Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tacd: update dependencies by hand #84

Open
wants to merge 7 commits into
base: main
Choose a base branch
from

Conversation

hnez
Copy link
Member

@hnez hnez commented Nov 15, 2024

Recently the periodic cargo deny jobs have started failing due to two new unmaintained transitive dependencies of ours.

One of them (RUSTSEC-2024-0384) is caused by tide and will likely not go away until we migrate away from it.

But the other one (RUSTSEC-2024-0388) was fixable by updating the zbus dependency.
That required some manual migration work and re-introspecting the DBus services on the TAC using zbus-xmlgen but was due anyways.

I've also updated other dependencies that had new major versions available and where thus not covered by cargo update alone.


TODO before merging:

@hnez hnez requested a review from KarlK90 November 15, 2024 15:09
@hnez hnez marked this pull request as draft November 15, 2024 15:14
@hnez
Copy link
Member Author

hnez commented Nov 15, 2024

Whoops. Good thing we have the CI jobs for different configurations and rust versions. Looks like I have some homework to do.

Marked as Draft until I get around to it.

We no longer need to build new tacd versions on nanbield,
so we can drop the check.

We do however need to build on the new styhead yocto release,
so add a check for its rust version.

Signed-off-by: Leonard Göhrs <[email protected]>
They are not a direct dependency of ours so there is not a lot we can do
about it.

The "derivative" create is brought in by the "zbus" dependency.

The "instant" crate is brought in by "futures-light".

Signed-off-by: Leonard Göhrs <[email protected]>
The new zbus version (4.2) is not the newest available version (5.1.1)
because the newer version has a minimum supported rust version of 1.80,
which is newer than the rust version available in yocto scarthgap.

The update gets rid of the unmaintained "derivative" dependency causing
cargo deny error RUSTSEC-2024-0388.

Signed-off-by: Leonard Göhrs <[email protected]>
The `LineRequestFlags` struct is no longer `Copy` in version 0.6.0,
which is why we need to `.clone()` it explicitly.

Signed-off-by: Leonard Göhrs <[email protected]>
Go through our dependencies, check their most recent version on crates.io
and update to that.

Signed-off-by: Leonard Göhrs <[email protected]>
@hnez
Copy link
Member Author

hnez commented Nov 18, 2024

I've fixed the issues that made the CI checks fail. For that I've borrowed a commit from #83 that replaces the rust version check for rust 1.70 (used in Yocto nanbield) with one for rust 1.79 (used in Yocto styhead).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants