diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 0bcfb989d3..4ff23ed686 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -57,9 +57,10 @@ jobs:
           rustup default ${{ matrix.rust }}
           cargo install --force --version ${{ matrix.cargo-audit }} cargo-audit --locked
       - name: Audit
+        # ignores RUSTSEC-2020-0071 because it is 'only' in a dev dependency (ic-certified-responses -> ic-types -> chrono -> time)
         run: |
           cd sdk
-          cargo audit --no-fetch --db "${GITHUB_WORKSPACE}"/advisory-db
+          cargo audit --no-fetch --db "${GITHUB_WORKSPACE}"/advisory-db --ignore RUSTSEC-2020-0071
         env:
           RUST_BACKTRACE: 1
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1c34080595..22d7c3000a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,32 @@
 # dfx changelog
 
+# 0.14.4
+
+## DFX
+
+### fix: added https://icp-api.io to the default Content-Security-Policy header
+
+Existing projects will need to change this value in .ic-assets.json or .ic-assets.json5 to include https://icp-api.io
+
+All projects will need to redeploy.
+
+### fix: access to raw assets is now enabled by default
+
+The default value for `allow_raw_access` is now `true`.  This means that by default, the frontend canister will no longer restrict the access of traffic to the `<canister-id>.raw.icp0.io` domain, and will no longer automatically redirect all requests to the certified domain (`<canister-id>.icp0.io`), unless configured explicitly.
+
+Note that existing projects that specify `"allow_raw_access": false` in .ic-assets.json5 will need to change or remove this value manually in order to allow raw access.
+
+## Dependencies
+
+### Updated candid to 0.9.0
+
+### Updated cdk-rs to 0.10.0
+
+### Frontend canister
+
+- Module hash: d5c324fea6b0f8eaa9feede10b342b098f7cf64682e168e58fa2ca2bf028b96f
+- https://github.com/dfinity/sdk/pull/3327
+
 # 0.14.3
 
 ## Dependencies
@@ -12,8 +39,6 @@ This removes a dependency on OpenSSL in order to avoid spurious errors that refe
 
 # 0.14.2
 
-Note: Canister http functionality is broken.  Do not release dfx until this is corrected.  See https://dfinity.atlassian.net/browse/SDK-1129
-
 ## DFX
 
 ### feat: deprecate `dfx bootstrap` and `dfx replica` commands
diff --git a/Cargo.lock b/Cargo.lock
index cf04959421..760ed74e36 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -145,6 +145,21 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "annotate-snippets"
 version = "0.9.1"
@@ -285,7 +300,7 @@ checksum = "b9ccdd8f2a161be9bd5c023df56f1b2a0bd1d83872ae53b71a84a12c9bf6e842"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.11",
+ "syn 2.0.29",
 ]
 
 [[package]]
@@ -328,6 +343,18 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base32"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23ce669cd6c8588f79e15cf450314f9638f967fc5770ff1c7c1deb0925ea7cfa"
+
+[[package]]
+name = "base64"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b41b7ea54a0c9d92199de89e20e58d49f02f8e699814ef3fdf266f6f748d15c7"
+
 [[package]]
 name = "base64"
 version = "0.13.1"
@@ -352,6 +379,15 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a8241f3ebb85c056b509d4327ad0358fbbba6ffb340bf388f26350aeda225b1"
 
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "binread"
 version = "2.2.0"
@@ -591,6 +627,18 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1db59621ec70f09c5e9b597b220c7a2b43611f4710dc03ceb8748637775692c"
 
+[[package]]
+name = "cached"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec6d20b3d24b6c74e2c5331d2d3d8d1976a9883c7da179aa851afa4c90d62e36"
+dependencies = [
+ "hashbrown",
+ "instant",
+ "once_cell",
+ "thiserror",
+]
+
 [[package]]
 name = "candid"
 version = "0.8.4"
@@ -598,17 +646,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "244005a1917bb7614cd775ca8a5d59efeb5ac74397bb14ba29a19347ebd78591"
 dependencies = [
  "anyhow",
- "arbitrary",
  "binread",
  "byteorder",
  "candid_derive 0.5.0",
  "codespan-reporting",
  "crc32fast",
  "data-encoding",
- "fake",
  "hex",
- "lalrpop",
- "lalrpop-util",
+ "lalrpop 0.19.8",
+ "lalrpop-util 0.19.8",
  "leb128",
  "logos",
  "num-bigint 0.4.3",
@@ -616,37 +662,43 @@ dependencies = [
  "num_enum",
  "paste",
  "pretty 0.10.0",
- "rand",
  "serde",
  "serde_bytes",
- "serde_dhall",
  "sha2 0.10.6",
  "thiserror",
 ]
 
 [[package]]
 name = "candid"
-version = "0.9.0-beta.2"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4163412115fdb2d41d418b2746405c0fa5716be8064d507ec8bacf88027141e6"
+checksum = "14881d34e5ad2b3e77dfbbdf3266d907f85d28faf214b843684f2e64e8acd6c7"
 dependencies = [
  "anyhow",
+ "arbitrary",
  "binread",
  "byteorder",
- "candid_derive 0.6.0",
+ "candid_derive 0.6.1",
  "codespan-reporting",
  "crc32fast",
  "data-encoding",
+ "fake",
  "hex",
+ "lalrpop 0.20.0",
+ "lalrpop-util 0.20.0",
  "leb128",
+ "logos",
  "num-bigint 0.4.3",
  "num-traits",
  "num_enum",
  "paste",
  "pretty 0.10.0",
+ "rand",
  "serde",
  "serde_bytes",
+ "serde_dhall",
  "sha2 0.10.6",
+ "stacker",
  "thiserror",
 ]
 
@@ -664,9 +716,9 @@ dependencies = [
 
 [[package]]
 name = "candid_derive"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34df46ac8b0a44de9b243d9dd21e608838183be20de408c934993ed6a4a8e4c1"
+checksum = "041ce1020740a400035899b2909a6f4f275b79c8db502cbd59ace9b2cc88af58"
 dependencies = [
  "lazy_static",
  "proc-macro2",
@@ -695,6 +747,21 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
+[[package]]
+name = "chrono"
+version = "0.4.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec837a71355b28f6556dbd569b37b3f363091c0bd4b2e735674521b4c5fd9bc5"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "time 0.1.45",
+ "wasm-bindgen",
+ "winapi",
+]
+
 [[package]]
 name = "cipher"
 version = "0.3.0"
@@ -739,7 +806,7 @@ dependencies = [
  "heck 0.4.0",
  "proc-macro2",
  "quote",
- "syn 2.0.11",
+ "syn 2.0.29",
 ]
 
 [[package]]
@@ -784,6 +851,42 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "comparable"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb513ee8037bf08c5270ecefa48da249f4c58e57a71ccfce0a5b0877d2a20eb2"
+dependencies = [
+ "comparable_derive",
+ "comparable_helper",
+ "pretty_assertions",
+ "serde",
+]
+
+[[package]]
+name = "comparable_derive"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a54b9c40054eb8999c5d1d36fdc90e4e5f7ff0d1d9621706f360b3cbc8beb828"
+dependencies = [
+ "convert_case 0.4.0",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "comparable_helper"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5437e327e861081c91270becff184859f706e3e50f5301a9d4dc8eb50752c3"
+dependencies = [
+ "convert_case 0.6.0",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "concurrent-queue"
 version = "1.2.4"
@@ -812,6 +915,21 @@ version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "520fbf3c07483f94e3e3ca9d0cfd913d7718ef2483d2cfd91c0d9e91474ab913"
 
+[[package]]
+name = "convert_case"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6245d59a3e82a7fc217c5828a6692dbc6dfb63a0c8c90495621f7b9d79704a0e"
+
+[[package]]
+name = "convert_case"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.3"
@@ -982,6 +1100,15 @@ dependencies = [
  "windows-sys 0.45.0",
 ]
 
+[[package]]
+name = "cvt"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2ae9bf77fbf2d39ef573205d554d87e86c12f1994e9ea335b0651b9b278bcf1"
+dependencies = [
+ "cfg-if 1.0.0",
+]
+
 [[package]]
 name = "cxx"
 version = "1.0.94"
@@ -1006,7 +1133,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "scratch",
- "syn 2.0.11",
+ "syn 2.0.29",
 ]
 
 [[package]]
@@ -1023,7 +1150,42 @@ checksum = "2345488264226bf682893e25de0769f3360aac9957980ec49361b083ddaa5bc5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.11",
+ "syn 2.0.29",
+]
+
+[[package]]
+name = "darling"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a01d95850c592940db9b8194bc39f4bc0e89dee5c4265e4b1807c34a9aba453c"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "859d65a907b6852c9361e3185c862aae7fafd2887876799fa55f5f99dc40d610"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c972679f83bdf9c42bd905396b6c3588a843a17f0f16dfcfa3e2c5d57441835"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -1071,6 +1233,16 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "derive_more"
+version = "0.99.8-alpha.0"
+source = "git+https://github.com/dfinity-lab/derive_more?branch=master#9f1b894e6fde640da4e9ea71a8fc0e4dd98d01da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "dfx"
 version = "0.14.3"
@@ -1085,7 +1257,7 @@ dependencies = [
  "base64 0.13.1",
  "byte-unit",
  "bytes",
- "candid 0.8.4",
+ "candid 0.9.0",
  "clap",
  "console",
  "crc32fast",
@@ -1106,7 +1278,7 @@ dependencies = [
  "ic-agent",
  "ic-asset",
  "ic-identity-hsm",
- "ic-utils",
+ "ic-utils 0.25.0",
  "ic-wasm",
  "indicatif",
  "itertools 0.10.5",
@@ -1146,13 +1318,12 @@ dependencies = [
  "tempfile",
  "term",
  "thiserror",
- "time",
+ "time 0.3.20",
  "tokio",
  "toml 0.7.3",
  "url",
  "walkdir",
  "walrus",
- "wasmparser 0.87.0",
  "which",
 ]
 
@@ -1164,7 +1335,7 @@ dependencies = [
  "argon2",
  "bip32",
  "byte-unit",
- "candid 0.8.4",
+ "candid 0.9.0",
  "dialoguer",
  "directories-next",
  "flate2",
@@ -1172,7 +1343,7 @@ dependencies = [
  "humantime-serde",
  "ic-agent",
  "ic-identity-hsm",
- "ic-utils",
+ "ic-utils 0.25.0",
  "k256 0.11.6",
  "keyring",
  "lazy_static",
@@ -1449,6 +1620,15 @@ dependencies = [
  "termcolor",
 ]
 
+[[package]]
+name = "erased-serde"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "837c0466252947ada828b975e12daf82e18bb5444e4df87be6038d4469e2a3d2"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "errno"
 version = "0.3.0"
@@ -1479,6 +1659,12 @@ dependencies = [
  "rand",
 ]
 
+[[package]]
+name = "fallible-iterator"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
+
 [[package]]
 name = "fastrand"
 version = "1.8.0"
@@ -1488,6 +1674,15 @@ dependencies = [
  "instant",
 ]
 
+[[package]]
+name = "features"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83072b3c84e55f9d0c0ff36a4575d0fd2e543ae4a56e04e7f5a9222188d574e3"
+dependencies = [
+ "bitflags",
+]
+
 [[package]]
 name = "ff"
 version = "0.12.1"
@@ -1537,6 +1732,15 @@ dependencies = [
  "miniz_oxide",
 ]
 
+[[package]]
+name = "float-cmp"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98de4bbd547a563b716d8dfa9aad1cb19bfab00f4fa09a6a4ed21dbcf44ce9c4"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "fn-error-context"
 version = "0.2.1"
@@ -1545,7 +1749,7 @@ checksum = "2cd66269887534af4b0c3e3337404591daa8dc8b9b2b3db71f9523beb4bafb41"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.11",
+ "syn 2.0.29",
 ]
 
 [[package]]
@@ -1711,8 +1915,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
 dependencies = [
  "cfg-if 1.0.0",
+ "js-sys",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1725,6 +1931,17 @@ dependencies = [
  "polyval",
 ]
 
+[[package]]
+name = "gimli"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22030e2c5a68ec659fde1e949a745124b48e6fa8b045b7ed5bd1fe4ccc5c4e5d"
+dependencies = [
+ "fallible-iterator",
+ "indexmap",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "globset"
 version = "0.4.10"
@@ -1997,18 +2214,41 @@ dependencies = [
  "tokio-native-tls",
 ]
 
+[[package]]
+name = "iana-time-zone"
+version = "0.1.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "ic-agent"
-version = "0.24.1"
-source = "git+https://github.com/dfinity/agent-rs.git?rev=b9c57f8bab23cc9936dca4560293ffe485471c6d#b9c57f8bab23cc9936dca4560293ffe485471c6d"
+version = "0.25.0"
+source = "git+https://github.com/dfinity/agent-rs.git?rev=6d923cbc918852ef5bfaeb08e63c86580aa80ffe#6d923cbc918852ef5bfaeb08e63c86580aa80ffe"
 dependencies = [
  "backoff",
- "candid 0.8.4",
+ "candid 0.9.0",
  "futures-util",
  "hex",
  "http",
  "http-body",
- "ic-certification 0.24.1",
+ "ic-certification 0.25.0",
  "ic-verify-bls-signature",
  "k256 0.13.1",
  "leb128",
@@ -2026,6 +2266,7 @@ dependencies = [
  "sha2 0.10.6",
  "simple_asn1",
  "thiserror",
+ "time 0.3.20",
  "tokio",
  "url",
 ]
@@ -2035,7 +2276,7 @@ name = "ic-asset"
 version = "0.20.0"
 dependencies = [
  "backoff",
- "candid 0.8.4",
+ "candid 0.9.0",
  "derivative",
  "dfx-core",
  "flate2",
@@ -2044,7 +2285,7 @@ dependencies = [
  "globset",
  "hex",
  "ic-agent",
- "ic-utils",
+ "ic-utils 0.25.0",
  "itertools 0.10.5",
  "json5",
  "mime",
@@ -2063,12 +2304,54 @@ dependencies = [
 ]
 
 [[package]]
-name = "ic-cdk"
+name = "ic-base-types"
 version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "401ddc246ab0d80e5e0bd2c926c6a0feef7b82ddbed81f1e752784c4aac58928"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "base32",
+ "byte-unit",
+ "bytes",
+ "candid 0.8.4",
+ "comparable",
+ "crc32fast",
+ "ic-crypto-sha",
+ "ic-protobuf",
+ "phantom_newtype",
+ "prost",
+ "serde",
+ "strum 0.23.0",
+ "strum_macros 0.23.1",
+]
+
+[[package]]
+name = "ic-btc-types"
+version = "0.1.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
 dependencies = [
  "candid 0.8.4",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
+name = "ic-btc-types-internal"
+version = "0.1.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "candid 0.8.4",
+ "ic-btc-types",
+ "ic-protobuf",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
+name = "ic-cdk"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d4c0b932bf454d5d60e61e13c3c944972fcfd74dc82b9ed5c8b0a75979cf50"
+dependencies = [
+ "candid 0.9.0",
  "ic-cdk-macros",
  "ic0",
  "serde",
@@ -2077,11 +2360,11 @@ dependencies = [
 
 [[package]]
 name = "ic-cdk-macros"
-version = "0.6.10"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebf50458685a0fc6b0e414cdba487610aeb199ac94db52d9fd76270565debee7"
+checksum = "b4587624e64b8db56224033ee74e5c246d39be15375d03d3df7c117d49d18487"
 dependencies = [
- "candid 0.8.4",
+ "candid 0.9.0",
  "proc-macro2",
  "quote",
  "serde",
@@ -2101,8 +2384,8 @@ dependencies = [
 
 [[package]]
 name = "ic-certification"
-version = "0.24.1"
-source = "git+https://github.com/dfinity/agent-rs.git?rev=b9c57f8bab23cc9936dca4560293ffe485471c6d#b9c57f8bab23cc9936dca4560293ffe485471c6d"
+version = "0.25.0"
+source = "git+https://github.com/dfinity/agent-rs.git?rev=6d923cbc918852ef5bfaeb08e63c86580aa80ffe#6d923cbc918852ef5bfaeb08e63c86580aa80ffe"
 dependencies = [
  "hex",
  "serde",
@@ -2115,12 +2398,14 @@ name = "ic-certified-assets"
 version = "0.2.5"
 dependencies = [
  "base64 0.13.1",
- "candid 0.8.4",
+ "candid 0.9.0",
  "hex",
  "ic-cdk",
- "ic-cdk-macros",
  "ic-certified-map",
+ "ic-crypto-tree-hash",
+ "ic-representation-independent-hash",
  "ic-response-verification",
+ "ic-response-verification-test-utils",
  "itertools 0.10.5",
  "num-traits",
  "serde",
@@ -2131,71 +2416,362 @@ dependencies = [
 
 [[package]]
 name = "ic-certified-map"
-version = "0.3.1"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ea6b4530bf4e304ba870da9f58f6e10a84c74fe2fdec574ec7a316f031c37fd"
+checksum = "6adc65afeffc619a7cd19553c66c79820908c12f42191af90cfb39e2e93c4431"
 dependencies = [
  "serde",
  "serde_bytes",
  "sha2 0.10.6",
 ]
 
+[[package]]
+name = "ic-constants"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+
+[[package]]
+name = "ic-crypto-getrandom-for-wasm"
+version = "0.1.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "ic-crypto-internal-bls12-381-type"
+version = "0.1.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "hex",
+ "ic-crypto-getrandom-for-wasm",
+ "ic_bls12_381",
+ "lazy_static",
+ "pairing",
+ "paste",
+ "rand",
+ "rand_chacha",
+ "sha2 0.9.9",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "ic-crypto-internal-seed"
+version = "0.1.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "hex",
+ "ic-crypto-sha",
+ "ic-types",
+ "rand",
+ "rand_chacha",
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "ic-crypto-internal-sha2"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "openssl",
+ "sha2 0.9.9",
+]
+
+[[package]]
+name = "ic-crypto-internal-threshold-sig-bls12381"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "arrayvec 0.5.2",
+ "base64 0.11.0",
+ "cached",
+ "hex",
+ "ic-crypto-internal-bls12-381-type",
+ "ic-crypto-internal-seed",
+ "ic-crypto-internal-threshold-sig-bls12381-der",
+ "ic-crypto-internal-types",
+ "ic-crypto-sha",
+ "ic-types",
+ "lazy_static",
+ "parking_lot 0.12.1",
+ "rand",
+ "rand_chacha",
+ "serde",
+ "serde_bytes",
+ "serde_cbor",
+ "strum_macros 0.23.1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "ic-crypto-internal-threshold-sig-bls12381-der"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "simple_asn1",
+]
+
+[[package]]
+name = "ic-crypto-internal-types"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "arrayvec 0.5.2",
+ "base64 0.11.0",
+ "hex",
+ "ic-protobuf",
+ "phantom_newtype",
+ "serde",
+ "serde_cbor",
+ "strum 0.23.0",
+ "strum_macros 0.23.1",
+ "thiserror",
+ "zeroize",
+]
+
+[[package]]
+name = "ic-crypto-sha"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "ic-crypto-internal-sha2",
+]
+
+[[package]]
+name = "ic-crypto-tree-hash"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "ic-crypto-internal-types",
+ "ic-crypto-sha",
+ "ic-protobuf",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
+name = "ic-crypto-utils-threshold-sig-der"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "base64 0.11.0",
+ "ic-crypto-internal-threshold-sig-bls12381-der",
+ "ic-crypto-internal-types",
+ "ic-types",
+]
+
+[[package]]
+name = "ic-error-types"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "serde",
+ "strum 0.23.0",
+ "strum_macros 0.23.1",
+]
+
 [[package]]
 name = "ic-frontend-canister"
 version = "0.2.5"
 dependencies = [
  "ic-cdk",
- "ic-cdk-macros",
  "ic-certified-assets",
 ]
 
 [[package]]
-name = "ic-identity-hsm"
-version = "0.24.1"
-source = "git+https://github.com/dfinity/agent-rs.git?rev=b9c57f8bab23cc9936dca4560293ffe485471c6d#b9c57f8bab23cc9936dca4560293ffe485471c6d"
+name = "ic-ic00-types"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "candid 0.8.4",
+ "float-cmp",
+ "ic-base-types",
+ "ic-btc-types",
+ "ic-btc-types-internal",
+ "ic-error-types",
+ "ic-protobuf",
+ "num-traits",
+ "serde",
+ "serde_bytes",
+ "serde_cbor",
+ "strum 0.23.0",
+ "strum_macros 0.23.1",
+]
+
+[[package]]
+name = "ic-identity-hsm"
+version = "0.25.0"
+source = "git+https://github.com/dfinity/agent-rs.git?rev=6d923cbc918852ef5bfaeb08e63c86580aa80ffe#6d923cbc918852ef5bfaeb08e63c86580aa80ffe"
+dependencies = [
+ "hex",
+ "ic-agent",
+ "pkcs11",
+ "sha2 0.10.6",
+ "simple_asn1",
+ "thiserror",
+]
+
+[[package]]
+name = "ic-protobuf"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "bincode",
+ "candid 0.8.4",
+ "erased-serde",
+ "maplit",
+ "prost",
+ "serde",
+ "serde_json",
+ "slog",
+]
+
+[[package]]
+name = "ic-representation-independent-hash"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f5790ff4b3752ce648d83554b3b0df1039a94bea24119d29a0f9874d796075e"
+dependencies = [
+ "leb128",
+ "sha2 0.10.6",
+]
+
+[[package]]
+name = "ic-response-verification"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "736044d69c526fa8a2a5e54d3debd878bbd4ec10c259fd21d9e6804aef67687b"
+dependencies = [
+ "base64 0.13.1",
+ "candid 0.8.4",
+ "flate2",
+ "http",
+ "ic-certification 0.23.2",
+ "ic-representation-independent-hash",
+ "leb128",
+ "log",
+ "miracl_core_bls12381",
+ "nom",
+ "sha2 0.10.6",
+ "thiserror",
+]
+
+[[package]]
+name = "ic-response-verification-test-utils"
+version = "0.3.0"
+source = "git+https://github.com/dfinity/response-verification.git?rev=d421c1bf01806425cbad4b977bd1499a259f3506#d421c1bf01806425cbad4b977bd1499a259f3506"
+dependencies = [
+ "base64 0.21.0",
+ "flate2",
+ "getrandom",
+ "hex",
+ "ic-base-types",
+ "ic-certified-map",
+ "ic-crypto-internal-seed",
+ "ic-crypto-internal-threshold-sig-bls12381",
+ "ic-crypto-internal-types",
+ "ic-crypto-tree-hash",
+ "ic-crypto-utils-threshold-sig-der",
+ "ic-types",
+ "leb128",
+ "rand",
+ "serde",
+ "serde_cbor",
+ "sha256",
+]
+
+[[package]]
+name = "ic-sys"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "hex",
+ "ic-crypto-sha",
+ "lazy_static",
+ "libc",
+ "nix 0.23.2",
+ "phantom_newtype",
+ "wsl",
+]
+
+[[package]]
+name = "ic-types"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
 dependencies = [
+ "base32",
+ "base64 0.11.0",
+ "bincode",
+ "candid 0.8.4",
+ "chrono",
+ "derive_more",
  "hex",
- "ic-agent",
- "pkcs11",
- "sha2 0.10.6",
- "simple_asn1",
+ "http",
+ "ic-base-types",
+ "ic-btc-types-internal",
+ "ic-constants",
+ "ic-crypto-internal-types",
+ "ic-crypto-sha",
+ "ic-crypto-tree-hash",
+ "ic-error-types",
+ "ic-ic00-types",
+ "ic-protobuf",
+ "ic-utils 0.8.0",
+ "maplit",
+ "num-traits",
+ "once_cell",
+ "phantom_newtype",
+ "prost",
+ "serde",
+ "serde_bytes",
+ "serde_cbor",
+ "serde_json",
+ "serde_with",
+ "strum 0.23.0",
+ "strum_macros 0.23.1",
  "thiserror",
+ "thousands",
+ "url",
 ]
 
 [[package]]
-name = "ic-response-verification"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f4e57f65dc2b5567f11e0508b3648518097fe9fcd443389eb0057b91a3c5acd"
+name = "ic-utils"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
 dependencies = [
- "base64 0.13.1",
- "candid 0.8.4",
- "flate2",
- "http",
- "ic-certification 0.23.2",
- "leb128",
- "log",
- "miracl_core_bls12381",
- "nom",
- "sha2 0.10.6",
+ "bitflags",
+ "cvt",
+ "features",
+ "hex",
+ "ic-sys",
+ "libc",
+ "nix 0.23.2",
+ "prost",
+ "rand",
+ "scoped_threadpool",
+ "serde",
  "thiserror",
 ]
 
 [[package]]
 name = "ic-utils"
-version = "0.24.1"
-source = "git+https://github.com/dfinity/agent-rs.git?rev=b9c57f8bab23cc9936dca4560293ffe485471c6d#b9c57f8bab23cc9936dca4560293ffe485471c6d"
+version = "0.25.0"
+source = "git+https://github.com/dfinity/agent-rs.git?rev=6d923cbc918852ef5bfaeb08e63c86580aa80ffe#6d923cbc918852ef5bfaeb08e63c86580aa80ffe"
 dependencies = [
  "async-trait",
- "candid 0.8.4",
+ "candid 0.9.0",
  "ic-agent",
  "once_cell",
  "semver",
  "serde",
  "serde_bytes",
- "strum",
- "strum_macros",
+ "strum 0.24.1",
+ "strum_macros 0.24.3",
  "thiserror",
+ "time 0.3.20",
 ]
 
 [[package]]
@@ -2212,12 +2788,12 @@ dependencies = [
 
 [[package]]
 name = "ic-wasm"
-version = "0.3.6"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2ae0572556cad5b2f7239d6d89aba67f445c48f69610d9f540351cb8929c604"
+checksum = "e360e45c2bf406a867c35ec5daee433f2c3bbbaf013469e6a386a322a9713885"
 dependencies = [
  "anyhow",
- "candid 0.9.0-beta.2",
+ "candid 0.9.0",
  "clap",
  "rustc-demangle",
  "tempfile",
@@ -2228,9 +2804,24 @@ dependencies = [
 
 [[package]]
 name = "ic0"
-version = "0.18.10"
+version = "0.18.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "576c539151d4769fb4d1a0c25c4108dd18facd04c5695b02cf2d226ab4e43aa5"
+
+[[package]]
+name = "ic_bls12_381"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "187fa0cecf46628330b7a390a1a65fb0637ea00d3a1121aa847ecbebc0f3ff79"
+checksum = "42a180f02c79a71fcbc10b194406dbffd6a883c916f96be4f17ae3aeb96348c5"
+dependencies = [
+ "digest 0.9.0",
+ "ff 0.12.1",
+ "group 0.12.1",
+ "pairing",
+ "rand_core",
+ "subtle",
+ "zeroize",
+]
 
 [[package]]
 name = "icx-asset"
@@ -2238,13 +2829,13 @@ version = "0.20.0"
 dependencies = [
  "anstyle",
  "anyhow",
- "candid 0.8.4",
+ "candid 0.9.0",
  "clap",
  "delay",
  "humantime",
  "ic-agent",
  "ic-asset",
- "ic-utils",
+ "ic-utils 0.25.0",
  "libflate",
  "num-traits",
  "pem 1.1.1",
@@ -2255,7 +2846,7 @@ dependencies = [
  "slog-async",
  "slog-term",
  "thiserror",
- "time",
+ "time 0.3.20",
  "tokio",
  "walkdir",
 ]
@@ -2266,6 +2857,12 @@ version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25a2bc672d1148e28034f176e01fffebb08b35768468cc954630da77a1449005"
 
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
 [[package]]
 name = "idna"
 version = "0.3.0"
@@ -2465,11 +3062,34 @@ dependencies = [
  "diff",
  "ena",
  "itertools 0.10.5",
- "lalrpop-util",
+ "lalrpop-util 0.19.8",
+ "petgraph",
+ "pico-args 0.4.2",
+ "regex",
+ "regex-syntax 0.6.29",
+ "string_cache",
+ "term",
+ "tiny-keccak",
+ "unicode-xid",
+]
+
+[[package]]
+name = "lalrpop"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da4081d44f4611b66c6dd725e6de3169f9f63905421e8626fcb86b6a898998b8"
+dependencies = [
+ "ascii-canvas",
+ "bit-set",
+ "diff",
+ "ena",
+ "is-terminal",
+ "itertools 0.10.5",
+ "lalrpop-util 0.20.0",
  "petgraph",
- "pico-args",
+ "pico-args 0.5.0",
  "regex",
- "regex-syntax",
+ "regex-syntax 0.7.3",
  "string_cache",
  "term",
  "tiny-keccak",
@@ -2485,6 +3105,15 @@ dependencies = [
  "regex",
 ]
 
+[[package]]
+name = "lalrpop-util"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f35c735096c0293d313e8f2a641627472b83d01b937177fe76e5e2708d31e0d"
+dependencies = [
+ "regex",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.4.0"
@@ -2602,10 +3231,16 @@ dependencies = [
  "fnv",
  "proc-macro2",
  "quote",
- "regex-syntax",
+ "regex-syntax 0.6.29",
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "maplit"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
+
 [[package]]
 name = "memchr"
 version = "2.5.0"
@@ -2669,7 +3304,7 @@ checksum = "e5d732bc30207a6423068df043e3d02e0735b155ad7ce1a6f76fe2baa5b158de"
 dependencies = [
  "libc",
  "log",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "windows-sys 0.42.0",
 ]
 
@@ -2755,6 +3390,19 @@ dependencies = [
  "memoffset 0.6.5",
 ]
 
+[[package]]
+name = "nix"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
+dependencies = [
+ "bitflags",
+ "cc",
+ "cfg-if 1.0.0",
+ "libc",
+ "memoffset 0.6.5",
+]
+
 [[package]]
 name = "nix"
 version = "0.26.2"
@@ -3204,6 +3852,16 @@ dependencies = [
  "indexmap",
 ]
 
+[[package]]
+name = "phantom_newtype"
+version = "0.8.0"
+source = "git+https://github.com/dfinity/ic.git?rev=a533346f63f4091eb64692891de0d5b2ffd5b22a#a533346f63f4091eb64692891de0d5b2ffd5b22a"
+dependencies = [
+ "candid 0.8.4",
+ "serde",
+ "slog",
+]
+
 [[package]]
 name = "phf_shared"
 version = "0.10.0"
@@ -3219,6 +3877,12 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db8bcd96cb740d03149cbad5518db9fd87126a10ab519c011893b1754134c468"
 
+[[package]]
+name = "pico-args"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.9"
@@ -3327,6 +3991,16 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "pretty_assertions"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af7cee1a6c8a5b9208b3cb1061f10c0cb689087b3d8ce85fb9d2dd7a29b6ba66"
+dependencies = [
+ "diff",
+ "yansi",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "0.1.5"
@@ -3349,9 +4023,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.54"
+version = "1.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e472a104799c74b514a57226160104aa483546de37e839ec50e3c2e41dd87534"
+checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
 dependencies = [
  "unicode-ident",
 ]
@@ -3371,12 +4045,44 @@ dependencies = [
  "rand",
  "rand_chacha",
  "rand_xorshift",
- "regex-syntax",
+ "regex-syntax 0.6.29",
  "rusty-fork",
  "tempfile",
  "unarray",
 ]
 
+[[package]]
+name = "prost"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d2d8d10f3c6ded6da8b05b5fb3b8a5082514344d56c9f871412d29b4e075b4"
+dependencies = [
+ "anyhow",
+ "itertools 0.10.5",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "psm"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5787f7cda34e3033a72192c018bc5883100330f362ef279a8cbccfce8bb4e874"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "ptr_meta"
 version = "0.1.4"
@@ -3411,9 +4117,9 @@ checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
 [[package]]
 name = "quote"
-version = "1.0.26"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
  "proc-macro2",
 ]
@@ -3516,7 +4222,7 @@ checksum = "8b1f693b24f6ac912f4893ef08244d70b6067480d2f1a46e950c9691e6749d1d"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-syntax 0.6.29",
 ]
 
 [[package]]
@@ -3525,6 +4231,12 @@ version = "0.6.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
+[[package]]
+name = "regex-syntax"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab07dc67230e4a4718e70fd5c20055a4334b121f1f9db8fe63ef39ce9b8c846"
+
 [[package]]
 name = "rend"
 version = "0.4.0"
@@ -3804,6 +4516,12 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea6a9290e3c9cf0f18145ef7ffa62d68ee0bf5fcd651017e586dc7fd5da448c2"
 
+[[package]]
+name = "scoped_threadpool"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d51f5df5af43ab3f1360b429fa5e0152ac5ce8c0bd6485cae490332e96846a8"
+
 [[package]]
 name = "scopeguard"
 version = "1.1.0"
@@ -3914,9 +4632,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.164"
+version = "1.0.187"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e8c8cf938e98f769bc164923b06dce91cea1751522f46f8466461af04c9027d"
+checksum = "30a7fe14252655bd1e578af19f5fa00fe02fd0013b100ca6b49fde31c41bae4c"
 dependencies = [
  "serde_derive",
 ]
@@ -3942,13 +4660,13 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.164"
+version = "1.0.187"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9735b638ccc51c28bf6914d90a2e9725b377144fc612c49a611fddd1b631d68"
+checksum = "e46b2a6ca578b3f1d4501b12f78ed4692006d79d82a1a7c561c12dbc3d625eb8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.11",
+ "syn 2.0.29",
 ]
 
 [[package]]
@@ -3994,7 +4712,7 @@ checksum = "bcec881020c684085e55a25f7fd888954d56609ef363479dc5a1305eb0d40cab"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.11",
+ "syn 2.0.29",
 ]
 
 [[package]]
@@ -4029,6 +4747,28 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_with"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678b5a069e50bf00ecd22d0cd8ddf7c236f68581b03db652061ed5eb13a312ff"
+dependencies = [
+ "serde",
+ "serde_with_macros",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e182d6ec6f05393cc0e5ed1bf81ad6db3a8feedf8ee515ecdd369809bcce8082"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.5"
@@ -4064,6 +4804,19 @@ dependencies = [
  "digest 0.10.6",
 ]
 
+[[package]]
+name = "sha256"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7895c8ae88588ccead14ff438b939b0c569cd619116f14b4d13fdff7b8333386"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "hex",
+ "sha2 0.10.6",
+ "tokio",
+]
+
 [[package]]
 name = "sha3"
 version = "0.10.6"
@@ -4130,7 +4883,7 @@ dependencies = [
  "num-bigint 0.4.3",
  "num-traits",
  "thiserror",
- "time",
+ "time 0.3.20",
 ]
 
 [[package]]
@@ -4153,6 +4906,9 @@ name = "slog"
 version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8347046d4ebd943127157b94d63abb990fcf729dc4e9978927fdf4ac3c998d06"
+dependencies = [
+ "erased-serde",
+]
 
 [[package]]
 name = "slog-async"
@@ -4176,7 +4932,7 @@ dependencies = [
  "slog",
  "term",
  "thread_local",
- "time",
+ "time 0.3.20",
 ]
 
 [[package]]
@@ -4227,6 +4983,19 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
 
+[[package]]
+name = "stacker"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c886bd4480155fd3ef527d45e9ac8dd7118a898a46530b7b94c3e21866259fce"
+dependencies = [
+ "cc",
+ "cfg-if 1.0.0",
+ "libc",
+ "psm",
+ "winapi",
+]
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
@@ -4252,12 +5021,31 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
+[[package]]
+name = "strum"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cae14b91c7d11c9a851d3fbc80a963198998c2a64eec840477fa92d8ce9b70bb"
+
 [[package]]
 name = "strum"
 version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "063e6045c0e62079840579a7e47a355ae92f60eb74daaf156fb1e84ba164e63f"
 
+[[package]]
+name = "strum_macros"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bb0dc7ee9c15cea6199cde9a127fa16a4c5819af85395457ad72d68edc85a38"
+dependencies = [
+ "heck 0.3.3",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "strum_macros"
 version = "0.24.3"
@@ -4300,9 +5088,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.11"
+version = "2.0.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21e3787bb71465627110e7d87ed4faaa36c1f61042ee67badb9e2ef173accc40"
+checksum = "c324c494eba9d92503e6f1ef2e6df781e78f6a7705a0202d9801b198807d518a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4413,9 +5201,15 @@ checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.11",
+ "syn 2.0.29",
 ]
 
+[[package]]
+name = "thousands"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bf63baf9f5039dadc247375c29eb13706706cfde997d0330d05aa63a77d8820"
+
 [[package]]
 name = "thread_local"
 version = "1.1.4"
@@ -4425,6 +5219,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "time"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b797afad3f312d1c66a56d11d0316f916356d11bd158fbc6ca6389ff6bf805a"
+dependencies = [
+ "libc",
+ "wasi 0.10.0+wasi-snapshot-preview1",
+ "winapi",
+]
+
 [[package]]
 name = "time"
 version = "0.3.20"
@@ -4499,9 +5304,9 @@ checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
 
 [[package]]
 name = "tokio"
-version = "1.27.0"
+version = "1.28.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0de47a4eecbe11f498978a9b29d792f0d2692d1dd003650c24c76510e3bc001"
+checksum = "94d7b1cfd2aa4011f2de74c2c4c63665e27a71006b0a192dcd2710272e73dfa2"
 dependencies = [
  "autocfg",
  "bytes",
@@ -4513,18 +5318,18 @@ dependencies = [
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
- "windows-sys 0.45.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.0.0"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a573bdc87985e9d6ddeed1b3d864e8a302c847e40d647746df2f1de209d1ce"
+checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.11",
+ "syn 2.0.29",
 ]
 
 [[package]]
@@ -4734,6 +5539,7 @@ dependencies = [
  "form_urlencoded",
  "idna",
  "percent-encoding",
+ "serde",
 ]
 
 [[package]]
@@ -4787,16 +5593,18 @@ dependencies = [
 
 [[package]]
 name = "walrus"
-version = "0.19.0"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4eb08e48cde54c05f363d984bb54ce374f49e242def9468d2e1b6c2372d291f8"
+checksum = "cc27d837c587f863d99515dc8cae7cef1098bd1d99fa29373e3660c12766265e"
 dependencies = [
  "anyhow",
+ "gimli",
  "id-arena",
  "leb128",
  "log",
  "walrus-macro",
- "wasmparser 0.77.0",
+ "wasm-encoder",
+ "wasmparser",
 ]
 
 [[package]]
@@ -4821,6 +5629,12 @@ dependencies = [
  "try-lock",
 ]
 
+[[package]]
+name = "wasi"
+version = "0.10.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
@@ -4893,16 +5707,25 @@ version = "0.2.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
 
+[[package]]
+name = "wasm-encoder"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18c41dbd92eaebf3612a39be316540b8377c871cb9bde6b064af962984912881"
+dependencies = [
+ "leb128",
+]
+
 [[package]]
 name = "wasm-opt"
-version = "0.112.0"
+version = "0.113.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87fef6d0d508f08334e0ab0e6877feb4c0ecb3956bcf2cb950699b22fedf3e9c"
+checksum = "65a2799e08026234b07b44da6363703974e75be21430cef00756bbc438c8ff8a"
 dependencies = [
  "anyhow",
  "libc",
- "strum",
- "strum_macros",
+ "strum 0.24.1",
+ "strum_macros 0.24.3",
  "tempfile",
  "thiserror",
  "wasm-opt-cxx-sys",
@@ -4911,9 +5734,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-opt-cxx-sys"
-version = "0.112.0"
+version = "0.113.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc816bbc1596c8f2e8127e137a760c798023ef3d378f2ae51f0f1840e2dfa445"
+checksum = "c8d26f86d1132245e8bcea8fac7f02b10fb885b6696799969c94d7d3c14db5e1"
 dependencies = [
  "anyhow",
  "cxx",
@@ -4923,9 +5746,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-opt-sys"
-version = "0.112.0"
+version = "0.113.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40199e4f68ef1071b3c6d0bd8026a12b481865d4b9e49c156932ea9a6234dd14"
+checksum = "497d069cd3420cdd52154a320b901114a20946878e2de62c670f9d906e472370"
 dependencies = [
  "anyhow",
  "cc",
@@ -4948,18 +5771,9 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.77.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35c86d22e720a07d954ebbed772d01180501afe7d03d464f413bb5f8914a8d6"
-
-[[package]]
-name = "wasmparser"
-version = "0.87.0"
+version = "0.80.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c04e207cd2e8ecb6f9bd28a2cf3119b4c6bfeee6fe3a25cc1daf8041d00a875"
-dependencies = [
- "indexmap",
-]
+checksum = "449167e2832691a1bff24cde28d2804e90e09586a448c8e76984792c44334a6b"
 
 [[package]]
 name = "web-sys"
@@ -5041,6 +5855,15 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
+[[package]]
+name = "windows"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
+dependencies = [
+ "windows-targets 0.48.0",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.36.1"
@@ -5249,6 +6072,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "wsl"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dab7ac864710bdea6594becbea5b5050333cf34fefb0dc319567eb347950d4"
+
 [[package]]
 name = "xattr"
 version = "0.2.3"
@@ -5258,6 +6087,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "yansi"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
+
 [[package]]
 name = "zbus"
 version = "1.9.3"
diff --git a/Cargo.toml b/Cargo.toml
index 7bfd6ceec3..235919d094 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,13 +17,12 @@ rust-version = "1.65.0"
 license = "Apache-2.0"
 
 [workspace.dependencies]
-candid = "0.8.4"
-ic-agent = "0.24.1"
+candid = "0.9.0"
+ic-agent = "0.25.0"
 ic-asset = { path = "src/canisters/frontend/ic-asset" }
-ic-cdk = "0.8.0"
-ic-cdk-macros = "0.6.7"
-ic-identity-hsm = "0.24.1"
-ic-utils = "0.24.1"
+ic-cdk = "0.10.0"
+ic-identity-hsm = "0.25.0"
+ic-utils = "0.25.0"
 
 aes-gcm = "0.9.4"
 anyhow = "1.0.56"
@@ -68,19 +67,19 @@ url = "2.1.0"
 walkdir = "2.3.2"
 
 [patch.crates-io.ic-agent]
-version = "0.24.1"
+version = "0.25.0"
 git = "https://github.com/dfinity/agent-rs.git"
-rev = "b9c57f8bab23cc9936dca4560293ffe485471c6d"
+rev = "6d923cbc918852ef5bfaeb08e63c86580aa80ffe"
 
 [patch.crates-io.ic-identity-hsm]
-version = "0.24.1"
+version = "0.25.0"
 git = "https://github.com/dfinity/agent-rs.git"
-rev = "b9c57f8bab23cc9936dca4560293ffe485471c6d"
+rev = "6d923cbc918852ef5bfaeb08e63c86580aa80ffe"
 
 [patch.crates-io.ic-utils]
-version = "0.24.1"
+version = "0.25.0"
 git = "https://github.com/dfinity/agent-rs.git"
-rev = "b9c57f8bab23cc9936dca4560293ffe485471c6d"
+rev = "6d923cbc918852ef5bfaeb08e63c86580aa80ffe"
 
 [profile.release]
 panic = 'abort'
diff --git a/e2e/assets/inter/Cargo.toml b/e2e/assets/inter/Cargo.toml
index 12ee451940..8100b0d8bf 100644
--- a/e2e/assets/inter/Cargo.toml
+++ b/e2e/assets/inter/Cargo.toml
@@ -1,6 +1,7 @@
 [workspace]
-members = [
-    "src/counter_rs",
-    "src/inter_rs",
-    "src/inter2_rs",
-]
+members = ["src/counter_rs", "src/inter_rs", "src/inter2_rs"]
+
+[workspace.dependencies]
+candid = "0.9"
+ic-cdk = "0.10"
+ic-cdk-bindgen = "0.1"
diff --git a/e2e/assets/inter/src/counter_rs/Cargo.toml b/e2e/assets/inter/src/counter_rs/Cargo.toml
index 1abb082772..133044c092 100644
--- a/e2e/assets/inter/src/counter_rs/Cargo.toml
+++ b/e2e/assets/inter/src/counter_rs/Cargo.toml
@@ -11,7 +11,5 @@ path = "lib.rs"
 crate-type = ["cdylib"]
 
 [dependencies]
-candid = "0.7.4"
-ic-cdk = { version = "0.5" }
-ic-cdk-macros = { version = "0.5" }
-lazy_static = "1.4.0"
+candid.workspace = true
+ic-cdk.workspace = true
diff --git a/e2e/assets/inter/src/counter_rs/lib.rs b/e2e/assets/inter/src/counter_rs/lib.rs
index 57c0c31d39..fd679526a3 100644
--- a/e2e/assets/inter/src/counter_rs/lib.rs
+++ b/e2e/assets/inter/src/counter_rs/lib.rs
@@ -1,8 +1,6 @@
-use ic_cdk::{
-    api::call::ManualReply,
-    export::{candid, Principal},
-};
-use ic_cdk_macros::*;
+use candid::Principal;
+use ic_cdk::api::call::ManualReply;
+use ic_cdk::{init, query, update};
 use std::cell::{Cell, RefCell};
 
 thread_local! {
@@ -16,7 +14,7 @@ fn init() {
 }
 
 #[update]
-fn inc() -> () {
+fn inc() {
     ic_cdk::println!("{:?}", OWNER.with(|owner| owner.get()));
     COUNTER.with(|counter| *counter.borrow_mut() += 1u64);
 }
@@ -27,6 +25,6 @@ fn read() -> ManualReply<candid::Nat> {
 }
 
 #[update]
-fn write(input: candid::Nat) -> () {
+fn write(input: candid::Nat) {
     COUNTER.with(|counter| *counter.borrow_mut() = input);
 }
diff --git a/e2e/assets/inter/src/inter2_rs/Cargo.toml b/e2e/assets/inter/src/inter2_rs/Cargo.toml
index a8cfe47164..e6c1ae9792 100644
--- a/e2e/assets/inter/src/inter2_rs/Cargo.toml
+++ b/e2e/assets/inter/src/inter2_rs/Cargo.toml
@@ -11,6 +11,8 @@ path = "lib.rs"
 crate-type = ["cdylib"]
 
 [dependencies]
-candid = "0.7.4"
-ic-cdk = { version = "*" }
-ic-cdk-macros = { version = "*" }
+candid.workspace = true
+ic-cdk.workspace = true
+
+[build-dependencies]
+ic-cdk-bindgen.workspace = true
diff --git a/e2e/assets/inter/src/inter2_rs/build.rs b/e2e/assets/inter/src/inter2_rs/build.rs
new file mode 100644
index 0000000000..948b69034e
--- /dev/null
+++ b/e2e/assets/inter/src/inter2_rs/build.rs
@@ -0,0 +1,11 @@
+use ic_cdk_bindgen::{Builder, Config};
+use std::path::PathBuf;
+
+fn main() {
+    let manifest_dir =
+        PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").expect("Cannot find manifest dir"));
+    let counter = Config::new("inter_mo");
+    let mut builder = Builder::new();
+    builder.add(counter);
+    builder.build(Some(manifest_dir.join("declarations")));
+}
diff --git a/e2e/assets/inter/src/inter2_rs/lib.rs b/e2e/assets/inter/src/inter2_rs/lib.rs
index 8daae069b5..2781e825ac 100644
--- a/e2e/assets/inter/src/inter2_rs/lib.rs
+++ b/e2e/assets/inter/src/inter2_rs/lib.rs
@@ -1,20 +1,19 @@
-use ic_cdk::export::candid;
-use ic_cdk_macros::*;
+use ic_cdk::update;
 
-#[import(canister = "inter_mo")]
-struct CounterCanister;
+mod declarations;
+use declarations::inter_mo::inter_mo;
 
 #[update]
 async fn read() -> candid::Nat {
-    CounterCanister::read().await.0
+    inter_mo.read().await.unwrap().0
 }
 
 #[update]
-async fn inc() -> () {
-    CounterCanister::inc().await
+async fn inc() {
+    inter_mo.inc().await.unwrap()
 }
 
 #[update]
-async fn write(input: candid::Nat) -> () {
-    CounterCanister::write(input).await
+async fn write(input: candid::Nat) {
+    inter_mo.write(input).await.unwrap()
 }
diff --git a/e2e/assets/inter/src/inter_rs/Cargo.toml b/e2e/assets/inter/src/inter_rs/Cargo.toml
index 928092f8b6..89e99e8282 100644
--- a/e2e/assets/inter/src/inter_rs/Cargo.toml
+++ b/e2e/assets/inter/src/inter_rs/Cargo.toml
@@ -11,6 +11,8 @@ path = "lib.rs"
 crate-type = ["cdylib"]
 
 [dependencies]
-candid = "0.7.4"
-ic-cdk = { version = "*" }
-ic-cdk-macros = { version = "*" }
+candid.workspace = true
+ic-cdk.workspace = true
+
+[build-dependencies]
+ic-cdk-bindgen.workspace = true
diff --git a/e2e/assets/inter/src/inter_rs/build.rs b/e2e/assets/inter/src/inter_rs/build.rs
new file mode 100644
index 0000000000..9b9493ff07
--- /dev/null
+++ b/e2e/assets/inter/src/inter_rs/build.rs
@@ -0,0 +1,11 @@
+use ic_cdk_bindgen::{Builder, Config};
+use std::path::PathBuf;
+
+fn main() {
+    let manifest_dir =
+        PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").expect("Cannot find manifest dir"));
+    let counter = Config::new("counter_mo");
+    let mut builder = Builder::new();
+    builder.add(counter);
+    builder.build(Some(manifest_dir.join("declarations")));
+}
diff --git a/e2e/assets/inter/src/inter_rs/lib.rs b/e2e/assets/inter/src/inter_rs/lib.rs
index fd407bf339..9a2bb519ed 100644
--- a/e2e/assets/inter/src/inter_rs/lib.rs
+++ b/e2e/assets/inter/src/inter_rs/lib.rs
@@ -1,20 +1,19 @@
-use ic_cdk::export::candid;
-use ic_cdk_macros::*;
+use ic_cdk::update;
 
-#[import(canister = "counter_mo")]
-struct CounterCanister;
+mod declarations;
+use declarations::counter_mo::counter_mo;
 
 #[update]
 async fn read() -> candid::Nat {
-    CounterCanister::read().await.0
+    counter_mo.read().await.unwrap().0
 }
 
 #[update]
 async fn inc() -> () {
-    CounterCanister::inc().await
+    counter_mo.inc().await.unwrap()
 }
 
 #[update]
 async fn write(input: candid::Nat) -> () {
-    CounterCanister::write(input).await
+    counter_mo.write(input).await.unwrap()
 }
diff --git a/e2e/assets/rust_deps/src/rust_deps/Cargo.toml b/e2e/assets/rust_deps/src/rust_deps/Cargo.toml
index 02b6cae869..bd7efb009d 100644
--- a/e2e/assets/rust_deps/src/rust_deps/Cargo.toml
+++ b/e2e/assets/rust_deps/src/rust_deps/Cargo.toml
@@ -10,5 +10,8 @@ path = "lib.rs"
 crate-type = ["cdylib"]
 
 [dependencies]
-ic-cdk = "0.5"
-ic-cdk-macros = "0.5"
+candid = "0.9"
+ic-cdk = "0.10"
+
+[build-dependencies]
+ic-cdk-bindgen = "0.1"
diff --git a/e2e/assets/rust_deps/src/rust_deps/build.rs b/e2e/assets/rust_deps/src/rust_deps/build.rs
new file mode 100644
index 0000000000..70ceacb120
--- /dev/null
+++ b/e2e/assets/rust_deps/src/rust_deps/build.rs
@@ -0,0 +1,11 @@
+use ic_cdk_bindgen::{Builder, Config};
+use std::path::PathBuf;
+
+fn main() {
+    let manifest_dir =
+        PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").expect("Cannot find manifest dir"));
+    let counter = Config::new("multiply_deps");
+    let mut builder = Builder::new();
+    builder.add(counter);
+    builder.build(Some(manifest_dir.join("declarations")));
+}
diff --git a/e2e/assets/rust_deps/src/rust_deps/lib.rs b/e2e/assets/rust_deps/src/rust_deps/lib.rs
index b5f4d16d21..409cb797ba 100644
--- a/e2e/assets/rust_deps/src/rust_deps/lib.rs
+++ b/e2e/assets/rust_deps/src/rust_deps/lib.rs
@@ -1,11 +1,10 @@
-use ic_cdk_macros::*;
-use ic_cdk::export::candid;
+use ic_cdk::update;
 
-#[import(canister = "multiply_deps")]
-struct CounterCanister;
+mod declarations;
+use declarations::multiply_deps::multiply_deps;
 
 // Inter-canister call can only be from a update call
 #[update]
 async fn read() -> candid::Nat {
-    CounterCanister::read().await.0
+    multiply_deps.read().await.unwrap().0
 }
diff --git a/e2e/assets/warning/main.mo b/e2e/assets/warning/main.mo
index a4054e20c3..0dfcf8308d 100644
--- a/e2e/assets/warning/main.mo
+++ b/e2e/assets/warning/main.mo
@@ -1,4 +1,6 @@
-func returnsLargeTuple() : (Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat) = (1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20);
-func wantsLargeTuple(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20) = ();
-wantsLargeTuple(returnsLargeTuple());
+actor {
+  func returnsLargeTuple() : (Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat,Nat) = (1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20);
+  func wantsLargeTuple(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20) = ();
+  let _ = wantsLargeTuple(returnsLargeTuple());
+}
 
diff --git a/e2e/tests-dfx/assetscanister.bash b/e2e/tests-dfx/assetscanister.bash
index e28552267c..0f68a466c9 100644
--- a/e2e/tests-dfx/assetscanister.bash
+++ b/e2e/tests-dfx/assetscanister.bash
@@ -109,14 +109,14 @@ check_permission_failure() {
   dfx identity get-principal --identity prepare
   dfx canister call e2e_project_frontend list_permitted '(record { permission = variant { Commit }; })'
   assert_command dfx deploy e2e_project_frontend --by-proposal --identity prepare
-  assert_contains "Proposed commit of batch 2 with evidence 4301263f1fcc0d19ef92cfb6774c4da92bf1a9d2002a293a9d95d97819c02958.  Either commit it by proposal, or delete it."
+  assert_contains "Proposed commit of batch 2 with evidence 164fcc4d933ff9992ab6ab909a4bf350010fa0f4a3e1e247bfc679d3f45254e1.  Either commit it by proposal, or delete it."
 
   assert_command_fail dfx deploy e2e_project_frontend --by-proposal --identity prepare
   assert_contains "Batch 2 is already proposed.  Delete or execute it to propose another."
 
   assert_command dfx deploy e2e_project_frontend --compute-evidence --identity anonymous
   # shellcheck disable=SC2154
-  assert_eq "4301263f1fcc0d19ef92cfb6774c4da92bf1a9d2002a293a9d95d97819c02958" "$stdout"
+  assert_eq "164fcc4d933ff9992ab6ab909a4bf350010fa0f4a3e1e247bfc679d3f45254e1" "$stdout"
 
   ID=$(dfx canister id e2e_project_frontend)
   PORT=$(get_webserver_port)
@@ -136,9 +136,9 @@ check_permission_failure() {
   assert_command_fail dfx canister call e2e_project_frontend commit_proposed_batch "$wrong_commit_args" --identity commit
   assert_match "batch computed evidence .* does not match presented evidence"
 
-  commit_args='(record { batch_id = 2; evidence = blob "\43\01\26\3f\1f\cc\0d\19\ef\92\cf\b6\77\4c\4d\a9\2b\f1\a9\d2\00\2a\29\3a\9d\95\d9\78\19\c0\29\58" } )'
+  commit_args='(record { batch_id = 2; evidence = blob "\16\4f\cc\4d\93\3f\f9\99\2a\b6\ab\90\9a\4b\f3\50\01\0f\a0\f4\a3\e1\e2\47\bf\c6\79\d3\f4\52\54\e1" } )'
   assert_command dfx canister call e2e_project_frontend validate_commit_proposed_batch "$commit_args" --identity commit
-  assert_contains "commit proposed batch 2 with evidence 4301"
+  assert_contains "commit proposed batch 2 with evidence 164f"
   assert_command dfx canister call e2e_project_frontend commit_proposed_batch "$commit_args" --identity commit
   assert_eq "()"
 
@@ -188,11 +188,11 @@ check_permission_failure() {
   dfx identity get-principal --identity prepare
   dfx canister call e2e_project_frontend list_permitted '(record { permission = variant { Commit }; })'
   assert_command dfx deploy e2e_project_frontend --by-proposal --identity prepare
-  assert_contains "Proposed commit of batch 2 with evidence 1b45c8b1d0deec88ac032590e0f1cd9ab407f796e827aac880f4ffb035fdc200.  Either commit it by proposal, or delete it."
+  assert_contains "Proposed commit of batch 2 with evidence 9b72eee7f0d7af2a9b41233c341b1caa0c905ef91405f5f513ffb58f68afee5b.  Either commit it by proposal, or delete it."
 
   assert_command dfx deploy e2e_project_frontend --compute-evidence --identity anonymous
   # shellcheck disable=SC2154
-  assert_eq "1b45c8b1d0deec88ac032590e0f1cd9ab407f796e827aac880f4ffb035fdc200" "$stdout"
+  assert_eq "9b72eee7f0d7af2a9b41233c341b1caa0c905ef91405f5f513ffb58f68afee5b" "$stdout"
 
   ID=$(dfx canister id e2e_project_frontend)
   PORT=$(get_webserver_port)
@@ -200,9 +200,9 @@ check_permission_failure() {
   assert_command_fail curl --fail -vv http://localhost:"$PORT"/sample-asset.txt?canisterId="$ID"
   assert_contains "The requested URL returned error: 404"
 
-  commit_args='(record { batch_id = 2; evidence = blob "\1b\45\c8\b1\d0\de\ec\88\ac\03\25\90\e0\f1\cd\9a\b4\07\f7\96\e8\27\aa\c8\80\f4\ff\b0\35\fd\c2\00" } )'
+  commit_args='(record { batch_id = 2; evidence = blob "\9b\72\ee\e7\f0\d7\af\2a\9b\41\23\3c\34\1b\1c\aa\0c\90\5e\f9\14\05\f5\f5\13\ff\b5\8f\68\af\ee\5b" } )'
   assert_command dfx canister call e2e_project_frontend validate_commit_proposed_batch "$commit_args" --identity commit
-  assert_contains "commit proposed batch 2 with evidence 1b45c8b1d0deec88ac032590e0f1cd9ab407f796e827aac880f4ffb035fdc200"
+  assert_contains "commit proposed batch 2 with evidence 9b72eee7f0d7af2a9b41233c341b1caa0c905ef91405f5f513ffb58f68afee5b"
   assert_command dfx canister call e2e_project_frontend commit_proposed_batch "$commit_args" --identity commit
   assert_eq "()"
 
@@ -1359,20 +1359,20 @@ CHERRIES" "$stdout"
   "cache": {
     "max_age": 2000
   },
-  "allow_raw_access": false
+  "allow_raw_access": true
 }'
     assert_match 'WARN: 4 unmatched configurations in .*/src/e2e_project_frontend/assets/somedir/.ic-assets.json config file:'
     assert_contains 'WARN: {
   "match": "nevermatchme",
   "headers": {},
   "ignore": false,
-  "allow_raw_access": false
+  "allow_raw_access": true
 }
 WARN: {
   "match": "nevermatchmetoo",
   "headers": {},
   "ignore": false,
-  "allow_raw_access": false
+  "allow_raw_access": true
 }
 WARN: {
   "match": "non-matcher",
@@ -1380,7 +1380,7 @@ WARN: {
     "x-header": "x-value"
   },
   "ignore": false,
-  "allow_raw_access": false
+  "allow_raw_access": true
 }'
     # splitting this up into two checks, because the order is different on macos vs ubuntu
     assert_contains 'WARN: {
@@ -1389,7 +1389,7 @@ WARN: {
     "x-header": "x-value"
   },
   "ignore": false,
-  "allow_raw_access": false
+  "allow_raw_access": true
 }'
 }
 
@@ -1417,7 +1417,7 @@ WARN: {
   record {
     headers = opt vec { record { "x-key"; "x-value" } };
     is_aliased = opt true;
-    allow_raw_access = opt false;
+    allow_raw_access = opt true;
     max_age = opt (2_000 : nat64);
   },
 )'
@@ -1437,7 +1437,7 @@ WARN: {
   record {
     headers = opt vec { record { "x-key"; "x-value" } };
     is_aliased = opt true;
-    allow_raw_access = opt false;
+    allow_raw_access = opt true;
     max_age = opt (5 : nat64);
   },
 )'
@@ -1450,7 +1450,7 @@ WARN: {
   record {
     headers = opt vec { record { "new-key"; "new-value" } };
     is_aliased = opt true;
-    allow_raw_access = opt false;
+    allow_raw_access = opt true;
     max_age = opt (5 : nat64);
   },
 )'
@@ -1546,7 +1546,7 @@ WARN: {
   record {
     headers = null;
     is_aliased = null;
-    allow_raw_access = opt false;
+    allow_raw_access = opt true;
     max_age = null;
   },
 )'
diff --git a/nix/sources.json b/nix/sources.json
index 5569ec4e13..affd1ee71f 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -127,7 +127,7 @@
     "ic-starter-x86_64-darwin": {
         "builtin": false,
         "rev": "0ab9178c6684f122ae713928b3664c33a697e9c4",
-        "sha256": "0zy6bml4lmca7pyvgb3q5rqmsm5d87c0y9j9i7y7n39qnxhw4lm2",
+        "sha256": "0pf094v4v09xi94bhirfkz3jbijiax4asnrib4a12yw5qbj0sb87",
         "type": "file",
         "url": "https://download.dfinity.systems/ic/0ab9178c6684f122ae713928b3664c33a697e9c4/openssl-static-binaries/x86_64-darwin/ic-starter.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/ic-starter.gz"
@@ -188,7 +188,7 @@
         "builtin": false,
         "description": "The replica binary. It must be updated together with the canister_sandbox binary.",
         "rev": "0ab9178c6684f122ae713928b3664c33a697e9c4",
-        "sha256": "0vskwrbgdxga7pwc3wknmvprhrm1wxfb6q4dn4z6xcccd8jw2lgj",
+        "sha256": "08zw6imbk6cf6h15jrrdjzd4dzqy3wiqsfg6rrxivanqjp12kavy",
         "type": "file",
         "url": "https://download.dfinity.systems/ic/0ab9178c6684f122ae713928b3664c33a697e9c4/openssl-static-binaries/x86_64-darwin/replica.gz",
         "url_template": "https://download.dfinity.systems/ic/<rev>/openssl-static-binaries/x86_64-darwin/replica.gz"
diff --git a/src/canisters/frontend/ic-asset/src/asset/config.rs b/src/canisters/frontend/ic-asset/src/asset/config.rs
index 8068d0928c..14cd34e89a 100644
--- a/src/canisters/frontend/ic-asset/src/asset/config.rs
+++ b/src/canisters/frontend/ic-asset/src/asset/config.rs
@@ -24,7 +24,7 @@ pub struct AssetConfig {
     pub(crate) headers: Option<HeadersConfig>,
     pub(crate) ignore: Option<bool>,
     pub(crate) enable_aliasing: Option<bool>,
-    #[derivative(Default(value = "Some(false)"))]
+    #[derivative(Default(value = "Some(true)"))]
     pub(crate) allow_raw_access: Option<bool>,
 }
 
@@ -36,7 +36,7 @@ pub(crate) struct CacheConfig {
 }
 
 fn default_raw_access() -> Option<bool> {
-    Some(false)
+    Some(true)
 }
 
 /// A single configuration object, from `.ic-assets.json` config file
@@ -932,7 +932,7 @@ mod with_tempdir {
                 .get_asset_config(assets_dir.join("index.html").as_path())
                 .unwrap(),
             AssetConfig {
-                allow_raw_access: Some(false),
+                allow_raw_access: Some(true),
                 ..Default::default()
             },
         );
diff --git a/src/canisters/frontend/ic-certified-assets/Cargo.toml b/src/canisters/frontend/ic-certified-assets/Cargo.toml
index 59f8be0453..c52d0c0b42 100644
--- a/src/canisters/frontend/ic-certified-assets/Cargo.toml
+++ b/src/canisters/frontend/ic-certified-assets/Cargo.toml
@@ -13,15 +13,19 @@ keywords = ["internet-computer", "dfinity"]
 
 [dependencies]
 base64.workspace = true
-candid = { workspace = true }
+candid.workspace = true
 hex.workspace = true
 ic-cdk.workspace = true
-ic-cdk-macros.workspace = true
-ic-certified-map = "0.3"
-ic-response-verification = "0.1.0"
+ic-certified-map = "0.3.2"
+ic-response-verification = "0.3.0"
+ic-representation-independent-hash = "0.3.0"
 itertools.workspace = true
 num-traits.workspace = true
 serde.workspace = true
 serde_bytes.workspace = true
 serde_cbor.workspace = true
 sha2.workspace = true
+
+[dev-dependencies]
+ic-response-verification-test-utils = { git = "https://github.com/dfinity/response-verification.git", rev = "d421c1bf01806425cbad4b977bd1499a259f3506" }
+ic-crypto-tree-hash = { git = "https://github.com/dfinity/ic.git", rev = "a533346f63f4091eb64692891de0d5b2ffd5b22a" }
diff --git a/src/canisters/frontend/ic-certified-assets/src/asset_certification/mod.rs b/src/canisters/frontend/ic-certified-assets/src/asset_certification/mod.rs
index 6eb65ed207..31f31d4317 100644
--- a/src/canisters/frontend/ic-certified-assets/src/asset_certification/mod.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/asset_certification/mod.rs
@@ -14,7 +14,7 @@ use sha2::Digest;
 pub mod tree;
 pub mod types;
 pub use ic_certified_map::HashTree;
-pub use ic_response_verification::hash::Value;
+use ic_representation_independent_hash::Value;
 
 pub type CertifiedResponses = NestedTree<NestedTreeKey, Vec<u8>>;
 
diff --git a/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/certification.rs b/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/certification.rs
index 5190029ea3..a6f8757129 100644
--- a/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/certification.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/certification.rs
@@ -1,7 +1,7 @@
 use std::borrow::Borrow;
 
 use candid::{CandidType, Deserialize};
-use ic_response_verification::hash::Value;
+use ic_representation_independent_hash::Value;
 use serde_cbor::ser::IoWrite;
 use serde_cbor::Serializer;
 use sha2::Digest;
diff --git a/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/http.rs b/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/http.rs
index a6478a89c1..7392a2d250 100644
--- a/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/http.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/http.rs
@@ -3,9 +3,9 @@ use crate::{
     state_machine::{encoding_certification_order, Asset, AssetEncoding},
 };
 
-use candid::{CandidType, Deserialize, Func, Nat};
+use candid::{define_function, CandidType, Deserialize, Nat};
 use ic_certified_map::Hash;
-use ic_response_verification::hash::{representation_independent_hash, Value};
+use ic_representation_independent_hash::{representation_independent_hash, Value};
 use serde_bytes::ByteBuf;
 use sha2::Digest;
 
@@ -47,10 +47,11 @@ pub struct StreamingCallbackToken {
     pub sha256: Option<ByteBuf>,
 }
 
+define_function!(pub CallbackFunc : (StreamingCallbackToken) -> (StreamingCallbackHttpResponse) query);
 #[derive(Clone, Debug, CandidType, Deserialize)]
 pub enum StreamingStrategy {
     Callback {
-        callback: Func,
+        callback: CallbackFunc,
         token: StreamingCallbackToken,
     },
 }
@@ -163,7 +164,7 @@ impl HttpResponse {
         key: &str,
         chunk_index: usize,
         certificate_header: Option<&HeaderField>,
-        callback: &Func,
+        callback: &CallbackFunc,
         etags: &[Hash],
         cert_version: u16,
     ) -> HttpResponse {
@@ -210,7 +211,7 @@ impl HttpResponse {
         key: &str,
         chunk_index: usize,
         certificate_header: Option<&HeaderField>,
-        callback: &Func,
+        callback: &CallbackFunc,
         etags: &[Hash],
         cert_version: u16,
     ) -> Option<HttpResponse> {
diff --git a/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/rc_bytes.rs b/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/rc_bytes.rs
index e9e21561d4..a12d20f61a 100644
--- a/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/rc_bytes.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/asset_certification/types/rc_bytes.rs
@@ -1,6 +1,6 @@
 //! This module contains an implementation of [RcBytes], a reference-counted byte array.
-use ic_cdk::export::candid::{
-    types::{internal::Type, Serializer},
+use candid::{
+    types::{Serializer, Type, TypeInner},
     CandidType, Deserialize,
 };
 use serde::de::Deserializer;
@@ -14,7 +14,7 @@ pub struct RcBytes(Rc<ByteBuf>);
 
 impl CandidType for RcBytes {
     fn _ty() -> Type {
-        Type::Vec(Box::new(Type::Nat8))
+        TypeInner::Vec(TypeInner::Nat8.into()).into()
     }
 
     fn idl_serialize<S>(&self, serializer: S) -> Result<(), S::Error>
diff --git a/src/canisters/frontend/ic-certified-assets/src/lib.rs b/src/canisters/frontend/ic-certified-assets/src/lib.rs
index 9cbac88bf4..34b7293f3a 100644
--- a/src/canisters/frontend/ic-certified-assets/src/lib.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/lib.rs
@@ -11,7 +11,8 @@ mod tests;
 pub use crate::state_machine::StableState;
 use crate::{
     asset_certification::types::http::{
-        HttpRequest, HttpResponse, StreamingCallbackHttpResponse, StreamingCallbackToken,
+        CallbackFunc, HttpRequest, HttpResponse, StreamingCallbackHttpResponse,
+        StreamingCallbackToken,
     },
     state_machine::{AssetDetails, CertifiedTree, EncodedAsset, State},
     types::*,
@@ -19,7 +20,7 @@ use crate::{
 use asset_certification::types::{certification::AssetKey, rc_bytes::RcBytes};
 use candid::{candid_method, Principal};
 use ic_cdk::api::{call::ManualReply, caller, data_certificate, set_certified_data, time, trap};
-use ic_cdk_macros::{query, update};
+use ic_cdk::{query, update};
 use serde_bytes::ByteBuf;
 use std::cell::RefCell;
 
@@ -316,10 +317,7 @@ fn http_request(req: HttpRequest) -> HttpResponse {
         s.borrow().http_request(
             req,
             &certificate,
-            candid::Func {
-                method: "http_request_streaming_callback".to_string(),
-                principal: ic_cdk::id(),
-            },
+            CallbackFunc::new(ic_cdk::id(), "http_request_streaming_callback".to_string()),
         )
     })
 }
diff --git a/src/canisters/frontend/ic-certified-assets/src/state_machine.rs b/src/canisters/frontend/ic-certified-assets/src/state_machine.rs
index 0f9d9f6c91..8bce06e1ff 100644
--- a/src/canisters/frontend/ic-certified-assets/src/state_machine.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/state_machine.rs
@@ -13,8 +13,8 @@ use crate::{
             },
             http::{
                 build_ic_certificate_expression_from_headers_and_encoding,
-                build_ic_certificate_expression_header, response_hash, HttpRequest, HttpResponse,
-                StreamingCallbackHttpResponse, StreamingCallbackToken, FALLBACK_FILE,
+                build_ic_certificate_expression_header, response_hash, CallbackFunc, HttpRequest,
+                HttpResponse, StreamingCallbackHttpResponse, StreamingCallbackToken, FALLBACK_FILE,
             },
             rc_bytes::RcBytes,
         },
@@ -25,9 +25,9 @@ use crate::{
     url_decode::url_decode,
 };
 
-use candid::{CandidType, Deserialize, Func, Int, Nat, Principal};
+use candid::{CandidType, Deserialize, Int, Nat, Principal};
 use ic_certified_map::{AsHashTree, Hash};
-use ic_response_verification::hash::Value;
+use ic_representation_independent_hash::Value;
 use num_traits::ToPrimitive;
 use serde::Serialize;
 use serde_bytes::ByteBuf;
@@ -245,7 +245,7 @@ pub struct StableState {
 
 impl Asset {
     fn allow_raw_access(&self) -> bool {
-        self.allow_raw_access.unwrap_or(false)
+        self.allow_raw_access.unwrap_or(true)
     }
 
     fn update_ic_certificate_expressions(&mut self) {
@@ -802,7 +802,7 @@ impl State {
         path: &str,
         requested_encodings: Vec<String>,
         chunk_index: usize,
-        callback: Func,
+        callback: CallbackFunc,
         etags: Vec<Hash>,
         req: HttpRequest,
     ) -> HttpResponse {
@@ -864,7 +864,7 @@ impl State {
         &self,
         req: HttpRequest,
         certificate: &[u8],
-        callback: Func,
+        callback: CallbackFunc,
     ) -> HttpResponse {
         let mut encodings = vec![];
         // waiting for https://dfinity.atlassian.net/browse/BOUN-446
diff --git a/src/canisters/frontend/ic-certified-assets/src/tests.rs b/src/canisters/frontend/ic-certified-assets/src/tests.rs
index 10d4a5a734..9f6db27758 100644
--- a/src/canisters/frontend/ic-certified-assets/src/tests.rs
+++ b/src/canisters/frontend/ic-certified-assets/src/tests.rs
@@ -1,6 +1,8 @@
 use std::collections::HashMap;
 
-use crate::asset_certification::types::http::{HttpRequest, HttpResponse, StreamingStrategy};
+use crate::asset_certification::types::http::{
+    CallbackFunc, HttpRequest, HttpResponse, StreamingStrategy,
+};
 use crate::state_machine::{StableState, State, BATCH_EXPIRY_NANOS};
 use crate::types::{
     AssetProperties, BatchId, BatchOperation, CommitBatchArguments, CommitProposedBatchArguments,
@@ -15,11 +17,8 @@ fn some_principal() -> Principal {
     Principal::from_text("ryjl3-tyaaa-aaaaa-aaaba-cai").unwrap()
 }
 
-fn unused_callback() -> candid::Func {
-    candid::Func {
-        method: "unused".to_string(),
-        principal: some_principal(),
-    }
+fn unused_callback() -> CallbackFunc {
+    CallbackFunc::new(some_principal(), "unused".to_string())
 }
 
 struct AssetBuilder {
@@ -887,10 +886,7 @@ fn uses_streaming_for_multichunk_assets() {
             .with_encoding("identity", vec![INDEX_BODY_CHUNK_1, INDEX_BODY_CHUNK_2])],
     );
 
-    let streaming_callback = candid::Func {
-        method: "stream".to_string(),
-        principal: some_principal(),
-    };
+    let streaming_callback = CallbackFunc::new(some_principal(), "stream".to_string());
     let response = state.http_request(
         RequestBuilder::get("/index.html")
             .with_header("Accept-Encoding", "gzip,identity")
@@ -1521,7 +1517,9 @@ mod allow_raw_access {
             "https://a-b-c.ic0.app/page"
         );
 
-        state.create_test_asset(AssetBuilder::new("/page2.html", "text/html"));
+        state.create_test_asset(
+            AssetBuilder::new("/page2.html", "text/html").with_allow_raw_access(Some(false)),
+        );
         let response = state.fake_http_request("a-b-c.raw.icp0.io", "/page2");
         dbg!(&response);
         assert_eq!(response.status_code, 308);
@@ -1530,7 +1528,9 @@ mod allow_raw_access {
             "https://a-b-c.icp0.io/page2"
         );
 
-        state.create_test_asset(AssetBuilder::new("/index.html", "text/html"));
+        state.create_test_asset(
+            AssetBuilder::new("/index.html", "text/html").with_allow_raw_access(Some(false)),
+        );
         let response = state.fake_http_request("a-b-c.raw.icp0.io", "/");
         dbg!(&response);
         assert_eq!(response.status_code, 308);
@@ -1588,9 +1588,8 @@ mod allow_raw_access {
 
 #[cfg(test)]
 mod certificate_expression {
-    use ic_response_verification::hash::Value;
-
     use crate::asset_certification::types::http::build_ic_certificate_expression_from_headers_and_encoding;
+    use ic_representation_independent_hash::Value;
 
     use super::*;
 
diff --git a/src/canisters/frontend/ic-frontend-canister/Cargo.toml b/src/canisters/frontend/ic-frontend-canister/Cargo.toml
index 2858af5728..5947ab793d 100644
--- a/src/canisters/frontend/ic-frontend-canister/Cargo.toml
+++ b/src/canisters/frontend/ic-frontend-canister/Cargo.toml
@@ -16,4 +16,3 @@ crate-type = ["cdylib"]
 [dependencies]
 ic-certified-assets = { path = "../ic-certified-assets" }
 ic-cdk.workspace = true
-ic-cdk-macros.workspace = true
diff --git a/src/canisters/frontend/ic-frontend-canister/src/lib.rs b/src/canisters/frontend/ic-frontend-canister/src/lib.rs
index 00abc170c4..ac0cd9d0c7 100644
--- a/src/canisters/frontend/ic-frontend-canister/src/lib.rs
+++ b/src/canisters/frontend/ic-frontend-canister/src/lib.rs
@@ -1,4 +1,4 @@
-use ic_cdk_macros::{init, post_upgrade, pre_upgrade};
+use ic_cdk::{init, post_upgrade, pre_upgrade};
 
 #[init]
 fn init() {
diff --git a/src/dfx/Cargo.toml b/src/dfx/Cargo.toml
index e358baee7c..e4a35a4f9d 100644
--- a/src/dfx/Cargo.toml
+++ b/src/dfx/Cargo.toml
@@ -58,7 +58,7 @@ ic-agent = { workspace = true, features = ["reqwest"] }
 ic-asset.workspace = true
 ic-identity-hsm = { workspace = true }
 ic-utils = { workspace = true }
-ic-wasm = "0.3.6"
+ic-wasm = "0.4.0"
 indicatif = "0.16.0"
 itertools.workspace = true
 keyring.workspace = true
@@ -107,8 +107,7 @@ time = { workspace = true, features = [
 tokio = { workspace = true, features = ["fs"] }
 url.workspace = true
 walkdir.workspace = true
-walrus = "0.19.0"
-wasmparser = "0.87.0"
+walrus = "0.20.1"
 which = "4.2.5"
 
 [target.'cfg(windows)'.dependencies]
diff --git a/src/dfx/assets/new_project_node_files/src/__project_name___frontend/assets/.ic-assets.json5 b/src/dfx/assets/new_project_node_files/src/__project_name___frontend/assets/.ic-assets.json5
index 8dc76d1ee6..ccdea94aa1 100644
--- a/src/dfx/assets/new_project_node_files/src/__project_name___frontend/assets/.ic-assets.json5
+++ b/src/dfx/assets/new_project_node_files/src/__project_name___frontend/assets/.ic-assets.json5
@@ -24,7 +24,7 @@
             //   See: https://github.com/WebAssembly/content-security-policy/blob/main/proposals/CSP.md.
             // - We added img-src data: because data: images are used often.
             // - frame-ancestors: none mitigates clickjacking attacks. See https://owasp.org/www-community/attacks/Clickjacking.
-            "Content-Security-Policy": "default-src 'self';script-src 'self' 'unsafe-eval';connect-src 'self' https://icp0.io https://*.icp0.io;img-src 'self' data:;style-src * 'unsafe-inline';style-src-elem * 'unsafe-inline';font-src *;object-src 'none';base-uri 'self';frame-ancestors 'none';form-action 'self';upgrade-insecure-requests;",
+            "Content-Security-Policy": "default-src 'self';script-src 'self' 'unsafe-eval';connect-src 'self' https://icp0.io https://*.icp0.io https://icp-api.io;img-src 'self' data:;style-src * 'unsafe-inline';style-src-elem * 'unsafe-inline';font-src *;object-src 'none';base-uri 'self';frame-ancestors 'none';form-action 'self';upgrade-insecure-requests;",
 
             // Security: The permissions policy disables all features for security reasons. If your site needs such permissions, activate them.
             // To configure permissions go here https://www.permissionspolicy.com/
@@ -50,7 +50,8 @@
             // See: https://owasp.org/www-community/attacks/xss/
             "X-XSS-Protection": "1; mode=block"
         },
-        // redirect all requests from .raw.icp0.io to .icp0.io (this redirection is the default)
-        "allow_raw_access": false
+        // Set the allow_raw_access field to false to redirect all requests from .raw.icp0.io to .icp0.io
+        // The default behavior is to allow raw access.
+        // "allow_raw_access": true
     },
 ]
diff --git a/src/dfx/assets/new_project_node_files/src/__project_name___frontend/src/.ic-assets.json5 b/src/dfx/assets/new_project_node_files/src/__project_name___frontend/src/.ic-assets.json5
index 8dc76d1ee6..ccdea94aa1 100644
--- a/src/dfx/assets/new_project_node_files/src/__project_name___frontend/src/.ic-assets.json5
+++ b/src/dfx/assets/new_project_node_files/src/__project_name___frontend/src/.ic-assets.json5
@@ -24,7 +24,7 @@
             //   See: https://github.com/WebAssembly/content-security-policy/blob/main/proposals/CSP.md.
             // - We added img-src data: because data: images are used often.
             // - frame-ancestors: none mitigates clickjacking attacks. See https://owasp.org/www-community/attacks/Clickjacking.
-            "Content-Security-Policy": "default-src 'self';script-src 'self' 'unsafe-eval';connect-src 'self' https://icp0.io https://*.icp0.io;img-src 'self' data:;style-src * 'unsafe-inline';style-src-elem * 'unsafe-inline';font-src *;object-src 'none';base-uri 'self';frame-ancestors 'none';form-action 'self';upgrade-insecure-requests;",
+            "Content-Security-Policy": "default-src 'self';script-src 'self' 'unsafe-eval';connect-src 'self' https://icp0.io https://*.icp0.io https://icp-api.io;img-src 'self' data:;style-src * 'unsafe-inline';style-src-elem * 'unsafe-inline';font-src *;object-src 'none';base-uri 'self';frame-ancestors 'none';form-action 'self';upgrade-insecure-requests;",
 
             // Security: The permissions policy disables all features for security reasons. If your site needs such permissions, activate them.
             // To configure permissions go here https://www.permissionspolicy.com/
@@ -50,7 +50,8 @@
             // See: https://owasp.org/www-community/attacks/xss/
             "X-XSS-Protection": "1; mode=block"
         },
-        // redirect all requests from .raw.icp0.io to .icp0.io (this redirection is the default)
-        "allow_raw_access": false
+        // Set the allow_raw_access field to false to redirect all requests from .raw.icp0.io to .icp0.io
+        // The default behavior is to allow raw access.
+        // "allow_raw_access": true
     },
 ]
diff --git a/src/dfx/src/commands/remote/generate_binding.rs b/src/dfx/src/commands/remote/generate_binding.rs
index 35722f9023..badf37ddf4 100644
--- a/src/dfx/src/commands/remote/generate_binding.rs
+++ b/src/dfx/src/commands/remote/generate_binding.rs
@@ -76,7 +76,10 @@ pub fn exec(env: &dyn Environment, opts: GenerateBindingOpts) -> DfxResult {
                 let bindings = if extension == "mo" {
                     Some(candid::bindings::motoko::compile(&type_env, &did_types))
                 } else if extension == "rs" {
-                    Some(candid::bindings::rust::compile(&type_env, &did_types))
+                    let config = candid::bindings::rust::Config::new();
+                    Some(candid::bindings::rust::compile(
+                        &config, &type_env, &did_types,
+                    ))
                 } else if extension == "js" {
                     Some(candid::bindings::javascript::compile(&type_env, &did_types))
                 } else if extension == "ts" {
diff --git a/src/dfx/src/lib/models/canister.rs b/src/dfx/src/lib/models/canister.rs
index 3d36367920..47ed47457c 100644
--- a/src/dfx/src/lib/models/canister.rs
+++ b/src/dfx/src/lib/models/canister.rs
@@ -129,7 +129,7 @@ impl Canister {
         // optimize or shrink
         if let Some(level) = info.get_optimize() {
             trace!(logger, "Optimizing WASM at level {}", level);
-            ic_wasm::shrink::shrink_with_wasm_opt(&mut m, &level.to_string())
+            ic_wasm::shrink::shrink_with_wasm_opt(&mut m, &level.to_string(), false)
                 .context("Failed to optimize the WASM module.")?;
             modified = true;
         } else if info.get_shrink() == Some(true)
@@ -314,11 +314,12 @@ impl Canister {
 
 fn separate_candid(path: &Path) -> DfxResult<(String, String)> {
     let (env, actor) = check_candid_file(path)?;
-    if let Some(candid::types::internal::Type::Class(args, ty)) = actor {
+    let actor = actor.ok_or_else(|| anyhow!("provided candid file contains no main service"))?;
+    if let candid::types::internal::TypeInner::Class(args, ty) = actor.as_ref() {
         use candid::bindings::candid::pp_ty;
         use candid::pretty::{concat, enclose};
 
-        let actor = Some(*ty);
+        let actor = Some(ty.clone());
         let service_did = candid::bindings::candid::compile(&env, &actor);
         let doc = concat(args.iter().map(pp_ty), ",");
         let init_args = enclose("(", doc, ")").pretty(80).to_string();
diff --git a/src/dfx/src/util/mod.rs b/src/dfx/src/util/mod.rs
index b1eb415373..45e3a5e510 100644
--- a/src/dfx/src/util/mod.rs
+++ b/src/dfx/src/util/mod.rs
@@ -6,9 +6,9 @@ use anyhow::{bail, Context};
 use backoff::backoff::Backoff;
 use backoff::ExponentialBackoff;
 use bytes::Bytes;
-use candid::parser::typing::{pretty_check_file, TypeEnv};
-use candid::types::{Function, Type};
-use candid::{parser::value::IDLValue, IDLArgs};
+use candid::parser::typing::pretty_check_file;
+use candid::types::{value::IDLValue, Function, Type, TypeEnv, TypeInner};
+use candid::IDLArgs;
 use fn_error_context::context;
 use hyper_rustls::ConfigBuilderExt;
 #[cfg(unix)]
@@ -131,8 +131,8 @@ pub fn get_candid_type(
 pub fn get_candid_init_type(idl_path: &std::path::Path) -> Option<(TypeEnv, Function)> {
     let (env, ty) = check_candid_file(idl_path).ok()?;
     let actor = ty?;
-    let args = match actor {
-        Type::Class(args, _) => args,
+    let args = match actor.as_ref() {
+        TypeInner::Class(args, _) => args.clone(),
         _ => vec![],
     };
     let res = Function {
@@ -195,7 +195,11 @@ pub fn blob_from_arguments(
                     } else if func.args.is_empty() {
                         use candid::Encode;
                         Encode!()
-                    } else if func.args.iter().all(|t| matches!(t, Type::Opt(_))) {
+                    } else if func
+                        .args
+                        .iter()
+                        .all(|t| matches!(t.as_ref(), TypeInner::Opt(_)))
+                    {
                         // If the user provided no arguments, and if all the expected arguments are
                         // optional, then use null values.
                         let nulls = vec![IDLValue::Null; func.args.len()];
@@ -241,7 +245,7 @@ pub fn fuzzy_parse_argument(
     let args = arg_str.parse::<IDLArgs>().or_else(|_| {
         if types.len() == 1 && !is_candid_format {
             let is_quote = first_char.map_or(false, |c| c == '"');
-            if candid::types::Type::Text == types[0] && !is_quote {
+            if &TypeInner::Text == types[0].as_ref() && !is_quote {
                 Ok(IDLValue::Text(arg_str.to_string()))
             } else {
                 candid::pretty_parse::<IDLValue>("Candid argument", arg_str)
diff --git a/src/distributed/assetstorage.wasm.gz b/src/distributed/assetstorage.wasm.gz
index cb0241dd69..5301b5eceb 100755
Binary files a/src/distributed/assetstorage.wasm.gz and b/src/distributed/assetstorage.wasm.gz differ