The Audit CI job (make audit -> cargo audit) is failing on main because keccak 0.1.5 has been yanked from crates.io. cargo audit fetches the live advisory DB at run time, so any build picks this up regardless of branch. The last green main run (June 23) predates the yank.
Crate: keccak
Version: 0.1.5
Warning: yanked
It's a transitive dependency (pulled in via the sha3/Solana crate graph) so nothing in the source tree needs to change.
Fix
Bump to the semver-compatible 0.1.6, which is not yanked:
cargo update -p keccak --precise 0.1.6
That's a Cargo.lock-only change. Same class of issue as #95 (quinn-proto audit update).
Surfaced on #87, but independent of it
I'll open a PR with the fix soon
The
AuditCI job (make audit->cargo audit) is failing onmainbecausekeccak 0.1.5has been yanked from crates.io.cargo auditfetches the live advisory DB at run time, so any build picks this up regardless of branch. The last greenmainrun (June 23) predates the yank.Crate: keccak
Version: 0.1.5
Warning: yanked
It's a transitive dependency (pulled in via the sha3/Solana crate graph) so nothing in the source tree needs to change.
Fix
Bump to the semver-compatible
0.1.6, which is not yanked:That's a
Cargo.lock-only change. Same class of issue as #95 (quinn-proto audit update).Surfaced on #87, but independent of it
I'll open a PR with the fix soon