Repository navigation
fix(deps): upgrade to Rust 1.99.1 and bump dependencies - #870
Merged
Merged
Conversation
Pin rust-toolchain.toml to Rust 1.99.1, the latest stable release and the version the Containerfile already builds with. This lets us take s3 0.1.38, which moves to reqx 0.2 and quick-xml 0.42, so the release binary no longer contains the vulnerable zstd 0.13.3 / zstd-safe 7.3.0 or quick-xml 0.41.0 from the S3 client. - Bump s3 to 0.1.38, lru to 0.19, and refresh Cargo.lock. - Enable the tokio features we use (fs, io-util, macros, net, rt-multi-thread, time) explicitly. We used to get them through the old s3/reqx dependency tree. - Drop the five deny.toml advisory ignores for zstd and quick-xml, and the MPL-2.0 license allowance (option-ext is gone from the tree). - Use as_chunks instead of chunks_exact, for the new clippy lint in Rust 1.99. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ttfb2KibySRhAksoHwWgAL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Sascha · project thread
Pins
rust-toolchain.tomlto Rust 1.99.1, the latest stable release. TheContainerfilealready builds with 1.99.1, so CI and release builds now use the same compiler. The project has norust-versionfield, and CI takes its toolchain fromrust-toolchain.toml, so no other file needed a change.The new compiler lets us take s3 0.1.38, which moves to reqx 0.2 and quick-xml 0.42. The vulnerable
zstd 0.13.3/zstd-safe 7.3.0andquick-xml 0.41.0are no longer in the dependency tree.Changes
s30.1.36 → 0.1.38,lru0.18 → 0.19, andcargo updatefor everything else.tokio: list the features we use (fs,io-util,macros,net,rt-multi-thread,time). We used to get them through the old s3/reqx dependency tree, so without this the build fails.deny.toml: drop the five advisory ignores for zstd (RUSTSEC-2026-0391/0398/0403, added in fix(deps): bump zstd crates for RUSTSEC-2026-0410 #869) and quick-xml (RUSTSEC-2026-0194/0195). Also drop theMPL-2.0license allowance, becauseoption-extis no longer a dependency. The only remaining ignore is atomic-polyfill.chunks_exact(N)toas_chunks::<N>()in 5 places, for the newchunks_exact_to_as_chunksclippy lint in 1.99.Testing
Ran locally with Rust 1.99.1:
cargo fmt --checkpasses.cargo clippy --locked --all-targets -- -D warningspasses.cargo test --lockedpasses, including the integration tests with tippecanoe.cargo deny checkreports advisories, bans, licenses and sources as ok. It still prints the existing duplicate-crate warnings.Generated by Claude Code