fix(bazel): bare @wsc_deps//:ureq alias — unbreaks the release (ureq 3.1.2→3.3.0 drift) - #212
Merged
Conversation
The release (and every wasm-component build) aborted at analysis:
no such target '@wsc_deps//:ureq-3.1.2' (did you mean ureq-3.3.0?)
referenced by //src/lib:wsc
ureq is the only dep referenced with a version-suffixed crate_universe
target; every other dep uses the bare alias (@wsc_deps//:anyhow, :p256,
…). When crate_universe re-pinned ureq ^3.1.2 -> 3.3.0, the hardcoded
`ureq-3.1.2` target vanished and the build broke. The bare `@wsc_deps//:ureq`
alias always tracks the resolved version, so it can't drift again.
This aborts before the sign/verify round-trip, so that step never ran —
the failure was a Cargo<->Bazel dep drift, not a signature problem.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This was referenced Aug 5, 2026
avrabe
added a commit
that referenced
this pull request
Aug 5, 2026
* release: v0.9.4 — unbreak the release + real #164 fix (sign large wasip2 components) Ships the release-integrity fixes now on main: - #213: MAX_SLICE_LEN 16MB -> 256MB so wsc-cli.wasm (large embedded core module) signs+verifies — the real #164 bug (rivet REQ-19 / DD-10). - #212: bare @wsc_deps//:ureq Bazel alias (dep drift unbroke the build). - #214: witness MC/DC baseline 12->17 (std/dep churn, documented; #128). - accumulated dep/action bumps since v0.9.3. Verified: release run build->sign->verify->publish green; 609 lib tests pass; Kani varint proof holds; witness gate green (17==17). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * release: sync Bazel version strings 0.9.0 -> 0.9.4 (clean-room finding) The Bazel-built CLI injects CARGO_PKG_VERSION from src/cli/BUILD.bazel's VERSION const, and MODULE.bazel carries the module version — both were stale at 0.9.0 despite 'keep in sync with workspace.version' comments. The release builds wsc-cli.wasm via Bazel, so the shipped CLI would have reported 0.9.0. Caught by the pre-tag clean-room verification. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * release: bump crossbeam-epoch 0.9.20 + wasmtime patch (RUSTSEC-2026-0204/0222/0223) Cargo Audit flagged 3 advisories in deps accumulated since v0.9.3: - crossbeam-epoch RUSTSEC-2026-0204 (invalid ptr deref) -> 0.9.20 - wasmtime RUSTSEC-2026-0222 (type-index mixup) + RUSTSEC-2026-0223 (bulk-op preemption) -> patched (wasmtime is optional/runtime-only, not in shipped binaries, but audit scans the whole lock). cargo audit clean (exit 0). Lockfile-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The release + every wasm-component build aborts at Bazel analysis:
ureq was the only dep referenced with a version-suffixed crate_universe target; all others use the bare alias. crate_universe re-pinned ureq
^3.1.2→ 3.3.0, soureq-3.1.2vanished. Switch bothsrc/lib/BUILD.bazelandsrc/cli/BUILD.bazelto the bare@wsc_deps//:ureqalias (matches every other dep; drift-proof).Note on the 'sign then verify' symptom: this aborts the wasm build before the sign/verify round-trip, so signing was never the failure — it's a Cargo↔Bazel dep drift. Once the build is green again the release reaches the sign/verify step (a hard requirement since #192, so any real signature issue would surface loudly).