bump: Bump Anchor, Solana, Node versions#74
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughWalkthroughA comprehensive toolchain and dependency upgrade from Anchor/Solana 0.31.1/2.1.21 to 0.32.1/3.0.13, accompanied by an IDL format migration from JSON to TypeScript syntax, enhanced CI/CD workflows with caching and setup improvements, and corresponding application-level dependency updates across React and Solana libraries. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR is being reviewed by Cursor Bugbot
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
app/src/idl/blockrunners.json (1)
2-2: Verify README.md matches the updated program address.The program address in blockrunners.json is correctly updated to
FajM5A4b5VgLSqcxxeYz3WxqsG3RnGiW9FN7G7PiBpcV, and this address is already configured in Anchor.toml and the program source (lib.rs). However, README.md (line 124) still contains adeclare_id!()macro with a placeholder address and should be updated to match the actual deployed program ID.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (7)
.github/workflows/anchor-test.ymlAnchor.tomlapp/src/idl/blockrunners.jsonapp/src/idl/blockrunners.tspackage.jsonprograms/blockrunners/Cargo.tomlprograms/blockrunners/src/utils/randomness_reveal.rs
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-04-13T19:06:34.047Z
Learnt from: jannden
Repo: jannden/blockrunners PR: 47
File: app/src/lib/constants.ts:18-27
Timestamp: 2025-04-13T19:06:34.047Z
Learning: In the blockrunners project, the IDL defines constants in UPPER_SNAKE_CASE format (e.g., "CIPHER_COST", "GAME_STATE_SEED"), while TypeScript types are translated to camelCase.
Applied to files:
app/src/idl/blockrunners.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Cursor Bugbot
🔇 Additional comments (6)
.github/workflows/anchor-test.yml (1)
10-12: Node.js 24.10.0 is available and part of the Active LTS branch. The version exists in the official downloads and is supported. Note that v24.12.0 is the latest patch release in the 24.x LTS line; consider updating if newer patches are preferred.programs/blockrunners/src/utils/randomness_reveal.rs (1)
41-41: API usage change verified as correct.The parameter change from
&clocktoclock.slotcorrectly aligns with switchboard-on-demand 0.11.3. The official API signature ispub fn get_value(&self, clock_slot: u64) -> std::result::Result<[u8; 32], OnDemandError>, and the code at line 41 correctly passesclock.slot(u64) as the required parameter. The return type is properly handled with.map_err()and.to_vec().package.json (1)
8-8: Review the Anchor 0.32.x breaking changes for compatibility.Version 0.32.1 exists and represents a significant upgrade with several breaking changes from 0.31.0:
- solana-program crate replaced with smaller crates
- CLI now uploads IDL by default on deploy (unless --no-idl flag used)
- CPI calls now use solana-invoke
- solana-client removed from anchor-client/cli
- anchor verify migrated to solana-verify
Verify that your codebase handles these changes, particularly any CPI implementations, IDL deployment workflows, and CLI invocations.
programs/blockrunners/Cargo.toml (1)
21-22: Dependency versions verified; breaking changes are correctly handled in the codebase.Both anchor-lang 0.32.1 and switchboard-on-demand 0.11.3 exist on crates.io. The significant version bump from 0.3.5 to 0.11.3 does introduce breaking changes (feature flags, API modifications, dependency upgrades), but the codebase correctly implements the updated API. The
get_value(clock.slot)call inrandomness_reveal.rs(line 42) uses the correct new signature. The API is consistently applied across bothrandomness_reveal.rsandrandomness_request.rs.app/src/idl/blockrunners.ts (1)
8-74: TypeScript IDL correctly mirrors the JSON IDL.The program address and new
debugGiveCardinstruction are consistent with the JSON IDL definition, following the expected camelCase naming convention for TypeScript.Please refer to the security concerns raised for the
debug_give_cardinstruction in the JSON IDL review regarding proper authorization guards for non-production environments.app/src/idl/blockrunners.json (1)
10-68: The IDL exposes the debug instruction, but verify how this IDL is generated and used in production.The
debug_give_cardinstruction is properly feature-gated with#[cfg(feature = "test")]in the Rust code and thetestfeature is not in default features, so the instruction is excluded from production builds. However, the IDL file in the repository (app/src/idl/blockrunners.json) includes this instruction, suggesting it was generated with test features enabled.This creates a potential issue: the committed IDL may be used by frontend/client code and references an instruction that won't exist in the deployed production program. Ensure the production IDL is generated without the
testfeature, or add IDL-level guards to exclude debug instructions from the public interface.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
Anchor.toml (1)
2-3: Verify that Anchor 0.32.1 and Solana 3.0.13 are valid release versions.A previous review flagged these version numbers as potentially invalid. The historical Solana release pattern used v1.x.x versioning (e.g., v1.18.26), and there's uncertainty about whether v3.0.13 exists as an official release.
Please verify these versions exist and provide migration documentation:
#!/bin/bash # Check Anchor 0.32.1 release echo "=== Checking Anchor v0.32.1 ===" curl -s https://api.github.com/repos/coral-xyz/anchor/releases/tags/v0.32.1 | jq -r '.tag_name // .message' # Check recent Anchor releases echo "" echo "=== Recent Anchor releases ===" curl -s https://api.github.com/repos/coral-xyz/anchor/releases?per_page=10 | jq -r '.[].tag_name' | head -10 # Check for Solana 3.0.13 echo "" echo "=== Checking Solana v3.0.13 ===" curl -s https://api.github.com/repos/anza-xyz/agave/releases/tags/v3.0.13 | jq -r '.tag_name // .message' # Note: Solana repo was archived and moved to anza-xyz/agave echo "" echo "=== Recent Agave (Solana) releases ===" curl -s https://api.github.com/repos/anza-xyz/agave/releases?per_page=10 | jq -r '.[].tag_name' | head -10Additionally, search for official documentation:
Anchor version 0.32.1 release notes changelogSolana Agave 3.0.13 release notes 2024 2025app/src/idl/blockrunners.json (1)
10-68: Confirm intentional inclusion of debug instruction in the IDL.The IDL now includes the
debug_give_cardinstruction, which is feature-gated with#[cfg(feature = "test")]in the Rust program. This suggests the IDL was generated with the "test" feature enabled.Implications:
- ✅ Development/Testing: Including this instruction is useful for localnet and devnet testing
⚠️ Production: The IDL should be regenerated without test features before mainnet deployment to avoid exposing debug functionality in client applicationsPlease clarify:
- Is this IDL intended for localnet/devnet only?
- Will you regenerate the IDL without
--features testfor production builds?Consider implementing environment-specific IDL generation in your deployment pipeline:
# For production (mainnet) anchor build --no-default-features anchor idl type target/idl/blockrunners.json -o app/src/idl/blockrunners.ts # For testing (localnet/devnet) anchor build --features test anchor idl type target/idl/blockrunners.json -o app/src/idl/blockrunners.ts
🧹 Nitpick comments (3)
.github/workflows/anchor-test-local.yml (3)
85-104: Anchor setup and build logic is correct.The Anchor CLI installation uses the recommended approach with AVM for version management. The build artifacts caching strategy correctly includes program source files and
Anchor.tomlin the cache key.Consider adding version verification after installation for debugging purposes:
🔎 Optional: Add version verification step
- name: Install Anchor CLI if: steps.cache-anchor.outputs.cache-hit != 'true' run: | cargo install --git https://github.com/coral-xyz/anchor avm --locked --force avm install ${{ env.ANCHOR_VERSION }} avm use ${{ env.ANCHOR_VERSION }} + anchor --version echo "$HOME/.cargo/bin" >> $GITHUB_PATH
106-107: Test command correctly passes feature flags.The test command properly uses
--features testwith the--separator to pass arguments to the underlying test runner, which aligns with the PR objectives.Consider adding a timeout to prevent hanging jobs:
🔎 Optional: Add timeout to test step
- name: Run Anchor tests + timeout-minutes: 30 run: anchor test -- --features test
64-73: Consider adding version verification after installation for better debugging.The installation URL is correct and matches the official Anza documentation. However, adding a version check after installation can be helpful for verifying the correct version was installed and for debugging CI issues:
Add version verification
- name: Setup Solana config run: | + solana --version solana address || solana-keygen new --no-bip39-passphrase solana config set --url localhost
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (3)
app/package-lock.jsonis excluded by!**/package-lock.jsonapp/yarn.lockis excluded by!**/yarn.lock,!**/*.lockyarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (8)
.github/workflows/anchor-test-local.ymlAnchor.tomlapp/package.jsonapp/src/hooks/useProgram.tsxapp/src/idl/blockrunners.jsonapp/src/idl/blockrunners.tsapp/src/index.cssprograms/blockrunners/src/lib.rs
💤 Files with no reviewable changes (1)
- app/src/hooks/useProgram.tsx
🚧 Files skipped from review as they are similar to previous changes (1)
- app/src/idl/blockrunners.ts
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-04-13T19:06:34.047Z
Learnt from: jannden
Repo: jannden/blockrunners PR: 47
File: app/src/lib/constants.ts:18-27
Timestamp: 2025-04-13T19:06:34.047Z
Learning: In the blockrunners project, the IDL defines constants in UPPER_SNAKE_CASE format (e.g., "CIPHER_COST", "GAME_STATE_SEED"), while TypeScript types are translated to camelCase.
Applied to files:
app/src/idl/blockrunners.jsonprograms/blockrunners/src/lib.rs
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Cursor Bugbot
- GitHub Check: test
- GitHub Check: test
🔇 Additional comments (9)
.github/workflows/anchor-test-local.yml (1)
21-47: LGTM! Well-structured dependency setup.The Node.js and Rust setup follows best practices:
- Uses
--frozen-lockfilefor reproducible builds- Comprehensive caching strategy for both Node and Cargo dependencies
- Cache keys properly incorporate dependency manifests for invalidation
app/src/index.css (1)
53-53: Verify that this CSS change is intentional.This PR is focused on bumping Anchor, Solana, and Node versions. The addition of
background-color: white;to the:rootselector appears unrelated to the toolchain updates. Please confirm whether this styling change is intentional or if it was accidentally included.programs/blockrunners/src/lib.rs (2)
48-51: LGTM! Debug function is properly feature-gated.The
debug_give_cardfunction is correctly protected by#[cfg(feature = "test")], ensuring it only compiles when the "test" feature is enabled. This prevents the debug functionality from being available in production builds.
13-13: Program ID configuration is correctly distributed across environments.The program ID has been properly updated for the localnet environment to
6BwNv3aA437eCifxaUymtRov1bw17eK4xXuYVXodNWjCand is consistently reflected in all relevant files:
programs/blockrunners/src/lib.rs(lib.rs:13)Anchor.toml([programs.localnet] section)app/src/idl/blockrunners.tsandblockrunners.jsonThe devnet configuration in Anchor.toml correctly retains the old program ID, which is the expected behavior for separate network environments.
Anchor.toml (2)
14-14: LGTM! Localnet program address updated consistently.The localnet blockrunners address has been updated to match the new program ID declared in
lib.rs. This ensures consistency for local development.
24-24: LGTM! IDL generation script enhanced with TypeScript output.The updated script now generates both JSON and TypeScript IDL files, which aligns with modern Anchor tooling practices and provides better type safety for the frontend.
app/src/idl/blockrunners.json (1)
2-2: LGTM! Program address updated consistently.The IDL address field correctly reflects the new program ID
6BwNv3aA437eCifxaUymtRov1bw17eK4xXuYVXodNWjC, maintaining consistency with the program declaration inlib.rsand the Anchor.toml configuration.app/package.json (2)
34-35: Codebase is already compliant with React 19 — no migration action required.The application is already properly configured for React 19.2.3:
- Modern JSX transform enabled in TypeScript config
- All
useRefcalls include arguments (useRef(currentCiphers),useRef<HTMLDivElement>(null))forwardRefused correctly throughout UI components- No string refs present
- No
react-test-rendererto migrate- Modern Context API (
createContext/useContext) is being used — these remain valid in React 19No breaking changes from the review comment apply to this codebase. The setup is already production-ready for React 19.
20-56: Test React 19.2.3 compatibility thoroughly before merging.All package versions exist in registries and Solana/Anchor packages are confirmed compatible. However, React 19.2.3 introduces breaking changes that require verification:
- Removed legacy
react-dom.render()andunmountComponentAtNode()APIs- Stricter ref forwarding and effect timing changes
- Potential third-party library incompatibilities
Run your full test suite with this configuration and audit dependencies using
npm lsto ensure no packages depend on the removed React APIs.
There was a problem hiding this comment.
Actionable comments posted: 1
Fix all issues with AI Agents 🤖
In @README.md:
- Line 5: The markdown link in README.md is malformed due to an extra closing
bracket; fix the link by removing the stray bracket so it reads [Play the game
here:
https://jannden.github.io/blockrunners/](https://jannden.github.io/blockrunners/)
or replace it with a descriptive link like [Play
Blockrunners](https://jannden.github.io/blockrunners/); update the line
containing the current link to one of these correct forms.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (7)
.github/workflows/anchor-test.yml.github/workflows/deploy.yamlREADME.mdapp/package.jsonapp/src/idl/blockrunners.jsonapp/src/idl/blockrunners.tsprograms/blockrunners/Cargo.toml
🚧 Files skipped from review as they are similar to previous changes (4)
- app/package.json
- app/src/idl/blockrunners.ts
- programs/blockrunners/Cargo.toml
- app/src/idl/blockrunners.json
🧰 Additional context used
🪛 markdownlint-cli2 (0.18.1)
README.md
5-5: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Cursor Bugbot
- GitHub Check: test
🔇 Additional comments (8)
.github/workflows/anchor-test.yml (7)
23-31: LGTM: Node.js setup and dependency installation.The Node.js setup correctly uses the environment variable, enables yarn caching with the proper lockfile path, and installs dependencies with
--frozen-lockfileto ensure reproducibility.
33-49: LGTM: Rust setup and dependency caching.The Rust toolchain setup uses the standard action with appropriate components. The cache configuration includes all necessary Cargo directories and uses a proper cache key that invalidates when dependencies change.
51-54: LGTM: System dependencies installation.The required system packages (
libudev-devandpkg-config) for Solana CLI are correctly installed.
56-77: LGTM: Solana CLI installation and configuration.The Solana CLI setup properly caches the installation, uses the official Anza installation script, configures the PATH, and sets up a keypair with localhost URL for testing.
79-97: LGTM: Anchor CLI installation and PATH configuration.The Anchor CLI setup properly caches the installation, uses the official repository with appropriate flags, and leverages
avmfor version management. The explicit PATH setup on line 97, while potentially redundant sincedtolnay/rust-toolchainlikely already adds~/.cargo/binto PATH, is a defensive measure that ensures the binaries are available for subsequent steps.
99-113: LGTM: Build and test execution.The build artifacts are properly cached with a cache key that invalidates when program source or Anchor configuration changes. The test execution correctly uses the
--features testflag, which aligns with the local testing instructions in the README.
11-14: Environment variables now properly utilized.The environment variables are now correctly referenced throughout the workflow (Node on line 26, Solana on lines 64 and 69, Anchor on lines 87, 93-94), addressing the previous review concern. However, please verify these versions are valid and compatible.
Are Solana CLI version 3.0.13, Anchor Framework version 0.32.1, and Node.js version 24.10.0 valid and compatible versions as of January 2026?.github/workflows/deploy.yaml (1)
15-18: Node.js version 24.10.0 is valid and in Active LTS status as of January 2026.The version was released on October 8, 2025, and is currently maintained under the Active LTS (Krypton) release line. This is an appropriate choice for a deployment workflow.
There was a problem hiding this comment.
Actionable comments posted: 1
Fix all issues with AI Agents 🤖
In @app/src/idl/blockrunners.ts:
- Around line 9-14: The IDL metadata in app/src/idl/blockrunners.ts is out of
sync with the crate version: update the metadata.version and metadata.spec from
"0.1.0" to "0.2.0" (or regenerate the IDL) so the IDL metadata matches
Cargo.toml; locate the metadata object (metadata: { name: "blockrunners";
version: "..."; spec: "..."; }) and either run the Anchor build/IDL generation
command to regenerate the file or manually set both version and spec to "0.2.0"
and commit the regenerated IDL.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
Anchor.tomlREADME.mdapp/src/idl/blockrunners.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- Anchor.toml
- README.md
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-04-13T19:06:34.047Z
Learnt from: jannden
Repo: jannden/blockrunners PR: 47
File: app/src/lib/constants.ts:18-27
Timestamp: 2025-04-13T19:06:34.047Z
Learning: In the blockrunners project, the IDL defines constants in UPPER_SNAKE_CASE format (e.g., "CIPHER_COST", "GAME_STATE_SEED"), while TypeScript types are translated to camelCase.
Applied to files:
app/src/idl/blockrunners.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Cursor Bugbot
🔇 Additional comments (1)
app/src/idl/blockrunners.ts (1)
7-837: Generated IDL type looks correct for Anchor 0.32.1.The TypeScript type definition follows the expected format for the upgraded Anchor version. Instructions, accounts, events, errors, types, and constants are properly structured. Constants use camelCase naming convention as expected for TypeScript translation. Based on learnings, this aligns with the project's convention of translating UPPER_SNAKE_CASE IDL constants to camelCase in TypeScript.
1 participant
Note
Anchorto0.32.1,Solanato3.0.13,Nodeto24.10.0; update Rust/JS deps; program version to0.2.0.anchor build, andanchor testin.github/workflows/anchor-test.yml.README.mdlink and apphomepageto GitHub Pages.copy_idlto also emitapp/src/idl/blockrunners.ts.:rootbackground to white.switchboard-on-demandfor randomness reveal with a test feature path that mocks randomness.Written by Cursor Bugbot for commit 195e5dd. This will update automatically on new commits. Configure here.
Summary by CodeRabbit
Chores
Documentation
Style
✏️ Tip: You can customize this high-level summary in your review settings.