Update to use non vulnerable dependencies

Cargo.toml

@@ -1,4 +1,5 @@
 [workspace]
+resolver = "2"
 
 members = [
     "pyth-sdk",

examples/sol-contract/Cargo.toml

@@ -8,7 +8,8 @@ edition = "2021"
 crate-type = ["cdylib", "lib"]
 
 [dependencies]
-borsh = "0.10.3"
+borsh = { version = "1.5.0", features = ["derive"] }
+borsh-derive = "1.5.0"
 arrayref = "0.3.6"
-solana-program = ">= 1.10"
-pyth-sdk-solana = { path = "../../pyth-sdk-solana", version = "0.10.0" }
+solana-program = "1.18.4"
+pyth-sdk-solana = { path = "../../pyth-sdk-solana" }

examples/sol-contract/src/instruction.rs

@@ -4,7 +4,7 @@
 //!     Init{} initializing some loan information and
 //!     Loan2Value{} checking the loan-to-value ratio of the loan.
 
-use borsh::{
+use borsh_derive::{
     BorshDeserialize,
     BorshSerialize,
 };

examples/sol-contract/src/processor.rs

@@ -14,10 +14,7 @@ use solana_program::pubkey::Pubkey;
 use solana_program::sysvar::clock::Clock;
 use solana_program::sysvar::Sysvar;
 
-use borsh::{
-    BorshDeserialize,
-    BorshSerialize,
-};
+use borsh::BorshDeserialize;
 use pyth_sdk_solana::state::SolanaPriceAccount;
 
 use crate::instruction::ExampleInstructions;
@@ -56,7 +53,7 @@ pub fn process_instruction(
             SolanaPriceAccount::account_info_to_feed(pyth_loan_account)?;
             SolanaPriceAccount::account_info_to_feed(pyth_collateral_account)?;
 
-            let config_data = config.try_to_vec()?;
+            let config_data = borsh::to_vec(&config)?;
             let config_dst = &mut admin_config_account.try_borrow_mut_data()?;
             sol_memcpy(config_dst, &config_data, 1 + 32 + 32);
             Ok(())

pyth-sdk-solana/Cargo.toml

@@ -11,9 +11,9 @@ keywords = [ "pyth", "solana", "oracle" ]
 readme = "README.md"
 
 [dependencies]
-solana-program = ">= 1.9"
-borsh = "0.10.3"
-borsh-derive = "0.10.3"
+solana-program = "1.18.14"
+borsh = "1.5.0"
+borsh-derive = "1.5.0"
 bytemuck = "1.7.2"
 num-derive = "0.3"
 num-traits = "0.2"
@@ -22,8 +22,8 @@ serde = { version = "1.0.136", features = ["derive"] }
 pyth-sdk = { path = "../pyth-sdk", version = "0.8.0" }
 
 [dev-dependencies]
-solana-client = ">= 1.9"
-solana-sdk = ">= 1.9"
+solana-client = "1.18.14"
+solana-sdk = "1.18.14"
 
 [lib]
 crate-type = ["cdylib", "lib"]

pyth-sdk-solana/src/state.rs

@@ -1,6 +1,6 @@
 //! Structures and functions for interacting with Solana on-chain account data.
 
-use borsh::{
+use borsh_derive::{
     BorshDeserialize,
     BorshSerialize,
 };

pyth-sdk-solana/test-contract/Cargo.toml

@@ -8,16 +8,16 @@ test-bpf = []
 no-entrypoint = []
 
 [dependencies]
-pyth-sdk-solana = { path = "../", version = "0.10.0" }
-solana-program = ">= 1.10, <= 1.16"
+pyth-sdk-solana = { path = "../" }
+solana-program = "1.18.14"
 bytemuck = "1.7.2"
-borsh = "0.10.3"
-borsh-derive = "0.10.3"
+borsh = "1.5.0"
+borsh-derive = "1.5.0"
 
 [dev-dependencies]
-solana-program-test = ">= 1.10, <= 1.16"
-solana-client = ">= 1.10, <= 1.16"
-solana-sdk = ">= 1.10, <= 1.16"
+solana-program-test = "1.18.4"
+solana-client = "1.18.4"
+solana-sdk = "1.18.4"
 
 [lib]
 crate-type = ["cdylib", "lib"]

pyth-sdk/Cargo.toml

@@ -15,8 +15,8 @@ crate-type = ["cdylib", "lib"]
 
 [dependencies]
 hex = { version = "0.4.3", features = ["serde"] }
-borsh = "0.10.3"
-borsh-derive = "0.10.3"
+borsh = "1.5.0"
+borsh-derive = "1.5.0"
 serde = { version = "1.0.136", features = ["derive"] }
 schemars = "0.8.8"
 getrandom = { version = "0.2.2", features = ["custom"] }

pyth-sdk/src/lib.rs

@@ -1,4 +1,4 @@
-use borsh::{
+use borsh_derive::{
     BorshDeserialize,
     BorshSerialize,
 };

pyth-sdk/src/price.rs

@@ -1,4 +1,4 @@
-use borsh::{
+use borsh_derive::{
     BorshDeserialize,
     BorshSerialize,
 };