build(deps): bump 6 dependencies (dependabot #10-#15) - #17
Merged
Conversation
v8's only change was Node.js 24.x runner support. v9's breaking changes
(require('@actions/github') no longer works, getOctokit is now an injected
parameter) don't apply here — ci.yml's version-suggestion script only uses
the injected github.rest.*/github.graphql client, never require() or a
redeclared getOctokit.
Patch release (resolves a clippy double_must_use lint in generated code); async-trait isn't used directly in this crate's own code, only pulled transitively via deadpool-postgres/tokio-postgres. Cargo.toml's existing "0.1" range already covers this — only Cargo.lock needed updating. Build/test/clippy all pass unchanged.
Major bump, but 0.23's changelog only adds new consts/SIMD-accelerated engines and custom padding support -- Engine::encode/decode with general_purpose::STANDARD (our only usage, in extract.rs/binding.rs/blob.rs for BLOB wire format) is untouched. tokio-postgres's own transitive postgres-protocol dependency stays pinned to 0.22.1 independently -- no shared types cross that boundary, so both coexist without conflict. Verified: 85/85 unit tests pass (including BLOB encode/decode coverage in binding_tests.rs/blob_tests.rs), clippy/fmt clean, and the full live_db.rs suite against a real PostgreSQL instance (7/7).
Six minor versions, but our only usage (infer::get(data).map(|k| k.mime_type()) in handlers/blob.rs's encode_blob_full) is infer's core stable API -- the version range only adds new format detectors (DWG, qcow2, par2, improved LZ4/zstd/audio/PDF/mkv detection) and internal cleanup, no signature changes. Verified: 85/85 unit tests pass (including blob_tests.rs's direct coverage of encode_blob_full's mime-sniffing path), clippy/fmt clean.
Explicitly documented upstream as semver-incompatible only due to the jni 0.21->0.22 bump, which affects Android targets exclusively -- this plugin only ships linux/darwin/windows binaries (release.yml), no Android. Remaining changes are Windows-specific certificate-chain fixes. Our only call site, BuilderVerifierExt::with_platform_verifier() in client.rs, is unchanged. Verified: 85/85 unit tests pass, clippy/fmt clean, compiles without any call-site changes needed. Not verified: a live TLS handshake end-to-end -- the local test Postgres container has ssl=off, and reconfiguring it would disrupt the shared dev environment. The with_platform_verifier() builder call itself is exercised by every build; no behavior change is documented for non-Android platforms.
Internal fixes only (correct x509 channel-binding parsing, deferred TLS hostname validation, drops the ring/const-oid deps in favor of sha2). Our only call site, MakeRustlsConnect::new(tls_config) in client.rs, is unchanged. Verified against a disposable, self-signed-cert Postgres container (not the shared dev container) built specifically for this: verify-ca mode connects successfully with a proper SAN cert pinned via ssl_ca, and require mode correctly rejects an untrusted cert -- both behaviors confirmed identical against a from-scratch build of the pre-dependabot baseline commit, ruling out any regression from this bump specifically. Also ran the full live_db.rs suite (7/7) against the primary non-TLS pooled-connection path. 85/85 unit tests, clippy/fmt clean.
aesslinger
added
the
prerelease:beta
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Assessed all 6 open Dependabot PRs (#10-#15) for compatibility, then applied each independently — one commit per PR, in this branch — after verifying it doesn't change behavior. This is not a user-visible change: no version bump warranted (
buildtype → no release per this repo's PR-titles convention), pure dependency maintenance.actions/github-scriptgithub.rest.*/github.graphql, neverrequire('@actions/github')or a redeclaredgetOctokit(the only v9 breaking changes)async-traitbase64Engine::encode/decode+general_purpose::STANDARD) is untouched by the changelog (adds new consts/SIMD engines only)inferinfer::get(data).map(|k| k.mime_type())) isinfer's stable core API; the range only adds new format detectorsrustls-platform-verifierjni0.21→0.22 bump (Android-only impact); this plugin ships no Android target. Our call site (with_platform_verifier()) is unchangedtokio-postgres-rustlsMakeRustlsConnect::new()) is unchangedVerification
Every commit:
cargo build --release,cargo test --lib --bins(85/85),cargo clippy --all-targets -- -D warnings,cargo fmt --all -- --check— all clean at every step.For the two TLS-adjacent bumps (#13, #15), unit tests alone don't exercise a real TLS handshake, so:
verify-camode connects successfully when pinned to that cert viassl_ca, andrequiremode correctly rejects it (untrusted by the system store) — both before and after the bumps, via a from-scratch build of the pre-dependabot baseline commit for direct comparison. Identical behavior both ways — no regression.tests/live_db.rssuite (7/7) against the primary non-TLS pooled-connection path, both individually per-commit and with all 6 bumps stacked.Test plan
cargo test --lib --bins: 85/85 at every commitcargo clippy --all-targets -- -D warnings/cargo fmt --all -- --check: clean at every committests/live_db.rs: 7/7 against the shared non-TLS dev container