[Qumeric]

Summary

• bump Reth to v2.7.0 on the lighter/openvm-v2.0.0 line, keeping openvm on tag v2.0.0, and align REVM 43, Alloy 2.5, alloy-trie and alloy-hardforks with Reth's workspace
• port the stateless-witness changes from the Reth 2.5.2 and 2.7.0 bumps on develop-v2.x.0: Reth's ExecutionWitnessRecord::into_execution_witness, the witness feature of reth-revm, and the EVM state provider wrapper
• lock vergen at 10.0.1, as Reth does; 10.0.3 requires rustc 1.96
• move the toolchain to nightly-2026-02-28, the last 1.95 nightly, because Reth 2.7.0 requires rustc 1.95; the KZG test guest keeps OpenVM v2.0.0's default guest toolchain
• move the hex-prefix flag comment in crates/mpt/src/hp.rs above its constant, as on main, so current nightly rustfmt accepts it

Lighter's EVM backend pins this branch in https://github.com/axiom-crypto/lighter-evm-backend/pull/467.

---

Part of INT-9800

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​alloy-consensus@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-eips@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-hardforks@​0.4.7 ⏵ 0.4.9
	cargo/​alloy-primitives@​1.6.0 ⏵ 1.6.1
	cargo/​alloy-rlp@​0.3.13 ⏵ 0.3.16
	cargo/​alloy-trie@​0.9.4 ⏵ 0.9.7
	cargo/​reth-primitives-traits@​0.4.1 ⏵ 0.8.1
	cargo/​revm@​40.0.3 ⏵ 43.0.3
	cargo/​revm-primitives@​24.0.1 ⏵ 43.0.0
	cargo/​alloy@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-json-rpc@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-provider@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-rpc-client@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-rpc-types@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-rpc-types-debug@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-transport@​2.0.5 ⏵ 2.5.0
	cargo/​alloy-transport-http@​2.0.5 ⏵ 2.5.0

View full report