Repository navigation
Adopt audited browser and cache clients in the public crawler workspace - #422
Merged
j-mendez merged 1 commit intoOct 18, 2026
Merged
Conversation
Workspace builds still used the older browser and two cache-client versions after their runtime safety fixes merged. Pin the public Chromey source to0312d624 and the public cache client to910fefb7 through root patch overrides. Move Spider's optional direct cache requirement from0.4 to0.5 so browser and crawler share one fixed client. Feature gates, spool bounds, proxy injection and cache error handling are preserved. Validation:9Spider runtime-safety tests passed with Chrome, remote cache, throttle, headers and disk enabled. Locked Cargo metadata verifies exactly one browser and one cache client in that consumer graph at the audited revisions. Independent Claude review approved. Cargo.lock changes only these sources/versions and the browser generator's required heck0.5 dependency; no runtime source adaptation was necessary. Upstream transport/capacity behavior was tested and reviewed in the earlier library audit PRs. These overrides affect builds of this workspace. Published-crate consumers need separate release/adoption work; backend adoption is handled by its own explicit dependency update. No crates were published and no live browser, cache service or origin was contacted by these checks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Workspace builds still used the older browser and two cache-client versions after their runtime safety fixes merged. Pin the public Chromey source to0312d624 and the public cache client to910fefb7 through root patch overrides. Move Spider's optional direct cache requirement from0.4 to0.5 so browser and crawler share one fixed client. Feature gates, spool bounds, proxy injection and cache error handling are preserved.
Validation:9Spider runtime-safety tests passed with Chrome, remote cache, throttle, headers and disk enabled. Locked Cargo metadata verifies exactly one browser and one cache client in that consumer graph at the audited revisions. Independent Claude review approved. Cargo.lock changes only these sources/versions and the browser generator's required heck0.5 dependency; no runtime source adaptation was necessary. Upstream transport/capacity behavior was tested and reviewed in the earlier library audit PRs.
These overrides affect builds of this workspace. Published-crate consumers need separate release/adoption work; backend adoption is handled by its own explicit dependency update. No crates were published and no live browser, cache service or origin was contacted by these checks.