ProveKit v1.0.3

ProveKit v1.0.3 is a security patch for the stable v1 release line, published from commit 00cbd7daba13e6ee1ee05d0b4a096a9ea0427ac4 (#519).

The release updates the compression dependency chain to zstd 0.14.3, zstd-safe 8.2.0, and zstd-sys 2.1.2, addressing RUSTSEC-2026-0391, RUSTSEC-2026-0398, RUSTSEC-2026-0403, and RUSTSEC-2026-0410. The manifest requires the patched minimum, protecting consumers that resolve their own lockfiles.

All six public crates are available on crates.io at 1.0.3:

• provekit-common
• provekit-prover
• provekit-verifier
• provekit-r1cs-compiler
• provekit-gnark
• provekit-cli

This release also includes the previously merged public-input count fix (#501), which had not shipped in v1.0.2. The compiler records the declared public-input count in R1CS, and verification rejects a mismatched R1CS hash, inconsistent public-input declaration, or incorrect public-input count.

Migration from v1.0.2: regenerate both prover (.pkp) and verifier (.pkv) keys for circuits with public inputs, then regenerate proofs with the new keys. Deploy the matching regenerated verifier key together with its proofs. Old v1.0.2 keys for these circuits are intentionally rejected by the stricter consistency checks; existing proofs cannot simply be reused with a new key. Keep the complete previous version's artifacts available during a coordinated upgrade; do not bypass the new verifier checks.

For the CLI, run prepare with v1.0.3 on the original Noir package, then prove with the regenerated prover key and verify with the matching regenerated verifier key.

Update exact =1.0.2 requirements to =1.0.3, or update the lockfile where an existing compatible requirement already permits 1.0.3. Re-run downstream advisory checks before removing exceptions for these four advisories.

CLI installation:

cargo +nightly-2026-03-04 install provekit-cli --version 1.0.3 --locked

Validation: Rust formatting, Clippy, build/tests, documentation, and Go CI passed on the release commit. All six Cargo package verifications passed before upload. The downloaded registry packages match their checksums and the release commit. A fresh downstream project using the five library crates passed cargo check; attempts to select vulnerable compression versions were rejected by Cargo.

Release-build smoke tests using fresh crates.io installations passed prepare/prove/verify and rejection of tampered public inputs. The same circuit proved and verified under v1.0.2, and its legacy public-input key was then correctly rejected by v1.0.3, confirming the migration requirement.

Known existing limitation: a debug-build v1.0.2 binary proof round-trip failed during postcard deserialization. Use the standard release-build CLI installation above; release-build v1.0.2 and v1.0.3 round-trips passed. This patch does not change the debug-only serialization implementation.