feat(wasm-utxo): add bech32 support for altcoin addresses

Add bech32 dependency for supporting altcoin address formats. Configure
dependency management with deny.toml to prevent duplicate dependencies.

Issue: BTC-2650

Co-authored-by: llm-git <[email protected]>

Author: OttoAllmendinger

.github/workflows/ci.yml

@@ -46,6 +46,7 @@ jobs:
           rustup component add rustfmt
           cargo install wasm-pack --version 0.13.1
           cargo install wasm-opt --version 0.116.1
+          cargo install cargo-deny --locked
 
       - name: Build Info
         run: |
@@ -54,6 +55,7 @@ jobs:
           echo "rustc $(rustc --version)"
           echo "wasm-pack $(wasm-pack --version)"
           echo "wasm-opt $(wasm-opt --version)"
+          echo "cargo-deny $(cargo deny --version)"
           git --version
           echo "base ref $GITHUB_BASE_REF"
           echo "head ref $GITHUB_HEAD_REF"
@@ -65,6 +67,10 @@ jobs:
       - name: Install Packages
         run: npm ci --workspaces --include-workspace-root
 
+      - name: Check dependencies with cargo-deny
+        run: cargo deny check
+        working-directory: packages/wasm-utxo
+
       - name: test
         run: npx --version
 

packages/wasm-utxo/Cargo.lock

@@ -10,6 +10,7 @@ crate-type = ["cdylib"]
 wasm-bindgen = "0.2"
 js-sys = "0.3"
 miniscript = { git = "https://github.com/BitGo/rust-miniscript", tag = "miniscript-12.3.4-opdrop" }
+bech32 = "0.11"
 
 [dev-dependencies]
 base64 = "0.22.1"

packages/wasm-utxo/Cargo.toml

@@ -0,0 +1,18 @@
+# Deny multiple versions of dependencies
+[bans]
+multiple-versions = "deny"
+# Highlight bech32 specifically (ensures it's caught if duplicated)
+highlight = "all"
+
+# Allow git sources (needed for miniscript)
+[sources]
+allow-git = ["https://github.com/BitGo/rust-miniscript"]
+
+# Allow common licenses used in the Rust ecosystem
+[licenses]
+allow = ["MIT", "Apache-2.0", "CC0-1.0", "MITNFA", "Unicode-DFS-2016"]
+# Clarify license for unlicensed crate
+[[licenses.clarify]]
+name = "wasm-utxo"
+expression = "MIT OR Apache-2.0"
+license-files = []