build(application): upgrade azure_iot_operations binaries in 500 applications#519
Conversation
🔧 - Generated by Copilot
🔧 - Generated by Copilot
🔧 - Generated by Copilot
🔧 - Generated by Copilot
🔧 - Generated by Copilot
🔧 - Generated by Copilot
🔧 - Generated by Copilot
🔧 - Generated by Copilot
bindsi
left a comment
There was a problem hiding this comment.
🤖 Automated review: AIO SDK upgrades (0.x→1.x) look correct across .NET and Rust crates. One observation:
reqwest downgrade (non-blocking): In 502-rust-http-connector/services/broker/Cargo.toml, reqwest is changed from 0.12 to 0.11.6. This is a semver downgrade — reqwest 0.12 has different APIs from 0.11 (e.g., the Body type and builder patterns changed). If the AIO SDK 1.0.2 pins to reqwest 0.11.x internally, this may be intentional for compatibility, but please confirm this doesn't regress any HTTP client functionality in the broker service. The same version (0.11.6) is also added as a new dep in media-capture-service.
bindsi
left a comment
There was a problem hiding this comment.
Automated batch review: requesting changes for one blocking lockfile issue.
- update rust coverage step to skip upload when coverage.xml is absent - ignore commented aio-sdks entries when deciding registry skip behavior - bump reqwest manifest pins in broker and media-capture crates 🔒 - Generated by Copilot
🔧 - Generated by Copilot
…de' into feat/298-aio-sdk-telemetry-upgrade
🔧 - Generated by Copilot
…ures - update dependencies for Azure IoT Operations SDK - refactor MQTT publisher to use new session management - implement enhanced message processing with topic filtering - add pallet correlation enrichment functionality 🔧 - Generated by Copilot Signed-off-by: Marcel Bindseil <marcelbindseil@gmail.com>
…de' into feat/298-aio-sdk-telemetry-upgrade # Conflicts: # src/500-application/502-rust-http-connector/services/broker/Cargo.lock # src/500-application/502-rust-http-connector/services/broker/src/main.rs # src/500-application/502-rust-http-connector/services/broker/src/mqtt_publisher.rs
Dependency ReviewThe following issues were found:
|
- replace git SHA dependencies with published crates.io versions - remove unused azure_iot_operations_aio_sdk dependency - remove aio-sdks private registry from .cargo/config.toml files - simplify Dockerfiles by removing registry injection blocks 📦 - Generated by Copilot
…1/receiver - receiver source imports azure_iot_operations_protocol but was missing from Cargo.toml - now matches sender and other services that use protocol module 🔧 - Generated by Copilot
- regenerated lock file after adding azure_iot_operations_protocol dependency - ensures reproducible builds with correct versions locked 🔧 - Generated by Copilot
- Format packages.lock.json files modified in this branch - No functional changes, formatting only 🎨 - Generated by Copilot
- memmap2 0.9.10/0.9.11 has unsound unchecked pointer offset vulnerability - Transitive dependency via candle-core 0.9.2 (used for AI inference) - Cannot update without upstream candle release - Documented in audit.toml alongside other transitive vulnerabilities 🔒 - Generated by Copilot
- Minor version updates from cargo update: autocfg 1.5.0 -> 1.5.1, http 1.4.0 -> 1.4.2, hyper 1.9.0 -> 1.10.1 - Ensures reproducible builds with up-to-date transitive dependencies 🔧 - Generated by Copilot
## Description Patches two newly published Rust security advisories that are failing the `Dependency Audit` (`cargo-audit`) CI job and blocking unrelated PRs (for example #519) from merging. Both fixes are semver-compatible, lockfile-only dependency bumps with no source or behavior changes. - **quinn-proto** `0.11.14` → `0.11.15` in `src/500-application/502-rust-http-connector/services/broker` to resolve [RUSTSEC-2026-0185](https://rustsec.org/advisories/RUSTSEC-2026-0185.html) — *Remote memory exhaustion from unbounded out-of-order stream reassembly* (CVSS 7.5 HIGH, denial-of-service). - **memmap2** `0.9.10` → `0.9.11` in `src/500-application/507-ai-inference/services/ai-edge-inference` and `ai-edge-inference-crate` to resolve [RUSTSEC-2026-0186](https://rustsec.org/advisories/RUSTSEC-2026-0186.html) — *Unchecked pointer offset* (unsound). These were addressed by upgrading the affected dependencies to their patched releases rather than allow-listing them in `.github/audit.toml` / `osv-scanner.toml`, because fixed versions are available and semver-compatible. ## Related Issue Relates to #519 (the cargo-audit failures were blocking that PR) ## Type of Change - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Blueprint modification or addition - [ ] Component modification or addition - [ ] Documentation update - [ ] CI/CD pipeline change - [ ] Other (please describe): ## Implementation Details - Ran `cargo update -p quinn-proto --precise 0.11.15` in the `502-rust-http-connector` broker crate. - Ran `cargo update -p memmap2 --precise 0.9.11` in both `507-ai-inference` crates. - Only `Cargo.lock` files changed; the affected entries are transitive dependencies, so no `Cargo.toml` manifest edits were required. - The diff is limited to the dependency version and checksum lines (6 lines across 3 lockfiles); no other dependencies were moved. ## Testing Performed - [ ] Terraform plan/apply - [ ] Blueprint deployment test - [ ] Unit tests - [ ] Integration tests - [ ] Bug fix includes regression test (see [Test Policy](docs/contributing/testing-validation.md)) - [x] Manual validation - [ ] Other: Ran `cargo audit --deny warnings` (with the repo `.github/audit.toml` allow-list applied) against each affected crate; all three now report no advisories. The remaining allow-listed advisories (`instant`, `paste`, `rustls-pemfile`, `rand`) are unchanged. ## Validation Steps 1. For each affected crate, copy the allow-list: `cp .github/audit.toml <crate>/.cargo/audit.toml`. 2. Run `cargo audit --deny warnings` in: - `src/500-application/502-rust-http-connector/services/broker` - `src/500-application/507-ai-inference/services/ai-edge-inference` - `src/500-application/507-ai-inference/services/ai-edge-inference-crate` 3. Confirm each reports no `error:` advisories. ## Checklist - [ ] I have updated the documentation accordingly - [ ] I have added tests to cover my changes - [ ] All new and existing tests passed - [ ] I have run `terraform fmt` on all Terraform code - [ ] I have run `terraform validate` on all Terraform code - [ ] I have run `az bicep format` on all Bicep code - [ ] I have run `az bicep build` to validate all Bicep code - [x] I have checked for any sensitive data/tokens that should not be committed - [x] Lint checks pass (run applicable linters for changed file types) ## Security Review - [x] No credentials, secrets, or tokens are hardcoded or logged - [ ] RBAC and identity changes follow least-privilege principles - [x] No new network exposure or public endpoints introduced without justification - [x] Dependency additions or updates have been reviewed for known vulnerabilities - [ ] Container image changes use pinned digests or SHA references ## Additional Notes - Terraform/Bicep checklist items are not applicable; this change touches only Rust `Cargo.lock` files. - This change does not touch any security-sensitive paths (`SECURITY.md`, `src/000-cloud/010-security-identity/`, `deploy/`), so the `security-reviewed` label should not be required.
Add missing transitive dependencies left out of the lock file after merging main, so cargo llvm-cov --locked no longer fails in the Rust Tests coverage job.
bindsi
left a comment
There was a problem hiding this comment.
Approving — all previously blocking feedback has been addressed and CI is green.
Verified on the current head (e2b52a0):
- Lockfiles in sync (was blocking):
Cargo.lockfiles were regenerated and allRust Tests / coveragejobs now pass withcargo llvm-cov --locked. The original--lockedfailure is resolved. - reqwest no longer downgraded:
502-rust-http-connector/services/broker/Cargo.tomlnow pinsreqwest = "0.12.28"(kept on 0.12,jsonfeature added) instead of the earlier0.11.6. No hyper 0.14/1.x regression. - ort
default-featuresconcern: the507-ai-inference/.../ai-edge-inference-crate/Cargo.tomlchange is no longer in the diff, soload-dynamicis not being silently dropped. - Workflow precision fixes applied: the
aio-sdksregistry grep now excludes commented lines (grep -v '^\s*#') and the Codecov upload is guarded byhashFiles()so skipped crates don't produce noisy failures.
All 5 review threads are resolved and all 61 checks are passing (success/skipped/neutral, none failing or pending). AIO SDK 0.x→1.x upgrades across the .NET and Rust crates look consistent, with matching lockfile updates.
Non-blocking observation for a follow-up: .cargo/config.toml removes the aio-sdks registry definition (packages now resolved from crates.io), while rust-tests.yml still contains the cargo login --registry aio-sdks step and the registry = "aio-sdks" skip guard. These are now effectively dead paths since no Cargo.toml references that registry — safe to leave, but worth pruning later to avoid confusion.
katriendg
left a comment
There was a problem hiding this comment.
Thanks for the iterative work on this 🙏
Big thanks to @kgmwang1 and Marcel Bindseil for pushing this AIO SDK GA migration through a long series of iterations and for cleaning up the merge-conflict artifacts that were breaking CI. The app coverage is spot on — I verified against main that exactly the six src/500-application services that depend on the AIO SDKs (500, 501, 502, 503, 504, 507) are updated, with no app missed, and the 507 mqtt.rs API migration lines up cleanly with the GA SDK surface. 👏
I'm marking this Request changes for a few valid items that should be applied before we merge. They're small and mostly mechanical — I've left inline suggestions where possible.
🔴 Please address before merge
- Pin to GA, not beta —
azure_iot_operations_servicesis set to1.3.0-beta1in501(sender + receiver) and507. crates.io confirms1.2.0is the max stable release, which is the GA target in #298. Inlinesuggestionblocks are attached on all three manifests. If any code path actually requires a1.3.0-beta1-only API, let's call that out explicitly rather than ship a pre-release. - Remove out-of-scope files —
src/500-application/514-wasm-msg-to-dss/operators/msg-to-dss-key/src/enricher.rsand.../resources/graphs/lowcode-pallet-correlation-enrichment.yamlare new feature files unrelated to the SDK upgrade (#298 explicitly lists new AIO usage as out of scope). Inline comments attached. - Drop the dead
aio-sdksCI logic — since every500-applicationcrate moved off the private registry to crates.io, theCARGO_REGISTRIES_AIO_SDKS_TOKENsecret, the auth step, and the coverage-skip branch inrust-tests.ymlare no longer needed. Inline comment attached.
🟠 PR hygiene (required, no inline anchor)
- Use the PR template and link the issue — please rewrite the description with the repo PR template and add
Closes #298so it auto-closes on merge. - Capture upgrade notes — #298's acceptance criteria asks for notes on non-obvious breaking changes. Worth summarizing the
507/504API migration (SessionConnectionMonitor→SessionMonitor,publish→publish_qos1, newTopicName/TopicFilter/SubscribeProperties/PublishProperties,message.topic→message.topic_name) and noting that507dropped its directazure_iot_operations_protocoldependency.
✅ Looks good / no action
507azure_iot_operations_protocolremoval is safe — verified no.rsfile references it.mqtt(1.0.2) andprotocol(1.0.0) pins are GA.- Keeping
.devcontainer/devcontainer-lock.jsonis fine.
One thing to keep an eye on: the Dependency Review check still flags 1 vulnerable package, and a RUSTSEC-2026-0186 (memmap2) ignore was added to 507's audit list — acceptable given the documented candle-core constraint, but please acknowledge it in the PR so it's an explicit decision.
Thanks again — once the above are in, this should be ready to go. 🚀
🧹 - Generated by Copilot
downgrade rust telemetry sender and receiver from 1.3.0-beta1 to 1.2.0 note that msg-to-dss enrichment files were removed from this PR scope Removed from this PR: src/500-application/514-wasm-msg-to-dss/resources/graphs/lowcode-pallet-correlation-enrichment.yaml enricher.rs 🔧 - Generated by Copilot
…e/Cargo.toml Co-authored-by: Katrien De Graeve <katriendg@users.noreply.github.com>
🔧 - Generated by Copilot Signed-off-by: Marcel Bindseil <marcelbindseil@gmail.com>
…om/microsoft/edge-ai into feat/298-aio-sdk-telemetry-upgrade
🔧 - Generated by Copilot
katriendg
left a comment
There was a problem hiding this comment.
Thanks for the quick turnaround 🙏
Really nice iteration here, @kgmwang1 (and Marcel Bindseil) — almost everything from the last pass is addressed:
- ✅
azure_iot_operations_servicesnow pinned to GA1.2.0across501sender/receiver and507(and the C#500-basic-inferenceis on GA too). No more1.3.0-beta1. - ✅ Both out-of-scope
514-wasm-msg-to-dssfiles removed. - ✅ PR description rewritten with the template,
Closes #298, the documented API breaking changes, and the507azure_iot_operations_protocolremoval note.
One remaining item (then this is good to go)
The rust-tests.yml aio-sdks token/auth handling is still in place, and I'm now confident it should be removed. I validated the registry directly and it requires no auth (config.json returns "auth-required":false; the wasm_graph_sdk index and tarball both download anonymously with 200). The WASM crates that still use registry = "aio-sdks" build fine without a token, and this coverage matrix doesn't even run those crates — it's only 501–507 + 901, which all moved to crates.io in this PR. Details in the inline comment.
Once the env, the "Configure aio-sdks registry authentication" step, and the token-based coverage-skip branch are removed (keep --locked), I'm happy to approve. Thanks again! 🚀
katriendg
left a comment
There was a problem hiding this comment.
Thank you for the additional changes! All good
Summary
This PR upgrades Azure IoT Operations dependencies across 500-application services to current crates.io releases, refreshes related lockfiles and runtime code paths, and hardens Rust CI behavior for private-registry scenarios.
Why
Move off older aio-sdks-pinned crate versions in application services.
Align service dependency versions and lockfiles for consistent builds.
Reduce CI fragility when private registry auth is unavailable.
Carry forward security/build fixes from dependency refreshes.
What Changed
Upgraded/migrated Azure IoT Operations Rust dependencies across application services:
azure_iot_operations_mqtt moved to 1.0.2 in multiple services.
azure_iot_operations_protocol moved to 1.0.0 where required.
azure_iot_operations_services standardized to 1.2.0 with state_store.
Refreshed Cargo lockfiles and selected Docker/runtime code for affected services.
Updated CI workflow behavior in rust-tests.yml :
Handles aio-sdks token-based auth more explicitly.
Skips token-required coverage jobs when token is missing.
Uses cargo llvm-cov --locked for reproducibility.
API Breaking changes resolved:
Additional note for 507:
Removed its direct azure_iot_operations_protocol dependency.
Closes #298