Skip to content

chore(deps): bump the deps group across 1 directory with 12 updates#110

Closed
dependabot[bot] wants to merge 72 commits intomainfrom
dependabot/cargo/deps-bcce6a16c2
Closed

chore(deps): bump the deps group across 1 directory with 12 updates#110
dependabot[bot] wants to merge 72 commits intomainfrom
dependabot/cargo/deps-bcce6a16c2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 1, 2026

Bumps the deps group with 12 updates in the / directory:

Package From To
axum 0.8.8 0.8.9
axum-test 18.7.0 20.0.0
clap 4.6.0 4.6.1
diesel 2.3.7 2.3.9
diesel-async 0.7.4 0.9.0
jiff 0.2.23 0.2.24
pulldown-cmark 0.13.1 0.13.3
tokio 1.50.0 1.52.1
tachys 0.2.14 0.2.15
diesel_migrations 2.3.1 2.3.2
uuid 1.22.0 1.23.1
tokio-postgres 0.7.16 0.7.17

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

  • added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
  • changed: Update minimum rust version to 1.80 (#3620)
  • fixed: Set connect endpoint on correct field in MethodRouter (#3656)
  • fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

Updates axum-test from 18.7.0 to 20.0.0

Release notes

Sourced from axum-test's releases.

19.1.0

  • Remove TestServer::scheme, as it never actually worked with http requests only mocked requests.
  • Remove TestRequest::scheme, as it never actually worked with http requests only mocked requests.
  • Mocked transport no longer provides the scheme and authority to the service, which matches the behaviour with Tokio / Hyper based services.
  • Mocked now provides the HOST header, which matches the behaviour with Hyper based HTTP services.

19.0.0

  • Simplified constructors for TestServer, TestServerBuilder, and TestServerConfig.
    • new() constructor no longer returns a Result, and instead panics on failure.
    • Added try_new() to allow people to continue to catch the Result if needed.
  • TestResponse assertion functions now return &self, allowing calls to be chained!
  • Requests using Reqwest will now share cookies with regular Axum Test requests.
    • Cookies saved by one are saved to the other, and both adhere to TestServer::save_cookies() and TestServer::do_not_save_cookies() commands.
  • Improved error messages across the API.
    • JSON and Yaml assertions now output the body of the request when they fail.
  • Removed deprecated feature old-json-diff.
Commits

Updates clap from 4.6.0 to 4.6.1

Release notes

Sourced from clap's releases.

v4.6.1

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed
Changelog

Sourced from clap's changelog.

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed
Commits
  • 1420275 chore: Release
  • d2c817d docs: Update changelog
  • f88c94e Merge pull request #6341 from epage/sep
  • acbb822 fix(complete): Reduce risk of conflict with actual subcommands
  • a49fadb refactor(complete): Pull out subcommand separator
  • ddc008b Merge pull request #6332 from epage/update
  • 497dc50 chore: Update compatible dependencies
  • dca2326 Merge pull request #6331 from clap-rs/renovate/j178-prek-action-2.x
  • 54bdaa3 chore(deps): Update j178/prek-action action to v2
  • f0d30d9 chore: Release
  • Additional commits viewable in compare view

Updates diesel from 2.3.7 to 2.3.9

Changelog

Sourced from diesel's changelog.

[2.3.9] 2026-04-30

  • Removed a dbg! statement from the Mysql backend that caused unwanted output
  • Fix a regression in #[derive(AsChangeset)] introduced in 2.3.8 where structs with a type or const generic parameter referenced in a field type failed to compile with error[E0425]: cannot find type 'T' in this scope. The diagnostic helper functions added to improve AsChangeset error messages now forward all generic parameters of the input struct, not only lifetimes.

[2.3.8] 2026-04-24

  • Added support for libsqlite3-sys 0.37.0
  • Raise a compile-time error when mixing aggregate and non-aggregate expressions in an ORDER BY clause without a GROUP BY clause
  • Calling .count() or .select(aggregate_expr) on a query that already has a non-aggregate .order_by() clause now raises a compile-time error instead of generating invalid SQL that would be rejected by the database at runtime (fixes #3815)
  • Added documentation for migration transaction behaviour at the crate root
  • Improved compile time error messages for #[derive(AsChangeset)]
  • Allow to use generic types in infix_operator!()
  • Fixes for several instances of unsound, unspecified or otherwise dangerous behaviour:
    • Unsound string construction in SqliteValue::read_text/FromSql<Text, Sqlite> for String
    • Invalid alignment for over aligned data in SqliteConnection::register_function for aggregate functions
    • Potential memory leaks in SqliteConnection::register_function
    • Access to padding bytes while serializing Date/time types in the Mysql backend
    • SQL Option Injection in PostgreSQL COPY FROM/TO
    • Unspecified pointer cast in Debug/Display implementation of batch INSERT statements for SQLite
    • Invalid call order of SQLite API functions in SqliteValue::read_text/FromSql<Text, Sqlite> for String/SqliteValue::read_blob()/FromSql<Binary, Sqlite> for Vec<u8>
    • Potential unsound pointer access for FromSql<Binary, _> for Vec<u8> and FromSql<Text, _> for String for third party backends (requires changes to the third party backend as well)
Commits
  • 2e7eb35 Also bump derives version
  • b3a16a3 Merge pull request #5046 from apastrana6/ap/fix-derive-as-changeset
  • 9f0a6c1 Prepare a 2.3.9 release
  • adcc896 Enable some clippy lints to prevent having dbg in a release again
  • 66760df Remove MySQL time serializer debug output
  • 58820dc Merge pull request #5036 from weiznich/prepare_2.3.8
  • 895b5ba Prepare a 2.3.8 release
  • ea008d3 Fix several UB instances
  • 64003c6 Merge pull request #5034 from ayarotsky/fix-reject-aggregate-select-with-non-...
  • 49b936e Merge pull request #5012 from ayarotsky/fix-aggregate-expressions-and-order-by
  • Additional commits viewable in compare view

Updates diesel-async from 0.7.4 to 0.9.0

Release notes

Sourced from diesel-async's releases.

Diesel-Async 0.9.0

Changes

  • Change all transaction related functions to accept an real async closure instead of the scoped boxed variant. This change requires adujsting all call sides of transaction based functions from conn.transaction(|conn| async move {/* your code */}.scoped_boxed()) to conn.transaction(async |conn| /* your code */)

Fixed

  • Fixed an unsound access to padding values while deserializing Date/Time values in the mysql backend Thanks to @​paolobarbolini for finding this issue.

You can support the development of Diesel by:

  • Contributing Code, Documentation or Guides. Checkout the planing for Diesel 2.4 for open tasks.
  • Providing knowledge and help to maintain the MySQL/MariaDB backend. This is currently the only in-tree backend that is not used by any maintainers, so having someone around that actually uses this backend would be very helpful for the Diesel project.
  • Answering questions in our discussion forum
  • Reporting bugs in our issue tracker
  • Helping triaging issues in our issue tracker
  • Sponsoring the maintainers.

Full Changelog: diesel-rs/diesel_async@v0.8.0...v0.9.0

v0.8.0

What's Changed

  • Added support for UpdateAndFetchResults for SyncConnectionWrapper, allowing to use save_changes
  • Bumped supported deadpool version to 0.13
  • Fixed a bug with postgres query pipelining that can cause panics
  • Fixed a bug with the SyncConnectionWrapper that can cause panics if the future is dropped before completion

You can support the development of Diesel by:

  • Contributing Code, Documentation or Guides. Checkout the planing for Diesel 2.4 for open tasks.
  • Providing knowledge and help to maintain the MySQL/MariaDB backend. This is currently the only in-tree backend that is not used by any maintainers, so having someone around that actually uses this backend would be very helpful for the Diesel project.
  • Answering questions in our discussion forum
  • Reporting bugs in our issue tracker
  • Helping triaging issues in our issue tracker
  • Sponsoring the maintainers.

New Contributors

Full Changelog: diesel-rs/diesel_async@v0.7.4...v0.8.0

Changelog

Sourced from diesel-async's changelog.

[0.9.0] - 2026-04-30

  • Change all transaction related functions to accept an real async closure instead of the scoped boxed variant. This change requires adujsting all call sides of transaction based functions from conn.transaction(|conn| async move {/* your code */}.scoped_boxed()) to conn.transaction(async |conn| /* your code */)
  • Fixed an unsound access to padding values while deserializing Date/Time values in the mysql backend Thanks to Paolo Barbolini for finding this issue.

[0.8.0] - 2026-03-20

  • Added support for UpdateAndFetchResults for SyncConnectionWrapper, allowing to use save_changes
  • Bumped supported deadpool version to 0.13
  • Fixed a bug with postgres query pipelining that can cause panics
  • Fixed a bug with the SyncConnectionWrapper that can cause panics if the future is dropped before completion
Commits
  • 18f2c86 Merge pull request #285 from diesel-rs/fix/padding_access
  • acc90e9 Prepare a 0.9 release
  • ba3ed66 Merge pull request #284 from diesel-rs/async_closures
  • 4e2fc54 Use real async closures for transactions
  • 237ac09 Prepare 0.8.0
  • 67e3e3f Merge pull request #282 from dav-wolff/fix-sync-connection-wrapper-panic
  • 03caa1e Replace timeout based tests with more robust channel usage
  • 7df84d8 Merge pull request #283 from dav-wolff/remove-unsafe-pin-projection
  • b426870 Use pin_project_lite instead of manually pin-projecting
  • 7dacba2 Remove pin-project dependency
  • Additional commits viewable in compare view

Updates jiff from 0.2.23 to 0.2.24

Changelog

Sourced from jiff's changelog.

0.2.24 (2026-04-23)

This release primarily adds a new memory_usage routine for reporting heap allocation sizes for the TimeZone and Zoned types. This release also acknowledges and updates the timeline expectations for a Jiff 1.0 release in README.md.

Enhancements:

  • #520: Add memory_usage to the TimeZone and Zoned types.
  • #535: Improve comment in Span::checked_add example.

Bug fixes:

  • #541: Update Jiff 1.0 timeline.
Commits

Updates pulldown-cmark from 0.13.1 to 0.13.3

Release notes

Sourced from pulldown-cmark's releases.

0.13.3

Bug Fixes

  • Fix Wikilink offset.

Full Changelog: pulldown-cmark/pulldown-cmark@v0.13.2...v0.13.3

0.13.2

Security

  • Bump tar to 0.4.45.

Full Changelog: pulldown-cmark/pulldown-cmark@v0.13.1...v0.13.2

Commits
  • b0e6f65 chore: bump pulldown-cmark version in Cargo.lock
  • ed2ee59 chore: bump pulldown-cmark version
  • 676afd2 fix: wrong wikilink end-offset
  • bad7926 chore: bump pulldown-cmark in Cargo.lock
  • f67922d fix: bump tar to 0.4.45 for security purposes
  • See full diff in compare view

Updates tokio from 1.50.0 to 1.52.1

Release notes

Sourced from tokio's releases.

Tokio v1.52.1

1.52.1 (April 16th, 2026)

Fixed

  • runtime: revert #7757 to fix [a regression]#8056 that causes spawn_blocking to hang (#8057)

#7757: tokio-rs/tokio#7757 #8056: tokio-rs/tokio#8056 #8057: tokio-rs/tokio#8057

Tokio v1.52.0

1.52.0 (April 14th, 2026)

Added

  • io: AioSource::register_borrowed for I/O safety support (#7992)
  • net: add try_io function to unix::pipe sender and receiver types (#8030)

Added (unstable)

  • runtime: Builder::enable_eager_driver_handoff setting enable eager hand off of the I/O and time drivers before polling tasks (#8010)
  • taskdump: add trace_with() for customized task dumps (#8025)
  • taskdump: allow impl FnMut() in trace_with instead of just fn() (#8040)
  • fs: support io_uring in AsyncRead for File (#7907)

Changed

  • runtime: improve spawn_blocking scalability with sharded queue (#7757)
  • runtime: use compare_exchange_weak() in worker queue (#8028)

Fixed

  • runtime: overflow second half of tasks when local queue is filled instead of first half (#8029)

Documented

  • docs: fix typo in oneshot::Sender::send docs (#8026)
  • docs: hide #[tokio::main] attribute in the docs of sync::watch (#8035)
  • net: add docs on ConnectionRefused errors with UDP sockets (#7870)

#7757: tokio-rs/tokio#7757 #7870: tokio-rs/tokio#7870 #7907: tokio-rs/tokio#7907 #7992: tokio-rs/tokio#7992 #8010: tokio-rs/tokio#8010 #8025: tokio-rs/tokio#8025 #8026: tokio-rs/tokio#8026 #8028: tokio-rs/tokio#8028 #8029: tokio-rs/tokio#8029

... (truncated)

Commits
  • 905c146 chore: prepare to release v1.52.1 (#8059)
  • 56aaa43 rt: revert #7757 to fix regression in spawn_blocking (#8057)
  • 57ff47a ci: update trybuild to expect output from rustc 1.95.0 (#8058)
  • 812de3e ci: bump taiki-e/cache-cargo-install-action from 1 to 3 (#8053)
  • ba82e73 ci: use Dependabot to keep github actions up to date (#8052)
  • 2e85f9d ci: replace cirrus-ci with freebsd-vm (#8041)
  • a7e1cd8 ci: update GitHub Actions workflows to use latest tool versions (#8047)
  • 5f7be0a chore: perpare 1.52.0 (#8045)
  • 36d12d2 taskdump: allow impl FnMut() in taskdumps instead of just fn() (#8040)
  • f943312 fs: support io-uring in AsyncRead for File (#7907)
  • Additional commits viewable in compare view

Updates tachys from 0.2.14 to 0.2.15

Commits

Updates diesel_migrations from 2.3.1 to 2.3.2

Release notes

Sourced from diesel_migrations's releases.

Diesel 2.3.2

Fixed

  • Fixed an incompatibility with libmariadb versions shipped by debian
  • Fixed docs.rs builds
  • Fixed applying patch file schema.rs file with formatting
  • Allow to compare DatabaseErrorKind values

(Diesel 2.3.1 did not contain any changes beside the version bump to retrigger the docs.rs build)

Full Changelog: diesel-rs/diesel@v2.3.0...v2.3.2

You can support the development of Diesel by:

  • Contributing Code, Documentation or Guides. Checkout the planing for Diesel 2.4 for open tasks.
  • Providing knowledge and help to maintain the MySQL/MariaDB backend. This is currently the only in-tree backend that is not used by any maintainers, so having someone around that actually uses this backend would be very helpful for the Diesel project.
  • Answering questions in our discussion forum
  • Reporting bugs in our issue tracker
  • Helping triaging issues in our issue tracker
  • Sponsoring the maintainers.
Changelog

Sourced from diesel_migrations's changelog.

[2.3.2] 2025-09-19

Fixed

  • Fixed an incompatibility with libmariadb versions shipped by debian
  • Fixed docs.rs builds
  • Fixed applying patch file schema.rs file with formatting
  • Allow to compare DatabaseErrorKind values
Commits

Updates uuid from 1.22.0 to 1.23.1

Release notes

Sourced from uuid's releases.

v1.23.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.0...v1.23.1

v1.23.0

What's Changed

New Contributors

Special thanks

@​meng-xu-cs raised a series of bugs against the timestamp logic in uuid using automated tooling. The issues themselves were reasonably and responsibly presented and the end result is a better uuid library for everyone. Thanks!

Deprecations

This release includes the following deprecations:

  • Context: Renamed to ContextV1
  • Timestamp::from_gregorian: Renamed to Timestamp::from_gregorian_time

Change to Version::Max

Version::Max's u8 representation has changed from 0xff to 0x0f to match the value returned by Uuid::get_version_num.

Change to Uuid::get_version for the max UUID

Uuid::get_version will only return Some(Version::Max) if the UUID is actually the max UUID (all bytes are 0xff). Previously it would return Some if only the version field was 0x0f. This change matches the behaviour of the nil UUID, which only returns Some(Version::Nil) if the UUID is the nil UUID (all bytes are 0x00).

Full Changelog: uuid-rs/uuid@v1.22.0...v1.23.0

Commits
  • ca0c85f Merge pull request #879 from uuid-rs/cargo/v1.23.1
  • b4db015 prepare for 1.23.1 release
  • 771069d Merge pull request #878 from aznashwan/fix-from-gregorian-deprecation-note
  • 80994a2 fix: Timestamp::from_gregorian deprecation note
  • 90c5be8 Merge pull request #877 from guybedford/remove-wasm-bindgen-msrv
  • 8b8c4f4 Remove deprecated feature from wasm-bindgen dependency
  • 00ab922 Merge pull request #876 from uuid-rs/cargo/v1.23.0
  • 726ba45 prepare for 1.23.0 release
  • 996dade Merge pull request #875 from uuid-rs/fix/context-ordering
  • e140479 simplify a use stmt
  • Additional commits viewable in compare view

Updates tokio-postgres from 0.7.16 to 0.7.17

Release notes

Sourced from tokio-postgres's releases.

tokio-postgres v0.7.17

Added

  • Added Client::execute_typed method.
  • Added Client::query_typed_one and Client::query_typed_opt methods.
  • Added GenericClient::execute_typed, GenericClient::query_typed_one, and GenericClient::query_typed_opt methods.
  • Added Transaction::execute_typed, Transaction::query_typed_one, and Transaction::query_typed_opt methods.
  • Added support for bit-vec 0.9 via the with-bit-vec-0_9 feature.

Changed

  • Upgraded rand to 0.10.
  • Upgraded to Rust edition 2024, minimum Rust version 1.85.
Commits
  • 35a85bd Release tokio-postgres v0.7.17
  • 64674ba Release postgres-types v0.2.13
  • 40b760d Release postgres-derive v0.4.8
  • 6c92298 Release postgres-protocol v0.6.11
  • e088d7d style(clippy): fix clippy::useless_conversion
  • 19897e8 build(deps): upgrade semver compatible Rust dependencies
  • 2584926 build(deps): upgrade RustCrypto dependencies
  • 10a7724 chore: add bit-vec v0.9 support
  • 2853157 fix: cargo fmt --all
  • c8f8993 feat: add rustfmt.toml for opiniated formatting
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

passcod added 30 commits April 29, 2026 23:09
…Ticket

Rust enum variant ServerKind::Meta -> ServerKind::Canopy, and the
on-disk/serialized string changes from "meta" to "canopy". MetaTicket
is renamed to CanopyTicket throughout. Migration updates the seeded nil
server row from kind='meta', name='Meta Server' to kind='canopy',
name='Canopy'.
server_grouped_ids takes no arguments; tests now post {} as the body
since with input = Json the macro deserialises an empty object.
New TypeScript SPA at private-web/, dev-only for now (not built into
the container image). Targets React 19 and MUI v9. Vite proxies
/api/private_server to the running Leptos backend so the frontend
can call existing server functions during the migration.

Includes a single Hello route that calls commons.is_current_user_admin
to verify the proxy round-trip end to end.
watch-private-api binds the Leptos server fns to 127.0.0.1:8081 (Node's
vite-proxy can't resolve [::1] literals so we go IPv4 in dev).
watch-private-web runs Vite on :8090 with the API proxy.

Round-trip verified: a POST to localhost:8090/api/private_server/fns/...
forwards to the backend and returns 200.
First migrated page: status dashboard with release summary, server
cards grouped by rank, and version/status legends. Includes an auto-
reload tick (60s, plus visibilitychange recovery and a custom
canopy-reload-status document event for manual reload).

Adds reusable VersionSquare/VersionIndicator/StatusDot components,
Legends, the useReloadInterval hook, and the wire-shape types for
the statuses fns.

App.tsx now has a top nav with Status as the only entry; / redirects
to /status.
Two related changes folded together because the text edits overlap:

1. Switch private-web from pnpm to npm. The earlier scaffold and dev-
   workflow commits assumed pnpm because I (incorrectly) inferred it
   from a sibling project. Replace pnpm-lock.yaml with package-lock.json,
   update the justfile recipe, AGENTS.md, and the plan.

2. Add Playwright e2e harness per the plan's new Phase 3.5: tests live
   in private-web/e2e/, run via 'npm run test:e2e', start Vite via
   webServer, and assume the operator already has the API running.
   Includes two smoke tests for the status page (chrome + backend
   round-trip).

Made AppBar 'Canopy' title an h1 so the smoke test can query it by
heading role.
Migrates the admins management page. Shows the current list, supports
adding via the form (with empty/invalid validation) and deleting per
row. Errors render inline; successful adds show a transient snackbar
(replacing the Leptos toast pattern, scoped to the page for now).

Adds /admins to the top nav.

E2e: four playwright tests covering listing seeded admins, the delete
button, the add flow, and the empty-email error path. Tests use
unique emails per run to avoid collisions in the shared dev DB.
Migrates /versions: collapsible accordion grouped by minor release,
each minor expands to show its patch versions linking to the (not
yet migrated) detail page. Drafts and yanked versions are tinted in
the row background and show a status chip.

Adds a VersionStatusChip component (replaces the Leptos
VersionStatusBadge), wire-shape types for the versions module, and
two smoke e2e tests.
Migrates /versions/:version as a read-only view: header with version
number and status chip, info panel (created, last updated, chrome
support), artifacts table, markdown-rendered changelog, and the
related lower patches in the same minor.

Adds a small Markdown component (react-markdown + remark-gfm) for
the changelog rendering, replacing pulldown-cmark + dangerouslySet-
InnerHTML.

Admin actions (status change, changelog edit, artifact CRUD) follow
in subsequent commits.
Adds the admin-gated controls: status select with a Change button (with
the same can't-revert-to-draft-unless-latest-in-minor rule as the
Leptos version), and an Edit button on the Changelog section that
swaps the rendered markdown for a textarea.

Both refetch the version detail on success rather than reloading the
whole page (cleaner than the Leptos behaviour, and quicker).

Adds a useApiAction hook for write-only fns alongside the existing
useApi for reads.
Adds the admin-only artifact create/edit/delete flow with the same
lock-unlock pattern as Leptos: Unlock toggles per-row Edit/Delete
buttons; Create reveals an inline form. Edit swaps the row contents
for input fields. Delete shows a Really-delete confirm step.

E2e: a smoke test for the detail page that tolerates either render
of the version data or an error alert (real DB state often won't
have version rows for a hard-coded test version).
Migrates /servers and /servers/facilities (Central / Facility tabs).
Each tab paginates 10 per page; uses MUI Pagination instead of the
Leptos PaginatedList component.

Adds a ServerShorty React component (replaces the Leptos one). Layout
is a vertical stack of bordered rows showing name, rank chip, kind
chip, and host. Three smoke e2e tests covering tab presence, switch,
and round-trip.
Migrates /servers/:id read-only: header with rank/kind chips, name +
status dots for self and children, optional Edit button (admin), URL
+ Device cards, info panel (last-seen, platform, timezone, version
indicator, postgres/nodejs/chrome versions, mobile listing flag,
parent link, location), child servers list, and the version/status
legends.

Extracts ServerKindChip and ServerRankChip from the existing
ServerShorty so the detail page can reuse them.

Bumps tsconfig.app target/lib to ES2023 for Array.findLast support.

Smoke e2e test that the page mounts on any id and surfaces either the
heading or an alert.

Edit, import, and geo pages follow as separate commits.
Migrates /servers/:id/edit. Form fields: name, host, kind (central/
facility select), rank (production/clone/demo/test/dev/unranked
select), device id, parent server, location (cloud/on-premise/unknown
select), lat/lon, and the 'Available in Tamanu Mobile app' checkbox
for centrals.

Parent server uses MUI Autocomplete with debounced search via
servers.search_parent. Pasting a UUID directly is also possible by
typing it. The cloud-region preset (lat/lon-from-region) is deferred
until the geo page is migrated; for now lat/lon are plain inputs.

On save, navigate to the detail page. Smoke e2e covers mount.
Migrates /devices (Search), /devices/untrusted, and /devices/trusted.
Search exposes a debounced search box hitting devices.search and an
admin-only Import Ticket dialog that mirrors the Leptos modal,
including client-side base64 decoding of the Canopy ticket to extract
kind/rank hints (which lock the corresponding selects).

Adds DeviceShorty React component and the parseCanopyTicket helper.
Three smoke e2e tests covering tabs, search input, and untrusted-tab
round-trip.

Detail and history pages follow next.
passcod and others added 22 commits May 1, 2026 07:09
…ontend job

build.rs already runs npm install + npm run build inside cargo build,
so the runners need npm available — they do, ubuntu-24.04 ships it.
Drop the parallel build-frontend job; drop the LEPTOS env vars from
the workflow; tighten build.rs to treat SKIP_FRONTEND_BUILD= (empty)
as 'do build', so the build-servers-release recipe's override works.

Dockerfile.native now copies static/ from the build context (built
in the workflow with just _copy-bulma) instead of a 'frontend' artefact.
The private-web SPA is embedded in the private-server binary, so we
no longer ship target/site/.
- devices.get_device_name_by_id: was for the Leptos breadcrumb, React
  derives the name client-side from get_device_by_id.
- servers.list_all/list_centrals/list_facilities: convenience wrappers
  for list_some that the React side never calls directly.
- versions.get_artifacts_by_version_id: showed every configured artifact
  including ones a public client wouldn't see; the detail page now uses
  versions.get_version_artifacts (the deduplicated public-API view) so
  the admin sees the same as the public.

Also restores commons.public_url and commons.server_versions_url to
the React AppBar — the right-side 'Public' / 'Server Versions' external
links got dropped during the migration and now render again, gated on
the corresponding env var being set on the backend.

Updates the artifacts test to assert deduplication on the new endpoint.
…t captions

>= becomes ≥, <= becomes ≤, != becomes ≠. So 'Applies to: >=2.44.2'
now reads 'Applies to: ≥2.44.2'.
The Arcs were a Leptos-era ergonomic for sharing values across signals
on the SSR side. Axum just serialises whatever's in Json(...), so the
wire shape is identical with or without them — the Arc only added a
clone gate in handler code that we no longer need.

Touches DeviceInfo, ServerDetailData, and the list_some/list_trusted/
list_untrusted/search return types. JSON serialisation is unchanged
(serde transparently serialises Arc<T> as T), so no client change.
…snippet

Both endpoints called BestoolSnippet::create with the same body — only
the supersedes field differed. Single endpoint takes an optional
supersedes uuid; absent for a brand-new snippet, set to the prior id
when editing (which records the new snippet as superseding the old).

Always returns the saved BestoolSnippetDetail. The create flow on
the React side still just refreshes the list; the edit flow uses the
returned id to navigate to the new version's detail page.
Devices was the outlier — it had `{ limit?, offset? }` (both optional,
limit listed first). The rest already used `{ offset, limit? }` with
offset required and limit optional. Switching devices to match.

The React side already always sends both, so no client-side change is
needed. limit defaults stay per-endpoint (10 for device lists, 100 for
connection history).
Introduces a small Page<T> { items, total } wrapper at crate::fns::Page
(and a matching Page<T> in private-web/src/types.ts). Five list endpoints
now embed their own count, removing the separate count fns:

- devices.list_untrusted (drops count_untrusted)
- devices.list_trusted (drops count_trusted)
- bestool.list_snippets (drops count_snippets)
- servers.list_some (drops count_some)
- sql.get_query_history (drops get_query_history_count)

Each was a guaranteed second round-trip from the React side anyway —
both calls fired in parallel from the same component on the same render
— so this is one fewer request per list page. The React useApi calls
become a single fetch with .data.items / .data.total instead of
juggling two states.
- watch-private-build: cargo build --bin private-server, watching crates/
- watch-private-api: runs target/debug/private-server directly, watching
  the binary path so it restarts on a fresh build instead of going
  through cargo run (which doesn't propagate watchexec's signals to
  its grandchild — left zombie servers holding the port)

Both recipes pass -I so watchexec doesn't apply its default ignore
filters.
The ring becomes a single stroked circle (r=40.55, stroke-width=8.9
gives the same outer-45/inner-36.1 it had before). The cross becomes
two overlapping rectangles. Three elements, no path arithmetic, easy
to tweak the next time.
The public-server's tera templates were the only consumer of Bulma and the
Leptos-era /static/private/main.css. The private side has moved to React+MUI
and no longer needs either. Replace both with a single hand-rolled stylesheet
covering only the primitives the templates use.
The Bulma submodule, _copy-bulma justfile recipe, static/bulma/ and
static/private/ directories, and the unreferenced static/bestool.css are no
longer needed: the public-server's templates now ship with a hand-rolled
public.css, and the private-server has its React bundle embedded in the
binary.
cargo-leptos is no longer pulled in by 'just install-deps' (and hasn't been
since the React migration); LEPTOS_OUTPUT_NAME, SERVER_FN_MOD_PATH and
DISABLE_SERVER_FN_HASH are no longer consumed by anything in CI; and
playwright.config.ts described the API server in stale terms.
The Playwright suite no longer assumes 'just watch-private-api' is running.
A worker-scoped fixture spawns target/debug/private-server on a dynamic
port against a freshly-migrated canopy_e2e_<random> database, starts Vite
on its own dynamic port with VITE_PROXY_TARGET pointed at the API, waits
for both, and tears the lot down (incl. dropping the database) when the
worker finishes.

This means each Playwright worker gets a fresh, isolated stack — no port
collisions with the operator's running dev servers, and no shared state
between workers.

Override CANOPY_E2E_ADMIN_DATABASE_URL (default postgres://localhost/postgres)
if your local Postgres uses different credentials. Set CANOPY_E2E_VERBOSE=1
to stream backend/frontend logs through the test runner.
Builds target/debug/{private-server,migrate}, runs npm ci in private-web,
caches the Playwright browser bundle keyed on the lockfile, and runs
npm run test:e2e against the same canopy/canopy Postgres role the rust
test job uses. Uploads the playwright-report on failure.
Bumps the deps group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axum](https://github.com/tokio-rs/axum) | `0.8.8` | `0.8.9` |
| [axum-test](https://github.com/JosephLenton/axum-test) | `18.7.0` | `20.0.0` |
| [clap](https://github.com/clap-rs/clap) | `4.6.0` | `4.6.1` |
| [diesel](https://github.com/diesel-rs/diesel) | `2.3.7` | `2.3.9` |
| [diesel-async](https://github.com/weiznich/diesel_async) | `0.7.4` | `0.9.0` |
| [jiff](https://github.com/BurntSushi/jiff) | `0.2.23` | `0.2.24` |
| [pulldown-cmark](https://github.com/raphlinus/pulldown-cmark) | `0.13.1` | `0.13.3` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.50.0` | `1.52.1` |
| [tachys](https://github.com/leptos-rs/leptos) | `0.2.14` | `0.2.15` |
| [diesel_migrations](https://github.com/diesel-rs/diesel) | `2.3.1` | `2.3.2` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.22.0` | `1.23.1` |
| [tokio-postgres](https://github.com/rust-postgres/rust-postgres) | `0.7.16` | `0.7.17` |



Updates `axum` from 0.8.8 to 0.8.9
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.8.8...axum-v0.8.9)

Updates `axum-test` from 18.7.0 to 20.0.0
- [Release notes](https://github.com/JosephLenton/axum-test/releases)
- [Commits](https://github.com/JosephLenton/axum-test/commits)

Updates `clap` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.0...clap_complete-v4.6.1)

Updates `diesel` from 2.3.7 to 2.3.9
- [Release notes](https://github.com/diesel-rs/diesel/releases)
- [Changelog](https://github.com/diesel-rs/diesel/blob/main/CHANGELOG.md)
- [Commits](diesel-rs/diesel@v2.3.7...v2.3.9)

Updates `diesel-async` from 0.7.4 to 0.9.0
- [Release notes](https://github.com/weiznich/diesel_async/releases)
- [Changelog](https://github.com/diesel-rs/diesel_async/blob/main/CHANGELOG.md)
- [Commits](diesel-rs/diesel_async@v0.7.4...v0.9.0)

Updates `jiff` from 0.2.23 to 0.2.24
- [Release notes](https://github.com/BurntSushi/jiff/releases)
- [Changelog](https://github.com/BurntSushi/jiff/blob/master/CHANGELOG.md)
- [Commits](BurntSushi/jiff@jiff-static-0.2.23...jiff-static-0.2.24)

Updates `pulldown-cmark` from 0.13.1 to 0.13.3
- [Release notes](https://github.com/raphlinus/pulldown-cmark/releases)
- [Commits](pulldown-cmark/pulldown-cmark@v0.13.1...v0.13.3)

Updates `tokio` from 1.50.0 to 1.52.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.50.0...tokio-1.52.1)

Updates `tachys` from 0.2.14 to 0.2.15
- [Release notes](https://github.com/leptos-rs/leptos/releases)
- [Commits](https://github.com/leptos-rs/leptos/commits)

Updates `diesel_migrations` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/diesel-rs/diesel/releases)
- [Changelog](https://github.com/diesel-rs/diesel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/diesel-rs/diesel/commits/v2.3.2)

Updates `uuid` from 1.22.0 to 1.23.1
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.22.0...v1.23.1)

Updates `tokio-postgres` from 0.7.16 to 0.7.17
- [Release notes](https://github.com/rust-postgres/rust-postgres/releases)
- [Commits](rust-postgres/rust-postgres@tokio-postgres-v0.7.16...tokio-postgres-v0.7.17)

---
updated-dependencies:
- dependency-name: axum
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: axum-test
  dependency-version: 20.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: deps
- dependency-name: clap
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: diesel
  dependency-version: 2.3.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: diesel-async
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: jiff
  dependency-version: 0.2.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: pulldown-cmark
  dependency-version: 0.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: tokio
  dependency-version: 1.52.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: tachys
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: diesel_migrations
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: uuid
  dependency-version: 1.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: tokio-postgres
  dependency-version: 0.7.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels May 1, 2026
@passcod passcod closed this May 1, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 1, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/cargo/deps-bcce6a16c2 branch May 1, 2026 03:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant