Remove duplicate dependencies from `deny.toml` once `ed25519-zebra` and `zcashd` are released

[mpguerra]

Motivation

We want to remove as many duplicate dependencies as possible from the zebra codebase. This should be possible after zcash/zcash#6648 currently planned for the the zcashd 5.6.0 release.

Specifications

With the zcashd 5.6.0 release, we we can upgrade and delete these dependencies in deny.toml

zebra/deny.toml

Lines 71 to 74 in 39c5997

	# wait for zcashd and zcash_script to upgrade
	# https://github.com/ZcashFoundation/zcash_script/pulls
	{ name = "metrics", version = "=0.20.1" },
	{ name = "sha2", version = "=0.9.9" },

zebra/deny.toml

Lines 85 to 89 in 39c5997

	# wait for zebra-chain to upgrade
	{ name = "secp256k1", version = "=0.21.3" },
	# wait for zebra-chain to upgrade `secp256k1`
	{ name = "secp256k1-sys", version = "=0.4.2" },

zebra/deny.toml

Lines 96 to 97 in 39c5997

	# wait for zcash_address to upgrade
	{ name = "bs58", version = "=0.4.0" },

zebra/deny.toml

Lines 76 to 78 in 39c5997

	# wait for ed25519-zebra, indexmap, metrics-util, and metrics to upgrade
	# ed25519-zebra/hashbrown: https://github.com/ZcashFoundation/ed25519-zebra/pull/65
	{ name = "ahash", version = "=0.7.6" },

zebra/deny.toml

Lines 64 to 65 in 4b6e2fe

	# wait for zcash_primitives to remove duplicated dependencies
	{ name = "block-buffer", version = "=0.9.0" },

Complex Code or Requirements

Testing

Related Work

• change(deps): Upgrade zcash_script to 0.1.12 to match zcashd 5.5.0 #6624
• Ensure we depend on sha2 0.10 (not 0.9.x) and metrics 0.21 (not 0.20.x) zcash/zcash#6648
• Tag a new ed25519-zebra release ed25519-zebra#79

[teor2345]

@mpguerra the next step here is to publish an ed25519-zebra release. The updated dependencies are in its main branch, but they haven't been released yet.

Once ed25519-zebra is done, it should be automatically picked up by the zcashd and zcash_script release processes. Then Zebra will pick it up automatically using dependabot.

Just a note: the deny.toml entries linked in the ticket will be outdated by the time we do this ticket, because PR #6624 will modify them.

(This ticket is also related to ZcashFoundation/ed25519-zebra#77 , because the release instructions for all our crates should include updating dependencies.)

[daira]

Note that we are cutting an rc of zcashd, so this is at risk of not getting into zcashd 5.6.0 if it is not done very soon.

[mpguerra]

tentatively scheduling for next sprint

[teor2345]

This needs to be done as part of #6859, can we close this ticket and just make it part of the PR for #6959?

(The duplicate dependency tests don't look for extra allowed duplicates, only new duplicates. So it needs to be a manual change as part of the dependency update.)

[teor2345]

I'm going to close this as incomplete rather than trying to track its dependencies separately, because it should happen in the same PR as #6859.