Bump ethnum to placate nightly, for unified build, for oss-fuzz#5287
Merged
Conversation
sisuresh
approved these changes
May 22, 2026
Contributor
sisuresh
left a comment
There was a problem hiding this comment.
This only affects --enable-unified-rust-unsafe-for-production builds, so seems safe to me.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The causal chain here is:
ethnum, specifically version1.5.0ethnum 1.5.0has a bug in it that our pinned rust1.95.0doesn't mind, but rust nightly rejects; it's fixed in1.5.31.5.3otherwise seems to work fine and the release notes show only some optimizations and bugfixes.ethnumwere fixed: Conversion to i128 is broken nlordell/ethnum-rs#44) but .. I don't see any way for this to actually get hit in practice: this PR is a bump to theethnumdependency outside any of the soroban production-build deps (they all have their own pinned ones in production builds) and that dependency only exists, as far as I can tell, becausestellar-xdrlinks inethnumto be able to do u256/i256 ops, which .. we don't actually use anywhere in the non-soroban-host rust code (eg. the bridge helpers). There's no use ofi256,u256,I256,U256, orethnumin any rust code in our tree outside the soroban crates. So I don't think this can cause any divergence in production. But, you know, one can always miss something!If that very narrow possible I-don't-see-how risk is still too much to swallow we can wait for a protocol boundary, but this will I think basically block oss-fuzz integration until it's resolved.
(There's another option which is to turn off the sanitizers, I guess; I am going to try that in the meantime to see if I can get it working, but I'm not sure how likely that is nor whether it's a particularly good idea longer-term.)