chore: Bump deps and update lockfile#3663
Conversation
As usual more fixes to the tool, too.
larseggert
requested review from
KershawChang,
martinthomson and
mxinden
as code owners
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3663 +/- ##
==========================================
- Coverage 95.18% 95.06% -0.12%
==========================================
Files 111 116 +5
Lines 38160 38509 +349
Branches 38160 38509 +349
==========================================
+ Hits 36321 36608 +287
- Misses 1152 1202 +50
- Partials 687 699 +12
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Good improvements to the lockfile tooling. The main changes:
-
mio fork removed — the
[patch.crates-io]for the kinetiknz/mio fork is dropped (per the existing TODO referencing bug 2024485), switching back to registry mio 1.2.0. This also sheds thebacktracedependency tree from tokio (addr2line, gimli, miniz_oxide, etc.). -
Lockfile scripts restructured around explicit invariants —
compare_lockfile.pynow checks three named invariants (A: no non-Gecko duplicates, B: advisory ahead-of-Gecko, C: hard behind-Gecko) with a clean hard-violation/warning split and clearer exit-code semantics. The refactoring intoclassify_version_relationandfind_non_gecko_duplicatesinlockfile_utils.pyis a nice DRY improvement shared between both scripts. -
update_lockfile.pyphased approach — the four-phase structure (free updates → Gecko alignment → dedup → ahead warnings) is well-organized. The--update-neqo-onlyflag removal is a behavior change (free updates are now unconditional), but this matches the stated goal. The_cargo_update_specslockfile-restore fix on cargo failure is a good correctness improvement.
Two items flagged inline: dead is_ahead_of_gecko function in lockfile_utils.py, and the module docstring in update_lockfile.py claiming deps are never downgraded when the code does allow production-dep downgrades.
Minor observation: the new classify_version_relation and find_non_gecko_duplicates utility functions would benefit from unit tests — they encode non-trivial invariant logic (999-version handling, range-based dedup) that could regress silently.
There was a problem hiding this comment.
Pull request overview
This PR updates Rust dependencies (including removing the mio git patch) and significantly enhances the lockfile tooling used to keep Cargo.lock aligned with Gecko’s pinned versions, adding explicit alignment/dedup “invariants” and automation to resolve non-Gecko duplicate versions.
Changes:
- Extend
update-lockfileto (1) freely bump non-Gecko-pinned deps, (2) align shared deps with Gecko, (3) attempt to auto-collapse non-Gecko duplicate versions, and (4) report “ahead of Gecko” deps. - Update
compare-lockfileto check and report three invariants (duplicate splits, ahead-of-Gecko advisory, behind-Gecko production hard violations). - Remove the
mio[patch.crates-io]override and refreshCargo.lockaccordingly.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
test/update_lockfile.py |
Reworks lockfile update flow into phases; adds auto-dedup of non-Gecko duplicates; improves reporting. |
test/compare_lockfile.py |
Adds invariant-based validation/reporting and duplicate-split checks. |
test/lockfile_utils.py |
Introduces shared helpers for version relation classification and non-Gecko duplicate detection. |
test/README.md |
Updates documentation to reflect new update-lockfile behavior (no --update-neqo-only). |
Cargo.toml |
Removes the mio git patch override. |
Cargo.lock |
Updates locked dependency graph (including mio, tokio, socket2, windows-sys, etc.). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Merging this PR will not alter performance
Comparing 
Footnotes
|
There was a problem hiding this comment.
Good PR. The main pieces:
-
mio fork removal: Dropping the
[patch.crates-io]for kinetiknz/mio (per bug 2024485) and switching back to registry mio 1.2.0 is a welcome cleanup. This also sheds thebacktracedependency tree from tokio (addr2line, gimli, miniz_oxide, object, rustc-demangle). -
Invariant-based structure in
compare_lockfile.py: The three named invariants (A/B/C) with a clear hard-violation vs. warning split and well-defined exit-code semantics are a nice improvement over the old flat mismatch report. -
Phased
update_lockfile.py: The four-phase flow (free updates → Gecko alignment → dedup → ahead warnings) reads well. The re-alignment loop with anattemptedset to guarantee termination (lines 512–534) and the_cargo_update_specsrestore-on-failure fix are solid correctness improvements. -
--update-neqo-onlyremoval: Making free updates unconditional simplifies the UX and matches the intent.
Previous review findings (dead is_ahead_of_gecko, inaccurate docstrings, Phase 2 "upgrade-only" comment, filter_neqo_only_mismatches regression) are all resolved in the Fixes commit.
Three minor items flagged inline: a redundant docstring bullet, a stray blank line in Cargo.toml, and a suggestion for unit tests on the new invariant-logic helpers.
Benchmark resultsSignificant performance differences relative to 94e4eea. transfer/1-conn/10_000-parallel-1b-resp (aka. RPS): 💚 Performance has improved by -3.0899%. time: [269.43 ms 271.40 ms 273.45 ms]
thrpt: [36.570 Kelem/s 36.846 Kelem/s 37.116 Kelem/s]
change:
time: [-4.1266% -3.0899% -1.9726] (p = 0.00 < 0.05)
thrpt: [+2.0123% +3.1884% +4.3042]
Performance has improved.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high mildstreams-flow-controlled/walltime/1-streams/each-4194304-bytes: 💚 Performance has improved by -1.3243%. time: [32.100 ms 32.151 ms 32.202 ms]
change: [-1.5759% -1.3243% -1.0717] (p = 0.00 < 0.05)
Performance has improved.All resultstransfer/1-conn/1-100mb-resp (aka. Download): Change within noise threshold. time: [177.18 ms 177.60 ms 178.06 ms]
thrpt: [561.62 MiB/s 563.07 MiB/s 564.38 MiB/s]
change:
time: [+0.1865% +0.6051% +1.0150] (p = 0.00 < 0.05)
thrpt: [-1.0048% -0.6015% -0.1861]
Change within noise threshold.
Found 2 outliers among 100 measurements (2.00%)
1 (1.00%) high mild
1 (1.00%) high severetransfer/1-conn/10_000-parallel-1b-resp (aka. RPS): 💚 Performance has improved by -3.0899%. time: [269.43 ms 271.40 ms 273.45 ms]
thrpt: [36.570 Kelem/s 36.846 Kelem/s 37.116 Kelem/s]
change:
time: [-4.1266% -3.0899% -1.9726] (p = 0.00 < 0.05)
thrpt: [+2.0123% +3.1884% +4.3042]
Performance has improved.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high mildtransfer/1-conn/1-1b-resp (aka. HPS): No change in performance detected. time: [38.446 ms 38.631 ms 38.839 ms]
thrpt: [25.747 B/s 25.886 B/s 26.011 B/s]
change:
time: [-0.5515% +0.1255% +0.7830] (p = 0.71 > 0.05)
thrpt: [-0.7769% -0.1253% +0.5546]
No change in performance detected.
Found 9 outliers among 100 measurements (9.00%)
1 (1.00%) high mild
8 (8.00%) high severetransfer/1-conn/1-100mb-req (aka. Upload): No change in performance detected. time: [179.27 ms 179.61 ms 180.01 ms]
thrpt: [555.53 MiB/s 556.77 MiB/s 557.82 MiB/s]
change:
time: [-0.1241% +0.2575% +0.6061] (p = 0.18 > 0.05)
thrpt: [-0.6024% -0.2568% +0.1242]
No change in performance detected.
Found 8 outliers among 100 measurements (8.00%)
1 (1.00%) low mild
6 (6.00%) high mild
1 (1.00%) high severestreams/walltime/1-streams/each-1000-bytes: Change within noise threshold. time: [568.55 µs 570.51 µs 572.80 µs]
change: [+0.0340% +0.5900% +1.1187] (p = 0.04 < 0.05)
Change within noise threshold.
Found 8 outliers among 100 measurements (8.00%)
1 (1.00%) high mild
7 (7.00%) high severestreams/walltime/1000-streams/each-1-bytes: Change within noise threshold. time: [11.401 ms 11.420 ms 11.439 ms]
change: [+0.0762% +0.3181% +0.5620] (p = 0.01 < 0.05)
Change within noise threshold.streams/walltime/1000-streams/each-1000-bytes: Change within noise threshold. time: [36.227 ms 36.273 ms 36.320 ms]
change: [+0.5550% +0.7591% +0.9540] (p = 0.00 < 0.05)
Change within noise threshold.
Found 2 outliers among 100 measurements (2.00%)
2 (2.00%) high mildstreams-flow-controlled/walltime/1-streams/each-4194304-bytes: 💚 Performance has improved by -1.3243%. time: [32.100 ms 32.151 ms 32.202 ms]
change: [-1.5759% -1.3243% -1.0717] (p = 0.00 < 0.05)
Performance has improved.streams-flow-controlled/walltime/10-streams/each-1048576-bytes: Change within noise threshold. time: [86.194 ms 86.485 ms 86.839 ms]
change: [-1.9233% -1.3388% -0.7785] (p = 0.00 < 0.05)
Change within noise threshold.
Found 10 outliers among 100 measurements (10.00%)
4 (4.00%) low mild
5 (5.00%) high mild
1 (1.00%) high severetransfer/walltime/pacing-false/varying-seeds: Change within noise threshold. time: [20.439 ms 20.456 ms 20.476 ms]
change: [-0.4187% -0.2330% -0.0774] (p = 0.00 < 0.05)
Change within noise threshold.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high severetransfer/walltime/pacing-true/varying-seeds: Change within noise threshold. time: [20.979 ms 21.005 ms 21.043 ms]
change: [-0.6261% -0.4676% -0.2648] (p = 0.00 < 0.05)
Change within noise threshold.
Found 2 outliers among 100 measurements (2.00%)
1 (1.00%) high mild
1 (1.00%) high severetransfer/walltime/pacing-false/same-seed: Change within noise threshold. time: [20.552 ms 20.580 ms 20.624 ms]
change: [-1.1455% -0.8770% -0.6097] (p = 0.00 < 0.05)
Change within noise threshold.
Found 2 outliers among 100 measurements (2.00%)
1 (1.00%) high mild
1 (1.00%) high severetransfer/walltime/pacing-true/same-seed: Change within noise threshold. time: [20.781 ms 20.809 ms 20.852 ms]
change: [-1.8825% -1.6518% -1.3986] (p = 0.00 < 0.05)
Change within noise threshold.
Found 2 outliers among 100 measurements (2.00%)
1 (1.00%) high mild
1 (1.00%) high severeDownload data for |
Failed Interop TestsQUIC Interop Runner, client vs. server, differences relative to
All resultsSucceeded Interop TestsQUIC Interop Runner, client vs. server neqo-pr as client
neqo-pr as server
Unsupported Interop TestsQUIC Interop Runner, client vs. server neqo-pr as client
neqo-pr as server
|
Client/server transfer resultsPerformance differences relative to 94e4eea. Transfer of 33554432 bytes over loopback, min. 100 runs. All unit-less numbers are in milliseconds.
Table above only shows statistically significant changes. See all results below. All resultsTransfer of 33554432 bytes over loopback, min. 100 runs. All unit-less numbers are in milliseconds.
Download data for |
As usual more fixes to the tool, too.