Skip to content

chore(deps): pin canton-lib 0.11.0 - #5

Merged
hubagaspar91 merged 1 commit into
mainfrom
chore/deps/canton-lib-0.11.0
Oct 9, 2026
Merged

hubagaspar91 merged 1 commit into
mainfrom
chore/deps/canton-lib-0.11.0

Conversation

@hubagaspar91

Copy link
Copy Markdown
Collaborator

What

This PR pins canton-lib 0.11.0 and prepares the bitsafe-token 0.2.0 release.

  • The five canton-lib crates move from v0.10.0 to v0.11.0.
  • The canton-api-client dev-dependency moves from 3.6.0-0.1.0 to 3.6.1-0.1.0.
  • The crate version, CHANGELOG.md and the README install tags move to 0.2.0.

Why

canton-lib 0.11.0 uses canton-api-client 3.6.1, which matches Canton 3.6.1. canton-lib 0.10.1 also fixes active_contracts::get. That function now returns the Ledger API error when the participant rejects a request. Before, it returned an empty list, so a balance query reported 0.

The localnet suite uses canton-api-client directly. Cargo permits only one 3.x version of that crate in a build. So the dev-dependency must move with canton-lib.

Key decision: 0.2.0, not 0.1.1

The Rust API of bitsafe-token does not change. The exposed JsActiveContract and CreatedEvent models have the same fields in 3.6.0 and 3.6.1.

A downstream project can still break. I built a test crate against this branch:

Extra dependency next to bitsafe-token Result
none, or keycloak v0.10.0 builds
any canton-lib crate at v0.11.0 builds
common, ledger, token or registry v0.10.0 fails: failed to select a version for canton-api-client
canton-api-client 3.6.0-0.1.0 fails with the same error

The README tells users to pin all canton-lib crates at the same tag. Those users must move their pins with this release, so the minor version signals that.

How tested

  • cargo fmt -- --check, cargo clippy --all-targets --all-features -- -D warnings and cargo test pass locally.
  • The CI localnet suite runs against the sandbox on this PR.

🤖 Generated with Claude Code

canton-lib 0.11.0 moves canton-api-client to 3.6.1. The localnet
suite depends on canton-api-client directly, so its pin moves too.

A project that pins a canton-lib v0.10.0 crate next to this one
cannot resolve canton-api-client, so the release is 0.2.0.
canton-lib 0.10.1 also makes active_contracts::get return the
Ledger API error instead of an empty list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedcanton-api-client@​3.6.0-0.1.0 ⏵ 3.6.1-0.1.010010093100100

View full report

@hubagaspar91
hubagaspar91 merged commit 7546324 into main Oct 9, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants