fix: triage backlog — versions, SCRAM escaping, unload_lib, docs#3
Merged
Conversation
about.rs hardcoded serverVersion/moduleVersion="0.7.2" and the Python module hardcoded __version__="0.1.0" while the workspace is 0.8.1. Both now use env!("CARGO_PKG_VERSION") so they track the crate version automatically. (Triage item 1.)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The with_router() doc comment warned about the auth-middleware bypass but not that custom routes also skip the 2 MB DefaultBodyLimit (both layers are applied before the merge). Documented, and noted with_authenticated_router() keeps the body limit. (Triage item 2.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
make_client_first_bare embedded the raw username, so a username containing ',' or '=' corrupted the client-first-message and could hijack extract_client_nonce's r= parsing. Now escaped per RFC 5802 (=->=3D, ,->=2C); both client and server escape identically so signatures still match. Also added a Drop impl that zeroizes ScramHandshake's stored_key and server_signature (previously it had no Drop, unlike ScramCredentials). Adds 3 tests. (Triage item 3.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
unload_lib removed defs/specs/libs but only cleared the mandatory cache, leaving stale TaxonomyTree edges, tag_on_index, conjuncts, and choice_index entries so is_a/fits could still see an unloaded lib. Now rebuilds all derived indexes from the remaining defs. Adds a regression test. (Triage item 4.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
proptest 1.10 was declared as a dev-dependency of haystack-core but had zero references in any source file. Removed it and its transitive dev-deps from the lockfile. (Triage item 5; adding real property tests can be a separate effort.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
architecture.md said the graph changelog is capped at 10,000 (actual DEFAULT_CHANGELOG_CAPACITY is 50,000); data/mod.rs called HDict an 'ordered map' though it is an unordered HashMap; README's dependency table listed pre-modernization versions (tower-http 0.6, tokio-tungstenite 0.28, roaring 0.10, pyo3 0.28). All corrected to match the code. (Triage item 6.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the triaged backlog items (identified during the 2026-07-01 codebase deep-dive). One focused commit per item.
/api/aboutand Python__version__hardcoded stale versions →env!("CARGO_PKG_VERSION")fix(server,python)with_router()doc didn't mention the 2 MB body-limit bypassdocs(server)ScramHandshakehad noDropzeroizefix(auth)unload_libleft stale taxonomy/tagOn/conjunct/choice index entriesfix(ontology)proptestdeclared but unusedchore(core)docsNotable
n=field, and both sides build the client-first-bare via the samemake_client_first_bare. So escaping is symmetric (signatures still match) and additionally hardensextract_client_nonceagainstr=injection in a username. 3 new tests, including a full handshake with the usernameod,al=ice.unload_libnow rebuilds all derived indexes from the surviving defs; regression test assertsis_ano longer sees an unloaded lib.Validation (local, Rust 1.95.0)
cargo fmt --all --checkcargo clippy --workspace --exclude rusty-haystack --all-targets -- -D warningscargo test --workspace --exclude rusty-haystack(827 core + 78 server + integration, incl. 4 new tests)Deferred (not in this PR)
tower-httpremains a declared-but-unused server dependency (removal candidate).Benchmarks.mdstill records "Rust 1.93.1" (historical run record — left as-is).proptestproperty tests (codec round-trips, unit conversion) is a good follow-up.🤖 Generated with Claude Code