From 0c444af078dea617670541a451ba0c8474d3f279 Mon Sep 17 00:00:00 2001 From: Erik de Castro Lopo Date: Thu, 2 Jul 2026 12:18:33 +1000 Subject: [PATCH 1/5] cabal.project: Update-index-states --- cabal.project | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cabal.project b/cabal.project index 3bb37cdadf..abb891618b 100644 --- a/cabal.project +++ b/cabal.project @@ -13,8 +13,8 @@ repository cardano-haskell-packages -- See CONTRIBUTING for information about these, including some Nix commands -- you need to run if you change them index-state: - , hackage.haskell.org 2026-06-02T21:49:32Z - , cardano-haskell-packages 2026-06-02T21:14:32Z + , hackage.haskell.org 2026-07-02T00:02:36Z + , cardano-haskell-packages 2026-06-29T12:05:19Z active-repositories: , :rest From 3f08bffc0c70e9aba0fa4f32b8b04c0a121a1a7f Mon Sep 17 00:00:00 2001 From: Erik de Castro Lopo Date: Thu, 2 Jul 2026 13:22:14 +1000 Subject: [PATCH 2/5] cabal.project: Update allow-newers --- cabal.project | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cabal.project b/cabal.project index abb891618b..b880c0473b 100644 --- a/cabal.project +++ b/cabal.project @@ -83,11 +83,11 @@ if impl(ghc >= 9.14) , cborg:containers , cborg-json:base , compact:base + , data-elevator:base , dependent-map:containers , dictionary-sharing:containers , diff-containers:base , fs-sim:QuickCheck - , lsm-tree:data-elevator , ordered-containers:containers , partial-order:containers , safe-wild-cards:template-haskell From 71fe3d508621c7af2477d88413d9bf7766d4c4b1 Mon Sep 17 00:00:00 2001 From: Erik de Castro Lopo Date: Thu, 2 Jul 2026 13:28:11 +1000 Subject: [PATCH 3/5] Bump aeson lower bound There is a DoS vulnerability in earlier versions: https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html M --- cabal.project | 11 +++++++++++ cardano-cli/cardano-cli.cabal | 4 ++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/cabal.project b/cabal.project index b880c0473b..d7c4b6ed99 100644 --- a/cabal.project +++ b/cabal.project @@ -74,6 +74,17 @@ write-ghc-environment-files: always -- Do NOT add more source-repository-package stanzas here unless they are strictly -- temporary! Please read the section in CONTRIBUTING about updating dependencies. +-- Needed for the aeson >= 2.3 dependency. +allow-newer: + , cborg-json:aeson + , deriving-aeson:aeson + , grapesy:aeson + , grpc-spec:aeson + , hedgehog-extras:aeson + , microstache:aeson + , http-api-data:text-iso8601 + , vary:aeson + -- cabal-allow-newer begin if impl(ghc >= 9.14) allow-newer: diff --git a/cardano-cli/cardano-cli.cabal b/cardano-cli/cardano-cli.cabal index 2e24f66059..2da8b74806 100644 --- a/cardano-cli/cardano-cli.cabal +++ b/cardano-cli/cardano-cli.cabal @@ -233,7 +233,7 @@ library autogen-modules: Paths_cardano_cli build-depends: -- TODO: bump consensus back - aeson >=1.5.6.0, + aeson >=2.3, aeson-pretty >=0.8.5, ansi-terminal, attoparsec, @@ -433,7 +433,7 @@ test-suite cardano-cli-golden main-is: cardano-cli-golden.hs type: exitcode-stdio-1.0 build-depends: - aeson >=1.5.6.0, + aeson >=2.3, base16-bytestring, bytestring, cardano-api:{cardano-api, gen}, From de1938240b048c7fcb128be3c3fa1367c3e5c81e Mon Sep 17 00:00:00 2001 From: Erik de Castro Lopo Date: Thu, 2 Jul 2026 14:15:15 +1000 Subject: [PATCH 4/5] Nix updates --- flake.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index 6d0ead243c..6373a3524c 100644 --- a/flake.lock +++ b/flake.lock @@ -3,11 +3,11 @@ "CHaP": { "flake": false, "locked": { - "lastModified": 1780436322, - "narHash": "sha256-3YDsDhjAcm5QatdluTKuQ9WeDdwrxZMnKH587pVyv9o=", + "lastModified": 1782769557, + "narHash": "sha256-tCYMTwH15mNajHybvC3KGVPBPMlLlqIOYE0ZgcqRkJU=", "owner": "intersectmbo", "repo": "cardano-haskell-packages", - "rev": "bc93f1caabfdc4d38c5b44e6eea8f5b8f535775a", + "rev": "3ee6b1ecce230d62f0083590f38c4ae3457da226", "type": "github" }, "original": { @@ -209,11 +209,11 @@ "hackageNix": { "flake": false, "locked": { - "lastModified": 1780437449, - "narHash": "sha256-DhOIrGPtRfqqYjKhO8ETnKLhcuPAnPHx1iUoWoyGw4Y=", + "lastModified": 1782962365, + "narHash": "sha256-60rASaqJX9GbdbbHappidbeH8kSxWYF9LvxK9u2A/Is=", "owner": "input-output-hk", "repo": "hackage.nix", - "rev": "c791c3f52a6985d49316d1f76317ed36d7f0a915", + "rev": "f4163dbd37cd4000a755bd242df326e7870c1b88", "type": "github" }, "original": { From e72c6a1c1185d3669eb19dc5e5afc070a12198ea Mon Sep 17 00:00:00 2001 From: Erik de Castro Lopo Date: Thu, 2 Jul 2026 14:17:08 +1000 Subject: [PATCH 5/5] Changelog fragment --- .changes/20260702_updates.yml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 .changes/20260702_updates.yml diff --git a/.changes/20260702_updates.yml b/.changes/20260702_updates.yml new file mode 100644 index 0000000000..2b703fce69 --- /dev/null +++ b/.changes/20260702_updates.yml @@ -0,0 +1,31 @@ +# Changelog fragment template - copy this file and fill in the fields. +# Or use 'herald new' for interactive creation. +# +# Files starting with _ are ignored by herald. +# +# Available projects and kinds are defined in .herald.yml + +# Which project this change belongs to (see 'projects' in .herald.yml) +# Uncomment exactly one: +project: cardano-cli +# project: cardano-api-gen +# project: cardano-rpc +# project: cardano-wasm + +# Pull request number associated with this change +pr: 1394 + +# One or more change kinds (see 'kinds' in .herald.yml) +kind: +# - breaking # the API has changed in a breaking way +# - feature # introduces a new feature +# - compatible # the API has changed but is non-breaking +# - bugfix # fixes a defect +# - optimisation # measurable performance improvements +# - documentation # change in code docs, haddocks +# - refactoring # code quality improvements +# - test # fixes or modifies tests + - maintenance # not directly related to the code +# - release # related to a new release preparation +description: | + Update dependencies, increase lower bound of aeson dependency.