Drop the honggfuzz version pin from the CI fuzz job
What the developer wrote
Authored by auto-pr-bot
Drop the honggfuzz version pin from the CI fuzz job
The pin only ever existed because the job ran on our MSRV toolchain while
honggfuzz's own MSRV had moved past it, so each honggfuzz release broke
the job until someone picked an older version to install. With the job on
stable there is nothing left for the pin to guard: `cargo install
honggfuzz` and the `honggfuzz` 0.5 dependency the fuzz targets link
against both resolve to the current release, which is what we want to be
fuzzing with anyway.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Fixes #4968
Requested-by: @matt
Link: https://git.rust-bitcoin.org/lightningdevkit/rust-lightning/issues/4968#issuecomment-445091
What changed, and why it matters
This commit removes a fixed-version pin for the honggfuzz fuzzing tool in a continuous-integration script. The project now uses the current release of honggfuzz instead of an older pinned version. There is no change to the actual Lightning protocol code, wallet logic, or any code that end users run in production.
No security action required. Review as a normal CI maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change is in fuzz/ci-fuzz.sh: it deletes a cargo update -p honggfuzz --precise "0.5.61" and a version-locked cargo install honggfuzz --version "0.5.61", replacing the install with an unversioned cargo install honggfuzz. The commit message explains the pin was only needed because the CI job previously ran on the project’s MSRV toolchain while honggfuzz’s MSRV had moved forward; now that the job runs on stable Rust, the pin is unnecessary. This is a CI/tooling maintenance change.
Changed components
fuzz/ci-fuzz.shInspect captured patch +1 / −5
### fuzz/ci-fuzz.sh
@@ -21,11 +21,7 @@ cargo run ../hfuzz_workspace/full_stack_target/input
cargo clean
popd
-# Pin honggfuzz as newer versions require a newer rustc than our fuzz CI uses.
-# This pins both the honggfuzz binary and the library dependency built into the
-# fuzz targets below.
-cargo update -p honggfuzz --precise "0.5.61"
-cargo install --color always --force honggfuzz --version "0.5.61" --no-default-features --locked
+cargo install --color always --force honggfuzz --no-default-features
# Because we're fuzzing relatively few iterations, the maximum possible
# compiler optimizations aren't necessary, so we turn off LTOWhy this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.