Skip to content

feat: remove usage of dalek dependency #127

@ICavlek

Description

@ICavlek

Is your feature request related to a problem? Please describe.
We are using dalek dependency version 2 in our Cargo.toml.
However, older version is being used as part of the solana-sdk dependency. This older version causes known RUSTSEC issues, which have been silenced in the deny.toml: RUSTSEC-2024-0344 and RUSTSEC-2022-0093. They can also be inspected with the following commands:

cargo tree -i ed25519-dalek@1.0.1
# or
git grep ed25519-dalek 
# shows version 1.0.1 only in Cargo.lock

Same commands can be also applied for curve25519-dalek.

Describe the solution you'd like
Fix it so that RUSTSEC-2024-0344 and RUSTSEC-2022-0093 are no longer issues in our repo.

Describe alternatives you've considered
Based on the docs on crates.io for solana-sdk, it is shown that ed25519-dalek and curve25519-dalek are under optional dependencies.

After initial investigation, where inside Cargo.toml, it has been set to:

solana-sdk = { version = "~2.1", optional = false}

ed25519-dalek and curve25519-dalek were still present

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions