Skip to content

chore: downgrade lockfile to match orchard v0.11.0#18

Merged
czarcas7ic merged 1 commit into
shielded-votefrom
adam/p4-downgrade-lockfile
Apr 11, 2026
Merged

chore: downgrade lockfile to match orchard v0.11.0#18
czarcas7ic merged 1 commit into
shielded-votefrom
adam/p4-downgrade-lockfile

Conversation

@czarcas7ic

Copy link
Copy Markdown

Summary

Propagates the lockfile downgrade from valargroup/voting-circuits#14 (merged) down to the iOS SDK. Pulls in the new voting-circuits + orchard revs (ecca2f0) and runs cargo update --precise across multiple passes to push transitive versions back to what orchard v0.11.0 relies on.

Reduction

  • Before: 176 crates drifted from orchard v0.11.0
  • After: 104 crates remain drifted
  • 72 crates successfully downgraded

The remaining 104 are blocked by the iOS SDK's non-orchard dependency graph:

  • arti crates pull rand 0.9 (orchard and all Zcash crypto use rand 0.8)
  • zcash_primitives 0.26.1 pins prerelease RustCrypto (sha2 0.11.0-pre.4, block-buffer 0.11.0-rc.3, crypto-common 0.2.0-rc.1, bip32 0.6.0-pre.1) — upstream zcash decision, not ours
  • tonic/reqwest/hyper dep chains pull newer futures/hashbrown/h2
  • clap 4.x required by CLI tooling
  • tokio 1.51 required by the FFI async layer

Context

Addresses Sean's P4 concern (direct quote):

"tons of dependencies are bumped in the orchard voting-circuits crates (via the lockfile) that had no reason to be bumped/locked to where they were. i tested locally and was able to downgrade all of them back to what orchard relies on in its v0.11.0 tag. i'm fearing that a lot of these ended up cascading into your librustzcash changes (the lockfiles are controlling only for the parent), some of them definitely got inherited by sdk/circuits (which I also downgraded and backed out and cleaned up locally with some success)."

Test plan

Propagates the lockfile downgrade from valargroup/voting-circuits#14
(merged) down to the iOS SDK shielded-vote branch. Pulls in the new
voting-circuits + orchard revs (ecca2f0) and runs cargo update --precise
across multiple passes to push transitive versions back to what orchard
v0.11.0 relies on.

## Reduction

- Before: 176 crates drifted from orchard v0.11.0
- After: 104 crates remain drifted

72 crates successfully downgraded. The remaining 104 are blocked by the
iOS SDK's non-orchard dependency graph:
- arti crates pull rand 0.9 (orchard and all Zcash crypto use rand 0.8)
- zcash_primitives 0.26.1 pins prerelease RustCrypto (sha2 0.11.0-pre.4,
  block-buffer 0.11.0-rc.3, crypto-common 0.2.0-rc.1, bip32 0.6.0-pre.1)
- tonic/reqwest/hyper dep chains pull newer futures/hashbrown/h2
- clap 4.x required by CLI tooling
- tokio 1.51 required by the FFI async layer

cargo build --release passes with the downgraded lockfile.

Addresses Sean's P4 concern: "some of them definitely got inherited by
sdk/circuits (which I also downgraded and backed out and cleaned up
locally with some success)".

Co-Authored-By: Claude <noreply@anthropic.com>
@czarcas7ic czarcas7ic changed the title chore: downgrade lockfile to match orchard v0.11.0 (P4 propagation) chore: downgrade lockfile to match orchard v0.11.0 Apr 11, 2026
@czarcas7ic czarcas7ic marked this pull request as ready for review April 11, 2026 02:44
@czarcas7ic czarcas7ic merged commit aeb0799 into shielded-vote Apr 11, 2026
3 checks passed
p0mvn added a commit that referenced this pull request Apr 11, 2026
This reverts merge commit 71a6e0f (PR #16).

Restores the call to wallet_db.generate_orchard_witnesses_at_frontier()
instead of the standalone function in voting::orchard_witnesses. The
Cargo.lock is left as-is since subsequent PRs (#17, #18) already
updated it.

Made-with: Cursor
greg0x pushed a commit that referenced this pull request Apr 13, 2026
chore: downgrade lockfile to match orchard v0.11.0
greg0x pushed a commit that referenced this pull request Apr 13, 2026
This reverts merge commit 71a6e0f (PR #16).

Restores the call to wallet_db.generate_orchard_witnesses_at_frontier()
instead of the standalone function in voting::orchard_witnesses. The
Cargo.lock is left as-is since subsequent PRs (#17, #18) already
updated it.

Made-with: Cursor
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant