From 0e945bbf8167db754557aa450306bc7f3eacb0ce Mon Sep 17 00:00:00 2001 From: Pierrick Fonquerne Date: Thu, 13 Aug 2026 00:04:26 +0200 Subject: [PATCH] fix Octocrab upgrade within MSRV --- .cargo/config.toml | 3 + Cargo.lock | 131 ++++++++--------------- README.md | 25 +++++ tools/ai-review/Cargo.toml | 2 +- tools/ai-review/tests/workflow_policy.rs | 13 +++ 5 files changed, 87 insertions(+), 87 deletions(-) create mode 100644 .cargo/config.toml diff --git a/.cargo/config.toml b/.cargo/config.toml new file mode 100644 index 0000000..c7dfbd9 --- /dev/null +++ b/.cargo/config.toml @@ -0,0 +1,3 @@ +# Keep dependency updates within the package's declared `rust-version`. +[resolver] +incompatible-rust-versions = "fallback" diff --git a/Cargo.lock b/Cargo.lock index 77331dd..4171c6c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -118,6 +118,17 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +[[package]] +name = "chacha20" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "rand_core", +] + [[package]] name = "chrono" version = "0.4.44" @@ -157,6 +168,15 @@ dependencies = [ "libc", ] +[[package]] +name = "cpufeatures" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201" +dependencies = [ + "libc", +] + [[package]] name = "crypto-common" version = "0.1.7" @@ -210,7 +230,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -341,15 +361,15 @@ dependencies = [ [[package]] name = "getrandom" -version = "0.3.4" +version = "0.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ "cfg-if", "js-sys", "libc", "r-efi", - "wasip2", + "rand_core", "wasm-bindgen", ] @@ -724,9 +744,9 @@ dependencies = [ [[package]] name = "octocrab" -version = "0.44.1" +version = "0.47.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "86996964f8b721067b6ed238aa0ccee56ecad6ee5e714468aa567992d05d2b91" +checksum = "76f50b2657b7e31c849c612c4ca71527861631fe3c392f931fb28990b045f972" dependencies = [ "arc-swap", "async-trait", @@ -736,7 +756,6 @@ dependencies = [ "chrono", "either", "futures", - "futures-util", "http", "http-body", "http-body-util", @@ -757,7 +776,6 @@ dependencies = [ "tokio", "tower", "tower-http", - "tracing", "url", "web-time", ] @@ -854,15 +872,6 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" -[[package]] -name = "ppv-lite86" -version = "0.2.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" -dependencies = [ - "zerocopy", -] - [[package]] name = "proc-macro2" version = "1.0.106" @@ -894,14 +903,15 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.14" +version = "0.11.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098" +checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" dependencies = [ "bytes", - "getrandom 0.3.4", + "getrandom 0.4.3", "lru-slab", "rand", + "rand_pcg", "ring", "rustc-hash", "rustls", @@ -938,37 +948,34 @@ dependencies = [ [[package]] name = "r-efi" -version = "5.3.0" +version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" +checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.9.4" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea" +checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "rand_chacha", + "chacha20", + "getrandom 0.4.3", "rand_core", ] [[package]] -name = "rand_chacha" -version = "0.9.0" +name = "rand_core" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb" -dependencies = [ - "ppv-lite86", - "rand_core", -] +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" [[package]] -name = "rand_core" -version = "0.9.5" +name = "rand_pcg" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c" +checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" dependencies = [ - "getrandom 0.3.4", + "rand_core", ] [[package]] @@ -1218,7 +1225,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", - "cpufeatures", + "cpufeatures 0.2.17", "digest", ] @@ -1290,7 +1297,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -1528,23 +1535,10 @@ version = "0.1.44" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100" dependencies = [ - "log", "pin-project-lite", - "tracing-attributes", "tracing-core", ] -[[package]] -name = "tracing-attributes" -version = "0.1.31" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.117", -] - [[package]] name = "tracing-core" version = "0.1.36" @@ -1618,15 +1612,6 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" -[[package]] -name = "wasip2" -version = "1.0.3+wasi-0.2.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6" -dependencies = [ - "wit-bindgen", -] - [[package]] name = "wasm-bindgen" version = "0.2.122" @@ -1927,12 +1912,6 @@ version = "0.53.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650" -[[package]] -name = "wit-bindgen" -version = "0.57.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" - [[package]] name = "writeable" version = "0.6.3" @@ -1962,26 +1941,6 @@ dependencies = [ "synstructure", ] -[[package]] -name = "zerocopy" -version = "0.8.50" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b065d4f0e55f82fae73202e189638116a87c55ab6b8e6c2721e13dd9d854ad1" -dependencies = [ - "zerocopy-derive", -] - -[[package]] -name = "zerocopy-derive" -version = "0.8.50" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.117", -] - [[package]] name = "zerofrom" version = "0.1.8" diff --git a/README.md b/README.md index eea7f20..bbd05da 100644 --- a/README.md +++ b/README.md @@ -91,3 +91,28 @@ jobs: Any other mode (`review`, `security`, `architecture`, `performance`, `product`) can be invoked the same way by passing it as the `mode` input. + +### Dependency resolution and MSRV + +The review tool currently supports Rust 1.88, as declared by its package and +verified by CI. Cargo is configured to prefer dependency versions compatible +with that declaration during updates. The blocked Octocrab 0.54.1 proposal +introduced this build dependency chain: + +```text +octocrab 0.54.1 +└── cargo_metadata 0.23.1 + └── cargo-platform 0.3.3 (MSRV 1.91) +``` + +Cargo can select `cargo-platform` 0.3.2 for Rust 1.88, but Octocrab 0.48 and +later also require `jsonwebtoken` 10 and a JWT crypto backend even though this +tool authenticates with the workflow token and never signs GitHub App JWTs. +RustCrypto introduces the unpatched RUSTSEC-2023-0071 advisory; AWS-LC requires +an additional native toolchain and fails a clean Windows build without NASM. + +Octocrab 0.47.1 is therefore the newest acceptable target. It retains +`jsonwebtoken` 9, supports Rust 1.73, and builds without either extra JWT +backend. Default features are disabled, leaving only the HTTP client, Rustls, +and request timeouts. Raising the fleet MSRV is a separate policy decision +tracked in issue #28, not a dependency-update side effect. diff --git a/tools/ai-review/Cargo.toml b/tools/ai-review/Cargo.toml index a6e181a..35250ed 100644 --- a/tools/ai-review/Cargo.toml +++ b/tools/ai-review/Cargo.toml @@ -13,7 +13,7 @@ path = "src/main.rs" [dependencies] tokio = { version = "1", features = ["full"] } reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false } -octocrab = "0.44" +octocrab = { version = "0.47", default-features = false, features = ["default-client", "rustls", "rustls-ring", "timeout"] } serde = { version = "1", features = ["derive"] } serde_json = "1" anyhow = "1" diff --git a/tools/ai-review/tests/workflow_policy.rs b/tools/ai-review/tests/workflow_policy.rs index c747c6e..94e2c90 100644 --- a/tools/ai-review/tests/workflow_policy.rs +++ b/tools/ai-review/tests/workflow_policy.rs @@ -85,3 +85,16 @@ fn documented_caller_is_safe_for_forks_and_stale_runs() { assert!(readme.contains("@")); assert!(!readme.contains("ai-review.yml@main")); } + +#[test] +fn dependency_updates_respect_the_declared_msrv() { + let cargo_config = read_repository_file(".cargo/config.toml"); + let manifest = read_repository_file("tools/ai-review/Cargo.toml"); + + assert!(cargo_config.contains("incompatible-rust-versions = \"fallback\"")); + assert!(manifest.contains("rust-version = \"1.88\"")); + assert!(manifest.contains("octocrab = { version = \"0.47\"")); + assert!(manifest.contains("default-features = false")); + assert!(!manifest.contains("jwt-rust-crypto")); + assert!(!manifest.contains("jwt-aws-lc-rs")); +}