Conversation
Update world-id-core (and transitive world-id-* crates) from 0.6 to 0.7. Code adaptations for the new API: - credential.rs: rename associated_data_hash → associated_data_commitment - proof_generation_integration.rs: OprfKeyId re-exported from world_id_core::primitives Extracted from #306.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| use walletkit_core::storage::cache_embedded_groth16_material; | ||
| use walletkit_core::{defaults::DefaultConfig, Authenticator, Environment}; | ||
| use world_id_core::primitives::{rp::RpId, FieldElement, Nullifier}; | ||
| use world_id_core::primitives::{rp::RpId, FieldElement, Nullifier, OprfKeyId}; |
There was a problem hiding this comment.
Unused taceo-oprf dev-dependency after import migration
Low Severity
Moving the OprfKeyId import from taceo_oprf::types to world_id_core::primitives was the only usage of the taceo-oprf dev-dependency in walletkit-core/Cargo.toml (line 80). That dev-dependency (with its TODO comment about removal) is now completely unused — the remaining taceo_oprf references in logger.rs are just string literals for log filtering, not actual crate imports. The dev-dep can be removed.
There was a problem hiding this comment.
ah yes I added this import. /otto worth removing the direct taceo dep now
2 participants
Summary
Bumps
world-id-core(and its transitiveworld-id-*dependencies) from 0.6 to 0.7, along with the minimal in-code adaptations required by the new upstream API.Changes
Cargo.tomlworld-id-coreversion0.6→0.7Cargo.lockworld-id-authenticator,world-id-primitives,world-id-proof0.6→0.7;taceo-oprf0.10,taceo-oprf-client0.9.1,taceo-oprf-types0.11)walletkit-core/src/credential.rsassociated_data_hash→associated_data_commitmentwalletkit-core/tests/proof_generation_integration.rsOprfKeyIdfromworld_id_core::primitivesinstead oftaceo_oprf::types(re-export moved upstream)Context
This is the dependency bump portion extracted from #306, separated from the new authenticator management feature to allow independent review and merge.
Verified:
cargo build -p walletkit-corecompiles cleanly.Note
Medium Risk
Upgrades a core cryptography/proof dependency (
world-id-core) and its transitiveworld-id-*/taceo-oprf*crates, which can subtly change proof generation/verification behavior despite minimal local code changes.Overview
Bumps
world-id-corefrom0.6to0.7and refreshes the lockfile accordingly (includingworld-id-authenticator/world-id-primitives/world-id-proof0.7and updatedtaceo-oprf*/windows-sysversions).Adapts
walletkit-coreto upstream API changes by renaming the credential accessor fromassociated_data_hashtoassociated_data_commitment, and updating the integration test to importOprfKeyIdfromworld_id_core::primitivesinstead oftaceo_oprf::types.Written by Cursor Bugbot for commit d19d812. This will update automatically on new commits. Configure here.