chore: modernize dependencies + bump Rust to 1.95.0#2
Merged
Conversation
Toolchain: - Bump workspace rust-version 1.94 -> 1.95; CI toolchain pins 1.94.0 -> 1.95.0 - Dockerfile builder rust:1.93-alpine -> rust:1.95-alpine (was below MSRV) - docs/README prerequisite Rust 1.93+ -> 1.95+ Dependencies: - cargo update: tokio 1.50->1.52, axum 0.8.8->0.8.9, reqwest 0.13.2->0.13.4, rustls 0.23.37->0.23.41, uuid 1.22->1.23, zeroize 1.8->1.9, and other semver-compatible patch/minor bumps across the lockfile - Major bumps: sha2 0.10->0.11, hmac 0.12->0.13, pbkdf2 0.12->0.13 (RustCrypto stack; pbkdf2 "simple" feature -> "hmac"), tower-http 0.6->0.7, pyo3 0.28->0.29 Code changes required by the bumps: - auth (core + server): import hmac::KeyInit (new_from_slice moved to the KeyInit trait in hmac 0.13 / crypto-common 0.2) - codecs/json/v3: collapse match-arm guards (clippy collapsible_match, new in 1.95) - cli/import: sort_by -> sort_by_key(Reverse) (clippy unnecessary_sort_by, new in 1.95) Also gitignore local claude-id.json (machine-local agent identity). Validated on Rust 1.95.0: cargo fmt --check, clippy -D warnings, full test suite (all pass), cargo deny check (advisories/bans/licenses/sources ok), and a maturin wheel build against pyo3 0.29. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add `dev` to the push and pull_request branch filters so the fmt/clippy/ test/deny gates run on pull requests targeting the dev integration branch, not just main. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Modernizes the workspace before resuming the triage backlog. Bumps the toolchain to Rust 1.95.0 and brings all dependencies up to their latest versions.
Toolchain
rust-version1.94 → 1.95; CI toolchain pins 1.94.0 → 1.95.0rust:1.93-alpine→rust:1.95-alpine(the old image was below MSRV — Docker builds were broken)dev(push + pull_request)Dependencies
cargo updateacross the lockfile: tokio 1.50→1.52, axum 0.8.8→0.8.9, reqwest 0.13.2→0.13.4, rustls 0.23.37→0.23.41, uuid 1.22→1.23, zeroize 1.8→1.9, chrono/serde/toml/time/env_logger, etc.pbkdf2simple→hmacfeature), tower-http 0.6→0.7, pyo3 0.28→0.29Code changes required by the bumps
hmac::KeyInit—new_from_slicemoved to theKeyInittrait in hmac 0.13 / crypto-common 0.2collapsible_match, new in 1.95)sort_by→sort_by_key(Reverse)(clippyunnecessary_sort_by, new in 1.95)Validation (local, Rust 1.95.0)
cargo fmt --all --checkcargo clippy --workspace --exclude rusty-haystack --all-targets -- -D warningscargo test --workspace --exclude rusty-haystack(all pass)cargo deny check(advisories / bans / licenses / sources ok)maturin buildof the Python crate against pyo3 0.29 (wheel builds & links)Notes
tower-httpis a declared server dependency but currently unused in source — bumped to 0.7 to satisfy the update; a candidate for removal in a later cleanup.python.yml) only runs onv*tags, so it is not exercised by this PR; validated locally with maturin instead.🤖 Generated with Claude Code