Repository navigation
chore(deps): bump the cargo-major group across 1 directory with 5 updates - #99
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
…ates Bumps the cargo-major group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [prost](https://github.com/tokio-rs/prost) | `0.13.5` | `0.14.4` | | [lz4_flex](https://github.com/pseitz/lz4_flex) | `0.13.1` | `0.14.0` | | [apache-avro](https://github.com/apache/avro-rs) | `0.21.0` | `0.22.0` | | [num-bigint](https://github.com/rust-num/num-bigint) | `0.4.8` | `0.5.1` | | [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` | Updates `prost` from 0.13.5 to 0.14.4 - [Release notes](https://github.com/tokio-rs/prost/releases) - [Changelog](https://github.com/tokio-rs/prost/blob/master/CHANGELOG.md) - [Commits](tokio-rs/prost@v0.13.5...v0.14.4) Updates `lz4_flex` from 0.13.1 to 0.14.0 - [Release notes](https://github.com/pseitz/lz4_flex/releases) - [Changelog](https://github.com/PSeitz/lz4_flex/blob/main/CHANGELOG.md) - [Commits](PSeitz/lz4_flex@0.13.1...0.14.0) Updates `apache-avro` from 0.21.0 to 0.22.0 - [Release notes](https://github.com/apache/avro-rs/releases) - [Changelog](https://github.com/apache/avro-rs/blob/main/RELEASE.md) - [Commits](apache/avro-rs@rel/release-0.21.0...rel/release-0.22.0) Updates `num-bigint` from 0.4.8 to 0.5.1 - [Changelog](https://github.com/rust-num/num-bigint/blob/main/RELEASES.md) - [Commits](rust-num/num-bigint@num-bigint-0.4.8...num-bigint-0.5.1) Updates `base64` from 0.22.1 to 0.23.1 - [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md) - [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1) --- updated-dependencies: - dependency-name: prost dependency-version: 0.14.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: lz4_flex dependency-version: 0.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: apache-avro dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: num-bigint dependency-version: 0.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major - dependency-name: base64 dependency-version: 0.23.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-major ... Signed-off-by: dependabot[bot] <support@github.com>
seagrep benchmarksmicromicro did not produce a table e2e S3e2e did not produce a table scalescale did not produce a table proseprose did not produce a table |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the cargo-major group with 5 updates in the / directory:
0.13.50.14.40.13.10.14.00.21.00.22.00.4.80.5.10.22.10.23.1Updates
prostfrom 0.13.5 to 0.14.4Changelog
Sourced from prost's changelog.
... (truncated)
Commits
13646cdchore: Release version 0.14.4 (#1437)dad79d5fix(prost-derive): return error for invalid enumeration default identifiers (...b0b6c93ci: Updatecargo clippyto 1.91 (#1435)32cfffbstyle: remove explicit.into_iter()(#1434)2710efdci: Updatecargo clippyto 1.89 (#1433)18ea4e4style: use variables directly informat!()(#1432)2821bd1build(deps): bump actions/upload-artifact from 6 to 7 (#1409)3ce3b39test(groups): Actually constructNestedGroup(#1363)8776405docs: Update changelog for version 0.14.3 (#1431)33d3ef1build: Grab binary path from cargo (#1429)Updates
lz4_flexfrom 0.13.1 to 0.14.0Changelog
Sourced from lz4_flex's changelog.
Commits
1bffdcbMerge pull request #229 from PSeitz/release/0.14.0-changeloga5973e4Update CHANGELOG for 0.14.0 release, bump version to 0.14.043cdb22Merge pull request #228 from PSeitz/0.14.x08fd47eadd release skilla6c6135Merge pull request #225 from fbrozovic/alloc-featureca019ecAdd alloc feature to support no_std without an allocator19194f9Merge pull request #223 from PSeitz/0.13.xUpdates
apache-avrofrom 0.21.0 to 0.22.0Release notes
Sourced from apache-avro's releases.
... (truncated)
Changelog
Sourced from apache-avro's changelog.
... (truncated)
Commits
ec5721cchore(deps): Bump thiserror from 2.0.18 to 2.0.19 (#604)b946aa3chore(deps): Bump quote from 1.0.46 to 1.0.47 (#605)98fa1f4chore(deps): Bump serde from 1.0.228 to 1.0.229 (#607)49732c4chore(ci): Bump the github-codeql group with 2 updates (#608)73629ebchore(ci): Bump shogo82148/actions-setup-perl from 1.41.1 to 1.42.0 (#609)ed733edchore(ci): Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#610)1c11867chore(ci): Bump actions/setup-java from 5.5.0 to 5.6.0 (#611)6879d53chore(ci): Bump taiki-e/install-action from 2.83.2 to 2.84.0 (#612)e59778bchore(deps): Bump proc-macro2 from 1.0.106 to 1.0.107 (#603)784294dfix: Allow serializing an enum inside a union (#591)Updates
num-bigintfrom 0.4.8 to 0.5.1Changelog
Sourced from num-bigint's changelog.
Commits
33c59baMerge pull request #348 from cuviper/bz-alg2-step3b38b68f6Release 0.5.1f4a43f5Fix the missing part of the Burnikel-Ziegler algorithmebfd89aAdd failing tests for a bug in B-Z division0ab95dfMerge pull request #338 from cuviper/rand-0.1033d6998Release 0.5.084d05b7Clean up manifests of ci cratesf8daf56Allowclippy::duplicate_modwhere intended022310aRearrange therandfeatures to support both 0.9 and 0.10537a036ci: use the fallback resolver for depsUpdates
base64from 0.22.1 to 0.23.1Changelog
Sourced from base64's changelog.
Commits
069bf70v0.23.16ab1fb0Merge pull request #310 from musicinmybrain/test-on-non-simd-arches7cffce6Fix testing on architectures without unsafe SIMD supporte34f9a0Merge pull request #308 from atouchet/come9240c9Remove outdated comment9e9220av0.23.0870326eMerge pull request #306 from marshallpierce/mp/trailing-bits-docsfbec5f1Document no trailing trailing bits0a23549Merge pull request #305 from marshallpierce/mp/edition-2021f10b7e2Update deps & editionDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsNote
Medium Risk
Major bumps of format-decoding crates (
apache-avro0.22,prost0.14,lz4_flex0.14) can change decode behavior; Avro 0.22 documents many breaking API and schema-parsing changes.Overview
Dependabot major-version updates for five crates:
prost0.13.5 → 0.14.4,lz4_flex0.13.1 → 0.14.0,apache-avro0.21.0 → 0.22.0,num-bigint0.4.8 → 0.5.1, andbase640.22.1 → 0.23.1. Manifests andCargo.lockonly; no application source changes.apache-avro0.22 is the highest-impact bump (stricter schema parsing and other breaking API changes).lz4_flex0.14 is used for LZ4 frame decode;prostfor protobuf/ORC;base64for JSON match encoding. Dual versions remain in the lockfile where other crates still pin olderbase64/num-bigint/lz4_flex/prost.Reviewed by Cursor Bugbot for commit 47630e2. Bugbot is set up for automated code reviews on this repo. Configure here.
Greptile Summary
This change upgrades five direct Rust dependencies and refreshes the lockfile. The updated dependency set prevents
seagrep-corefrom building: ORC decoding imports a Prost trait from a version incompatible withorc-rust, Avro decimal conversion crosses incompatiblenum-bigintversions, and the test helpers use the fallible Avro writer constructor as though it returned a writer directly.T-Rex validation blocked
The compilation command completed and reported these failures, but the uploaded validation artifacts were returned without the required artifact labels. Because the evidence cannot be rendered as labeled artifacts, no proof entries are included.
Confidence Score: 2/5
Not safe to merge because the upgraded dependency set stops the core library and its test target from compiling.
The locked all-targets, all-features core compilation check reproduced three independent failures at the reported source locations: a Prost trait-version mismatch, a
num-biginttype-version mismatch, and an unhandled fallible Avro writer constructor.Files Needing Attention:
crates/core/src/codec/detect.rs,crates/core/src/codec/tabular.rs,crates/core/src/testutil.rs, and the corresponding dependency declarations inCargo.tomlandcrates/core/Cargo.tomlneed updates.What T-Rex did
Comments Outside Diff (3)
General comment
crates/core/src/codec/detect.rs:133:orc_rust::proto::PostScript::decode(...)is not found. The compiler identifies two Prost versions: the importedMessagetrait is Prost 0.14.4, whilePostScriptimplements the Prost 0.13.5 trait required byorc-rust 0.8.0.crates/core/Cargo.toml:49consumes workspace Prost 0.14.4, but lockedorc-rust 0.8.0depends on Prost 0.13.5. Trait-provided associated methods cannot cross crate-version boundaries.orc-rustfor this decode path (for example, add an explicitly renamed Prost 0.13 dependency and import itsMessagetrait), or upgradeorc-rustto a release generated against/compatible with Prost 0.14 before retaining the workspace 0.14 dependency.General comment
crates/core/src/codec/tabular.rs:89:let unscaled: num_bigint::BigInt = decimal.into();fails becauseBigInt: From<apache_avro::Decimal>is not implemented. The compiler explicitly reports multiple num-bigint versions.crates/core/Cargo.toml:35selectsnum-bigint 0.5.1, whereas lockedapache-avro 0.22.0exposes itsDecimalconversion fornum-bigint 0.4.8.num-bigintdependency with Apache Avro's 0.4.x type for this conversion, or convert through Avro's supported byte representation so the code does not require the two versionedBigInttypes to be identical.General comment
writer.append(...)andwriter.into_inner()targetResult<apache_avro::Writer<_>, _>, rather thanWriter. Primary occurrences arecrates/core/src/testutil.rs:171,175,177; repeated test cases fail atcrates/core/src/codec.rs:1740,1742,1816,1817,1835,1836,1854,1856.Writer::new(&schema, Vec::new())returnResult<Writer<_>, _>, but the existing code retains the pre-upgrade direct-Writer usage.apache_avro::Writer::new(...)at construction, then callappendandinto_inneron the resulting writer.Reviews (1): Last reviewed commit: "chore(deps): bump the cargo-major group ..." | Re-trigger Greptile