build(huntsman): Manage crate dependency versions centrally through the Cargo workspace; Set all crates' version to 0.1.0-dev.

[LinZhihao-723]

Description

Summary

This PR introduces workspace-level dependency and package inheritance so that every external crate is declared exactly once, in the root Cargo.toml, instead of being pinned independently in each of the 21 member manifests. Before this change a version bump was an N-file edit, and five crates had already drifted apart across members (tokio was simultaneously 1.50.0 and 1.52.3, anyhow 1.0.98 and 1.0.102, tokio-util 0.7 and 0.7.18, tracing 0.1.41 and 0.1.44, tracing-subscriber 0.3.19 and 0.3.23). All drift is resolved and every dependency is aligned to the newest semver-compatible release.

Every bump stays within its crate's current major, so no Rust source file is modified by this PR — it is confined to manifests and Cargo.lock. Where a crate has a breaking major available, it is pinned to the last release before that break rather than upgraded; those upgrades are deferred to individual PRs (see below).

The change is intended to be behavior-neutral. It was verified as such by diffing the fully resolved feature graph (cargo metadata) before and after: of roughly 318 packages common to both graphs, exactly one differs, and that difference comes from an upstream manifest change rather than from this migration (see Notes).

All member crates additionally move from version = "0.1.0" to a shared version = "0.1.0-dev", and the Helm chart's appVersion is updated to match.

Workspace inheritance (root Cargo.toml)

• Adds [workspace.package] holding the two fields every member repeated identically: version = "0.1.0-dev" and edition = "2024".
• Adds [workspace.dependencies] with 39 external crates and the 13 internal path dependencies. Internal crates are now referenced by name rather than by a relative path, which removes path spellings like ../../../../components/spider-tdl from the example crates.
• resolver, members, and default-members are unchanged.

Member manifests (21 crates)

• [package] now uses version = { workspace = true } and edition = { workspace = true }.
• Every entry in [dependencies], [dev-dependencies], and [build-dependencies] becomes { workspace = true }. Members retain only the features they need in addition to what the workspace entry already provides, so the common case collapses to a single bare inheritance.
• The { workspace = true } inline-table form is used throughout rather than the dotted dep.workspace = true form, for consistency and to avoid tripping the dotted-keys-out-of-order lint rule configured in tombi.toml.
• Features that remain member-local: sqlx adds runtime-tokio in spider-storage; syn adds full in spider-tdl-derive; tracing adds attributes in spider-storage; spider-tdl adds derive in huntsman-complex, huntsman-nn-tasks, and integration-test-tasks. The tokio and tokio-util workspace entries deliberately carry no features, because the per-member feature sets differ substantially, so each member keeps its full list.
• spider-tdl-derive remains an optional dependency of spider-tdl ({ workspace = true, optional = true }).

default-features = false moves up to the workspace

futures-util, tracing, and tracing-subscriber were each declared with default-features = false in individual members. Cargo ignores a member's default-features = false when the workspace entry leaves defaults enabled, so this key now lives on the workspace entry instead; leaving it in the members would have silently re-enabled default features.

For tracing this meant restating the intent slightly: the workspace entry is default-features = false, features = ["std"], and spider-storage — which previously took defaults plus attributes — now declares attributes explicitly. The resolved feature set is unchanged (verified below).

Dependency version alignment

Aligned to the newest compatible release

Where a crate had drifted, the drifted requirements are listed together in "Before".

Crate	Before	After	Note
anyhow	1.0.98, 1.0.102	1.0.104	Drift resolved
async-channel	2.3.1	2.5.0
async-trait	0.1.89	0.1.91
bytes	1.10	1.12.1	Requirement was not patch-exact
clap	4.6.1	4.6.4
const_format	0.2.35	0.2.36
dashmap	6.1.0	6.2.1
futures-util	0.3.31	0.3.33
libloading	0.8.5	0.8.9	Major deferred
proc-macro2	1.0.106	1.0.107
quote	1.0.45	1.0.47
rand	0.9.1	0.9.5	Major deferred
semver	1.0.27	1.0.28
serde	1.0.228	1.0.229
serde_json	1.0.149	1.0.151
serial_test	3.2.0	3.5.0	Major deferred
syn	2.0.117	2.0.119	Major deferred
thiserror	2.0.18	2.0.19
tokio	1.50.0, 1.52.3	1.53.1	Drift resolved
tokio-util	0.7, 0.7.18	0.7.19	Drift resolved; requirement was not patch-exact
tracing	0.1.41, 0.1.44	0.1.44	Drift resolved
tracing-subscriber	0.3.19, 0.3.23	0.3.23	Drift resolved

Every entry in [workspace.dependencies] is now patch-exact, per the repository convention. bytes and tokio-util previously named no patch version, and those two pre-existing deviations are corrected here.

Breaking major available, deliberately not taken

Each of these is pinned to the newest release within its current major — the last version before the API break — so that this PR needs no source changes. Each upgrade is deferred to its own PR so it can be reviewed against its own migration guide.

Crate	Pinned at	Major available	Why deferred
bincode	1.3.3	3.0.0	3.0.0 is a tombstone, not a usable release; crate is unmaintained
libloading	0.8.9	0.9.0	dlerror text moves out of Display, degrading load-failure diagnostics
rand	0.9.5	0.10.2	Rng renamed to RngExt; SeedableRng::from_os_rng removed
serial_test	3.5.0	4.0.1	MSRV bump and internal syn 3 only; no user-facing API change
sqlx	0.8.6	0.9.0	ArgumentBuffer loses its lifetime; query*() narrowed; MySQL behavior changes
syn	2.0.119	3.0.3	Workspace stays on syn 2.x deliberately; see Notes
tabled	0.20.0	0.21.0	Charset, TabSize, and ColumnNames reworked; none used here

sqlx and libloading are worth calling out, because their majors would each require code changes that this pinning avoids:

• sqlx 0.9.0 removes the lifetime parameter from ArgumentBuffer (which the Encode impls in spider-core/src/types/id.rs and the MySqlEnum derive in spider-derive/src/mysql.rs both name) and narrows query*() to impl SqlSafeStr (which the dynamically built statements in spider-storage/src/db/mariadb.rs would need to opt out of). It also changes MySQL connection behavior — SET NAMES utf8mb4 COLLATE utf8_general_ci is no longer sent by default — and touches how database errors are surfaced, which matters here because duplicate-key and foreign-key handling in mariadb.rs classifies errors by downcasting to MySqlDatabaseError and matching on the error number. Staying on 0.8.6 keeps all of that as-is.
• libloading 0.9.0 moves the underlying dlerror text out of Error's Display implementation and behind Error::source(). Because ExecutorError's From<libloading::Error> impl formats via to_string(), taking that major without also rewriting the conversion would silently reduce every TDL package load failure to "dlopen failed". Staying on 0.8.9 preserves the current diagnostics.

bincode is a special case in that table: it is not merely deferred. The crate is unmaintained, and its 3.0.0 release is a deliberate tombstone whose src/lib.rs is a bare compile_error!, so it cannot be depended on at all — 2.0.1 is the last functional release. Migrating off bincode entirely is tracked separately; this repo already uses rmp-serde for every other serialization path.

Crate version scheme

All 21 members now report 0.1.0-dev through workspace inheritance. 0.1.0-dev is a valid SemVer 2.0.0 pre-release (dev is a well-formed alphanumeric identifier) and orders below 0.1.0. No member declares a version requirement on another member — internal dependencies are path-only — so the suffix has no effect on resolution.

Helm chart (tools/deployment/spider-helm/Chart.yaml)

• appVersion moves from "0.1.0" to "0.1.0-dev" so the deployed application version tracks the workspace crate version. appVersion is surfaced only as the app.kubernetes.io/version label via spider.labels in _helpers.tpl; container image tags come from values.yaml through spider.imageRef and are unaffected.
• The chart version is bumped 0.1.5 → 0.1.6, matching the convention that every change to the chart carries a patch bump.

Notes

• Resolved-feature verification: comparing cargo metadata output between a pristine checkout and this branch, exactly one package's feature set differs. tokio-util gains libc, because tokio-util 0.7.19 declares codec = ["libc"] where 0.7.18 did not; the workspace already enabled codec, so this follows mechanically from the upstream bump. No package loses a feature. futures-util, tracing, tracing-subscriber, tokio, sqlx, serde, clap, syn, and spider-tdl all resolve to byte-identical feature sets.
• Cargo.lock gains exactly one package, syn 3.0.3, pulled in by the bumped async-trait, clap_derive, serde_derive, and thiserror-impl. It resolves only as a host dependency, so it adds one proc-macro-side compilation unit and contributes nothing to the target artifact. syn 2.x is unaffected and still required by 23 crates in the graph, including this repo's two proc-macro crates, and syn 1.0.109 remains reachable through non-empty-string → delegate, so a single syn version is not achievable at present and the workspace intentionally stays on syn 2.x.
• default-features = false on tracing is effectively inert in this workspace, since sqlx-core enables tracing's default features regardless. It is declared for correctness of intent rather than for effect. The same is true of futures-util, whose defaults are enabled transitively by serial_test, hyper-util, sqlx, and tonic.
• test-utils previously declared serde with no features and now inherits derive from the workspace entry. This is inherent to Cargo's feature unioning and has no resolved effect, as serde/derive is already enabled by 12 other members. Avoiding it would mean removing derive from the workspace entry and repeating it in those 12 members.

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a
  breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

• Ensure all workflows pass.

Summary by CodeRabbit

• Chores

  • Centralized package versions, editions, and dependency management across the project.
  • Updated components, examples, and test packages to use shared workspace configuration.
  • Preserved existing dependency features while simplifying project configuration.

• Deployment

  • Bumped the Helm chart version to 0.1.6.
  • Updated the application version label to 0.1.0-dev.

[coderabbitai]

Walkthrough

The root Cargo workspace now owns shared package metadata and dependency configuration. Component, example, and test manifests inherit those settings. The Helm chart version is updated to 0.1.6, with appVersion set to 0.1.0-dev.

Changes

Cargo workspace migration

Layer / File(s)	Summary
Workspace metadata and dependency contract Cargo.toml	Shared crate metadata, dependency versions, features, and internal paths are centralized under workspace configuration.
Component manifest migration components/*/Cargo.toml	Component crates switch package metadata and dependencies to workspace inheritance while retaining applicable features and targets.
Example and test manifest migration examples/huntsman/*/Cargo.toml, tests/huntsman/*/Cargo.toml	Example and test crates replace hard-coded versions and local paths with workspace-managed declarations.

Helm chart metadata

Layer / File(s)	Summary
Chart release metadata tools/deployment/spider-helm/Chart.yaml	The chart version changes to 0.1.6, and appVersion changes to 0.1.0-dev.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• y-scope/spider#418: Overlaps with workspace dependency changes for spider-execution-manager and Tokio features.
• y-scope/spider#333: Overlaps with dependency and metadata resolution for spider-proto-rust.
• y-scope/spider#420: Also updates tools/deployment/spider-helm/Chart.yaml and the chart version.

Suggested reviewers: sitaowang1998

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: centralizing Cargo workspace dependency management and setting crate versions to 0.1.0-dev.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sitaowang1998]

Shall we create issues to track the pending upgrade and the removal of bincode?

[LinZhihao-723]

@coderabbitai Based on the PR description, create issues to track the pending upgrades for the following dependencies:

• bincode: Since this library is no longer maintained, we should probably switch to an alternative.
• sqlx: API changed.
• libloading: API changed.
• syn: Other dependencies used by this project depend on different versions of syn: some on 2.x and others on 3.x.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="y-scope/spider"

for query in \
  'bincode in:title,body is:issue is:open' \
  'sqlx in:title,body is:issue is:open' \
  'libloading in:title,body is:issue is:open' \
  'syn in:title,body is:issue is:open'
do
  echo "=== $query ==="
  gh issue list --repo "$repo" --state open --search "$query" \
    --json number,title,url,body,assignees \
    --jq '.[] | {number, title, url, assignees: [.assignees[].login]}'
done

Length of output: 920

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== Dependency declarations ==='
rg -n -i -C 2 '^\s*(bincode|sqlx|libloading|syn)\s*=' \
  -g 'Cargo.toml' -g 'Cargo.lock' .

printf '%s\n' '=== Direct Rust usage ==='
rg -n -i -C 2 '\b(bincode|sqlx|libloading|syn)\b' \
  -g '*.rs' .

Length of output: 66988

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="y-scope/spider"
pr_url="https://github.com/y-scope/spider/pull/421"
requester="LinZhihao-723"
comment_url="$(
  gh api "repos/$repo/issues/421/comments" --paginate \
    --jq '.[] | select(.body | contains("create issues to track the pending upgrades")) | .html_url' \
    | head -n 1
)"
if [[ -z "$comment_url" ]]; then
  comment_url="$pr_url#issuecomment-unavailable"
fi

create_issue() {
  local title="$1"
  local body="$2"
  gh issue create \
    --repo "$repo" \
    --title "$title" \
    --assignee "$requester" \
    --body "$body"
}

bincode_body=$(cat <<EOF
## Summary
Replace the unmaintained \`bincode\` dependency with a maintained serialization alternative.

## Rationale
The workspace currently centralizes \`bincode = "1.3.3"\`. Because the library is no longer maintained, the executor IPC serialization should move to a supported alternative.

## Affected areas
- Workspace dependency declaration: \`Cargo.toml\`
- Executor process-pool request/response framing: \`components/spider-execution-manager/src/process_pool.rs\`
- Executor subprocess protocol: \`components/spider-task-executor/src/bin/spider_task_executor.rs\` and \`components/spider-task-executor/src/protocol.rs\`
- Shared executor test harness: \`tests/huntsman/test-utils/src/executor.rs\`
- Related integration and protocol tests

## Required changes
1. Evaluate maintained serialization formats/libraries that meet the executor IPC protocol requirements.
2. Select and document the replacement.
3. Migrate all request/response encoding and decoding together so parent and subprocess remain wire-compatible.
4. Remove the direct \`bincode\` dependency and update the lockfile.

## Acceptance criteria
- No workspace member directly depends on \`bincode\`.
- Parent/executor request-response behavior and error handling remain covered by tests.
- The selected format and any compatibility or migration constraints are documented.

Requested by @$requester.

Backlinks: $pr_url · $comment_url
EOF
)

sqlx_body=$(cat <<EOF
## Summary
Upgrade \`sqlx\` across the workspace and adapt Spider to its breaking API changes.

## Rationale
The centralized workspace dependency is currently \`sqlx = "0.8.6"\` with MySQL support. The pending major upgrade changes APIs, so it was intentionally deferred from PR `#421`.

## Affected areas
- Workspace dependency declaration: \`Cargo.toml\`
- Custom SQLx trait implementations: \`components/spider-core/src/types/id.rs\` and \`components/spider-derive/src/mysql.rs\`
- MariaDB implementation and database error types: \`components/spider-storage/src/db/\`
- SQLx-related derive and integration test coverage

## Required changes
1. Upgrade to the targeted supported \`sqlx\` release and preserve required MySQL/runtime features.
2. Update custom \`Type\`, \`Encode\`, and \`Decode\` implementations plus storage queries/transactions for API changes.
3. Refresh the lockfile and validate database-facing tests.

## Acceptance criteria
- The workspace uses the selected upgraded \`sqlx\` version centrally.
- All compile errors and behavioral changes caused by the upgrade are addressed.
- MariaDB storage workflows and custom ID/enum SQL mappings remain covered by tests.

Requested by @$requester.

Backlinks: $pr_url · $comment_url
EOF
)

libloading_body=$(cat <<EOF
## Summary
Upgrade \`libloading\` and adapt task-executor dynamic-library loading code to its breaking API changes.

## Rationale
The workspace currently centralizes \`libloading = "0.8.9"\`. Its pending major upgrade has API changes and was deferred from PR `#421`.

## Affected areas
- Workspace dependency declaration: \`Cargo.toml\`
- Dynamic library and symbol loading: \`components/spider-task-executor/src/manager.rs\`
- Dynamic-loading error conversion: \`components/spider-task-executor/src/error.rs\`
- Task-executor integration tests that load task packages

## Required changes
1. Upgrade \`libloading\` to the intended supported major release.
2. Adapt library/symbol lifetime, unsafe-operation, and error-handling code to the new API.
3. Refresh the lockfile and test loading valid and invalid task libraries.

## Acceptance criteria
- The workspace centrally resolves the selected upgraded \`libloading\` version.
- Task packages can still be loaded and executed successfully.
- Invalid or incompatible libraries produce the expected \`ExecutorError\` behavior.
- Relevant tests cover the updated loading path.

Requested by @$requester.

Backlinks: $pr_url · $comment_url
EOF
)

syn_body=$(cat <<EOF
## Summary
Assess and align the \`syn\` dependency graph, which currently resolves both 2.x and 3.x versions.

## Rationale
The workspace directly declares \`syn = "2.0.119"\`, while other resolved dependencies use \`syn 3.x\`. PR `#421` intentionally did not make the breaking alignment change; its lockfile adds \`syn 3.0.3\` as a host dependency.

## Affected areas
- Workspace dependency declaration: \`Cargo.toml\`
- \`spider-derive\` procedural macro: \`components/spider-derive/src/\`
- \`spider-tdl-derive\` procedural macro: \`components/spider-tdl-derive/src/\`
- \`Cargo.lock\` and proc-macro dependency graph

## Required changes
1. Identify which direct and transitive dependencies require each \`syn\` major version.
2. Determine whether the workspace's direct procedural-macro dependencies can migrate to \`syn 3.x\`.
3. Update macro parsing/AST code for breaking API changes where applicable.
4. Document any remaining multiple-major-version resolution that is unavoidable because it is transitive.

## Acceptance criteria
- The direct workspace \`syn\` strategy is documented and implemented.
- Spider procedural macros and their tests work with the selected \`syn\` version.
- The lockfile contains no avoidable duplicate \`syn\` major versions; any unavoidable versions are documented with their dependency owners.

Requested by @$requester.

Backlinks: $pr_url · $comment_url
EOF
)

printf 'bincode: %s\n' "$(create_issue "Replace unmaintained bincode serialization dependency" "$bincode_body")"
printf 'sqlx: %s\n' "$(create_issue "Upgrade sqlx and adapt to breaking API changes" "$sqlx_body")"
printf 'libloading: %s\n' "$(create_issue "Upgrade libloading and adapt task library loading" "$libloading_body")"
printf 'syn: %s\n' "$(create_issue "Assess and align syn 2.x/3.x dependency versions" "$syn_body")"

Length of output: 6719

---

@LinZhihao-723 Created and assigned the four follow-up issues:

• #423 — Replace unmaintained bincode serialization dependency
• #424 — Upgrade sqlx and adapt to breaking API changes
• #425 — Upgrade libloading and adapt task library loading
• #426 — Assess and align syn 2.x/3.x dependency versions

_{You are interacting with an AI system.}