Pin cardano-node dependencies in cabal files.

[coot]

cardano-node dependencies should be pinned in *.cabal files rather than cabal.project file.

Note that people might use some packages independently of the others (thanks to CHaP), thus independent components should come with package bounds.

What I found so far is that we can pin network packages in cardano-api, which will be propagated to cardano-cli & cardano-node. But there are other nodes of the dependency graph which must be constraint, e.g. the trace-* packages, cardano-tracer package, etc.

We need to add upper bounds so that things don't suddenly break for downstream when a new version of some dependency is published to CHaP.

[andreabedini]

Happy to help with this.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 120 days.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 120 days.

[nfrisby]

A brief Slack discussion today (about explicitly bounding eg the ledger packages) suggests that @Jimbo4350 is also interested in this.