Skip to content

Update dependencies#178

Merged
simonmarty merged 1 commit intomainfrom
update-deps
Mar 24, 2026
Merged

Update dependencies#178
simonmarty merged 1 commit intomainfrom
update-deps

Conversation

@simonmarty
Copy link
Copy Markdown
Contributor

@simonmarty simonmarty commented Mar 23, 2026

Description

Why is this change being made?

  1. Addressing CVEs on dependencies

What is changing?

  1. Dependency version numbers in the lockfile

Related Links

  • Issue #, if available:

Testing

How was this tested?

  1. cargo test --exclude integration_tests --workspace

When testing locally, provide testing artifact(s):


Reviewee Checklist

Update the checklist after submitting the PR

  • I have reviewed, tested and understand all changes
    If not, why:
  • I have filled out the Description and Testing sections above
    If not, why:
  • Build and Unit tests are passing
    If not, why:
  • Unit test coverage check is passing
    If not, why:
  • Integration tests pass locally
    If not, why: Did not run integ tests locally, will wait for GH action run.
  • I have updated integration tests (if needed)
    If not, why: Not needed since this is just a dependency version update.
  • I have ensured no sensitive information is leaking (i.e., no logging of sensitive fields, or otherwise)
    If not, why: Not applicable, we are just doing dependency update.
  • I have added explanatory comments for complex logic, new classes/methods and new tests
    If not, why: No complex logic added.
  • I have updated README/documentation (if needed)
    If not, why: No changes to readme needed for a version update.
  • I have clearly called out breaking changes (if any)
    If not, why: No breaking changes.

Reviewer Checklist

All reviewers please ensure the following are true before reviewing:

  • Reviewee checklist has been accurately filled out
  • Code changes align with stated purpose in description
  • Test coverage adequately validates the changes

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@simonmarty simonmarty requested a review from a team as a code owner March 23, 2026 21:00
@simonmarty simonmarty requested a review from reyhankoyun March 23, 2026 21:00
@simonmarty simonmarty added the safe-to-test Maintainer approval to run integration tests for external contributor PRs. label Mar 23, 2026
@simonmarty simonmarty enabled auto-merge (squash) March 23, 2026 21:01
@github-actions github-actions bot removed the safe-to-test Maintainer approval to run integration tests for external contributor PRs. label Mar 23, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 23, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.14%. Comparing base (d4a69c0) to head (a973f2a).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #178   +/-   ##
=======================================
  Coverage   92.14%   92.14%           
=======================================
  Files          14       14           
  Lines        2405     2405           
  Branches     2405     2405           
=======================================
  Hits         2216     2216           
  Misses        143      143           
  Partials       46       46           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@simonmarty simonmarty requested a review from harsheejshah March 23, 2026 22:46
Copy link
Copy Markdown

@harsheejshah harsheejshah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

approved

@simonmarty simonmarty merged commit 49af71f into main Mar 24, 2026
12 checks passed
@simonmarty simonmarty deleted the update-deps branch March 24, 2026 19:40
"hex",
"http 1.4.0",
"ring",
"sha1",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why move from ring to sha1?

"bytes",
"fastrand",
"http 0.2.12",
"http 1.4.0",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need both http versions here? If we support both now, what will be our migration strategy to only using Major version 1?
Same for multiple other places.

]

[[package]]
name = "sha1"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://crates.io/crates/sha1

The SHA-1 hash function should be considered cryptographically broken and unsuitable for further use in any security critical capacity, as it is practically vulnerable to chosen-prefix collisions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants