Repository navigation
Drop the elliptic-curve pin and the no-op tokio-stream = - #4576
Merged
Merged
Conversation
elliptic-curve was pinned for k256 release candidates. k256 0.14.0 requires elliptic-curve ^0.14.1 itself, so the =0.14.1 pin only blocks patch releases. No snarkos code uses the crate; it was a direct dependency only to carry the pin, so it goes, with its cargo-machete exemption. The resolved version and its enabled features are unchanged. tokio-stream's "=0.1" means any 0.1.x, the same as "0.1". The proptest comment said snarkVM uses 1.6; it uses 1.12 now. The "1.6" requirement admits that, so only the comment goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WknVbv96cQthGZ7Ztp2dEQ
cbeck88
force-pushed
the
deps/relax-exact-pins
branch
from
October 25, 2026 12:18
829162b to
8fd2c27
Compare
cbeck88
changed the title
vicsn
approved these changes
Oct 25, 2026
vicsn
left a comment
vicsn
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, should we add this to e.g. CONTRIBUTING.md or some other style guide, or I guess it could be mentioned in any internal prerelease prompt.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Exact (
=) requirements force every build onto one version and outlive the reason they were added. #4575 removed thecrypto-bigintpin to move past RUSTSEC-2026-0387. This PR removes the other non-internal ones:elliptic-curve(rootsnarkos)=0.14.1elliptic-curve ^0.14.1itself, so the pin only blocks patch releases.tokio-stream(node,node/router)=0.10.1=0.1matches any 0.1.x, the same as0.1. The=only misleads.No snarkos code uses
elliptic-curve. It was a direct dependency only to carry the pin, so it goes along with its cargo-machete exemption. k256 still reaches it throughsnarkvm-console-algorithms.The
proptestcomment said snarkVM uses 1.6; it is on 1.12 now. The1.6requirement admits 1.12, so only the comment goes.The internal
snarkos-*pins (=4.12.0) stay. Those crates are released together, so each has to take its siblings at exactly its own version.Test Plan
Cargo.lockchanges only by dropping theelliptic-curveedge fromsnarkos.cargo update --workspacelocks 0 packages; every resolved version is unchanged.cargo tree -e features -i elliptic-curveenables the same features before and after.cargo check --workspace --all-targets --lockedpasses.Documentation
None.
Backwards compatibility
No code changes, and the lockfile resolves to the same versions.
🤖 Generated with Claude Code
https://claude.ai/code/session_01WknVbv96cQthGZ7Ztp2dEQ