deps: clear all 14 Dependabot PRs - #24
Open
singhpratech wants to merge 2 commits into
Open
Conversation
…onale Three of the fourteen were red, all on cargo-deny, all for a duplicate-version ban rather than an advisory: #20 serde 1.0.229 serde_derive moved to syn 3.0 #22 thiserror 2.0.19 thiserror-impl moved to syn 3.0 #21 twox-hash 2.1.2 pulled rand 0.9 beside DataFusion's rand 0.8 syn gets a documented skip: both roots on the 3.0 line and all eighteen on the 2.0 line are proc-macro or build-script crates, so neither version links into a shipped artifact and the cost is compile time. The derive ecosystem is mid-migration; the retire condition is the 2.0 list emptying out. twox-hash needed no skip at all. The `random` feature exists to build a RandomState we never construct, and it was the only thing pulling rand 0.9 — `default-features = false` drops it. XXH64 is fixed by the spec, so 2.x is digest-identical to the 1.6 line every published Puffin sidecar was built with; verified over both the oneshot and chunked-write paths before taking the bump, because a silent digest change would have broken cross-version sketch merges without failing a test. That bump also exposed a wrong comment. The existing twox-hash skip claimed samkhya-core pinned 1.6 while DataFusion pulled 2.x. In fact DataFusion 46 roots both — parquet 54 takes 1.6.3, lz4_flex takes 2.1.2 — and samkhya-core's own pin was the 1.6 that made the duplicate look like ours. The skip stays, upstream-only, with the paths corrected. The Actions bumps go to the current major (checkout/setup-node/ upload-artifact v7, setup-python v7, one past the v6 Dependabot proposed) rather than one step at a time; the runner had already started warning that checkout@v4 targets the deprecated Node 20. #16 is declined instead: it proposed replacing floating `@v2` with an exact patch of taiki-e/install-action, which publishes several releases a week. Every action here is referenced by major tag on purpose, so dependabot.yml now ignores patch and minor for the Actions ecosystem and lets majors through. Verified locally against every CI job, not just the changed surface: fmt, clippy, 415 workspace tests, MSRV check on a real 1.85 toolchain, all five optional-feature matrix entries including the bundled DuckDB C++ build, all four cargo-deny checks, and both wire-contract transports against the bumped FastAPI 0.140.13 / uvicorn 0.51.0. One thing to know rather than act on: duckdb 1.10505.0 declares rust-version 1.85.1 while the workspace declares 1.85. It only matters to someone on exactly 1.85.0 enabling the off-by-default `bundled` feature, and CI's "1.85" resolves to 1.85.1, so the floor is not being raised for an optional dependency. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`core-all` went red on the dependency batch with
residual::llm_http_tests::mock_clamps_to_ceiling
left: None right: Some(500)
which is not a dependency regression. `mock_success_returns_clamped_estimate`
exercises the identical mock, transport and JSON path and passed in the
same run, and samkhya-core's HTTP client (ureq 2.12.1) is byte-identical
to main — the duckdb bump's ureq 3.3.0 is a separate, unrelated node.
The mock served one `read()` per connection and called that the whole
request. It isn't, however small the payload: a read returns one
segment's worth, and the header block and JSON body can arrive
separately. When they do, the server replies and drops the socket with
body bytes still in its receive queue, the kernel answers those
leftovers with an RST rather than a FIN, and the RST discards the
response out of the client's receive buffer. ureq reports ECONNRESET,
the corrector's failure contract converts that to `Ok(None)`, and a
green-path assertion fails as though the endpoint were down.
Confirmed rather than assumed — a standalone repro drives the split
directly. With the old single-read server the client gets `Connection
reset by peer` at 3/3 timing configurations; with the request drained it
gets the response at 3/3.
So the fix is to read the request in full: to the `\r\n\r\n`
terminator, then exactly `Content-Length` more bytes. Still not a
general HTTP parser — it handles what the corrector sends and nothing
else.
Worth noting the failure mode this class of bug hides behind. The
corrector is *designed* to swallow transport errors so a downed LLM
endpoint can never fail a query, which means a broken transport and a
working one that returns nothing are indistinguishable at the
assertion. A flake here reads as a bad estimate, not a dropped
connection.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #1, #2, #3, #4, #5, #6, #16, #17, #18, #19, #20, #21, #22, #23.
Three of the fourteen were red, all on cargo-deny, all for a duplicate-version ban rather than an advisory:
serde_derivemoved to syn 3.0thiserror-implmoved to syn 3.0syn gets a documented skip. Both roots on the 3.0 line and all eighteen on the 2.0 line are proc-macro or build-script crates, so neither version links into a shipped artifact and the cost is compile time. Retires when the 2.0 list empties out.
twox-hash needed no skip. The
randomfeature exists to build aRandomStatewe never construct, and it was the only thing pulling rand 0.9 —default-features = falsedrops it. XXH64 is spec-fixed, so 2.x is digest-identical to the 1.6 line every published Puffin sidecar was built with; verified over both the oneshot and chunked-write paths before taking the bump, since a silent digest change would break cross-version sketch merges without failing a test.That bump also exposed a wrong comment in
deny.toml: the existing twox-hash skip claimed samkhya-core pinned 1.6 while DataFusion pulled 2.x. DataFusion 46 in fact roots both — parquet 54 → 1.6.3, lz4_flex → 2.1.2 — and samkhya-core's own pin was the 1.6 that made the duplicate look like ours. The skip stays, upstream-only, paths corrected.Actions go to the current major (checkout / setup-node / upload-artifact v7, setup-python v7 — one past the v6 Dependabot proposed) rather than one step at a time; the runner had already started warning that
checkout@v4targets the deprecated Node 20.#16 is declined, not merged: it proposed replacing floating
@v2with an exact patch oftaiki-e/install-action, which publishes several releases a week. Every action here is referenced by major tag on purpose, sodependabot.ymlnow ignores patch and minor for the Actions ecosystem and lets majors through.Verification
Run locally against every CI job, not just the changed surface:
cargo fmt --check,cargo clippy --workspace --all-targets— cleancargo test --locked --workspace— 415 passed, 0 failedcargo +1.85 check --locked --workspaceon a real 1.85 toolchain — cleanbundled9 (full C++ build), puffin-cross-engine 2 — all 0 failedcargo deny --locked --workspace check— advisories ok, bans ok, licenses ok, sources okNote, not an action item
duckdb 1.10505.0declaresrust-version = 1.85.1while the workspace declares1.85. It only affects someone on exactly 1.85.0 enabling the off-by-defaultbundledfeature, and CI's"1.85"resolves to 1.85.1 — so the floor is not being raised for an optional dependency.🤖 Generated with Claude Code