Skip to content

Resolve and install project toolchains in AVM#4824

Open
jamie-osec wants to merge 5 commits into
otter-sec:masterfrom
jamie-osec:fix/pin-idl-nightly
Open

Resolve and install project toolchains in AVM#4824
jamie-osec wants to merge 5 commits into
otter-sec:masterfrom
jamie-osec:fix/pin-idl-nightly

Conversation

@jamie-osec

@jamie-osec jamie-osec commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator

New set of features for AVM resolution to support more projects:

  • feat(avm): Pin compatible IDL nightly - Resolve a dated Rust nightly from the project’s locked proc-macro2 versions, install it on demand, and pin unversioned cargo +nightly IDL invocations.
  • fix(avm): Map Solana 1.17 to platform-tools v1.37 - Add the oldest hosted Solana 1.17 release and its platform-tools bundle to the resolution map.
  • feat(avm): Install project toolchains from Anchor stub- Resolve and install the project’s Solana CLI and platform-tools before launching Anchor, then expose the matching bundled Rust toolchain through Rustup.
  • fix(avm): Defer dependency compatibility to build-sbf - Remove the Cargo metadata MSRV preflight and let the selected cargo-build-sbf toolchain report dependency incompatibilities directly.
  • fix(avm): Support v4 lockfiles with legacy Cargo - Enable Cargo’s lockfile-v4 opt-in only for compatible legacy platform-tools bundles and report an actionable error for unsupported bundles.

Tested in: https://github.com/otter-sec/anchor/actions/runs/29965656707/job/89276824238

@vercel

vercel Bot commented Jul 20, 2026

Copy link
Copy Markdown

@jamie-osec is attempting to deploy a commit to the OtterSec Team on Vercel.

A member of the Team first needs to authorize it.

@jamie-osec
jamie-osec force-pushed the fix/pin-idl-nightly branch 2 times, most recently from e7f2b17 to e11ad3d Compare July 20, 2026 20:28
@jamie-osec
jamie-osec marked this pull request as draft July 21, 2026 21:51
@jamie-osec
jamie-osec force-pushed the fix/pin-idl-nightly branch 4 times, most recently from f984a26 to 54c61f1 Compare July 22, 2026 14:33
@jamie-osec
jamie-osec force-pushed the fix/pin-idl-nightly branch from 54c61f1 to 50a7b93 Compare July 22, 2026 23:16
@jamie-osec jamie-osec changed the title Pin IDL nightly toolchain in AVM Resolve and install project toolchains in AVM Jul 22, 2026
@socket-security

socket-security Bot commented Jul 22, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedcargo/​fs2@​0.4.310010090100100

View full report

@jamie-osec
jamie-osec marked this pull request as ready for review July 23, 2026 18:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant