search

paritytech / substrate

Substrate: The platform for blockchain innovators
Apache License 2.0
8.39k stars 2.65k forks source link

bump ed25519-dalek to 2.0 #14776

Closed andresilva closed 1 year ago

andresilva commented 1 year ago

https://rustsec.org/advisories/RUSTSEC-2022-0093

Can't merge until https://github.com/mcginty/snow/issues/164 to remove cargo patch in this PR.

There is also ed25519-zebra "4.0" available, but can't update to it for the same reason as above. Zebra is unaffected by this issue though.

polkadot companion: https://github.com/paritytech/polkadot/pull/7648 cumulus companion: https://github.com/paritytech/cumulus/pull/3038

andresilva commented 1 year ago

Should probably be burned-in to make sure nothing breaks.

bkchr commented 1 year ago

Should probably be burned-in to make sure nothing breaks.

Can probably don while we wait for the snow release.

andresilva commented 1 year ago

We'll still have ed25519-dalek 1.5 in our dependencies until https://github.com/libp2p/rust-libp2p/issues/4327 is fixed (which is also blocked on snow).

skunert commented 1 year ago

Took the liberty to remove the snow patch here since 0.9.3 has been released in the meantime (and I am also needing the new version for a PR of mine).

ggwpez commented 1 year ago

Can we merge this? Substrate master CI needs it.

skunert commented 1 year ago

bot merge

paritytech-processbot[bot] commented 1 year ago

Waiting for commit status.