fix(install): Downgrade owo-colors from 3.6.0 to 3.5.0

[oxarbitrage]

Motivation

owo-colors v 0.3.6 is yanked. This PR downgrade to version 0.3.5. Close #6197

Solution

Downgrade.

Test the warning is gone with:

cargo install --locked --features getblocktemplate-rpcs --git https://github.com/ZcashFoundation/zebra --branch issue6197 zebrad

Dependabot will try to update, we will deny, dependabot will leave us alone until a greater version is released.

The change in command.rs is needed to fix a clippy lint that was not happening when owo-colors was at 0.3.6.

Review

Anyone can review.

Reviewer Checklist

• Will the PR name make sense to users?
  • Does it need extra CHANGELOG info? (new features, breaking changes, large changes)
• Are the PR labels correct?
• Does the code do what the ticket and PR says?
  • Does it change concurrent code, unsafe code, or consensus rules?
• How do you know it works? Does it have tests?

[codecov]

Codecov Report

Merging #6203 (4a80946) into main (4daedbc) will decrease coverage by 0.10%.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6203      +/-   ##
==========================================
- Coverage   78.01%   77.92%   -0.10%     
==========================================
  Files         304      304              
  Lines       39251    39251              
==========================================
- Hits        30623    30586      -37     
- Misses       8628     8665      +37     

[teor2345]

I'm surprised to see such a large change to Cargo.lock. How did you generate it?

We're keeping some packages to specific versions, and there are some cryptographic package changes in here. So I think we might need to check each dependency change in detail to make sure they are correct. Can you split those changes into another PR, and just to the owo-colors change in this one?

[oxarbitrage]

I'm surprised to see such a large change to Cargo.lock. How did you generate it?

I just downgraded owo-colors and build, Cargo.lock is auto generated.

We're keeping some packages to specific versions, and there are some cryptographic package changes in here. So I think we might need to check each dependency change in detail to make sure they are correct. Can you split those changes into another PR, and just to the owo-colors change in this one?

I am not understanding, changes here are just to make the downgrade work. I can't see unrelated changes. Deny.toml changes are done to make the CI pass.

[teor2345]

I'm surprised to see such a large change to Cargo.lock. How did you generate it?

I just downgraded owo-colors and build, Cargo.lock is auto generated.

Cargo.lock is auto-generated from the Cargo.toml files and the previous Cargo.lock. It's easy to accidentally change it a lot. It can happen if you delete the Cargo.lock, replace it with an older version, or use a command like cargo update to update all the dependency versions.

We're keeping some packages to specific versions, and there are some cryptographic package changes in here. So I think we might need to check each dependency change in detail to make sure they are correct. Can you split those changes into another PR, and just to the owo-colors change in this one?

I am not understanding, changes here are just to make the downgrade work. I can't see unrelated changes. Deny.toml changes are done to make the CI pass.

There are 700 lines of changes in Cargo.lock. That's a very big change.

For example, the cryptographic dependency bls12_381 should not change in a PR about a terminal colour dependency:
https://github.com/ZcashFoundation/zebra/pull/6203/files#diff-13ee4b2252c9e516a0547f2891aa2105c3ca71c6d7a1e682c69be97998dfc87eR484-R488

[teor2345]

Happy to jump on a call if that would help?

[oxarbitrage]

Happy to jump on a call if that would help?

Sorry, it seems i screwed up somewhere, my apologies for not checking it carefully.

It seems only a downgrade in the Cargo.toml is needed, no changes were done to the lock after built. The warning is gone and no need to change deny.toml.

[oxarbitrage]

Hmm, unfortunatly the warning is still there, so it needs further changes.

$ cargo install --locked --features getblocktemplate-rpcs --git https://github.com/ZcashFoundation/zebra --branch issue6197 zebrad
    Updating git repository `https://github.com/ZcashFoundation/zebra`
  Installing zebrad v1.0.0-rc.4 (https://github.com/ZcashFoundation/zebra?branch=issue6197#35199d2e)
    Updating crates.io index
warning: package `owo-colors v3.6.0` in Cargo.lock is yanked in registry `crates-io`, consider running without --locked

[oxarbitrage]

Trying updated Cargo.lock after cargo update -p owo-color in 4a80946

[teor2345]

Thanks, that looks a lot better!