From 82fbfb1162b7f7596f7ccfccfafce70dd70f3b33 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Mon, 30 Jun 2025 15:02:29 +0200
Subject: [PATCH 01/12] make http-parser and ctrlc optional features

---
 Cargo.toml                     |  7 ++++++-
 stacks-common/Cargo.toml       | 17 ++++++++++-------
 stacks-common/src/libcommon.rs | 14 ++++++++++++--
 stacks-common/src/util/mod.rs  |  1 +
 4 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index d604038f94..2c3147c384 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,11 +16,16 @@ members = [
 [workspace.dependencies]
 ed25519-dalek = { version = "2.1.1", features = ["serde", "rand_core"] }
 hashbrown = { version = "0.15.2", features = ["serde"] }
+lazy_static = "1.4.0"
 rand_core = "0.6.4"
 rand = "0.8"
 rand_chacha = "0.3.1"
-tikv-jemallocator = "0.5.4"
+serde = "1"
+serde_derive = "1"
+slog = { version = "2.5.2", features = [ "max_level_trace" ] }
+regex = "1"
 rusqlite = { version = "0.31.0", features = ["blob", "serde_json", "i128_blob", "bundled", "trace"] }
+tikv-jemallocator = "0.5.4"
 thiserror = "1.0.65"
 toml = "0.5.6"
 
diff --git a/stacks-common/Cargo.toml b/stacks-common/Cargo.toml
index a1a27ba6bf..753fa2da7d 100644
--- a/stacks-common/Cargo.toml
+++ b/stacks-common/Cargo.toml
@@ -31,20 +31,21 @@ path = "./src/libcommon.rs"
 
 [dependencies]
 rand = { workspace = true }
-serde = { version = "1.0", features = ["derive"] }
-serde_derive = "1"
+serde = { workspace = true , features = ["derive"] }
+serde_derive = { workspace = true }
 sha3 = "0.10.1"
 ripemd = "0.1.1"
-lazy_static = "1.4.0"
-slog = { version = "2.5.2", features = ["max_level_trace"] }
+lazy_static = { workspace = true }
+slog = { workspace = true }
 slog-term = "2.6.0"
 slog-json = { version = "2.3.0", optional = true }
 chrono = "0.4.19"
 hashbrown = { workspace = true }
+regex = { workspace = true }
 rusqlite = { workspace = true, optional = true }
 
 [target.'cfg(unix)'.dependencies]
-nix = "0.23"
+nix = {version = "0.23", optional = true}
 
 [target.'cfg(windows)'.dependencies]
 winapi = { version = "0.3", features = [
@@ -83,8 +84,10 @@ rand_core = { workspace = true }
 proptest = "1.6.0"
 
 [features]
-default = ["developer-mode"]
+default = ["developer-mode", "ctrlc-handler", "http-parser"]
 developer-mode = []
+ctrlc-handler = ["dep:nix"]
+http-parser = []
 slog_json = ["slog-json"]
 rusqlite = ["dep:rusqlite"]
 testing = []
@@ -93,7 +96,7 @@ bech32_std = []
 bech32_strict = []
 
 [build-dependencies]
-toml = "0.5.6"
+toml = { workspace = true }
 
 [target.'cfg(all(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64"), not(any(target_os="windows"))))'.dependencies]
 sha2 = { version = "0.10", features = ["asm"] }
diff --git a/stacks-common/src/libcommon.rs b/stacks-common/src/libcommon.rs
index 48f8cd5970..4472235224 100644
--- a/stacks-common/src/libcommon.rs
+++ b/stacks-common/src/libcommon.rs
@@ -13,7 +13,7 @@ extern crate slog;
 #[macro_use]
 extern crate serde_derive;
 
-#[cfg(unix)]
+#[cfg(all(unix, feature = "ctrlc-handler"))]
 extern crate nix;
 
 #[cfg(windows)]
@@ -29,7 +29,17 @@ pub mod types;
 
 pub mod address;
 
-pub mod deps_common;
+pub mod deps_common {
+    pub mod bech32;
+    pub mod bitcoin;
+
+    // These are gated by features.
+    #[cfg(feature = "ctrlc-handler")]
+    pub mod ctrlc;
+
+    #[cfg(feature = "http-parser")]
+    pub mod httparse;
+}
 
 pub mod bitvec;
 
diff --git a/stacks-common/src/util/mod.rs b/stacks-common/src/util/mod.rs
index 38801fa00d..534b40c792 100644
--- a/stacks-common/src/util/mod.rs
+++ b/stacks-common/src/util/mod.rs
@@ -18,6 +18,7 @@
 pub mod log;
 #[macro_use]
 pub mod macros;
+#[cfg(feature = "http-parser")]
 pub mod chunked_encoding;
 #[cfg(feature = "rusqlite")]
 pub mod db;

From cb16f1a5917b345bcef54639c7b1061b64824b24 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Mon, 30 Jun 2025 15:37:55 +0200
Subject: [PATCH 02/12] remove regex from stacks-common

---
 Cargo.toml               | 1 -
 stacks-common/Cargo.toml | 1 -
 2 files changed, 2 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 2c3147c384..bcb608b1bd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,7 +23,6 @@ rand_chacha = "0.3.1"
 serde = "1"
 serde_derive = "1"
 slog = { version = "2.5.2", features = [ "max_level_trace" ] }
-regex = "1"
 rusqlite = { version = "0.31.0", features = ["blob", "serde_json", "i128_blob", "bundled", "trace"] }
 tikv-jemallocator = "0.5.4"
 thiserror = "1.0.65"
diff --git a/stacks-common/Cargo.toml b/stacks-common/Cargo.toml
index 753fa2da7d..8c1948fa85 100644
--- a/stacks-common/Cargo.toml
+++ b/stacks-common/Cargo.toml
@@ -41,7 +41,6 @@ slog-term = "2.6.0"
 slog-json = { version = "2.3.0", optional = true }
 chrono = "0.4.19"
 hashbrown = { workspace = true }
-regex = { workspace = true }
 rusqlite = { workspace = true, optional = true }
 
 [target.'cfg(unix)'.dependencies]

From f348b656561dfa203f51775205448ca26130fe8b Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Tue, 1 Jul 2025 19:05:58 +0200
Subject: [PATCH 03/12] move serde_json to workspace. refactor stacks common
 cargo

---
 Cargo.toml               |  5 ++--
 stacks-common/Cargo.toml | 51 +++++++++++++++++-----------------------
 2 files changed, 25 insertions(+), 31 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index bcb608b1bd..7fcbfc0a8a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,6 +22,7 @@ rand = "0.8"
 rand_chacha = "0.3.1"
 serde = "1"
 serde_derive = "1"
+serde_json = { version = "1.0", features = ["arbitrary_precision", "unbounded_depth"] }
 slog = { version = "2.5.2", features = [ "max_level_trace" ] }
 rusqlite = { version = "0.31.0", features = ["blob", "serde_json", "i128_blob", "bundled", "trace"] }
 tikv-jemallocator = "0.5.4"
@@ -29,13 +30,13 @@ thiserror = "1.0.65"
 toml = "0.5.6"
 
 # Use a bit more than default optimization for
-#  dev builds to speed up test execution
+# dev builds to speed up test execution
 [profile.dev]
 opt-level = 1
 
 # Use release-level optimization for dependencies
 # This slows down "first" builds on development environments,
-#  but won't impact subsequent builds.
+# but won't impact subsequent builds.
 [profile.dev.package."*"]
 opt-level = 3
 
diff --git a/stacks-common/Cargo.toml b/stacks-common/Cargo.toml
index 8c1948fa85..30c4841f4a 100644
--- a/stacks-common/Cargo.toml
+++ b/stacks-common/Cargo.toml
@@ -30,18 +30,23 @@ name = "stacks_common"
 path = "./src/libcommon.rs"
 
 [dependencies]
+chrono = "0.4.19"
+curve25519-dalek = { version = "4.1.3", features = ["serde"] }
+ed25519-dalek = { workspace = true }
+hashbrown = { workspace = true }
+lazy_static = { workspace = true }
 rand = { workspace = true }
+ripemd = "0.1.1"
 serde = { workspace = true , features = ["derive"] }
 serde_derive = { workspace = true }
+serde_json = { workspace = true }
 sha3 = "0.10.1"
-ripemd = "0.1.1"
-lazy_static = { workspace = true }
 slog = { workspace = true }
 slog-term = "2.6.0"
-slog-json = { version = "2.3.0", optional = true }
-chrono = "0.4.19"
-hashbrown = { workspace = true }
+
+# Optional dependencies
 rusqlite = { workspace = true, optional = true }
+slog-json = { version = "2.3.0", optional = true }
 
 [target.'cfg(unix)'.dependencies]
 nix = {version = "0.23", optional = true}
@@ -57,35 +62,32 @@ winapi = { version = "0.3", features = [
 [target.'cfg(windows)'.dev-dependencies]
 winapi = { version = "0.3", features = ["fileapi", "processenv", "winnt"] }
 
-[dependencies.serde_json]
-version = "1.0"
-features = ["arbitrary_precision", "unbounded_depth"]
-
-[dependencies.ed25519-dalek]
-workspace = true
-
-[dependencies.curve25519-dalek]
-version = "4.1.3"
-features = ["serde"]
-
-[dependencies.time]
-version = "0.2.23"
-features = ["std"]
-
 [target.'cfg(not(target_family = "wasm"))'.dependencies]
 secp256k1 = { version = "0.24.3", features = ["serde", "recovery"] }
 
 [target.'cfg(target_family = "wasm")'.dependencies]
 libsecp256k1 = { version = "0.7.0" }
 
+[target.'cfg(all(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64"), not(any(target_os="windows"))))'.dependencies]
+sha2 = { version = "0.10", features = ["asm"] }
+
+[target.'cfg(any(not(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64")), any(target_os="windows")))'.dependencies]
+sha2 = { version = "0.10" }
+
 [dev-dependencies]
 rand_core = { workspace = true }
 proptest = "1.6.0"
 
+[build-dependencies]
+toml = { workspace = true }
+
 [features]
 default = ["developer-mode", "ctrlc-handler", "http-parser"]
 developer-mode = []
+# Enables graceful shutdown handling for Ctrl+C (SIGINT) signals on Unix-like systems.
+# This pulls in the `nix` dependency.
 ctrlc-handler = ["dep:nix"]
+# Enables a lightweight, internal HTTP/1.x parser.
 http-parser = []
 slog_json = ["slog-json"]
 rusqlite = ["dep:rusqlite"]
@@ -93,12 +95,3 @@ testing = []
 serde = []
 bech32_std = []
 bech32_strict = []
-
-[build-dependencies]
-toml = { workspace = true }
-
-[target.'cfg(all(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64"), not(any(target_os="windows"))))'.dependencies]
-sha2 = { version = "0.10", features = ["asm"] }
-
-[target.'cfg(any(not(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64")), any(target_os="windows")))'.dependencies]
-sha2 = { version = "0.10" }

From 6775c857db2fe5b4a2719417c28fe4a011b2dfa1 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Tue, 1 Jul 2025 19:12:09 +0200
Subject: [PATCH 04/12] removed time

---
 Cargo.lock | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Cargo.lock b/Cargo.lock
index 662e4b9900..c39e514c6e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3271,7 +3271,6 @@ dependencies = [
  "slog",
  "slog-json",
  "slog-term",
- "time 0.2.27",
  "toml",
  "winapi 0.3.9",
 ]

From d186115a5a783f06b1179b261772e29ddc3c68d3 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Thu, 3 Jul 2025 17:56:41 +0200
Subject: [PATCH 05/12] make rand optional for CosmWasm support

---
 Cargo.lock                                    | 54 ++-----------------
 Cargo.toml                                    |  2 +-
 stacks-common/Cargo.toml                      | 31 ++++++-----
 .../src/deps_common/bitcoin/util/mod.rs       | 20 -------
 stacks-common/src/libcommon.rs                |  5 +-
 stacks-common/src/util/chunked_encoding.rs    |  2 +-
 stacks-common/src/util/mod.rs                 |  2 +
 stacks-common/src/util/pipe.rs                |  3 +-
 stacks-common/src/util/secp256k1/native.rs    |  5 +-
 stacks-common/src/util/secp256k1/wasm.rs      |  4 +-
 stacks-common/src/util/vrf.rs                 | 14 ++---
 11 files changed, 41 insertions(+), 101 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c39e514c6e..2718b603d6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -477,12 +477,6 @@ version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
-[[package]]
-name = "base64ct"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
-
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -726,12 +720,6 @@ dependencies = [
  "tempfile",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
 [[package]]
 name = "const_fn"
 version = "0.4.9"
@@ -880,16 +868,6 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5"
 
-[[package]]
-name = "der"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fffa369a668c8af7dbf8b5e56c9f744fbd399949ed171606040001947de40b1c"
-dependencies = [
- "const-oid",
- "zeroize",
-]
-
 [[package]]
 name = "deranged"
 version = "0.3.11"
@@ -963,8 +941,6 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8",
- "serde",
  "signature",
 ]
 
@@ -976,11 +952,8 @@ checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
- "rand_core 0.6.4",
- "serde",
  "sha2 0.10.8",
  "subtle",
- "zeroize",
 ]
 
 [[package]]
@@ -1289,8 +1262,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
 dependencies = [
  "cfg-if 1.0.0",
+ "js-sys",
  "libc",
  "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2279,16 +2254,6 @@ dependencies = [
  "futures-io",
 ]
 
-[[package]]
-name = "pkcs8"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
-dependencies = [
- "der",
- "spki",
-]
-
 [[package]]
 name = "pkg-config"
 version = "0.3.30"
@@ -3129,9 +3094,6 @@ name = "signature"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "rand_core 0.6.4",
-]
 
 [[package]]
 name = "similar"
@@ -3223,16 +3185,6 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
-[[package]]
-name = "spki"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
-dependencies = [
- "base64ct",
- "der",
-]
-
 [[package]]
 name = "stacker"
 version = "0.1.15"
@@ -3253,13 +3205,13 @@ dependencies = [
  "chrono",
  "curve25519-dalek",
  "ed25519-dalek",
+ "getrandom 0.2.12",
  "hashbrown 0.15.2",
  "lazy_static",
  "libsecp256k1",
  "nix",
  "proptest",
  "rand 0.8.5",
- "rand_core 0.6.4",
  "ripemd",
  "rusqlite",
  "secp256k1",
diff --git a/Cargo.toml b/Cargo.toml
index 7fcbfc0a8a..838e9d5000 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -14,7 +14,7 @@ members = [
 
 # Dependencies we want to keep the same between workspace members
 [workspace.dependencies]
-ed25519-dalek = { version = "2.1.1", features = ["serde", "rand_core"] }
+ed25519-dalek = { version = "2.1.1", default-features = false }
 hashbrown = { version = "0.15.2", features = ["serde"] }
 lazy_static = "1.4.0"
 rand_core = "0.6.4"
diff --git a/stacks-common/Cargo.toml b/stacks-common/Cargo.toml
index 30c4841f4a..c3c94939de 100644
--- a/stacks-common/Cargo.toml
+++ b/stacks-common/Cargo.toml
@@ -35,7 +35,7 @@ curve25519-dalek = { version = "4.1.3", features = ["serde"] }
 ed25519-dalek = { workspace = true }
 hashbrown = { workspace = true }
 lazy_static = { workspace = true }
-rand = { workspace = true }
+rand = { workspace = true, optional = true }
 ripemd = "0.1.1"
 serde = { workspace = true , features = ["derive"] }
 serde_derive = { workspace = true }
@@ -45,7 +45,6 @@ slog = { workspace = true }
 slog-term = "2.6.0"
 
 # Optional dependencies
-rusqlite = { workspace = true, optional = true }
 slog-json = { version = "2.3.0", optional = true }
 
 [target.'cfg(unix)'.dependencies]
@@ -57,16 +56,15 @@ winapi = { version = "0.3", features = [
     "handleapi",
     "synchapi",
     "winbase",
-] }
-
-[target.'cfg(windows)'.dev-dependencies]
-winapi = { version = "0.3", features = ["fileapi", "processenv", "winnt"] }
+], optional = true }
 
 [target.'cfg(not(target_family = "wasm"))'.dependencies]
 secp256k1 = { version = "0.24.3", features = ["serde", "recovery"] }
+rusqlite = { workspace = true, optional = true }
 
 [target.'cfg(target_family = "wasm")'.dependencies]
-libsecp256k1 = { version = "0.7.0" }
+libsecp256k1 = { version = "0.7.0", default-features = false, features = ["hmac", "static-context"] }
+getrandom = { version = "0.2.12", features = ["js"], optional = true }
 
 [target.'cfg(all(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64"), not(any(target_os="windows"))))'.dependencies]
 sha2 = { version = "0.10", features = ["asm"] }
@@ -75,23 +73,28 @@ sha2 = { version = "0.10", features = ["asm"] }
 sha2 = { version = "0.10" }
 
 [dev-dependencies]
-rand_core = { workspace = true }
 proptest = "1.6.0"
 
+[target.'cfg(windows)'.dev-dependencies]
+winapi = { version = "0.3", features = ["fileapi", "processenv", "winnt"] }
+
 [build-dependencies]
 toml = { workspace = true }
 
 [features]
-default = ["developer-mode", "ctrlc-handler", "http-parser"]
+default = ["developer-mode", "ctrlc-handler", "http-parser", "rand"]
 developer-mode = []
-# Enables graceful shutdown handling for Ctrl+C (SIGINT) signals on Unix-like systems.
-# This pulls in the `nix` dependency.
-ctrlc-handler = ["dep:nix"]
+# Enables graceful shutdown handling for Ctrl+C (SIGINT) signals.
+# This pulls in the `nix` or `winapi` dependency.
+ctrlc-handler = ["dep:nix", "dep:winapi"]
 # Enables a lightweight, internal HTTP/1.x parser.
 http-parser = []
 slog_json = ["slog-json"]
-rusqlite = ["dep:rusqlite"]
-testing = []
+rusqlite = ["dep:rusqlite", "rand"]
+# Enables the rand module. This flag must be off on deterministic
+# platforms such as CosmWasm
+rand = ["dep:rand", "dep:getrandom"]
 serde = []
+testing = ["rand"]
 bech32_std = []
 bech32_strict = []
diff --git a/stacks-common/src/deps_common/bitcoin/util/mod.rs b/stacks-common/src/deps_common/bitcoin/util/mod.rs
index 7032ba41cd..a4740ffe06 100644
--- a/stacks-common/src/deps_common/bitcoin/util/mod.rs
+++ b/stacks-common/src/deps_common/bitcoin/util/mod.rs
@@ -20,8 +20,6 @@ pub mod hash;
 
 use std::{error, fmt};
 
-use secp256k1;
-
 use crate::deps_common::bitcoin::network;
 use crate::deps_common::bitcoin::network::serialize;
 
@@ -50,8 +48,6 @@ pub trait BitArray {
 /// if appropriate.
 #[derive(Debug)]
 pub enum Error {
-    /// secp-related error
-    Secp256k1(secp256k1::Error),
     /// Serialization error
     Serialize(serialize::Error),
     /// Network error
@@ -65,7 +61,6 @@ pub enum Error {
 impl fmt::Display for Error {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match *self {
-            Error::Secp256k1(ref e) => fmt::Display::fmt(e, f),
             Error::Serialize(ref e) => fmt::Display::fmt(e, f),
             Error::Network(ref e) => fmt::Display::fmt(e, f),
             Error::SpvBadProofOfWork => f.write_str("target correct but not attained"),
@@ -77,7 +72,6 @@ impl fmt::Display for Error {
 impl error::Error for Error {
     fn cause(&self) -> Option<&dyn error::Error> {
         match *self {
-            Error::Secp256k1(ref e) => Some(e),
             Error::Serialize(ref e) => Some(e),
             Error::Network(ref e) => Some(e),
             Error::SpvBadProofOfWork | Error::SpvBadTarget => None,
@@ -85,20 +79,6 @@ impl error::Error for Error {
     }
 }
 
-#[doc(hidden)]
-impl From<secp256k1::Error> for Error {
-    fn from(e: secp256k1::Error) -> Error {
-        Error::Secp256k1(e)
-    }
-}
-
-#[doc(hidden)]
-impl From<serialize::Error> for Error {
-    fn from(e: serialize::Error) -> Error {
-        Error::Serialize(e)
-    }
-}
-
 #[doc(hidden)]
 impl From<network::Error> for Error {
     fn from(e: network::Error) -> Error {
diff --git a/stacks-common/src/libcommon.rs b/stacks-common/src/libcommon.rs
index 4472235224..9b1f800daa 100644
--- a/stacks-common/src/libcommon.rs
+++ b/stacks-common/src/libcommon.rs
@@ -16,7 +16,7 @@ extern crate serde_derive;
 #[cfg(all(unix, feature = "ctrlc-handler"))]
 extern crate nix;
 
-#[cfg(windows)]
+#[cfg(all(windows, feature = "ctrlc-handler"))]
 extern crate winapi;
 
 #[macro_use]
@@ -33,8 +33,7 @@ pub mod deps_common {
     pub mod bech32;
     pub mod bitcoin;
 
-    // These are gated by features.
-    #[cfg(feature = "ctrlc-handler")]
+    #[cfg(all(not(target_family = "wasm"), feature = "ctrlc-handler"))]
     pub mod ctrlc;
 
     #[cfg(feature = "http-parser")]
diff --git a/stacks-common/src/util/chunked_encoding.rs b/stacks-common/src/util/chunked_encoding.rs
index ef6ce6fa79..81ee94ae99 100644
--- a/stacks-common/src/util/chunked_encoding.rs
+++ b/stacks-common/src/util/chunked_encoding.rs
@@ -447,7 +447,7 @@ mod test {
     use std::io;
     use std::io::Read;
 
-    use rand::RngCore;
+    use rand::RngCore as _;
 
     use super::*;
 
diff --git a/stacks-common/src/util/mod.rs b/stacks-common/src/util/mod.rs
index 534b40c792..309ea3f672 100644
--- a/stacks-common/src/util/mod.rs
+++ b/stacks-common/src/util/mod.rs
@@ -139,3 +139,5 @@ where
     let reader = BufReader::new(file);
     serde_json::from_reader::<_, J>(reader).map_err(std::io::Error::from)
 }
+#[cfg(all(feature = "rusqlite", target_family = "wasm"))]
+compile_error!("The `rusqlite` feature is not supported for wasm targets");
diff --git a/stacks-common/src/util/pipe.rs b/stacks-common/src/util/pipe.rs
index c851c04ae5..e7bfca27fb 100644
--- a/stacks-common/src/util/pipe.rs
+++ b/stacks-common/src/util/pipe.rs
@@ -317,8 +317,7 @@ mod test {
     use std::io::{Read, Write};
     use std::{io, thread};
 
-    use rand;
-    use rand::RngCore;
+    use rand::RngCore as _;
 
     use super::*;
 
diff --git a/stacks-common/src/util/secp256k1/native.rs b/stacks-common/src/util/secp256k1/native.rs
index d47bcb597b..f9ed65fb87 100644
--- a/stacks-common/src/util/secp256k1/native.rs
+++ b/stacks-common/src/util/secp256k1/native.rs
@@ -24,7 +24,6 @@ use ::secp256k1::{
     constants as LibSecp256k1Constants, Error as LibSecp256k1Error, Message as LibSecp256k1Message,
     PublicKey as LibSecp256k1PublicKey, Secp256k1, SecretKey as LibSecp256k1PrivateKey,
 };
-use rand::RngCore;
 use serde::de::{Deserialize, Error as de_Error};
 use serde::Serialize;
 
@@ -240,7 +239,10 @@ impl PublicKey for Secp256k1PublicKey {
 }
 
 impl Secp256k1PrivateKey {
+    #[cfg(feature = "rand")]
     pub fn random() -> Secp256k1PrivateKey {
+        use rand::RngCore as _;
+
         let mut rng = rand::thread_rng();
         loop {
             // keep trying to generate valid bytes
@@ -422,6 +424,7 @@ pub fn secp256k1_verify(
 
 #[cfg(test)]
 mod tests {
+    use rand::RngCore as _;
     use secp256k1;
     use secp256k1::{PublicKey as LibSecp256k1PublicKey, Secp256k1};
 
diff --git a/stacks-common/src/util/secp256k1/wasm.rs b/stacks-common/src/util/secp256k1/wasm.rs
index bea3c5e2d5..954ad4f772 100644
--- a/stacks-common/src/util/secp256k1/wasm.rs
+++ b/stacks-common/src/util/secp256k1/wasm.rs
@@ -21,7 +21,6 @@ use ::libsecp256k1::{
     RecoveryId as LibSecp256k1RecoveryId, SecretKey as LibSecp256k1PrivateKey,
     Signature as LibSecp256k1Signature,
 };
-use rand::RngCore;
 use serde::de::{Deserialize, Error as de_Error};
 use serde::Serialize;
 
@@ -123,7 +122,10 @@ impl Secp256k1PublicKey {
 }
 
 impl Secp256k1PrivateKey {
+    #[cfg(feature = "rand")]
     pub fn new() -> Secp256k1PrivateKey {
+        use rand::RngCore as _;
+
         let mut rng = rand::thread_rng();
         loop {
             // keep trying to generate valid bytes
diff --git a/stacks-common/src/util/vrf.rs b/stacks-common/src/util/vrf.rs
index bd124a5da0..5e757582fa 100644
--- a/stacks-common/src/util/vrf.rs
+++ b/stacks-common/src/util/vrf.rs
@@ -27,7 +27,6 @@ use std::{error, fmt};
 use curve25519_dalek::constants::ED25519_BASEPOINT_POINT;
 use curve25519_dalek::edwards::{CompressedEdwardsY, EdwardsPoint};
 use curve25519_dalek::scalar::{clamp_integer, Scalar as ed25519_Scalar};
-use rand;
 use sha2::{Digest, Sha512};
 
 use crate::util::hash::{hex_bytes, to_hex};
@@ -99,6 +98,7 @@ impl PartialEq for VRFPrivateKey {
     }
 }
 
+#[cfg(any(test, feature = "testing"))]
 impl Default for VRFPrivateKey {
     fn default() -> Self {
         Self::new()
@@ -106,9 +106,13 @@ impl Default for VRFPrivateKey {
 }
 
 impl VRFPrivateKey {
+    #[cfg(any(test, feature = "testing"))]
     pub fn new() -> VRFPrivateKey {
+        use rand::RngCore;
         let mut rng = rand::thread_rng();
-        let signing_key = ed25519_dalek::SigningKey::generate(&mut rng);
+        let mut sk_bytes = [0u8; 32];
+        rng.fill_bytes(&mut sk_bytes);
+        let signing_key = ed25519_dalek::SigningKey::from_bytes(&sk_bytes);
         VRFPrivateKey(signing_key)
     }
 
@@ -182,7 +186,6 @@ pub enum Error {
     InvalidPublicKey,
     InvalidDataError,
     InvalidHashPoints,
-    OSRNGError(rand::Error),
 }
 
 impl fmt::Display for Error {
@@ -191,7 +194,6 @@ impl fmt::Display for Error {
             Error::InvalidPublicKey => write!(f, "Invalid public key"),
             Error::InvalidDataError => write!(f, "No data could be found"),
             Error::InvalidHashPoints => write!(f, "VRF hash points did not yield a valid scalar"),
-            Error::OSRNGError(ref e) => fmt::Display::fmt(e, f),
         }
     }
 }
@@ -202,7 +204,6 @@ impl error::Error for Error {
             Error::InvalidPublicKey => None,
             Error::InvalidDataError => None,
             Error::InvalidHashPoints => None,
-            Error::OSRNGError(ref e) => Some(e),
         }
     }
 }
@@ -540,8 +541,7 @@ impl VRF {
 
 #[cfg(test)]
 mod tests {
-    use rand;
-    use rand::RngCore;
+    use rand::RngCore as _;
 
     use super::*;
     use crate::util::hash::hex_bytes;

From 97c968ceac555985680ff889a9162aa94ab5e83c Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Thu, 3 Jul 2025 18:22:43 +0200
Subject: [PATCH 06/12] substitute ::generate with ::from_bytes

---
 stacks-common/src/util/vrf.rs               | 2 +-
 stackslib/src/burnchains/tests/burnchain.rs | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/stacks-common/src/util/vrf.rs b/stacks-common/src/util/vrf.rs
index 5e757582fa..a0cbee3373 100644
--- a/stacks-common/src/util/vrf.rs
+++ b/stacks-common/src/util/vrf.rs
@@ -108,7 +108,7 @@ impl Default for VRFPrivateKey {
 impl VRFPrivateKey {
     #[cfg(any(test, feature = "testing"))]
     pub fn new() -> VRFPrivateKey {
-        use rand::RngCore;
+        use rand::RngCore as _;
         let mut rng = rand::thread_rng();
         let mut sk_bytes = [0u8; 32];
         rng.fill_bytes(&mut sk_bytes);
diff --git a/stackslib/src/burnchains/tests/burnchain.rs b/stackslib/src/burnchains/tests/burnchain.rs
index 9d170ab6f2..c4d6cb0ed9 100644
--- a/stackslib/src/burnchains/tests/burnchain.rs
+++ b/stackslib/src/burnchains/tests/burnchain.rs
@@ -15,7 +15,7 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 use rand::rngs::ThreadRng;
-use rand::thread_rng;
+use rand::{thread_rng, RngCore as _};
 use stacks_common::address::AddressHashMode;
 use stacks_common::types::chainstate::{
     BlockHeaderHash, BurnchainHeaderHash, PoxId, SortitionId, TrieHash, VRFSeed,
@@ -690,7 +690,9 @@ fn test_burn_snapshot_sequence() {
 
     for i in 0..32 {
         let mut csprng: ThreadRng = thread_rng();
-        let vrf_privkey = VRFPrivateKey(ed25519_dalek::SigningKey::generate(&mut csprng));
+        let mut sk_bytes = [0u8; 32];
+        csprng.fill_bytes(&mut sk_bytes);
+        let vrf_privkey = VRFPrivateKey(ed25519_dalek::SigningKey::from_bytes(&sk_bytes));
         let vrf_pubkey = VRFPublicKey::from_private(&vrf_privkey);
 
         let pubkey_hex = vrf_pubkey.to_hex();

From f6621cb7ff7a8e2f58861945cefd7088c3e6ec5a Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Fri, 4 Jul 2025 12:12:32 +0200
Subject: [PATCH 07/12] add custom dummy getdefault

---
 stacks-common/Cargo.toml                 | 10 +++++++---
 stacks-common/src/libcommon.rs           | 17 +++++++++++++++++
 stacks-common/src/util/secp256k1/wasm.rs | 23 ++++++++++++++++++++---
 3 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/stacks-common/Cargo.toml b/stacks-common/Cargo.toml
index c3c94939de..9203735614 100644
--- a/stacks-common/Cargo.toml
+++ b/stacks-common/Cargo.toml
@@ -46,6 +46,7 @@ slog-term = "2.6.0"
 
 # Optional dependencies
 slog-json = { version = "2.3.0", optional = true }
+getrandom = { version = "0.2", default-features = false, optional = true }
 
 [target.'cfg(unix)'.dependencies]
 nix = {version = "0.23", optional = true}
@@ -63,8 +64,7 @@ secp256k1 = { version = "0.24.3", features = ["serde", "recovery"] }
 rusqlite = { workspace = true, optional = true }
 
 [target.'cfg(target_family = "wasm")'.dependencies]
-libsecp256k1 = { version = "0.7.0", default-features = false, features = ["hmac", "static-context"] }
-getrandom = { version = "0.2.12", features = ["js"], optional = true }
+libsecp256k1 = { version = "0.7.0", default-features = false, features = ["hmac"] }
 
 [target.'cfg(all(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64"), not(any(target_os="windows"))))'.dependencies]
 sha2 = { version = "0.10", features = ["asm"] }
@@ -93,8 +93,12 @@ slog_json = ["slog-json"]
 rusqlite = ["dep:rusqlite", "rand"]
 # Enables the rand module. This flag must be off on deterministic
 # platforms such as CosmWasm
-rand = ["dep:rand", "dep:getrandom"]
+rand = ["dep:rand"]
 serde = []
 testing = ["rand"]
 bech32_std = []
 bech32_strict = []
+
+# Wasm-specific features for easier configuration
+wasm-web = ["rand", "getrandom/js", "libsecp256k1/static-context"]
+wasm-deterministic = ["getrandom/custom"]
diff --git a/stacks-common/src/libcommon.rs b/stacks-common/src/libcommon.rs
index 9b1f800daa..8157320664 100644
--- a/stacks-common/src/libcommon.rs
+++ b/stacks-common/src/libcommon.rs
@@ -110,6 +110,23 @@ pub mod versions {
     include!(concat!(env!("OUT_DIR"), "/versions.rs"));
 }
 
+#[cfg(all(feature = "wasm-deterministic", target_family = "wasm"))]
+mod getrandom {
+    use core::num::NonZeroU32;
+
+    use getrandom::Error;
+
+    pub const NO_RANDOMNESS_ERROR_CODE: u32 = Error::CUSTOM_START;
+    pub fn always_fail(_buf: &mut [u8]) -> Result<(), Error> {
+        let code = NonZeroU32::new(NO_RANDOMNESS_ERROR_CODE).unwrap();
+        Err(Error::from(code))
+    }
+    pub use getrandom::register_custom_getrandom;
+}
+
+#[cfg(all(feature = "wasm-deterministic", target_family = "wasm"))]
+getrandom::register_custom_getrandom!(getrandom::always_fail);
+
 /// This test asserts that the constant above doesn't change.
 /// This exists because the constant above is used by Epoch 2.5 instantiation code.
 ///
diff --git a/stacks-common/src/util/secp256k1/wasm.rs b/stacks-common/src/util/secp256k1/wasm.rs
index 954ad4f772..c9c79a352e 100644
--- a/stacks-common/src/util/secp256k1/wasm.rs
+++ b/stacks-common/src/util/secp256k1/wasm.rs
@@ -16,10 +16,11 @@
 
 use ::libsecp256k1;
 pub use ::libsecp256k1::Error;
+#[cfg(not(feature = "wasm-deterministic"))]
+use ::libsecp256k1::{Error as LibSecp256k1Error, Message as LibSecp256k1Message};
 use ::libsecp256k1::{
-    Error as LibSecp256k1Error, Message as LibSecp256k1Message, PublicKey as LibSecp256k1PublicKey,
-    RecoveryId as LibSecp256k1RecoveryId, SecretKey as LibSecp256k1PrivateKey,
-    Signature as LibSecp256k1Signature,
+    PublicKey as LibSecp256k1PublicKey, RecoveryId as LibSecp256k1RecoveryId,
+    SecretKey as LibSecp256k1PrivateKey, Signature as LibSecp256k1Signature,
 };
 use serde::de::{Deserialize, Error as de_Error};
 use serde::Serialize;
@@ -101,6 +102,7 @@ impl Secp256k1PublicKey {
         Secp256k1PublicKey::from_slice(&data[..]).map_err(|_e| "Invalid public key hex string")
     }
 
+    #[cfg(not(feature = "wasm-deterministic"))]
     pub fn from_private(privk: &Secp256k1PrivateKey) -> Secp256k1PublicKey {
         let key = LibSecp256k1PublicKey::from_secret_key(&privk.key);
         Secp256k1PublicKey {
@@ -109,6 +111,7 @@ impl Secp256k1PublicKey {
         }
     }
 
+    #[cfg(not(feature = "wasm-deterministic"))]
     /// recover message and signature to public key (will be compressed)
     pub fn recover_to_pubkey(
         msg: &[u8],
@@ -186,6 +189,7 @@ impl Secp256k1PrivateKey {
     }
 }
 
+#[cfg(not(feature = "wasm-deterministic"))]
 pub fn secp256k1_recover(
     message_arr: &[u8],
     serialized_signature: &[u8],
@@ -197,6 +201,7 @@ pub fn secp256k1_recover(
     Ok(recovered_pub_key.serialize_compressed())
 }
 
+#[cfg(not(feature = "wasm-deterministic"))]
 pub fn secp256k1_verify(
     message_arr: &[u8],
     serialized_signature: &[u8],
@@ -300,6 +305,12 @@ impl PublicKey for Secp256k1PublicKey {
         self.to_bytes()
     }
 
+    #[cfg(feature = "wasm-deterministic")]
+    fn verify(&self, _data_hash: &[u8], _sig: &MessageSignature) -> Result<bool, &'static str> {
+        Err("Not implemented for wasm-deterministic")
+    }
+
+    #[cfg(not(feature = "wasm-deterministic"))]
     fn verify(&self, data_hash: &[u8], sig: &MessageSignature) -> Result<bool, &'static str> {
         let pub_key = Secp256k1PublicKey::recover_to_pubkey(data_hash, sig)?;
         Ok(self.eq(&pub_key))
@@ -315,6 +326,12 @@ impl PrivateKey for Secp256k1PrivateKey {
         bits
     }
 
+    #[cfg(feature = "wasm-deterministic")]
+    fn sign(&self, _data_hash: &[u8]) -> Result<MessageSignature, &'static str> {
+        Err("Not implemented for wasm-deterministic")
+    }
+
+    #[cfg(not(feature = "wasm-deterministic"))]
     fn sign(&self, data_hash: &[u8]) -> Result<MessageSignature, &'static str> {
         let message = LibSecp256k1Message::parse_slice(data_hash)
             .map_err(|_e| "Invalid message: failed to decode data hash: must be a 32-byte hash")?;

From 309e98deecb2cf21c689a91115d93e8b97f55946 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Fri, 4 Jul 2025 16:50:09 +0200
Subject: [PATCH 08/12] remove getrandom::register_custom_getrandom for
 wasm-deterministic

---
 stacks-common/src/libcommon.rs | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/stacks-common/src/libcommon.rs b/stacks-common/src/libcommon.rs
index 8157320664..9b1f800daa 100644
--- a/stacks-common/src/libcommon.rs
+++ b/stacks-common/src/libcommon.rs
@@ -110,23 +110,6 @@ pub mod versions {
     include!(concat!(env!("OUT_DIR"), "/versions.rs"));
 }
 
-#[cfg(all(feature = "wasm-deterministic", target_family = "wasm"))]
-mod getrandom {
-    use core::num::NonZeroU32;
-
-    use getrandom::Error;
-
-    pub const NO_RANDOMNESS_ERROR_CODE: u32 = Error::CUSTOM_START;
-    pub fn always_fail(_buf: &mut [u8]) -> Result<(), Error> {
-        let code = NonZeroU32::new(NO_RANDOMNESS_ERROR_CODE).unwrap();
-        Err(Error::from(code))
-    }
-    pub use getrandom::register_custom_getrandom;
-}
-
-#[cfg(all(feature = "wasm-deterministic", target_family = "wasm"))]
-getrandom::register_custom_getrandom!(getrandom::always_fail);
-
 /// This test asserts that the constant above doesn't change.
 /// This exists because the constant above is used by Epoch 2.5 instantiation code.
 ///

From 2ebf15ed9a1c3d7c80ca4c9c45f31f03f5c163f7 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Wed, 9 Jul 2025 13:54:13 +0200
Subject: [PATCH 09/12] remove http-parser feature

---
 stacks-common/Cargo.toml       | 4 +---
 stacks-common/src/libcommon.rs | 4 +---
 stacks-common/src/util/mod.rs  | 1 -
 3 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/stacks-common/Cargo.toml b/stacks-common/Cargo.toml
index 9203735614..dca85d84a0 100644
--- a/stacks-common/Cargo.toml
+++ b/stacks-common/Cargo.toml
@@ -82,13 +82,11 @@ winapi = { version = "0.3", features = ["fileapi", "processenv", "winnt"] }
 toml = { workspace = true }
 
 [features]
-default = ["developer-mode", "ctrlc-handler", "http-parser", "rand"]
+default = ["developer-mode", "ctrlc-handler", "rand"]
 developer-mode = []
 # Enables graceful shutdown handling for Ctrl+C (SIGINT) signals.
 # This pulls in the `nix` or `winapi` dependency.
 ctrlc-handler = ["dep:nix", "dep:winapi"]
-# Enables a lightweight, internal HTTP/1.x parser.
-http-parser = []
 slog_json = ["slog-json"]
 rusqlite = ["dep:rusqlite", "rand"]
 # Enables the rand module. This flag must be off on deterministic
diff --git a/stacks-common/src/libcommon.rs b/stacks-common/src/libcommon.rs
index 9b1f800daa..9fa27c4763 100644
--- a/stacks-common/src/libcommon.rs
+++ b/stacks-common/src/libcommon.rs
@@ -32,12 +32,10 @@ pub mod address;
 pub mod deps_common {
     pub mod bech32;
     pub mod bitcoin;
+    pub mod httparse;
 
     #[cfg(all(not(target_family = "wasm"), feature = "ctrlc-handler"))]
     pub mod ctrlc;
-
-    #[cfg(feature = "http-parser")]
-    pub mod httparse;
 }
 
 pub mod bitvec;
diff --git a/stacks-common/src/util/mod.rs b/stacks-common/src/util/mod.rs
index 309ea3f672..30353b1d0c 100644
--- a/stacks-common/src/util/mod.rs
+++ b/stacks-common/src/util/mod.rs
@@ -18,7 +18,6 @@
 pub mod log;
 #[macro_use]
 pub mod macros;
-#[cfg(feature = "http-parser")]
 pub mod chunked_encoding;
 #[cfg(feature = "rusqlite")]
 pub mod db;

From 908b21ccec870dd500d1b032ebe81abf2e82b434 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Wed, 9 Jul 2025 18:22:24 +0200
Subject: [PATCH 10/12] remove unused default features

---
 stacks-common/Cargo.toml                     | 18 +++++++++---------
 stacks-common/src/deps_common/bitcoin/mod.rs |  3 ---
 stacks-common/src/libcommon.rs               |  1 -
 stacks-common/src/types/chainstate.rs        |  8 ++++++--
 stacks-common/src/util/secp256k1/native.rs   |  1 +
 5 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/stacks-common/Cargo.toml b/stacks-common/Cargo.toml
index dca85d84a0..4b2c96d3bb 100644
--- a/stacks-common/Cargo.toml
+++ b/stacks-common/Cargo.toml
@@ -30,26 +30,26 @@ name = "stacks_common"
 path = "./src/libcommon.rs"
 
 [dependencies]
-chrono = "0.4.19"
-curve25519-dalek = { version = "4.1.3", features = ["serde"] }
+chrono = { version = "0.4.41", default-features = false, features = ["clock"] }
+curve25519-dalek = { version = "4.1.3", default-features = false, features = ["serde"] }
 ed25519-dalek = { workspace = true }
 hashbrown = { workspace = true }
 lazy_static = { workspace = true }
-rand = { workspace = true, optional = true }
-ripemd = "0.1.1"
+ripemd = { version = "0.1.1", default-features = false }
 serde = { workspace = true , features = ["derive"] }
 serde_derive = { workspace = true }
 serde_json = { workspace = true }
-sha3 = "0.10.1"
+sha3 = { version = "0.10.1", default-features = false }
 slog = { workspace = true }
-slog-term = "2.6.0"
+slog-term = { version = "2.6.0", default-features = false }
 
 # Optional dependencies
-slog-json = { version = "2.3.0", optional = true }
 getrandom = { version = "0.2", default-features = false, optional = true }
+rand = { workspace = true, optional = true }
+slog-json = { version = "2.3.0", default-features = false, optional = true }
 
 [target.'cfg(unix)'.dependencies]
-nix = {version = "0.23", optional = true}
+nix = {version = "0.23", default-features = false, optional = true}
 
 [target.'cfg(windows)'.dependencies]
 winapi = { version = "0.3", features = [
@@ -60,7 +60,7 @@ winapi = { version = "0.3", features = [
 ], optional = true }
 
 [target.'cfg(not(target_family = "wasm"))'.dependencies]
-secp256k1 = { version = "0.24.3", features = ["serde", "recovery"] }
+secp256k1 = { version = "0.24.3", default-features = false, features = ["std","serde", "recovery"] }
 rusqlite = { workspace = true, optional = true }
 
 [target.'cfg(target_family = "wasm")'.dependencies]
diff --git a/stacks-common/src/deps_common/bitcoin/mod.rs b/stacks-common/src/deps_common/bitcoin/mod.rs
index 097bfa2b65..2585d164a8 100644
--- a/stacks-common/src/deps_common/bitcoin/mod.rs
+++ b/stacks-common/src/deps_common/bitcoin/mod.rs
@@ -25,9 +25,6 @@
 //! software.
 //!
 
-// Clippy flags
-#![allow(clippy::needless_range_loop)] // suggests making a big mess of array newtypes
-
 // Coding conventions
 #![deny(non_upper_case_globals)]
 #![deny(non_camel_case_types)]
diff --git a/stacks-common/src/libcommon.rs b/stacks-common/src/libcommon.rs
index 9fa27c4763..2a83bd4270 100644
--- a/stacks-common/src/libcommon.rs
+++ b/stacks-common/src/libcommon.rs
@@ -4,7 +4,6 @@
 #![allow(non_snake_case)]
 #![allow(non_upper_case_globals)]
 #![cfg_attr(test, allow(unused_variables, unused_assignments))]
-#![allow(clippy::assertions_on_constants)]
 
 #[allow(unused_imports)]
 #[macro_use(o, slog_log, slog_trace, slog_debug, slog_info, slog_warn, slog_error)]
diff --git a/stacks-common/src/types/chainstate.rs b/stacks-common/src/types/chainstate.rs
index 7026eacffd..58f247a88f 100644
--- a/stacks-common/src/types/chainstate.rs
+++ b/stacks-common/src/types/chainstate.rs
@@ -168,8 +168,12 @@ impl SortitionId {
             write!(hasher, "{pox}").expect("Failed to deserialize PoX ID into the hasher");
             let h = Sha512Trunc256Sum::from_hasher(hasher);
             let s = SortitionId(h.0);
-            test_debug!("SortitionId({}) = {} + {}", &s, bhh, pox);
-            s
+            // The `test_debug!` macro will expand to nothing on release builds.
+            #[allow(clippy::let_and_return)]
+            {
+                test_debug!("SortitionId({}) = {} + {}", &s, bhh, pox);
+                s
+            }
         }
     }
 }
diff --git a/stacks-common/src/util/secp256k1/native.rs b/stacks-common/src/util/secp256k1/native.rs
index f9ed65fb87..fe5591b349 100644
--- a/stacks-common/src/util/secp256k1/native.rs
+++ b/stacks-common/src/util/secp256k1/native.rs
@@ -609,6 +609,7 @@ mod tests {
             let key = Secp256k1PublicKey::from_hex(fixture.public_key).unwrap();
             let signature = MessageSignature::from_raw(&hex_bytes(fixture.signature).unwrap());
             let ver_res = key.verify(&hex_bytes(fixture.data).unwrap(), &signature);
+            #[allow(clippy::assertions_on_constants)]
             match (ver_res, fixture.result) {
                 (Ok(true), Ok(true)) => {}
                 (Ok(false), Ok(false)) => {}

From 5694877c50e4621012bec2177246d318280ab5b7 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Wed, 9 Jul 2025 23:29:11 +0200
Subject: [PATCH 11/12] update cargo.lock

---
 Cargo.lock | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2718b603d6..53db0bebb5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -590,16 +590,16 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.34"
+version = "0.4.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
+checksum = "c469d952047f47f91b68d1cba3f10d63c11d73e4636f24f08daf0278abf01c4d"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "js-sys",
  "num-traits",
  "wasm-bindgen",
- "windows-targets 0.52.0",
+ "windows-link",
 ]
 
 [[package]]
@@ -848,7 +848,6 @@ dependencies = [
  "rustc_version 0.4.0",
  "serde",
  "subtle",
- "zeroize",
 ]
 
 [[package]]
@@ -4125,6 +4124,12 @@ dependencies = [
  "windows-targets 0.52.0",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -4296,9 +4301,3 @@ dependencies = [
  "quote",
  "syn 2.0.58",
 ]
-
-[[package]]
-name = "zeroize"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"

From 06b010a7f280cd8931339eb1dc69bd79514d2fc0 Mon Sep 17 00:00:00 2001
From: Francesco Leacche <francescoleacche@gmail.com>
Date: Thu, 10 Jul 2025 16:30:21 +0200
Subject: [PATCH 12/12] remove clippy::assertions_on_constants

---
 stacks-common/src/util/secp256k1/native.rs | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/stacks-common/src/util/secp256k1/native.rs b/stacks-common/src/util/secp256k1/native.rs
index fe5591b349..74c57ad837 100644
--- a/stacks-common/src/util/secp256k1/native.rs
+++ b/stacks-common/src/util/secp256k1/native.rs
@@ -609,22 +609,19 @@ mod tests {
             let key = Secp256k1PublicKey::from_hex(fixture.public_key).unwrap();
             let signature = MessageSignature::from_raw(&hex_bytes(fixture.signature).unwrap());
             let ver_res = key.verify(&hex_bytes(fixture.data).unwrap(), &signature);
-            #[allow(clippy::assertions_on_constants)]
             match (ver_res, fixture.result) {
                 (Ok(true), Ok(true)) => {}
                 (Ok(false), Ok(false)) => {}
                 (Err(e1), Err(e2)) => assert_eq!(e1, e2),
                 (Err(e1), _) => {
                     test_debug!("Failed to verify signature: {}", e1);
-                    assert!(
-                        false,
+                    panic!(
                         "failed fixture (verification: {:?}): {:#?}",
                         &ver_res, &fixture
                     );
                 }
                 (_, _) => {
-                    assert!(
-                        false,
+                    panic!(
                         "failed fixture (verification: {:?}): {:#?}",
                         &ver_res, &fixture
                     );