refactor: migrate inline dev-deps to workspace references in basics/

[NikkiAung]

Summary

• Replaces all inline-pinned [dev-dependencies] versions with .workspace = true across 28 native, pinocchio, and asm Cargo.toml files under basics/
• Adds two new entries to the root [workspace.dependencies]: solana-rent = "4.1.0" and solana-transaction-error = "3.2.0"
• Also migrates the cross-program-invocation hand/lever programs' inline [dependencies] (borsh, borsh-derive, solana-program, solana-system-interface) to workspace references

This removes the version duplication that makes future upgrades error-prone — when a crate version bumps in root Cargo.toml, it now propagates automatically to all member crates.

Test plan

• cargo metadata --no-deps resolves cleanly with no errors
• CI build matrix passes for all affected programs

[greptile-apps]

Greptile Summary

This PR migrates inline-pinned [dev-dependencies] versions across 28 Cargo.toml files under basics/ to *.workspace = true references, eliminating version duplication so a single edit to the root manifest propagates everywhere. It also refactors the realloc TypeScript client from the old borsh v0 class-based API to the modern borsh v2 plain-object schema API, and improves the favorites test assertion logic.

• Workspace migration: adds solana-rent = "4.1.0" and solana-transaction-error = "3.2.0" to root [workspace.dependencies]; all migrated crates already present in the root manifest resolve correctly.
• CPI programs (hand/lever) keep inline versions (now bumped to borsh 1.6.1 / solana-program 4.0) since they live in their own sub-workspace with no [workspace.dependencies] section.
• pnpm-lock.yaml incidentally drops the libc: [glibc] and libc: [musl] qualifiers from the solana-bankrun Linux optional packages, which is unrelated to the stated change and could affect CI optional-dependency resolution on Linux.

Confidence Score: 5/5

Safe to merge; the workspace migration is mechanically correct and all migrated crates are defined in the root manifest.

Every .workspace = true reference introduced in the 28 member crates maps to an entry that already existed (or is newly added) in the root [workspace.dependencies]. The CPI sub-workspace programs correctly keep inline version pins. The realloc borsh v2 migration and the favorites test fix are clean. The only notable side-effect is the unrelated removal of libc qualifiers from the pnpm lockfile, which could affect Linux CI optional-dependency selection but does not break the Rust workspace changes.

basics/realloc/native/pnpm-lock.yaml — the incidental removal of libc qualifiers from solana-bankrun Linux platform packages should be verified or regenerated with the project's canonical pnpm version.

Important Files Changed

Filename	Overview
Cargo.toml	Adds solana-transaction-error = "3.2.0" and solana-rent = "4.1.0" to [workspace.dependencies] to support the new workspace references in member crates
basics/cross-program-invocation/native/programs/hand/Cargo.toml	Bumps inline [dependencies] (borsh 1.5.7 → 1.6.1, solana-program 3.0 → 4.0); dev-dependencies remain inline since this crate belongs to its own sub-workspace with no [workspace.dependencies]
basics/cross-program-invocation/native/programs/lever/Cargo.toml	Same inline version bumps as hand (borsh 1.5.7 → 1.6.1, solana-program 3.0 → 4.0) for the same sub-workspace reason
basics/favorites/native/tests/test.ts	Removes stale bn.js import, improves wrong-PDA test assertion so it fails rather than silently passing, and renames favoritesPda to wrongPda for clarity
basics/realloc/native/ts/instructions/create.ts	Migrates to borsh v2 plain-object API and sets isSigner: true for the target account (the isSigner flip was flagged in a prior review thread)
basics/realloc/native/ts/instructions/reallocate.ts	Refactors to borsh v2 plain-object schema API, removing the class-based ReallocateWithoutZeroInit and ReallocateZeroInit wrappers
basics/realloc/native/ts/state/address-info.ts	Moves AddressInfoSchema definition before the class and switches fromBuffer to the borsh v2 two-argument deserialize call
basics/realloc/native/pnpm-lock.yaml	Adds borsh@2.0.0 snapshot and removes the libc: [glibc] / libc: [musl] qualifiers from the solana-bankrun Linux platform packages, which may affect optional-dependency resolution on Linux
basics/realloc/native/package.json	Adds borsh@^2.0.0 as a runtime dependency to support the new plain-object borsh v2 schema API
basics/repository-layout/native/program/Cargo.toml	Migrates both [dependencies] (borsh, borsh-derive, solana-program) and [dev-dependencies] to workspace references

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Root["Root Cargo.toml\n[workspace.dependencies]\nlitesvm, solana-keypair,\nsolana-pubkey, solana-transaction,\nsolana-native-token, solana-instruction,\nsolana-rent, solana-transaction-error\n+ borsh, solana-program …"]

    Root -->|".workspace = true"| A["basics/*/native/program/Cargo.toml\n(~14 crates)"]
    Root -->|".workspace = true"| B["basics/*/pinocchio/program/Cargo.toml\n(~12 crates)"]
    Root -->|".workspace = true"| C["basics/*/asm/Cargo.toml\n(2 crates)"]

    SubWS["basics/cross-program-invocation/native/Cargo.toml\n(sub-workspace, no [workspace.dependencies])"]
    SubWS -->|"inline versions kept\nborsh=1.6.1, solana-program=4.0"| D["hand/Cargo.toml"]
    SubWS -->|"inline versions kept\nborsh=1.6.1, solana-program=4.0"| E["lever/Cargo.toml"]

    style Root fill:#d4edda,stroke:#28a745
    style SubWS fill:#fff3cd,stroke:#ffc107

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    Root["Root Cargo.toml\n[workspace.dependencies]\nlitesvm, solana-keypair,\nsolana-pubkey, solana-transaction,\nsolana-native-token, solana-instruction,\nsolana-rent, solana-transaction-error\n+ borsh, solana-program …"]

    Root -->|".workspace = true"| A["basics/*/native/program/Cargo.toml\n(~14 crates)"]
    Root -->|".workspace = true"| B["basics/*/pinocchio/program/Cargo.toml\n(~12 crates)"]
    Root -->|".workspace = true"| C["basics/*/asm/Cargo.toml\n(2 crates)"]

    SubWS["basics/cross-program-invocation/native/Cargo.toml\n(sub-workspace, no [workspace.dependencies])"]
    SubWS -->|"inline versions kept\nborsh=1.6.1, solana-program=4.0"| D["hand/Cargo.toml"]
    SubWS -->|"inline versions kept\nborsh=1.6.1, solana-program=4.0"| E["lever/Cargo.toml"]

    style Root fill:#d4edda,stroke:#28a745
    style SubWS fill:#fff3cd,stroke:#ffc107

Loading

_{Reviews (2): Last reviewed commit: "fix: revert CPI hand/lever to inline dep..." | Re-trigger Greptile}

[greptile-apps]

Workspace references in a non-root workspace member

The hand and lever programs live inside their own isolated sub-workspace declared at basics/cross-program-invocation/native/Cargo.toml, which has no [workspace.dependencies] section. Every borsh.workspace = true, borsh-derive.workspace = true, solana-program.workspace = true, litesvm.workspace = true, etc. added here will resolve against that local workspace, not the root workspace. Because the local workspace defines no [workspace.dependencies], Cargo will error: `workspace.borsh` was not found in the root manifest's `workspace.dependencies`. Building the CPI native example directly (or any CI job that targets it) will fail. Either add the needed entries to basics/cross-program-invocation/native/Cargo.toml's [workspace.dependencies], or keep the versions inline for these two crates.

[greptile-apps]

Same sub-workspace issue as hand

lever is also a member of basics/cross-program-invocation/native/Cargo.toml (not the root workspace). All four *.workspace = true references here (borsh, borsh-derive, solana-program, solana-system-interface) will fail to resolve for the same reason described on hand/Cargo.toml.

[greptile-apps]

isSigner flipped for target account

The target account changed from isSigner: false to isSigner: true. If target is a program-derived address, the runtime will reject the transaction because PDAs cannot provide a traditional signature. If target is a regular keypair, the transaction must include that keypair as a signer — but this change is unrelated to the stated scope of this PR (workspace dep migration), and the realloc test files were not updated to supply the extra signature. Please confirm the intended semantics and update the test accordingly.

[NikkiAung]

Thanks for the review @greptile-apps!

CPI hand/lever — fixed in the latest push (commit d801098). Those programs live in basics/cross-program-invocation/native/ which is its own sub-workspace with no [workspace.dependencies], so I've reverted them back to inline versions.

realloc/native/ts/instructions/create.ts — this change is not part of this PR. The isSigner: true fix for the target account is in a separate PR (#631) that was already opened before this branch was created. This PR only touches Cargo.toml files and the root Cargo.toml.

[greptile-apps]

Thanks for the clarification on both points!

CPI hand/lever — confirmed, the revert in d801098 looks correct. basics/cross-program-invocation/native/ has its own root [workspace] table without a [workspace.dependencies] section, so .workspace = true would fail to resolve there. Keeping those deps inline is the right call.

realloc/native/ts/instructions/create.ts — understood, that's tracked in #631. No action needed here.

The PR looks good from a correctness standpoint. Once CI confirms cargo metadata --no-deps resolves cleanly across all 28 affected members, this should be ready to merge.

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.