Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pin ed25519-dalek for v22 Core release #1422

Closed
dmkozh opened this issue Jun 21, 2024 · 4 comments
Closed

Pin ed25519-dalek for v22 Core release #1422

dmkozh opened this issue Jun 21, 2024 · 4 comments
Assignees

Comments

@dmkozh
Copy link
Contributor

dmkozh commented Jun 21, 2024

We temporarily unpin the dalek version in order to unblock the downstream deps from updating to non-vulnerable version. We should pin this back after Core is updated to use new env for p22 or after v22 release (depending on whether unpinning works with prev+curr env build).

@sisuresh
Copy link
Contributor

sisuresh commented Aug 30, 2024

@dmkozh which version did we want to pin to? 2.1.1?

@sisuresh sisuresh mentioned this issue Aug 30, 2024
@dmkozh
Copy link
Contributor Author

dmkozh commented Aug 30, 2024

I don't recall the exact version, but I suppose the latest one should work. Basically as long as cargo-deny doesn't complain we should be good.

@leighmcculloch
Copy link
Member

leighmcculloch commented Sep 2, 2024

Why do we need to repin? The lock file already pins the core build. And @graydon added a check to ensure that the env repo and core repos use the same version in the lock file so that tests run in both repos using the same version. The unpinning was intended to be permanent.

@anupsdf
Copy link
Contributor

anupsdf commented Sep 9, 2024

Closing this since we will be using stellar/stellar-core#4278 to track how to handle dependencies. We may go with the submodule approach in stellar/stellar-core#4456

@anupsdf anupsdf closed this as completed Sep 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

6 participants
@graydon @leighmcculloch @sisuresh @dmkozh @anupsdf and others