feat(orchestrator): Make Orchestrator's get_replica_version method a thin wrapper...

[daniel-wong-dfinity-org-twin]

... around the get_replica_version (same name) method of RegistryClient.

This builds on PR 10840, where we started to become aware of StandardEngineReplicaVersionRecord.

👈 Previous PR | Next PR 👉

[zeropath-ai]

🟡 6 security issues detected below the blocking threshold. Reviewed everything up to 9da943a.

The following issues were found:

• Issue 1: maxminddb:GHSA-mj73-j457-8x9q

  • Location: Cargo.lock
  • Score: MEDIUM (50.0)
  • Description: Package maxminddb version 0.24.0 has vulnerability GHSA-mj73-j457-8x9q. Fixed in version 0.27.0. maxminddb's Reader::open_mmap unsoundly marks unsafe memmap operation as safe
  • Link to UI: https://zeropath.com/app/issues/30df6f7b-d7f2-401e-b41c-e6d3454ca719 (Issue 1, id: 30df6f7b-d7f2-401e-b41c-e6d3454ca719)

• Issue 2: opentelemetry_sdk:CVE-2026-48504

  • Location: Cargo.lock
  • Score: MEDIUM (50.0)
  • Description: Package opentelemetry_sdk version 0.18.0 has vulnerability CVE-2026-48504. Fixed in version 0.32.1. opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation
  • Link to UI: https://zeropath.com/app/issues/69d1815f-39ff-4e17-8b66-2903d9dd9576 (Issue 2, id: 69d1815f-39ff-4e17-8b66-2903d9dd9576)

• Issue 3: lru:GHSA-rhfx-m35p-ff5j

  • Location: Cargo.lock
  • Score: MEDIUM (50.0)
  • Description: Package lru version 0.12.5 has vulnerability GHSA-rhfx-m35p-ff5j. Fixed in version 0.16.3. IterMut violates Stacked Borrows by invalidating internal pointer
  • Link to UI: https://zeropath.com/app/issues/8ce1cffc-bbaa-4ca0-889e-73d0d50cd893 (Issue 3, id: 8ce1cffc-bbaa-4ca0-889e-73d0d50cd893)

• Issue 4: atty:GHSA-g98v-hv3f-hcfr

  • Location: Cargo.lock
  • Score: MEDIUM (50.0)
  • Description: Package atty version 0.2.14 has vulnerability GHSA-g98v-hv3f-hcfr. atty potential unaligned read
  • Link to UI: https://zeropath.com/app/issues/aece2d9a-0524-4283-b516-4e68f81ab0d5 (Issue 4, id: aece2d9a-0524-4283-b516-4e68f81ab0d5)

• Issue 5: golang.org/x/sys:CVE-2026-39824

  • Location: go.mod
  • Score: MEDIUM (50.0)
  • Description: Package golang.org/x/sys version v0.0.0-20220728004956-3c1f35247d10 has vulnerability CVE-2026-39824. Fixed in version 0.44.0. Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
  • Link to UI: https://zeropath.com/app/issues/bdd74246-b6ed-424c-b5bb-d6a572a170b2 (Issue 5, id: bdd74246-b6ed-424c-b5bb-d6a572a170b2)

• Issue 6: paramiko:CVE-2026-44405

  • Location: requirements.txt
  • Score: MEDIUM (50.0)
  • Description: Package paramiko version 3.5.1 has vulnerability CVE-2026-44405. paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use
  • Link to UI: https://zeropath.com/app/issues/de4a96c5-ffa4-4bb7-b662-861177cb2917 (Issue 6, id: de4a96c5-ffa4-4bb7-b662-861177cb2917)

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f5e9d2bb-29a4-4b64-902a-391d65fd8b2d?scanId=1a3a33ed-67f4-4590-a7dc-709bbc4d4e5e&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► rs/orchestrator/BUILD.bazel     Add lazy_static test dependency to rust_test configuration
Enhancement	► rs/orchestrator/Cargo.toml     Add lazy_static as workspace dependency
Enhancement	► rs/orchestrator/src/registry_helper.rs     Refactor get_replica_version to use registry_client and handle missing/subnet errors; add test module linkage
Enhancement	► rs/orchestrator/src/registry_helper_tests.rs     Add tests for get_replica_version behavior (direct spec, standard engine path, missing subnet)
Enhancement	► rs/registry/helpers/src/subnet.rs     Extend get_replica_version logic with detailed error handling and validation for replica_version_id; add comments on edge cases and illegal characters; update related logic to use new str_to_result helper
Enhancement	► rs/registry/helpers/src/subnet.rs (tests block updated/extended within same file)     Add tests for illegal characters in replica_version_id and resolved standard engine replica version path

[daniel-wong-dfinity-org-twin]

Oops. I forgot to rebase after PR 10851 went in (originally, this targetted the branch of that PR). Oops. I should not have set this to merge automatically. DOH! Oh well. I think in the end, the same result resulted. I'm surprised this was able to go in, was not blocked by conflict. I feel like that's usually what happens when you build on another PR, i.e. once the first one goes in, the second one says "CONFLICT! CONFLICT! WEE WOO WEE WOO! CONFLICT! CONFLICT!", but not this time for whatever reason 🤷 Ah, the wonders of git/GitHub. When are they going to learn that people continue working off their own work before it makes it into master???