Why is my system trying to build a newer solana-program crate than the one I have installed?

Question

So when I build projects (new or old), I frequently see this error:

% anchor test
error: package `solana-program v1.18.12` cannot be built because it requires rustc 1.75.0 or newer, while the currently active rustc version is 1.72.0-dev

I know how to fix this error, but my question is: why is my system trying to build solana-program v1.18.12?

My versions:

% cargo build-sbf --version
solana-cargo-build-sbf 1.18.5
platform-tools v1.39
rustc 1.72.0

% solana -V
solana-cli 1.18.5

My system has 1.18.5 - where is '1.18.12' coming from?

Answer 1

cargo, the Rust package manager, uses Semantic Versioning (SemVer) when deciding which version of the dependency to install.

My system has 1.18.5 - where is '1.18.12' coming from?

There is (almost) no link between your solana-cli version and the solana-program crate you install other than the fact that they use the same release schedule, hence the same versioning.

anchor-lang 0.30.0 uses the following version requirement for the solana-program crate:

solana-program = "1.16"

For Semver, this means >= 1.16.0, < 2.0.0, and because cargo resolves to the latest compatible version by default, new installations (without a lock file) currently resolve to the 1.18.12 version.

This is also the reason why the ecosystem participants have continuously requested for Solana crates to properly follow SemVer in order to reduce the possibility of dependency related issues.