feat: enable js tracer

[georgehao]

Because rundler must use js-tracer to validate the userOps.

https://github.com/alchemyplatform/rundler/blob/main/crates/sim/src/simulation/v0_6/tracer.rs#L109
https://github.com/alchemyplatform/rundler/blob/main/crates/sim/src/simulation/v0_7/tracer.rs#L184

After investigation, found runder can use --unsafe to skip validation, but Flag for unsafe bundling mode. When set Rundler will skip checking simulation rules.

so it's better we can enable js-tracer

[codspeed-hq]

CodSpeed Performance Report

Merging #334 will not alter performance

_{Comparing feat/enable_js_tracer (23c7472) with scroll (d485f47)}

Summary

✅ 77 untouched benchmarks

[frisitano]

Looks good, I've left some minor comments inline. Can you fix CI? We may need to remove the license type from the allow list to get deny working but I'm not sure. Do we also need to activet the js-tracer feature in the rollup-node repo?

[yiweichi]

lgtm

[georgehao]

Looks good, I've left some minor comments inline. Can you fix CI? We may need to remove the license type from the allow list to get deny working but I'm not sure. Do we also need to activet the js-tracer feature in the rollup-node repo?

error[vulnerability]: Logging user input may result in poisoning logs with ANSI escape sequences
    ┌─ /Users/haohongfan-scroll/scroll/reth/Cargo.lock:915:1
    │
915 │ tracing-subscriber 0.3.19 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulner
ability detected

    │
    ├ ID: RUSTSEC-2025-0055
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0055
    ├ Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attac
ks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when

There is a vulnerability has been detected. need to upgrade to tracing-subscriber 0.3.20

[frisitano]

There is a vulnerability has been detected. need to upgrade to tracing-subscriber 0.3.20

We can do this in a future PR

[frisitano]

lgtm