pin v1.16 ahash to 0.8.3

[t-nelson]

Problem

poor upstream release management

Summary of Changes

pin ahash

[t-nelson]

@yihau is this not the command that's failing in CI ./cargo test --tests --verbose -p solana-cargo-build-sbf? it passes locally 🤔

[t-nelson]

ohhh i think it's because these test cargo.lock aren't under version control. the error comes from resolution of the index, to build the lockfile. mebe we can just commit them...

[t-nelson]

and yet, here i am!

[t-nelson]

@dmakarov on a scale of 1-10, how bad do you hate 3ad21cd ?

[dmakarov]

@dmakarov on a scale of 1-10, how bad do you hate 3ad21cd ?

0. I don't mind this change at all. It shouldn't affect the tests it seems.

[t-nelson]

0. I don't mind this change at all. It shouldn't affect the tests it seems.

great, thanks!

[willhickey]

If I understand correctly this solves the problem without impacting the actual build. If that's correct I'd prefer this over 34645 to reduce risk for the v1.16 releases we need to bridge to v1.17

[yihau]

🔥

[t-nelson]

If I understand correctly this solves the problem without impacting the actual build. If that's correct I'd prefer this over 34645 to reduce risk for the v1.16 releases we need to bridge to v1.17

correct

[yihau]

bummer 🫠 I got this one.

[t-nelson]

this is from secondary?

[CriesofCarrots]

ahash v0.8.3 was yanked, so pinning to that specific version isn't going to work. v0.8.4 is probably the most-reasonable alternative, given how many old versions have been yanked.

[yihau]

this is from secondary?

yes

[yihau]

I'm thinking that maybe we don't need to pin the ahash version for all crates. we only pin the ahash version for programs. (keep sdk/cargo-build-sbf/tests/crates/fail/Cargo.lock and sdk/cargo-build-sbf/tests/crates/noop/Cargo.lock).

the original error originated from test_build. If users import our crates and not for a Solana program, they probably shouldn't be restricted by this 🤔

btw, I just checked the build log of v1.16.23. It seems that we have already compiled ahash 0.8.6 to crates. so I guess if we still prefer to pin ahash, 0.8.4 won't be so dangerous. (even 0.8.6)

[yihau]

I'm going to ping you in two different PRs for this issue 🪖

1. v1.16: pin ahash to 0.8.4 #34723
2. v1.16: unpin ahash for workspace #34716

(I prefer 1. atm. everything should be fixed magically and we don't need lock files for programs anymore. I guess it is also more friendly for users(?))