Where: https://github.com/MystenLabs/MemWal/blob/dev/services/indexer/Cargo.toml
What's wrong: sui-rpc is pulled in directly from a GitHub URL instead of a published crate version, and it's not pinned to a specific commit.
Why it matters: Git dependencies don't go through the normal package registry checks, and without a pinned commit, a future push to that branch could silently change the code you're building with.
Suggested fix: Pin this dependency to an exact commit hash, or switch to a published version once one is available.
Where: https://github.com/MystenLabs/MemWal/blob/dev/services/indexer/Cargo.toml
What's wrong: sui-rpc is pulled in directly from a GitHub URL instead of a published crate version, and it's not pinned to a specific commit.
Why it matters: Git dependencies don't go through the normal package registry checks, and without a pinned commit, a future push to that branch could silently change the code you're building with.
Suggested fix: Pin this dependency to an exact commit hash, or switch to a published version once one is available.