chore: release v0.6.31 — ship pipeline auto-commit - #589
Merged
Conversation
Brings every upstream dependency to its latest version, with one
deliberate, documented exception.
polars 0.54.4 -> 0.55.2 (breaking). No source changes were required:
the uffs-polars facade absorbed the whole delta, which is what the
compilation-isolation strategy exists for. One new crate enters the
tree (digest-io, replacing the digest/generic-array stack).
reqwest stays at 0.12.28 — the ONE dependency deliberately not at
latest, now with the rationale recorded in the manifest. 0.13 drops
`rustls-tls-native-roots` and routes system trust through
`rustls-platform-verifier`, which pulls the Android JNI stack (jni,
jni-macros, jni-sys, combine, simd_cesu8 — roughly 63k lines). None
of it appears in the host or x86_64-pc-windows-msvc dependency trees
(verified with `cargo tree -i jni`): it is Android-only, a target
UFFS does not ship. cargo-vet audits every target regardless, so 0.13
would have cost ~63k lines of supply-chain review for code that never
enters a binary we build, in exchange for no functional gain.
Also: libc and zerocopy requirements tightened to the exact versions
they already resolved to, and ~20 transitives moved to latest.
Supply chain — no blanket exemptions, in priority order:
* pre-approved publisher paths where the ecosystem already has them
(digest-io via RustCrypto/utils, find-msvc-tools via
rust-lang/cc-rs);
* the polars family via a publisher-scoped trust entry for
ritchie46 — verified that every 0.55.2 version we consume was in
fact published by him, so the entry does not extend to the
crates' wider publisher history;
* genuine source-diff review for the remaining 14, each recorded as
a delta audit with real notes (trailers below).
Exemptions fall 238 -> 184; `cargo vet` passes.
Findings worth recording from that review: sqlparser_derive 0.5.0
reads $CARGO_MANIFEST_DIR/src/dialect/mod.rs at macro-expansion time
(fixed path, read-only, confined to the invoking crate, and
unreachable on our feature path); base64 0.23 adds SIMD unsafe behind
a default-on feature, checked against the scalar engine over 624,480
differential cases; sysinfo's rewritten getifaddrs iterator would
alias if more than one item were held live, though its single
internal call site drops each item per iteration.
Test-measurement fix, not a threshold change: the uffs-mft tests_perf
suite asserts wall-clock budgets, and under the full 2400-test
fan-out those numbers measure scheduler contention rather than the
code — the same test that takes ~88 ms alone was observed at 118 ms
and 436 ms mid-suite. It now runs with the machine to itself via
nextest `threads-required`. The budgets are UNCHANGED. Measuring the
identical test either side of the polars bump gave 86-93 ms before
and 88 ms after, confirming there is no regression to accommodate.
Vet-Reviewed-Diff: android_system_properties@0.1.5->0.1.6
Vet-Reviewed-Diff: rustls-webpki@0.103.13->0.103.14
Vet-Reviewed-Diff: blake3@1.8.5->1.8.6
Vet-Reviewed-Diff: strum_macros@0.27.2->0.28.0
Vet-Reviewed-Diff: zerocopy@0.8.50->0.8.56
Vet-Reviewed-Diff: zerocopy-derive@0.8.50->0.8.56
Vet-Reviewed-Diff: sqlparser@0.60.0->0.62.0
Vet-Reviewed-Diff: sqlparser_derive@0.4.0->0.5.0
Vet-Reviewed-Diff: fs4@0.13.1->1.1.0
Vet-Reviewed-Diff: atoi_simd@0.17.0->0.18.1
Vet-Reviewed-Diff: sysinfo@0.37.2->0.39.6
Vet-Reviewed-Diff: portable-atomic@1.13.1->1.15.0
Vet-Reviewed-Diff: base64@0.22.1->0.23.1
Vet-Reviewed-Diff: bytemuck_derive@1.10.2->1.12.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
just shipPhase 2 auto-commit for v0.6.31 — the[workspace.package].versionbump inCargo.toml. This PR routes that commit through branch-protection rules. Once it merges tomain, runjust release-tagto cut the signedv0.6.31tag, which firesrelease.ymland builds the cross-platform binaries + GitHub Release v0.6.31. (No auto-tag on merge — the tag step is manual on-demand, Path B.)Auto-merge
--auto --squashis queued — GitHub will merge as soon as the required status checks pass. Squash is required becausemain-protectionmandates signed commits, and GitHub's rebase-auto-merge cannot sign the rebased commit; the squash-merge commit is signed by GitHub's own key, which satisfiesrequired_signatures: true. The original author's signed commit remains verifiable in the PR branch history.After merge
The auto-commit lived only on
release/v0.6.31, so localmainnever drifted — sync it with a plaingit pull --ff-only origin main(noreset --hardneeded).