Unable to build `sp-runtime` after `cargo update`

[Serial-ATA]

sp-runtime depends on parity-scale-codec 3.6.12 (https://crates.io/crates/sp-runtime/40.1.0/dependencies), and pinning it to that version makes it possible to build again.

Running cargo update bumps the version to 3.7.2, which causes the following:

  error[E0277]: the trait bound `generic::header::Header<Number, Hash>: Encode` is not satisfied
      --> <path>/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sp-runtime-39.0.5/src/generic/header.rs:75:39
       |
  75   | impl<Number, Hash> traits::Header for Header<Number, Hash>
       |                                       ^^^^^^^^^^^^^^^^^^^^ the trait `Encode` is not implemented for `generic::header::Header<Number, Hash>`
       |
       = note: required for `generic::header::Header<Number, Hash>` to implement `Codec`
  note: required by a bound in `traits::Header`
      --> <path>/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sp-runtime-39.0.5/src/traits.rs:1199:24
       |
  1198 | pub trait Header:
       |           ------ required by a bound in this trait
  1199 |     Clone + Send + Sync + Codec + Eq + MaybeSerialize + Debug + TypeInfo + 'static
       |                           ^^^^^ required by this bound in `Header`
  help: consider extending the `where` clause, but there might be an alternative better way to express this requirement
       |
  78   |     Hash: HashT, generic::header::Header<Number, Hash>: Encode
       |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  error[E0277]: the trait bound `generic::header::Header<Number, Hash>: Encode` is not satisfied
     --> <path>/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sp-runtime-39.0.5/src/generic/header.rs:148:17
      |
  148 |         Hash::hash_of(self)
      |         ------------- ^^^^ the trait `Encode` is not implemented for `generic::header::Header<Number, Hash>`
      |         |
      |         required by a bound introduced by this call
      |
  note: required by a bound in `traits::Hash::hash_of`
     --> <path>/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sp-runtime-39.0.5/src/traits.rs:973:16
      |
  973 |     fn hash_of<S: Encode>(s: &S) -> Self::Output {
      |                   ^^^^^^ required by this bound in `Hash::hash_of`
  help: consider extending the `where` clause, but there might be an alternative better way to express this requirement
      |
  143 |     Hash: HashT, generic::header::Header<Number, Hash>: Encode
      |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  For more information about this error, try `rustc --explain E0277`.
  error: could not compile `sp-runtime` (lib) due to 2 previous errors

[bkchr]

@Serial-ATA do you have a link to the repo? So, we can reproduce this.

[Serial-ATA]

@bkchr https://github.com/tangle-network/gadget

Specifically, the package in blueprints/incredible-squaring. The workspace Cargo.lock still has parity-scale-codec 3.6.12, so you should be able to build before cargo update.

[gui1117]

 1031  git clone https://github.com/tangle-network/gadget
 1032  cd gadget/
 1033  cd blueprints/incredible-squaring
 1036  cargo update -p parity-scale-codec
 1037  cargo check

This returns success to me

EDIT: but running cargo update and not cargo update -p parity-scale-codec, now I can reproduce.

[gui1117]

My guess is that one PR has added where Hash: Encode bound in the derive macro, or at least some unwanted bound

EDIT: my new guess is that it is actually the compact bound that is wrong.

[xlc]

we having the same issue here https://github.com/open-web3-stack/open-runtime-module-library/actions/runs/13042465350/job/36387082114
force to use 3.6.12 workarounds it

[gui1117]

I think this is the fix: #689

[serban300]

Thank you for the report ! Taking a look.

[serban300]

Yes, #689 should fix this. Yanked 3.7.2 and will publish 3.7.3 after the fix is merged

[Shr1ftyy]

[gui1117]

what do you mean, failing at compilation because of a bounds issue is not a CVE.