fix(deps): Update yanked versions of cpufeatures (orchard/aes), ed25519 (tor), and quick-xml (flamegraph)

[teor2345]

Motivation

Some of Zebra's transitive dependencies have been yanked (unpublished on crates.io).

The latest versions fix a miscompile that causes crashes in cryptographic code, and other bugs.

This fixes compilation warnings like:

Warning: warning: package ed25519 v1.4.0 in Cargo.lock is yanked in registry crates-io, consider running without --locked

https://github.com/ZcashFoundation/zebra/actions/runs/3150408776/jobs/5123159992#step:4:18

https://github.com/ZcashFoundation/zebra/actions/runs/3170245187

Solution

Use cargo update -p <crate-name> to update each of these dependencies to the latest version in Cargo.lock.

(We don't depend on them directly, so we can't update Cargo.toml to fix them.)

Review

This is a high priority because it might be a cause of #5091.

(These dependencies are not used by the download code, but they are in the same crate. So it's unlikely but possible.)

Reviewer Checklist

• Will the PR name make sense to users?
  • Does it need extra CHANGELOG info? (new features, breaking changes, large changes)
• Are the PR labels correct?
• Does the code do what the ticket and PR says?
• How do you know it works? Does it have tests?

[codecov]

Codecov Report

Merging #5308 (34585ff) into main (9849d14) will decrease coverage by 0.04%.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5308      +/-   ##
==========================================
- Coverage   79.15%   79.10%   -0.05%     
==========================================
  Files         308      308              
  Lines       39479    39560      +81     
==========================================
+ Hits        31248    31294      +46     
- Misses       8231     8266      +35     

[teor2345]

Failed due to db_init_outside_future_executor, which is fixed on main:
https://github.com/ZcashFoundation/zebra/actions/runs/3178286290/jobs/5179623991#step:10:3727

And local_listener_fixed_port_localhost_addr_v4, which is #4999:
https://github.com/ZcashFoundation/zebra/actions/runs/3178286293/jobs/5180152372#step:3:3344

[teor2345]

@Mergifyio refresh

[mergify]

refresh

✅ Pull request refreshed