error: failed to select a version for the requirement `anchor-lang = "^0.14.0"`

Question

Im trying to use marinade finance program to CPI into for my project, however while trying to import it in my cargo.toml i get this error

My cargo.toml dependencies

[dependencies]
anchor-lang = "0.24.2"
anchor-spl = "0.24.2"
marinade-finance = { git = "https://github.com/marinade-finance/liquid-staking-program" }

The error

Failed to obtain package metadata: `cargo metadata` exited with an error: warning: profiles for the non root package will be ignored, specify profiles at the workspace root:
package:   /home/swaystar/programming/solana/altruism/programs/altruism/Cargo.toml
workspace: /home/swaystar/programming/solana/altruism/Cargo.toml
    Updating git repository `https://github.com/marinade-finance/liquid-staking-program`
    Updating crates.io index
error: failed to select a version for the requirement `anchor-lang = "^0.14.0"`
candidate versions found which didn't match: 0.25.0, 0.24.2
location searched: crates.io index
required by package `marinade-finance v0.1.0 (https://github.com/marinade-finance/liquid-staking-program#a309057f)`
    ... which satisfies git dependency `marinade-finance` of package `altruism v0.1.0 (/home/swaystar/programming/solana/altruism/programs/altruism)`

Answer 1

youre seeing this error because all pre-0.24 anchor versions were yanked from cargo due to a vuln. you can reproduce the same error with an empty project

name = "asdf"
version = "0.1.0"
edition = "2021"

[dependencies]
anchor-lang = "0.14.0"

error: failed to select a version for the requirement `anchor-lang = "^0.14.0"`
candidate versions found which didn't match: 0.25.0, 0.24.2
location searched: crates.io index
required by package `asdf v0.1.0 (/tmp/asdf)

unfortunately cargo yank and the decision to use it is a deliberate choice to induce breakage, the merits of which can be debated. as for a solution, you might be able to build the dependency yourself and specify it in Cargo.toml by its filesystem path, if the authors provided a Cargo.lock file

Answer 2

I had the same error and solved here: https://stackoverflow.com/questions/72022128/solana-anchor-error-yanked-dependencies-failed-to-obtain-package-metadata-c

what you need to do get it working is go to /programs/myAnchorProject/cargo.toml. I'm assuming your program name is myAnchorProject or replace it with your program name.

[dependencies]
anchor-lang = "^0.24.2"