docs: dependency audit, Helios pinning rationale, ethereum_hashing fork rationale - #175
Merged
Merged
Conversation
…rk rationale (#165, #166, #167) - DEPENDENCIES.md: audit every direct dependency across all packages, split into verification-path (security-critical) and UI/tooling (non-critical) categories with per-dependency justification. - Cargo.toml: add inline comments explaining why helios-consensus-core is pinned to git rev 582fda3 (a16z/helios#776 not yet in a tagged release) and why ethereum_hashing uses the ncitron fork (removes ring C dependency in favor of pure-Rust sha2). - README.md: link to DEPENDENCIES.md from the architecture section. Closes #165 Closes #166 Closes #167 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Owner
Author
|
@BugBot review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DEPENDENCIES.mddocumenting every direct dependency across all packages, split into verification-path (security-critical: viem, zod, helios, alloy, revm, etc.) and UI/tooling (non-critical: React, Tailwind, Next.js, etc.) with per-dependency justification.helios-consensus-coreis pinned to git rev582fda3(includes a16z/helios#776 fix for hex-encoded beacon API fields, not yet in a tagged release past0.11.0). Includes action item to migrate to a version pin once a new Helios release ships.ethereum_hashinguses the ncitron fork (removesringC dependency, uses pure-Rustsha2unconditionally). ncitron is the top Helios contributor. Includes action item to drop the patch once upstream releases a version with thesha2feature flag.DEPENDENCIES.mdfrom the architecture section.Test plan
Closes #165
Closes #166
Closes #167
🤖 Generated with Claude Code
Note
Low Risk
Docs-only changes plus Cargo.toml comments; no runtime behavior or dependency versions change. Low risk aside from potentially stale documentation if future pins/patches diverge.
Overview
Adds a new
DEPENDENCIES.mdthat documents why each direct dependency exists, explicitly separating verification-path (security-critical) dependencies from UI/tooling ones.Updates
README.mdto link to the new dependency audit, and expandsapps/desktop/src-tauri/Cargo.tomlwith rationale comments for thehelios-consensus-coregit rev pin and theethereum_hashingfork/patch (including guidance to migrate back to tagged upstream releases when available).Written by Cursor Bugbot for commit 2b41421. This will update automatically on new commits. Configure here.