dfinity · lwshang · Aug 20, 2025 · Aug 13, 2025 · Aug 13, 2025 · Aug 13, 2025
diff --git a/Cargo.Bazel.json.lock b/Cargo.Bazel.json.lock
diff --git a/Cargo.Bazel.toml.lock b/Cargo.Bazel.toml.lock
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -591,7 +591,8 @@ bitcoincore-rpc = "0.19.0"
 build-info = { git = "https://github.com/dfinity-lab/build-info", rev = "701a696844fba5c87df162fbbc1ccef96f27c9d7" }
 build-info-build = { git = "https://github.com/dfinity-lab/build-info", rev = "701a696844fba5c87df162fbbc1ccef96f27c9d7", default-features = false }
 bytes = "1.9.0"
-candid = { version = "0.10.6" }
+canbench-rs = "0.2.1"
+candid = { version = "0.10.17" }
 candid_parser = { version = "0.1.2" }
 chrono = { version = "0.4.38", default-features = false, features = [
     "alloc",
@@ -655,10 +656,10 @@ ic-bn-lib = { git = "https://github.com/dfinity/ic-bn-lib", rev = "620fb49a238b3
     "acme_alpn",
 ] }
 ic-btc-interface = "0.2.2"
-ic-canister-sig-creation = { git = "https://github.com/dfinity/ic-canister-sig-creation", rev = "7f9e931954637526295269155881207f6c832d6d" }
+ic-canister-sig-creation = "1.3.0"
 ic-cbor = "3"
-ic-cdk = "0.17.2"
-ic-cdk-timers = "0.11.0"
+ic-cdk = "0.18.6"
+ic-cdk-timers = "0.12.2"
 ic-certificate-verification = "3"
 ic-certification = "3"
 ic-gateway = { git = "https://github.com/dfinity/ic-gateway", rev = "b78562340bd00f05f9c055dcba3ec0f74758c927", default-features = false }
@@ -671,7 +672,7 @@ ic-sha3 = "1.0.0"
 ic-stable-structures = "0.6.8"
 ic-transport-types = { version = "0.40.1" }
 ic-utils = { version = "0.40.1", features = ["raw"] }
-ic-vetkeys = { git = "https://github.com/dfinity/vetkeys", rev = "5885675b6ccb5269cfac9740dc3da6f14f75347f" }
+ic-vetkeys = "0.4.0"
 ic_bls12_381 = { version = "0.10.1", default-features = false, features = [
     "groups",
     "pairings",

@@ -834,8 +834,8 @@ http_file(
     # ci/container/container-run.sh
     # bazel build //publish/binaries:pocket-ic.gz
     # sha256sum bazel-bin/publish/binaries/pocket-ic.gz
-    sha256 = "399596330c40a76effbbd20660ce8e892d5d74f3de6380cad4aac1598b9d6394",
-    url = "https://download.dfinity.systems/ic/c36a05a9d367bb6ba9068444e6d6f53e7911f1b0/binaries/x86_64-linux/pocket-ic.gz",
+    sha256 = "237272216498074e5250a0685813b96632963ff9abbc51a7030d9b625985028d",
+    url = "https://github.com/dfinity/pocketic/releases/download/9.0.1/pocket-ic-x86_64-linux.gz",
 )
 
 # Management canister candid interface

@@ -370,13 +370,13 @@ def external_crates_repository(name, cargo_lockfile, lockfile):
                 default_features = False,
             ),
             "canbench": crate.spec(
-                version = "^0.1.15",
+                version = "^0.2.1",
             ),
             "canbench-rs": crate.spec(
-                version = "^0.1.15",
+                version = "^0.2.1",
             ),
             "candid": crate.spec(
-                version = "^0.10.13",
+                version = "^0.10.17",
             ),
             "cargo_metadata": crate.spec(
                 version = "^0.14.2",
@@ -662,21 +662,19 @@ def external_crates_repository(name, cargo_lockfile, lockfile):
                 version = "^0.2.0",
             ),
             "ic-canister-sig-creation": crate.spec(
-                git = "https://github.com/dfinity/ic-canister-sig-creation",
-                rev = "7f9e931954637526295269155881207f6c832d6d",
+                version = "^1.3.0",
             ),
             "ic-cbor": crate.spec(
                 version = "3.0.3",
             ),
             "ic-cdk": crate.spec(
-                version = "^0.17.2",
+                version = "^0.18.6",
             ),
-            "ic-cdk-next": crate.spec(
-                package = "ic-cdk",
-                version = "^0.18.0-alpha.2",
+            "ic-cdk-executor": crate.spec(
+                version = "^1.0.2",
             ),
             "ic-cdk-timers": crate.spec(
-                version = "^0.11.0",
+                version = "^0.12.2",
             ),
             "ic-certified-map": crate.spec(
                 version = "^0.3.1",
@@ -746,8 +744,7 @@ def external_crates_repository(name, cargo_lockfile, lockfile):
                 default_features = False,
             ),
             "ic-vetkeys": crate.spec(
-                git = "https://github.com/dfinity/vetkeys",
-                rev = "5885675b6ccb5269cfac9740dc3da6f14f75347f",
+                version = "^0.4.0",
             ),
             "ic-wasm": crate.spec(
                 version = "^0.8.4",

@@ -20,6 +20,7 @@ impl Runtime for CdkRuntime {
         In: ArgumentEncoder + Send,
         Out: for<'a> ArgumentDecoder<'a>,
     {
+        #[allow(deprecated)]
         ic_cdk::call(id, method, args)
             .await
             .map_err(|(code, msg)| (code as i32, msg))

@@ -1,3 +1,4 @@
+#![allow(deprecated)]
 use candid::{define_function, CandidType, Nat, Principal};
 use ic_cdk::api::call::{accept_message, arg_data_raw, reject, RejectionCode};
 use ic_cdk::api::instruction_counter;

@@ -1,3 +1,4 @@
+#![allow(deprecated)]
 use bitcoin::{consensus::Decodable, Address, Transaction};
 use candid::Nat;
 use ic_btc_checker::{
@@ -69,10 +70,10 @@ fn check_address(args: CheckAddressArgs) -> CheckAddressResponse {
     let config = get_config();
     let btc_network = config.btc_network();
     let address = Address::from_str(args.address.trim())
-        .unwrap_or_else(|err| ic_cdk::trap(&format!("Invalid Bitcoin address: {}", err)))
+        .unwrap_or_else(|err| ic_cdk::trap(format!("Invalid Bitcoin address: {}", err)))
         .require_network(btc_network.clone().into())
         .unwrap_or_else(|err| {
-            ic_cdk::trap(&format!("Not a Bitcoin {} address: {}", btc_network, err))
+            ic_cdk::trap(format!("Not a Bitcoin {} address: {}", btc_network, err))
         });
 
     match config.check_mode {
@@ -169,7 +170,7 @@ fn init(arg: Option<CheckArg>) {
                 init_arg.check_mode,
                 init_arg.num_subnet_nodes,
             )
-            .unwrap_or_else(|err| ic_cdk::trap(&format!("error creating config: {}", err))),
+            .unwrap_or_else(|err| ic_cdk::trap(format!("error creating config: {}", err))),
         ),
         _ => {
             ic_cdk::trap("cannot init canister state without init args");
@@ -192,7 +193,7 @@ fn post_upgrade(arg: Option<CheckArg>) {
                 .unwrap_or(old_config.check_mode);
             let config =
                 Config::new_and_validate(old_config.btc_network(), check_mode, num_subnet_nodes)
-                    .unwrap_or_else(|err| ic_cdk::trap(&format!("error creating config: {}", err)));
+                    .unwrap_or_else(|err| ic_cdk::trap(format!("error creating config: {}", err)));
             set_config(config);
         }
         Some(CheckArg::InitArg(_)) => {

@@ -1,3 +1,4 @@
+#![allow(deprecated)]
 use candid::{decode_one, Encode, Principal};
 use ic_base_types::PrincipalId;
 use ic_btc_checker::{

diff --git a/rs/bitcoin/ckbtc/minter/Cargo.toml b/rs/bitcoin/ckbtc/minter/Cargo.toml
@@ -14,7 +14,7 @@ path = "src/main.rs"
 async-trait = { workspace = true }
 bech32 = "0.9.0"
 bs58 = "0.5.0"
-canbench-rs = { version = "0.1.7", optional = true }
+canbench-rs = { workspace = true, optional = true }
 candid = { workspace = true }
 ciborium = { workspace = true }
 hex = { workspace = true }

@@ -1,3 +1,4 @@
+#![allow(deprecated)]
 use crate::address::BitcoinAddress;
 use crate::logs::{P0, P1};
 use crate::management::CallError;

@@ -69,7 +69,7 @@ pub fn post_upgrade(upgrade_args: Option<UpgradeArgs>) {
     log!(P0, "[upgrade]: replaying {} events", count_events());
 
     let state = replay::<CheckInvariantsImpl>(events()).unwrap_or_else(|e| {
-        ic_cdk::trap(&format!(
+        ic_cdk::trap(format!(
             "[upgrade]: failed to replay the event log: {:?}",
             e
         ))

@@ -1,3 +1,4 @@
+#![allow(deprecated)]
 use candid::Principal;
 use ic_btc_interface::Utxo;
 use ic_canister_log::export as export_logs;
@@ -111,10 +112,15 @@ fn check_anonymous_caller() {
 
 #[export_name = "canister_global_timer"]
 fn timer() {
-    #[cfg(feature = "self_check")]
-    ok_or_die(check_invariants());
-
-    ic_ckbtc_minter::timer(IC_CANISTER_RUNTIME);
+    // ic_ckbtc_minter::timer invokes ic_cdk::spawn
+    // which must be wrapped in in_executor_context
+    // as required by the new ic-cdk-executor.
+    ic_cdk::futures::in_executor_context(|| {
+        #[cfg(feature = "self_check")]
+        ok_or_die(check_invariants());
+
+        ic_ckbtc_minter::timer(IC_CANISTER_RUNTIME);
+    });
 }
 
 #[post_upgrade]

@@ -844,7 +844,7 @@ impl CkBtcMinterState {
         {
             self.stuck_transactions.swap_remove(pos)
         } else {
-            ic_cdk::trap(&format!(
+            ic_cdk::trap(format!(
                 "Attempted to finalized a non-existent transaction {}",
                 txid
             ));

@@ -58,7 +58,7 @@ pub async fn init_ecdsa_public_key() -> ECDSAPublicKey {
     let ecdsa_public_key =
         crate::management::ecdsa_public_key(key_name, DerivationPath::new(vec![]))
             .await
-            .unwrap_or_else(|e| ic_cdk::trap(&format!("failed to retrieve ECDSA public key: {e}")));
+            .unwrap_or_else(|e| ic_cdk::trap(format!("failed to retrieve ECDSA public key: {e}")));
     log!(
         P1,
         "ECDSA public key set to {}, chain code to {}",

@@ -422,11 +422,11 @@ async fn burn_ckbtcs(user: Principal, amount: u64, memo: Memo) -> Result<u64, Re
                 "cannot burn ckBTC: the ledger fails with: {} (error code {})", message, error_code
             )))
         }
-        Err(TransferError::BadFee { expected_fee }) => ic_cdk::trap(&format!(
+        Err(TransferError::BadFee { expected_fee }) => ic_cdk::trap(format!(
             "unreachable: the ledger demands the fee of {} even though the fee field is unset",
             expected_fee
         )),
-        Err(TransferError::Duplicate{ duplicate_of }) => ic_cdk::trap(&format!(
+        Err(TransferError::Duplicate{ duplicate_of }) => ic_cdk::trap(format!(
             "unreachable: the ledger reports duplicate ({}) even though the create_at_time field is unset",
             duplicate_of
         )),
@@ -436,7 +436,7 @@ async fn burn_ckbtcs(user: Principal, amount: u64, memo: Memo) -> Result<u64, Re
         Err(TransferError::TooOld) => ic_cdk::trap(
             "unreachable: the ledger reports TooOld even though the create_at_time field is unset"
         ),
-        Err(TransferError::BadBurn { min_burn_amount }) => ic_cdk::trap(&format!(
+        Err(TransferError::BadBurn { min_burn_amount }) => ic_cdk::trap(format!(
             "the minter is misconfigured: retrieve_btc_min_amount {} is less than ledger's min_burn_amount {}",
             read_state(|s| s.retrieve_btc_min_amount),
             min_burn_amount
@@ -495,11 +495,11 @@ async fn burn_ckbtcs_icrc2(
                 "cannot burn ckBTC: the ledger fails with: {} (error code {})", message, error_code
             )))
         }
-        Err(TransferFromError::BadFee { expected_fee }) => ic_cdk::trap(&format!(
+        Err(TransferFromError::BadFee { expected_fee }) => ic_cdk::trap(format!(
             "unreachable: the ledger demands the fee of {} even though the fee field is unset",
             expected_fee
         )),
-        Err(TransferFromError::Duplicate { duplicate_of }) => ic_cdk::trap(&format!(
+        Err(TransferFromError::Duplicate { duplicate_of }) => ic_cdk::trap(format!(
             "unreachable: the ledger reports duplicate ({}) even though the create_at_time field is unset",
             duplicate_of
         )),
@@ -509,7 +509,7 @@ async fn burn_ckbtcs_icrc2(
         Err(TransferFromError::TooOld) => ic_cdk::trap(
             "unreachable: the ledger reports TooOld even though the create_at_time field is unset"
         ),
-        Err(TransferFromError::BadBurn { min_burn_amount }) => ic_cdk::trap(&format!(
+        Err(TransferFromError::BadBurn { min_burn_amount }) => ic_cdk::trap(format!(
             "the minter is misconfigured: retrieve_btc_min_amount {} is less than ledger's min_burn_amount {}",
             read_state(|s| s.retrieve_btc_min_amount),
             min_burn_amount

@@ -1,3 +1,4 @@
+#![allow(deprecated)]
 use assert_matches::assert_matches;
 use bitcoin::util::psbt::serialize::Deserialize;
 use bitcoin::{Address as BtcAddress, Network as BtcNetwork};

@@ -1,3 +1,4 @@
+#![allow(deprecated)]
 use candid::candid_method;
 use ic_btc_interface::{
     Address, GetCurrentFeePercentilesRequest, GetUtxosRequest, GetUtxosResponse,

@@ -1,3 +1,4 @@
+#![allow(deprecated)]
 use bitcoin::consensus::deserialize;
 use bitcoin::Transaction;
 use candid::{Decode, Encode};

@@ -4,7 +4,7 @@ use anyhow::anyhow;
 use certificate_orchestrator_interface::{
     EncryptedPair, ExportPackage, IcCertificate, Id, Registration, LEFT_GUARD, RIGHT_GUARD,
 };
-use ic_cdk::caller;
+use ic_cdk::api::msg_caller;
 use prometheus::labels;
 
 use crate::{
@@ -46,7 +46,7 @@ impl GetCert for CertGetter {
 
 impl<T: GetCert, A: Authorize> GetCert for WithAuthorize<T, A> {
     fn get_cert(&self, id: &Id) -> Result<EncryptedPair, GetCertError> {
-        if let Err(err) = self.1.authorize(&caller()) {
+        if let Err(err) = self.1.authorize(&msg_caller()) {
             return Err(match err {
                 AuthorizeError::Unauthorized => GetCertError::Unauthorized,
                 AuthorizeError::UnexpectedError(err) => GetCertError::UnexpectedError(err),
@@ -134,7 +134,7 @@ impl<T: Upload> Upload for UploadWithIcCertification<T> {
 
 impl<T: Upload, A: Authorize> Upload for WithAuthorize<T, A> {
     fn upload(&self, id: &Id, pair: EncryptedPair) -> Result<(), UploadError> {
-        if let Err(err) = self.1.authorize(&caller()) {
+        if let Err(err) = self.1.authorize(&msg_caller()) {
             return Err(match err {
                 AuthorizeError::Unauthorized => UploadError::Unauthorized,
                 AuthorizeError::UnexpectedError(err) => UploadError::UnexpectedError(err),
@@ -299,7 +299,7 @@ impl Export for Exporter {
 
 impl<T: Export, A: Authorize> Export for WithAuthorize<T, A> {
     fn export(&self, key: Option<String>, limit: u64) -> Result<Vec<ExportPackage>, ExportError> {
-        if let Err(err) = self.1.authorize(&caller()) {
+        if let Err(err) = self.1.authorize(&msg_caller()) {
             return Err(match err {
                 AuthorizeError::Unauthorized => ExportError::Unauthorized,
                 AuthorizeError::UnexpectedError(err) => ExportError::UnexpectedError(err),
@@ -314,7 +314,7 @@ impl<T: Export, A: Authorize> Export for WithAuthorize<T, A> {
         key: Option<String>,
         limit: u64,
     ) -> Result<(Vec<ExportPackage>, IcCertificate), ExportError> {
-        if let Err(err) = self.1.authorize(&caller()) {
+        if let Err(err) = self.1.authorize(&msg_caller()) {
             return Err(match err {
                 AuthorizeError::Unauthorized => ExportError::Unauthorized,
                 AuthorizeError::UnexpectedError(err) => ExportError::UnexpectedError(err),

@@ -2,7 +2,7 @@ use candid::Encode;
 use certificate_orchestrator_interface::{
     BoundedString, ExportPackage, IcCertificate, Id, LABEL_DOMAINS, LEFT_GUARD, RIGHT_GUARD,
 };
-use ic_cdk::api::{data_certificate, set_certified_data};
+use ic_cdk::api::{certified_data_set, data_certificate};
 use ic_certified_map::{labeled, labeled_hash, AsHashTree, Hash as ICHash, RbTree};
 use serde::Serialize;
 use serde_cbor::Serializer;
@@ -19,13 +19,13 @@ pub fn init_cert_tree() {
         let value: Vec<u8> = Vec::new();
         tree.insert(LEFT_GUARD.into(), Sha256::digest(&value).into());
         tree.insert(RIGHT_GUARD.into(), Sha256::digest(&value).into());
-        set_certified_data(&labeled_hash(LABEL_DOMAINS, &tree.root_hash()));
+        certified_data_set(labeled_hash(LABEL_DOMAINS, &tree.root_hash()));
     });
 }
 
 pub fn set_root_hash() {
     let root_hash = CERT_TREE.with(|tree| labeled_hash(LABEL_DOMAINS, &tree.borrow().root_hash()));
-    set_certified_data(&root_hash);
+    certified_data_set(root_hash);
 }
 
 pub fn remove_cert(key: BoundedString<64>) {