Four more length-unchecked (required) fields no longer panic. DelegateKey.key, SecretsId.hash, RegisterDelegate.cipher and RegisterDelegate.nonce were read with copy_from_slice or try_from(..).unwrap() into fixed-size arrays. The flatbuffers verifier checks that a (required) vector is PRESENT, not that it is the right LENGTH, so any client could send a short one and take down its connection task. DelegateKey is on the normal delegate path, and the TypeScript SDK exports it as the raw generated type with no length validation.

• Four union discriminants no longer hit unreachable!(). ContractType, DelegateType, UpdateDataType and InboundDelegateMsgType were decoded with unreachable!() on an unrecognized discriminant, but every generated union verifier ends in _ => Ok(()), so any discriminant a client sets reaches the decoder's match. All four now return a per-request error, matching what ContractRequestType and DelegateRequestType already did; those two, plus ClientRequestType, now share the same error shape and all report the offending value.

  A single test sweeps all 256 discriminants of all seven unions currently on the decode path, and a source-scrape test fails CI if a new decoder reintroduces either shape.

• HostResponse's three related-update variants now encode related_to as raw bytes. They wrote related_to.encode() - base58 text - into common.ContractInstanceId.data, which every other producer and every consumer treats as 32 raw bytes. This is the encode half of the same bug, and it survived because Rust only encodes host responses while only TypeScript

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)