Skip to content

build(deps): bump ed25519-dalek from 2.2.0 to 3.0.0 #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
+22 −54
Open

build(deps): bump ed25519-dalek from 2.2.0 to 3.0.0 #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 21 additions & 53 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion src/cortex-plugins/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ reqwest = { workspace = true }
url = { workspace = true }

# Cryptographic signing
ed25519-dalek = "2.1"
ed25519-dalek = "3.0"

@greptile-apps greptile-apps Bot Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Cover Valid Signature Verification

This upgrade has no committed test that signs plugin bytes with ed25519-dalek 3.0, trusts the matching public key, and verifies that PluginSigner::verify_plugin returns true. The currently untested success branch accepts authentic plugins, so a future compatibility regression could pass the suite unnoticed. Please add a fixed-vector or sign-then-verify regression test. This is non-blocking, but it leaves the upgrade’s central behavior without coverage.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Command output from the check

  • Ran the existing PluginSigner unit-test scope and captured all 12 passing tests, which cover only setup, invalid input, no-key, and checksum cases; the valid trusted-signature success path is absent.

Evidence from the check

  • Authored the focused integration test that signs fixed plugin bytes with ed25519-dalek 3.0, trusts the matching verifying key, and asserts `verify_plugin` returns true; it is the missing regression coverage.

Command output from the check

  • Ran the authored integration test against the public PluginSigner contract and captured `verify_plugin returned Ok(true)` with 1 passed and 0 failed; the success path works but was previously untested.

View artifacts

T-Rex Ran code and verified through T-Rex


# Checksums
sha2 = { workspace = true }
Expand Down
Loading