fix(dashmate): yaml package security vulnerability - #975
Merged
Conversation
shumkov
changed the title
shumkov
changed the title
markin-io
pushed a commit
that referenced
this pull request
Apr 28, 2023
romchornyi
pushed a commit
that referenced
this pull request
Aug 24, 2026
…ned height Repin rust-dashcore to 090faea2 (#975), which adds winner_mined_height to WalletEvent::TransactionsSwept, and rework the sweep-tombstone lifetime rule on all three backends to mirror key-wallet's observed-spends doctrine exactly, closing the held_since_height review blocker: - a mempool-context sweep (IS-locked winner, unmined) creates no placeholder at all: upstream deliberately never records an unconfirmed spend ("an unconfirmed spend must not invalidate a coin"), the engine keeps no durable hold the mirror could be mirroring, and the placeholder population an attacker could grow by double-spending incoming payments dies at the source - a block-context placeholder stores the winner's own mined height and is collected exactly when min(chainlock_height, synced_height) reaches it - prune_finalized_observed_spends' condition verbatim; the two-block observation-age margin, the held_since_height stamp, and the back-fill machinery are removed, not bypassed - an IS-locked chained re-point keeps the earlier block-context stamp, as upstream never retracts an observed-spend entry for an unconfirmed conflict; a block-context re-point re-stamps to the new winner's height - SweepBatchFFI carries the winner's finality context, and the numeric chainlock height now crosses to mobile through a new size-negotiated extension slot, replacing the "chainlock bytes exist" gate that let Swift and Kotlin collect on synced height alone SQLite V006 and Room's v12->13 migration are amended in place under the pre-release policy (nothing shipped has applied either); a dev database that ran the old V006 fails refinery's divergence check and must be recreated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue being fixed or feature implemented
Need to update docker-compose dashmate dependency to version 0.24.2
What was done?
Updated docker-compose dashmate dependency
How Has This Been Tested?
With tests
Breaking Changes
No
Checklist:
For repository code-owners and collaborators only