[Thegaram]

Changes

• Fix: eth_sendRawTransaction panicked on malformed input from Basic (JWT) users. It now decodes exact EIP-2718 bytes and returns -32602 invalid params.
• New rule: the proxy rejects blob (EIP-4844) transactions for all access levels.
• Dependencies:
  • Remove reth-rpc-api (unused) and reth-primitives (one call, replaced by alloy). Only scroll-alloy-rpc-types still comes from the reth fork.
  • Disable alloy default features. This removes alloy-contract, alloy-provider and reqwest.
  • Bump jsonwebtoken to 10.4 (rust_crypto backend) and run cargo update.
  • The lock goes from 832 to 533 crates. This removes the hickory advisories and stops building alloy-dyn-abi (RUSTSEC-2025-0073) and zstd.
• Lint: add #![expect(clippy::double_must_use)] in the modules that use #[rpc]. jsonrpsee 0.26.1 still triggers this lint on Rust 1.99.
• Example: update `siwe-er 6 and remove the Nodepolyfill plugin.

Behavior change

Raw transaction bytes must be exactly one EIP-2718 transaction. The proxy rejects the p2p network format and trailing bytes. Now the checked transaction is always the forwarded one.

Testing

• fmt, clippy (-D warnings) and tests pass with --locked.
• New tests cover typed and legacy decoding, sender recovery, 5 malformed inputs and blob rejection.

Known remaining

cargo audit still lists zstd and alloy-dyn-abi. Both are optional lock entries that are not compiled. Still open: crypto-bigint (needs alloy 2.x) and rsa (no fix; JWT uses HMAC only).