Repository navigation
chore(deps): take the ten open Dependabot bumps as one batch - #368
Merged
Merged
Conversation
A signed PUT URL commits to the bucket, the key and the expiry and nothing else, so the bytes land at whatever size the uploader chooses — and on a presign-and-head connector nothing in Orion can then delete them, because the `storage_head` size check runs one round-trip after the write. `content_length` signs the byte count as a `content-length` header, the way `content_type` already signs the type, so the store refuses any other size with `SignatureDoesNotMatch`. SigV4 query-string auth signs a header's value, so the bound is an exact count rather than a range (a range is S3's POST-policy scheme, which Orion does not implement). Zero is refused at authoring time: AWS's front end rewrites an incoming `Content-Length: 0` to an empty value, so such a URL could never match its own signature.
Ten PRs were open against `main`, four green (#357 debian digest, #358 redis 1.7.1 + windows-sys, #360 the actions group, #366 wasmtime 49) and six red (#359/#362/#363/#365 the OpenTelemetry 0.33 family, #361 utoipa-swagger-ui 10, #364 utoipa 6). The six were not six failures: the four OTel crates move as one semver unit, so `opentelemetry` 0.33 against `opentelemetry_sdk` 0.32 cannot link, and each of those PRs bumped one crate of the four. Merging them one at a time would have meant four rounds of a red PR rebasing onto a red `main`, so all ten land together and the resolver sees the whole set at once. Only utoipa 6 needed source: `Response::content` is now an `IndexMap<String, RefOr<Content>>`, so a content entry may itself be a `$ref`. `ResponseBuilder::content` takes the `Into<RefOr<_>>` and is unchanged; `fill_error_content` writes the map directly, so its insert wraps in `RefOr::T`. Nothing else in the injected-error path moves — the envelope every 4xx/5xx carries is still one `error_content()`. utoipa 6 also reorders the `oneOf` of a nullable optional, emitting the `$ref` before `{"type": "null"}` rather than after. `oneOf` is a set, so the document is the same document; `docs/openapi.json` is regenerated (222 lines, all of that one shape) to keep `openapi_test` quiet. wasmtime 49 and the OTel family are source-compatible here: the sandbox compiles and its 48 integration cases pass, and the tracing setup is untouched. Verified with the full gate (fmt, clippy `-D warnings`, `cargo test --workspace`, `--doc`, rustdoc), plus `cargo deny` and the 118-case e2e suite for the plugin and model paths wasmtime sits under. The two `advisory-not-detected` warnings `cargo deny` prints are stale `deny.toml` ignores that predate this change — neither `rsa` nor `proc-macro-error` is in `main`'s lock either — and are left alone.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
orion-docs | d7e425c | Sep 29 2026, 03:42 AM |
This was referenced Oct 1, 2026
Closed
Closed
This was referenced Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #357, #358, #359, #360, #361, #362, #363, #364, #365, #366.
Four of the ten were green (#357 debian digest, #358 redis 1.7.1 + windows-sys, #360 the actions group, #366 wasmtime 49). The other six were not six independent failures: the four OpenTelemetry crates move as one semver unit, so #359/#362/#363/#365 each bumped one crate of a set that cannot resolve apart, and every one of them failed to link. Merging them serially would have meant four rounds of a red PR rebasing onto a red
main, so all ten land together and the resolver sees the whole set at once.What needed source
Exactly one line. utoipa 6 changed
Response::contentto anIndexMap<String, RefOr<Content>>, so a response body may itself be a$ref.ResponseBuilder::contenttakes theInto<RefOr<_>>and is unchanged;fill_error_contentwrites the map directly, so its insert wraps inRefOr::T.The
docs/openapi.jsonchurn is ordering onlyutoipa 6 emits the
oneOfof a nullable optional with the$refahead of{"type": "null"}rather than behind it. That is all 222 changed lines; the two documents are equal as JSON modulo list order, andoneOfis a set, so no published schema changed meaning.MSRV is unchanged at 1.98
Wasmtime 49 asks for 1.96, utoipa 6 / utoipa-swagger-ui 10 / redis 1.7.1 for 1.88, the OTel family for 1.75 — all below Orion's floor. Verified with a real
cargo +1.98 check --workspace --locked.Verification
Full local gate green:
cargo fmt --all --check,cargo clippy --workspace --all-targets -- -D warnings,cargo test --workspace(3462 passed / 0 failed),cargo test --doc,RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --lib. Pluscargo deny check(advisories, bans, licenses, sources ok), the 118-case e2e suite, the 48 plugin integration cases that exercise the wasmtime sandbox for real, the MSRV check above, anddocs/lint.sh.The two
advisory-not-detectedwarningscargo denyprints are staledeny.tomlignores that predate this change — neitherrsanorproc-macro-erroris inmain's lock either — and are left alone rather than folded into a dependency batch.