graph-node uses `blake3` versions that install a potentially compromised `arrayref` dependency

[dimitrovmaksim]

Summary

The Rust project disclosed a supply-chain attack involving arrayref 0.3.10. The compromised release introduced a malicious proc-macro1 dependency whose build script executed a downloaded payload.

Graph Node is not currently locked to the compromised version:

• Cargo.lock contains arrayref 0.3.7.
• proc-macro1 is not present.

However, Graph Node still depends on arrayref through two versions of BLAKE3. BLAKE3 1.8.7 explicitly removed the arrayref dependency following the compromise.

We should remove arrayref from Graph Node’s dependency graph and move the small, Graph-owned stable-hash implementations into the graph-node workspace.

Current dependency graph

  arrayref 0.3.7
  ├── blake3 1.8.5
  │   ├── graph-server-index-node
  │   └── graph-store-postgres
  └── blake3 0.3.8
      ├── stable-hash 0.4.4 (main branch) // locked to e50aabef55b8c4de581ca5c4ffa7ed8beed7e998, 083b67b949eff48e210c5753eb9c777a73958d9b updates blake3 to 1.5.4
      │   ├── graph
      │   └── graph-graphql
      └── stable-hash 0.3.4 (old branch)
          ├── graph
          ├── graph-graphql
          └── graph-store-postgres

The direct dependencies are declared in:

• server/index-node/Cargo.toml
• store/postgres/Cargo.toml

The transitive blake3 0.3.8 dependencies come from the main and old branches of graphprotocol/stable-hash.

Updating only the direct BLAKE3 dependencies is insufficient because the legacy stable-hash branch still requires blake3 0.3.x.