docs(security): Solana v4 consolidation investigation#34
Conversation
Documents the workspace's multi-version solana-* split, why solana-program-test is vendored, and why a full v4 consolidation is blocked upstream by Anchor. Key findings: - The split is expected post-monorepo (each solana-* crate versions independently), not corruption. - solana-program-test is vendored only for the agave-unstable-api feature; it is plain cargo-vendor output, not a fork. - anchor-lang is pinned to 1.0.0-rc.2 deliberately: rc.2 is the only 1.0 release admitting solana-pubkey v4. Stable 1.0.0–1.0.2 narrowed pubkey back to ^3.0.0. - Option A (re-vendor program-test 4.0.0, keep anchor rc.2) was attempted and FAILS to resolve: program-test 4.0.0's solana-sysvar requirement conflicts with anchor rc.2's solana-sysvar = "~3.0.0". Branch reverted. Recommendation: keep current pins; optionally patch-bump within 3.x (3.1.10 -> 3.1.12); track Anchor upstream for a release compatible with program-test 4.x before attempting full v4. No dependency changes — documentation only.
|
Warning Review limit reached
More reviews will be available in 33 minutes and 29 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR adds a new migration investigation document to ChangesSolana v3/v4 Migration Investigation Documentation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a detailed investigation and migration plan document (docs/solana-v4-migration.md) for the Solana v4 consolidation, outlining the dependency conflicts and blockers involving Anchor. The feedback suggests a more robust and idiomatic way to verify the version spread using cargo tree instead of parsing Cargo.lock with grep.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (3)
docs/solana-v4-migration.md (3)
36-41: ⚡ Quick winAdd language specifier to code block.
The code block should specify a language identifier for proper rendering and syntax highlighting.
📝 Proposed fix
-``` +```text major v0: 3 crates major v3: 143 crates (the bulk)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/solana-v4-migration.md` around lines 36 - 41, Update the fenced code block in the Solana migration doc so it includes a language specifier for proper rendering (e.g., change the opening ``` to ```text or another appropriate identifier) around the lines showing crate counts (the block containing "major v0: 3 crates major v3: 143 crates (the bulk)" through "major v6: 1 crate (solana-loader-v3-interface)") so the renderer applies correct syntax highlighting.
128-133: ⚡ Quick winAdd language specifier to error code block.
The error output block should specify a language identifier for proper rendering.
📝 Proposed fix
- ``` + ```text failed to select a version for `solana-sysvar`.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/solana-v4-migration.md` around lines 128 - 133, The fenced code block showing the dependency error containing the line "failed to select a version for `solana-sysvar`." needs a language specifier for proper rendering; update the opening fence from ``` to ```text (i.e., add "text" after the backticks) so the error block (the block that includes "required by solana-program-test v4.0.0 (vendored)" and "required by anchor-lang v1.0.0-rc.2") is rendered as plain text.
22-23: ⚡ Quick winAdd blank line before table.
The table should be preceded by a blank line for proper markdown rendering.
📝 Proposed fix
### Declared (root `Cargo.toml`) + | Crate | Pinned | Major |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/solana-v4-migration.md` around lines 22 - 23, Add a blank line immediately before the Markdown table under the "Declared (root `Cargo.toml`)" heading so the table renders correctly; locate the heading text "### Declared (root `Cargo.toml`)" and insert one empty line between that heading and the table starting with "| Crate | Pinned | Major |".
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/solana-v4-migration.md`:
- Around line 36-41: Update the fenced code block in the Solana migration doc so
it includes a language specifier for proper rendering (e.g., change the opening
``` to ```text or another appropriate identifier) around the lines showing crate
counts (the block containing "major v0: 3 crates major v3: 143 crates
(the bulk)" through "major v6: 1 crate (solana-loader-v3-interface)") so the
renderer applies correct syntax highlighting.
- Around line 128-133: The fenced code block showing the dependency error
containing the line "failed to select a version for `solana-sysvar`." needs a
language specifier for proper rendering; update the opening fence from ``` to
```text (i.e., add "text" after the backticks) so the error block (the block
that includes "required by solana-program-test v4.0.0 (vendored)" and "required
by anchor-lang v1.0.0-rc.2") is rendered as plain text.
- Around line 22-23: Add a blank line immediately before the Markdown table
under the "Declared (root `Cargo.toml`)" heading so the table renders correctly;
locate the heading text "### Declared (root `Cargo.toml`)" and insert one empty
line between that heading and the table starting with "| Crate | Pinned | Major
|".
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 56c8e431-9215-49ef-9878-8e27c27a16fd
📒 Files selected for processing (1)
docs/solana-v4-migration.md
1 participant
Documents the investigation into the workspace's multi-version
solana-*split and whether a full v4 consolidation is feasible. Documentation only — no dependency changes.TL;DR
solana-program-test4.0.0, Agave v4.0.1, anchor stable 1.0.2).solana-*crate versions independently; the lockfile spans majors 0–6 (143 crates on v3, 13 on v4).solana-program-testis vendored only foragave-unstable-api— it's plaincargo vendoroutput, not a fork (Cargo.toml.orig+ cargo banner, only an added license header).anchor-langis on1.0.0-rc.2deliberately: rc.2 is the only 1.0 release that admitssolana-pubkeyv4 — stable 1.0.0–1.0.2 narrowed it back to^3.0.0. This is why the prior "upgrade anchor and solana sdk stack" work (1200aa7e) stopped at rc.2.Option A was attempted and proven infeasible
Re-vendoring
solana-program-test → 4.0.0while keeping anchor rc.2 fails to resolve:A blanket
cargo updateonly looked like it worked because it silently drifted anchor to 1.0.2, which then failscargo check(AnchorDeserialize macro breakage). The scratch branch was fully reverted.Recommendation
solana-program-test3.1.10 → 3.1.12 within the 3.x line.See
docs/solana-v4-migration.mdfor the full analysis, conflict tables, and verification commands.Summary by CodeRabbit
Documentation