Bump the cargo group with 8 updates#2684
Conversation
Bumps the cargo group with 8 updates: | Package | From | To | | --- | --- | --- | | [tracing-forest](https://github.com/QnnOkabayashi/tracing-forest) | `0.1.6` | `0.2.0` | | [hashbrown](https://github.com/rust-lang/hashbrown) | `0.16.1` | `0.17.1` | | [rusqlite](https://github.com/rusqlite/rusqlite) | `0.39.0` | `0.40.1` | | [hashlink](https://github.com/djc/hashlink) | `0.11.1` | `0.12.0` | | [libsqlite3-sys](https://github.com/rusqlite/rusqlite) | `0.37.0` | `0.38.1` | | [rustls-ffi](https://github.com/rustls/rustls-ffi) | `0.15.0` | `0.15.3` | | [rustls-platform-verifier](https://github.com/rustls/rustls-platform-verifier) | `0.5.3` | `0.7.0` | | [webpki-root-certs](https://github.com/rustls/webpki-roots) | `0.26.11` | `1.0.8` | Updates `tracing-forest` from 0.1.6 to 0.2.0 - [Commits](https://github.com/QnnOkabayashi/tracing-forest/commits) Updates `hashbrown` from 0.16.1 to 0.17.1 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](rust-lang/hashbrown@v0.16.1...v0.17.1) Updates `rusqlite` from 0.39.0 to 0.40.1 - [Release notes](https://github.com/rusqlite/rusqlite/releases) - [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md) - [Commits](rusqlite/rusqlite@v0.39.0...v0.40.1) Updates `hashlink` from 0.11.1 to 0.12.0 - [Release notes](https://github.com/djc/hashlink/releases) - [Changelog](https://github.com/djc/hashlink/blob/main/CHANGELOG.md) - [Commits](djc/hashlink@v0.11.1...v0.12.0) Updates `libsqlite3-sys` from 0.37.0 to 0.38.1 - [Release notes](https://github.com/rusqlite/rusqlite/releases) - [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md) - [Commits](https://github.com/rusqlite/rusqlite/commits) Updates `rustls-ffi` from 0.15.0 to 0.15.3 - [Release notes](https://github.com/rustls/rustls-ffi/releases) - [Changelog](https://github.com/rustls/rustls-ffi/blob/main/CHANGELOG.md) - [Commits](rustls/rustls-ffi@v0.15.0...v0.15.3) Updates `rustls-platform-verifier` from 0.5.3 to 0.7.0 - [Release notes](https://github.com/rustls/rustls-platform-verifier/releases) - [Changelog](https://github.com/rustls/rustls-platform-verifier/blob/main/CHANGELOG) - [Commits](rustls/rustls-platform-verifier@v/0.5.3...v/0.7.0) Updates `webpki-root-certs` from 0.26.11 to 1.0.8 - [Release notes](https://github.com/rustls/webpki-roots/releases) - [Commits](rustls/webpki-roots@v/0.26.11...v/1.0.8) --- updated-dependencies: - dependency-name: tracing-forest dependency-version: 0.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: hashbrown dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: rusqlite dependency-version: 0.40.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: hashlink dependency-version: 0.12.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo - dependency-name: libsqlite3-sys dependency-version: 0.38.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo - dependency-name: rustls-ffi dependency-version: 0.15.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo - dependency-name: rustls-platform-verifier dependency-version: 0.7.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo - dependency-name: webpki-root-certs dependency-version: 1.0.8 dependency-type: indirect update-type: version-update:semver-major dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b4b984406c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "Codex (@codex) address that feedback".
|
Some of the Windows failures look slightly concerning, maybe this update really does have side-effects. |
|
Thanks--I'll investigate. |
Eliah Kagan (EliahKagan)
left a comment
Eliah Kagan (EliahKagan)
left a comment
There was a problem hiding this comment.
Some of the Windows failures look slightly concerning
I'm guessing the concerning appearance was the lines such as:
Cancelling due to interrupt: 6 tests still running
ABORT [ 4.960s] (1161/3272) gix-dir::dir walk::empty_root
- with code 0xc0000409: The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. (os error 1282)
ABORT [ 4.973s] (1162/3272) gix-dir::dir walk::expendable_and_precious_in_ignored_dir_with_pathspec
- with code 0xc0000409: The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. (os error 1282)
ABORT [ 5.018s] (1163/3272) gix-dir::dir walk::empty_and_nested_untracked
- with code 0xc0000409: The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. (os error 1282)
ABORT [ 5.014s] (1164/3272) gix-dir::dir walk::expendable_and_precious
- with code 0xc0000409: The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. (os error 1282)
ABORT [ 5.049s] (1165/3272) gix-dir::dir walk::complex_empty
- with code 0xc0000409: The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. (os error 1282)
ABORT [ 5.088s] (1166/3272) gix-dir::dir walk::cancel_with_collection_does_not_fail
- with code 0xc0000409: The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. (os error 1282)
────────────
Summary [ 103.200s] 1166/3272 tests run: 1160 passed, 6 failed, 6 skipped
warning: 2106/3272 tests were not run due to interrupt
error: test run failed
Error: The operation was canceled.
These look alarming because they contain:
code 0xc0000409: The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. (os error 1282)
This is #1722. When gitoxide test runs are canceled on Windows, they sometimes produce this message. I'm not clear enough on why to allow #1722 to be closed, but I think that something gitoxide uses (when those tests run) is calling __fastfail or equivalent, which is also called to terminate when buffer overruns are detected. See STATUS_STACK_BUFFER_OVERRUN doesn’t mean that there was a stack buffer overrun and Misinterpreting the misleadingly-named STATUS_STACK_BUFFER_OVERRUN by Raymond Chen.
As the log shows, those tests strongly appear to have been cancelled. It seems to have happened as a result of their jobs being cancelled. I think that, when the job is cancelled while it is running one of the tests that terminates that way when cancelled, this will happen, and I think that's all we've seen here.
In the first run, the workflows were cancelled due to the macOS job in the same matrix failing (the matrix is intentionally not fail-fast: false). Then it happened again in the second run, with no apparent cause of the cancellation, unless you cancelled them by accident when meaning to tell a different run to cancel. But my guess is that they were cancelled due to an infrastructural flake on GitHub. I don't know.
While I don't know enough for #1722 to be resolved, I do feel pretty confident that this is a case of #1722 and also that it is not caused by the changes in this PR, since multiple subsequent runs succeeded (and also testing in my fork, including with these dependencies, did not surface it).
The other failure, too recently to have been what you were concerned about because it was in a later rerun I triggered, was this one. That's a more common infrastructural flake we've been seeing where the the component orchestrating the run loses contact with the runner.
So I think this can be merged, which I plan to do. I'll just check a couple of other things first.
There was a problem hiding this comment.
Pull request overview
This PR updates Cargo dependencies for gitoxide, primarily affecting gitoxide-core’s optional SQLite-backed “query/corpus” functionality, and refreshes the workspace lockfile to newer resolved versions.
Changes:
- Bump
rusqliteingitoxide-corefrom0.39.0to0.40.1. - Update
Cargo.lockto reflect newer resolved dependency versions (includinghashbrown,hashlink,rustls-platform-verifier, andwebpki-root-certs, among others).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| gitoxide-core/Cargo.toml | Updates the rusqlite dependency used by optional query/corpus functionality. |
| Cargo.lock | Refreshes the resolved dependency set to newer versions following the manifest change(s). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Thanks a lot for the analysis, and all the references. Lessons? Run CI at least thrice, or else it could just be a sticky flake 😁. |
Bumps the cargo group with 8 updates:
0.1.60.2.00.16.10.17.10.39.00.40.10.11.10.12.00.37.00.38.10.15.00.15.30.5.30.7.00.26.111.0.8Updates
tracing-forestfrom 0.1.6 to 0.2.0Commits
Updates
hashbrownfrom 0.16.1 to 0.17.1Release notes
Sourced from hashbrown's releases.
Changelog
Sourced from hashbrown's changelog.
Commits
c62a63achore: release v0.17.1420e83bMerge pull request #722 from cuviper/rustc_try_insert51cecbdMove theRustcOccupiedErrornote as requested in review16d0f37AddHashMap::rustc_try_insert18a04c5Merge pull request #721 from clarfonthey/branch-renameee8a0eeRename master to main in release-plz workflow147df65Merge pull request #720 from xtqqczze/authors64a0acbRemove package.authors field from Cargo metadata867db72Merge pull request #716 from atouchet/rdm57b760bUpdate ReadmeUpdates
rusqlitefrom 0.39.0 to 0.40.1Release notes
Sourced from rusqlite's releases.
Commits
6d3c282Merge pull request #1856 from gwenn/0.40.12ba28b7Prepare next releasea021dc7Merge pull request #1854 from gwenn/savepoint534a149Merge pull request #1855 from gwenn/hashlink6d9764fBump hashlink versionfa574ebUsesqlite3_keyword_check15385ccFix SQL injection when SAVEPOINT name is taintede5e48f2Merge pull request #1853 from gwenn/3.53.2ac22292Bump bundled SQLite version to 3.53.2c5f8828Merge pull request #1852 from gwenn/clippyUpdates
hashlinkfrom 0.11.1 to 0.12.0Release notes
Sourced from hashlink's releases.
Commits
677c871Bump version to 0.12c4a5abcUpgrade hashbrown to 0.1739e1d4aUpgrade to 2024 edition00a7920Bump MSRV to 1.85Updates
libsqlite3-sysfrom 0.37.0 to 0.38.1Release notes
Sourced from libsqlite3-sys's releases.
Commits
Updates
rustls-ffifrom 0.15.0 to 0.15.3Release notes
Sourced from rustls-ffi's releases.
... (truncated)
Changelog
Sourced from rustls-ffi's changelog.
... (truncated)
Commits
3e6eb3fprepare 0.15.3498f679Cargo: rustls 0.23.38 -> 0.23.392775011Cargo: bump semver compatible depsbf5aad6build(deps): bump actions/upload-pages-artifact from 4 to 5ff0e9d3prepare 0.15.20fb744aCargo: update semver compatible deps82a5544librustls: add rustls_client_config_builder_set_check_selected_alpn0fa8c47librustls: rustls 0.23.37 -> 0.23.3851e69d7Upgrade rustls-platform-verifier to 0.7b5ff5c8Take semver-compatible dependency updatesUpdates
rustls-platform-verifierfrom 0.5.3 to 0.7.0Release notes
Sourced from rustls-platform-verifier's releases.
Commits
996b1c9Bump version to 0.7.089a83ffUpgrade jni to 0.22ffe03d3Bump MSRV to 1.85.0 (for jni)64b561etests: update real-world test certificatesf609519Take semver-compatible dependency updatesdafabbeUpdate Android setup instructions to include library usecase examples554923dremove nix flake, CI testingbbc27c7try with extra roots when root is untrustede50903aUpdate real world test certificates31bf3faTake semver-compatible dependency updatesUpdates
webpki-root-certsfrom 0.26.11 to 1.0.8Release notes
Sourced from webpki-root-certs's releases.
... (truncated)
Commits
50729cd1.0.8: removeSecureSign Root CA12root (#124)c965c54Take semver-compatible dependency updates (#123)a83a3c9Move MSRV to 1.70 (#122)be94846Update dependencies (#119)76476f9Prepare 1.0.7 (#120)ed392f4Take semver-compatible updates (#118)ec8b744Take semver-compatible dependency updates (#117)84a0c23Take semver-compatible dependency updates (#116)c97def9webpki-roots: 1.0.6 (#115)d30d248Trigger CI workflow on merge groupsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions