chore(deps): upgrade sha2/hmac/reqwest with digest 0.11 adaptations (PRs #5 #8 #9) - #10
Merged
Merged
Conversation
…daptations Consolidates dependabot PRs #5 (sha2), #8 (hmac) and #9 (reqwest), which failed CI individually: sha2 0.11 and hmac 0.13 both move to digest 0.11 and must land together (digest-version mismatch breaks Hmac<Sha256>), and reqwest 0.13 renamed the rustls-tls-manual-roots feature (now rustls + webpki-roots). Code adaptations for digest 0.11: - hybrid-array Output no longer implements LowerHex; replace {:x} formatting of SHA-256/HMAC outputs with explicit lowercase hex over the byte slices (executor/src/auth.rs canonical digest, pg18_driver sign helper). - hmac 0.13: new_from_slice moved from Mac to the KeyInit trait; import it in both sites. PR #4 (p256 0.14) stays out of this batch: blocked by upstream jaws 1.0.4 (p256 ^0.13 / ecdsa ^0.16 internals; its TokenSigner/TokenVerifier impls would reject ecdsa 0.17 types at all five sign/verify call sites, and p256 0.14 removed the jwk feature). See PR #4 comment. Verification: local cargo builds are forbidden by repo rules; CI on this branch is the authoritative gate.
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
目标
合并三个各自 CI 失败的 dependabot PR(#5 sha2、#8 hmac、#9 reqwest),一次性解决它们的交叉依赖与 API 适配。
变更
Cargo.toml:dev-depsha2 0.10 → 0.11。executor/Cargo.toml:hmac 0.12 → 0.13、sha2 0.10 → 0.11、dev-depreqwest 0.12 → 0.13(featurerustls-tls-manual-roots在 0.13 已移除,改为rustls + webpki-roots)。executor/src/auth.rs与executor/tests/support/pg18_driver.rs:digest 0.11 的 Output 类型(hybrid-array)不再实现LowerHex,三处{:x}摘要/签名十六进制格式化改为显式逐字节小写 hex(行为完全等价,固定测试向量语义不变);hmac 0.13 的new_from_slice从Mactrait 移到KeyInittrait,两处 import 补KeyInit。为什么三个一起合
Hmac<Sha256>无法编译(CI 已证实);不含 p256 0.14(PR #4)
被上游阻塞:jaws 1.0.4 内部钉住
p256 ^0.13/ecdsa ^0.16,其TokenSigner/TokenVerifier实现不接受 ecdsa 0.17 类型——升级后 5 处sign::<_, Signature>/verify::<_, Signature>调用点全部失配;且 p256 0.14 移除了jwkfeature(VerifyingKey::from_value依赖它)。已在 #4 评论登记,待 jaws 支持 p256 0.14 后再合。验证
仓库规则禁止本地 cargo 构建;以本分支 CI(Generate lockfile → Rust domain → 真实 PG18 → final image)为权威门禁。