Pin curve25519-dalek dependency

[thomaseizinger]

Pre-releases are compared lexicographically. Pre-releases are also allowed to make breaking changes. Depending on a pre-release without pinning is likely to cause breakages downstream.

Pin the dependency until this issue is resolved.

Fixes #146.

[nickray]

Would probably be better to pin on the release candidate than the prerelease, and simply remove the &?

[thomaseizinger]

Would probably be better to pin on the release candidate than the prerelease, and simply remove the &?

If that is backwards-compatible, yes. I don't know the public API-surface of this crate and whether curve25519-dalek is exposed or not.

Remember that we need to release as a patch-release to unblock downstream users like CI pipelines that will download the latest compatible version.

[BlackHoleFox]

If that is backwards-compatible, yes. I don't know the public API-surface of this crate and whether curve25519-dalek is exposed or not.

I'm not the crate author but afaict it's not exposed anywhere. Every method that uses it in parameters is not public or ends up working with &[u8] anyway. See also the commit (b581997) which added the dep.

[tarcieri]

FYI: I opened #148 which updates to rc.0

[thomaseizinger]

If that is backwards-compatible, yes. I don't know the public API-surface of this crate and whether curve25519-dalek is exposed or not.

I'm not the crate author but afaict it's not exposed anywhere. Every method that uses it in parameters is not public or ends up working with &[u8] anyway. See also the commit (b581997) which added the dep.

I am happy with either. I only opened this because I hoped it would be the least controversial and thus the fastest to merge and release so we can unblock downstream users that currently have failing builds.

[mcginty]

Closing in favor of the @tarcieri's pinning to rc.0, thanks for opening this and sorry for the lag in publishing a fixed version.

[thomaseizinger]

Closing in favor of the @tarcieri's pinning to rc.0, thanks for opening this and sorry for the lag in publishing a fixed version.

All good, thank you for handling this! :)