Bump dependencies

* Increase lower bound on aeson >= 2.3 to avoid a DoS vulnerability in
  earlier versions:
    https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html
* Make it compatible with QuickCheck == 2.18.* and earlier.

Author: erikd

cabal.project

@@ -31,7 +31,7 @@ packages: cardano-constitution
           plutus-metatheory
           plutus-tx
           plutus-tx-plugin
-          doc/docusaurus/docusaurus-examples.cabal
+          doc/docusaurus
 
 -- We never, ever, want this.
 write-ghc-environment-files: never
@@ -93,9 +93,19 @@ allow-newer:
   , inline-r:containers
   , inline-r:primitive
 
--- https://github.com/IntersectMBO/plutus/pull/7236
-constraints: setup.optparse-applicative >=0.19.0.0
-allow-newer: turtle:optparse-applicative
+constraints:
+  -- https://github.com/mrkkrp/megaparsec/issues/605
+  , megaparsec <9.8.0
+
+  -- https://github.com/IntersectMBO/plutus/pull/7236
+  , setup.optparse-applicative >=0.19.0.0
+
+allow-newer:
+  , deriving-aeson:aeson
+  , microstache:aeson
+  , monoidal-containers:aeson
+  , turtle:containers
+  , turtle:optparse-applicative
 
 if impl (ghc >= 9.14)
   -- https://github.com/snowleopard/alga/issues/322
@@ -104,24 +114,18 @@ if impl (ghc >= 9.14)
     location: https://github.com/snowleopard/alga
     tag: d4e43fb42db05413459fb2df493361d5a666588a
 
--- cabal-allow-newer begin
-if impl(ghc >= 9.14)
   allow-newer:
-    , binary:containers
     , canonical-json:containers
     , cborg:base
     , cborg:containers
     , config-ini:containers
     , dependent-map:containers
+    , dependent-sum:some
     , dictionary-sharing:containers
-    , hedgehog-quickcheck:QuickCheck
+    , monad-control:transformers-compat
     , ordered-containers:containers
     , serialise:base
     , serialise:containers
     , serialise:time
-    , tree-diff:time
-    , turtle:containers
     , turtle:time
     , with-utf8:base
--- cabal-allow-newer end
-

cardano-constitution/cardano-constitution.cabal

@@ -82,7 +82,7 @@ library
     PlutusTx.NonCanonicalRational
 
   build-depends:
-    , aeson
+    , aeson              >=2.3
     , base               >=4.9   && <5
     , containers
     , filepath

plutus-benchmark/plutus-benchmark.cabal

@@ -926,7 +926,7 @@ executable uplc-evaluator
   hs-source-dirs:   uplc-evaluator
   ghc-options:      -rtsopts -with-rtsopts=-I0
   build-depends:
-    , aeson                  >=2.0
+    , aeson                  >=2.3
     , base                   >=4.9   && <5
     , bytestring
     , containers
@@ -952,7 +952,7 @@ test-suite uplc-evaluator-integration-tests
   ghc-options:        -threaded -rtsopts -with-rtsopts=-N1
   build-tool-depends: plutus-benchmark:uplc-evaluator
   build-depends:
-    , aeson               >=2.0
+    , aeson               >=2.3
     , base                >=4.9 && <5
     , bytestring
     , directory

plutus-conformance/plutus-conformance.cabal

@@ -102,7 +102,7 @@ test-suite agda-conformance
   hs-source-dirs: agda test-cases
   other-modules:
   build-depends:
-    , aeson
+    , aeson               >=2.3
     , base                >=4.9   && <5
     , plutus-conformance
     , plutus-core         ^>=1.65

plutus-core/plutus-core.cabal

@@ -313,7 +313,7 @@ library
   -- * This bound also includes support for the bls12-381 msm primitives (see CIP-133)
   -- * The bound on 'dependent-sum' is needed to avoid https://github.com/obsidiansystems/dependent-sum/issues/72
   build-depends:
-    , aeson
+    , aeson                       >=2.3
     , array
     , barbies
     , base                        >=4.9     && <5
@@ -398,7 +398,7 @@ test-suite plutus-core-test
 
   default-language: Haskell2010
   build-depends:
-    , aeson
+    , aeson                            >=2.3
     , base                             >=4.9     && <5
     , base16-bytestring                ^>=1.0
     , bytestring
@@ -942,7 +942,7 @@ executable print-cost-model
   hs-source-dirs: cost-model/print-cost-model
   other-modules:  Paths_plutus_core
   build-depends:
-    , aeson
+    , aeson        >=2.3
     , base         >=4.9   && <5
     , bytestring
     , plutus-core  ^>=1.65
@@ -957,7 +957,7 @@ library satint
   exposed-modules: Data.SatInt
   hs-source-dirs:  satint/src
   build-depends:
-    , aeson
+    , aeson             >=2.3
     , base              >=4.9 && <5
     , cassava
     , deepseq

plutus-core/plutus-core/test/Generators/QuickCheck/Utils.hs

@@ -1,3 +1,4 @@
+{-# LANGUAGE CPP #-}
 {-# LANGUAGE TypeApplications #-}
 
 module Generators.QuickCheck.Utils where
@@ -8,6 +9,8 @@ import PlutusCore.Data
 import PlutusCore.Generators.QuickCheck.Builtin
 import PlutusCore.Generators.QuickCheck.Utils
 
+import qualified Test.QuickCheck as QC
+
 import Test.Tasty
 import Test.Tasty.QuickCheck
 
@@ -21,14 +24,14 @@ test_multiSplitSound =
       , ("multiSplit0", multiSplit0 0.1)
       ]
     pure . testProperty name $ \(xs :: [Int]) ->
-      withMaxSuccess 10000 . forAll (split xs) $ \aSplit ->
+      withNumTests 10000 . forAll (split xs) $ \aSplit ->
         xs === concat aSplit
 
 -- | Show the distribution of lists generated by a split function for a list of the given length.
 test_listDistribution :: Int -> ([()] -> Gen [[()]]) -> Int -> TestTree
 test_listDistribution numRuns split n =
   testProperty ("for a list of length " ++ show n) $
-    withMaxSuccess numRuns . forAll (split $ replicate n ()) $ \aSplit ->
+    withNumTests numRuns . forAll (split $ replicate n ()) $ \aSplit ->
       label (show $ map length aSplit) True
 
 -- | Count the number of 'I' and 'B' nodes in a 'Data' object.
@@ -48,7 +51,7 @@ length of the spine. Ensures that the 'Data' generator is not exponential in 'B'
 test_arbitraryDataExpectedLeafs :: TestTree
 test_arbitraryDataExpectedLeafs =
   testProperty "'arbitrary @Data' has the expected number of 'B' and 'I' leaves" $
-    withMaxSuccess 1000 . mapSize (* 5) $ \spine ->
+    withNumTests 1000 . mapSize (* 5) $ \spine ->
       forAll (genDataFromSpine spine) $ \dat ->
         countIandBs dat === length spine
 
@@ -80,3 +83,10 @@ test_utils =
     , test_multiSplitSound
     , test_multiSplitDistribution
     ]
+
+withNumTests :: QC.Testable prop => Int -> prop -> QC.Property
+#if MIN_VERSION_QuickCheck(2, 18, 0)
+withNumTests = QC.withNumTests
+#else
+withNumTests = QC.withMaxSuccess
+#endif

plutus-core/plutus-ir/test/PlutusCore/Generators/QuickCheck/BuiltinsTests.hs

@@ -8,4 +8,4 @@ import Test.QuickCheck
 
 -- | This mainly tests that the `Data` generator isn't non-terminating or too slow.
 prop_genData :: Property
-prop_genData = withMaxSuccess 800 $ \(d :: Data) -> d === deserialise (serialise d)
+prop_genData = withNumTests 800 $ \(d :: Data) -> d === deserialise (serialise d)

plutus-core/plutus-ir/test/PlutusCore/Generators/QuickCheck/SubstitutionTests.hs

@@ -38,7 +38,7 @@ The statistics at the time this comment was written are as follows:
 So we don't get great coverage, but given that it takes a few seconds to generate dozens of
 thousands of (non-filtered) test cases, we do still get some reasonable coverage in the end. -}
 prop_unify :: Property
-prop_unify = withMaxSuccess 500 $
+prop_unify = withNumTests 500 $
   forAllDoc "n" arbitrary shrink $ \(NonNegative n) ->
     forAllDoc "nSub" (choose (0, n)) shrink $ \nSub ->
       -- See Note [Chaotic Good fresh name generation].
@@ -89,7 +89,7 @@ prop_unifyRename =
 {-| Check that substitution eliminates from the type all free occurrences of variables present in
 the domain of the substitution. -}
 prop_substType :: Property
-prop_substType = withMaxSuccess 1000 $
+prop_substType = withNumTests 1000 $
   -- No shrinking because every nested shrink makes properties harder to shrink (because you'd need
   -- to regenerate the stuff that depends on the context, meaning you don't have the same
   -- counterexample as you did before) and context minimality doesn't help readability very much.

plutus-core/plutus-ir/test/PlutusCore/Generators/QuickCheck/TypesTests.hs

@@ -21,7 +21,7 @@ prop_genKindCorrect = p_genKindCorrect False
 See Note [Debugging generators that don't generate well-typed/kinded terms/types]
 and see the utility tests below when this property fails. -}
 p_genKindCorrect :: Bool -> Property
-p_genKindCorrect debug = withMaxSuccess 1000 $
+p_genKindCorrect debug = withNumTests 1000 $
   -- Context minimality doesn't help readability, so no shrinking here
   forAllDoc "ctx" genCtx (const []) $ \ctx ->
     -- Note, no shrinking here because shrinking relies on well-kindedness.
@@ -30,7 +30,7 @@ p_genKindCorrect debug = withMaxSuccess 1000 $
 
 -- | Check that shrinking types maintains kinds.
 prop_shrinkTypeSound :: Property
-prop_shrinkTypeSound = withMaxSuccess 500 $
+prop_shrinkTypeSound = withNumTests 500 $
   forAllDoc "ctx" genCtx (const []) $ \ctx ->
     forAllDoc "k,ty" (genKindAndTypeWithCtx ctx) (shrinkKindAndType ctx) $ \(k, ty) ->
       -- See discussion about the same trick in 'prop_shrinkTermSound'.
@@ -45,7 +45,7 @@ prop_shrinkTypeSound = withMaxSuccess 500 $
 
 -- | Test that shrinking a type results in a type of a smaller kind. Useful for debugging shrinking.
 prop_shrinkTypeSmallerKind :: Property
-prop_shrinkTypeSmallerKind = withMaxSuccess 3000 $
+prop_shrinkTypeSmallerKind = withNumTests 3000 $
   forAllDoc "k,ty" genKindAndType (shrinkKindAndType Map.empty) $ \(k, ty) ->
     assertNoCounterexamples
       [ (k', ty')
@@ -55,13 +55,13 @@ prop_shrinkTypeSmallerKind = withMaxSuccess 3000 $
 
 -- | Test that shrinking kinds generates smaller kinds.
 prop_shrinkKindSmaller :: Property
-prop_shrinkKindSmaller = withMaxSuccess 30000 $
+prop_shrinkKindSmaller = withNumTests 30000 $
   forAllDoc "k" arbitrary shrink $ \k ->
     assertNoCounterexamples [k' | k' <- shrink k, not $ leKind k' k]
 
 -- | Test that fixKind actually gives you something of the right kind.
 prop_fixKind :: Property
-prop_fixKind = withMaxSuccess 10000 $
+prop_fixKind = withNumTests 10000 $
   forAllDoc "ctx" genCtx (const []) $ \ctx ->
     forAllDoc "k,ty" genKindAndType (shrinkKindAndType ctx) $ \(k, ty) ->
       -- Note, fixKind only works on smaller kinds, so we use shrink to get a definitely smaller kind
@@ -74,7 +74,7 @@ prop_fixKind = withMaxSuccess 10000 $
 
 -- | Check that 'normalizeType' returns a normal type.
 prop_normalizedTypeIsNormal :: Property
-prop_normalizedTypeIsNormal = withMaxSuccess 1000 $
+prop_normalizedTypeIsNormal = withNumTests 1000 $
   forAllDoc "k,ty" genKindAndType (shrinkKindAndType Map.empty) $ \(_, ty) ->
     unless (isNormalType . unNormalized . runQuote $ normalizeType ty) $
       Left "'normalizeType' returned a non-normal type"

plutus-core/plutus-ir/test/PlutusIR/Compiler/Let/Tests.hs

@@ -36,7 +36,7 @@ test_lets =
 test_propLets :: TestTree
 test_propLets =
   ignoreTest $ testProperty "lets" $ \letKind ->
-    withMaxSuccess 40000 $
+    withNumTests 40000 $
       testPassProp' @_ @_ @_ @(Provenance ())
         (Original ())
         (\t -> fmap Original t)