From 16a84dfd2e0a97455d216d09cd59059c6a6f3071 Mon Sep 17 00:00:00 2001 From: wchwawa Date: Fri, 16 Oct 2026 16:06:17 +1100 Subject: [PATCH 1/2] deps: batch the pending Dependabot bumps Apply nine open Dependabot updates in one change. Main requires an up-to-date branch, so merging them one at a time would cost a rebase and a full CI run each. Cargo: - tokio 1.53.1 -> 1.53.2, libc 0.2.189 -> 0.2.190, pyo3 0.29.0 -> 0.29.3, base64 0.23.0 -> 0.23.1 (lockfile only) - etcd-client 0.19.0 -> 0.20.0: additive release (trust roots, aws-lc-rs, token refresh); NoKV builds it with default features off - signal-hook =0.3.18 -> =0.4.5: 0.4 only changes the low-level pipe API; NoKV uses consts and flag::register - sha2 0.10 -> 0.11: the workspace now resolves to the sha2 0.11.0 already in the lockfile. Its digest no longer implements LowerHex, so the sdk_facade test helper formats the bytes itself. The lockfile was updated with targeted --precise updates only, so no other package moves. GitHub Actions: - actions/upload-artifact 7.0.1 -> 7.0.2 - actions/download-artifact 8.0.1 -> 8.0.2 Signed-off-by: wchwawa --- .github/workflows/python-sdk.yml | 2 +- .github/workflows/release-homebrew.yml | 8 +-- .github/workflows/release-python-sdk.yml | 4 +- .github/workflows/rust.yml | 14 +++--- Cargo.lock | 62 ++++++++++++------------ Cargo.toml | 6 +-- crates/nokv-agent/tests/sdk_facade.rs | 6 ++- 7 files changed, 53 insertions(+), 49 deletions(-) diff --git a/.github/workflows/python-sdk.yml b/.github/workflows/python-sdk.yml index 434ab713b..fd7a47801 100644 --- a/.github/workflows/python-sdk.yml +++ b/.github/workflows/python-sdk.yml @@ -68,7 +68,7 @@ jobs: "$venv/bin/python" -m pytest -q "$GITHUB_WORKSPACE/crates/nokv-python/tests" - name: Upload wheel for inspection - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nokv-python-sdk-${{ github.sha }}-linux-x86_64 path: dist/*.whl diff --git a/.github/workflows/release-homebrew.yml b/.github/workflows/release-homebrew.yml index b4bc220be..99c8cfb35 100644 --- a/.github/workflows/release-homebrew.yml +++ b/.github/workflows/release-homebrew.yml @@ -98,7 +98,7 @@ jobs: --marker "$RELEASE_DIR/.nokv-tap.json" - name: Upload exact release candidate - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nokv-homebrew-${{ needs.validate.outputs.commit }} path: ${{ runner.temp }}/nokv-homebrew-release @@ -129,7 +129,7 @@ jobs: ref: ${{ needs.validate.outputs.commit }} - name: Download exact release candidate - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: nokv-homebrew-${{ needs.validate.outputs.commit }} path: ${{ runner.temp }}/nokv-homebrew-release @@ -209,7 +209,7 @@ jobs: ref: ${{ needs.validate.outputs.commit }} - name: Download tested release candidate - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: nokv-homebrew-${{ needs.validate.outputs.commit }} path: ${{ runner.temp }}/nokv-homebrew-release @@ -310,7 +310,7 @@ jobs: persist-credentials: false - name: Download tested release candidate - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: nokv-homebrew-${{ needs.validate.outputs.commit }} path: ${{ runner.temp }}/nokv-homebrew-release diff --git a/.github/workflows/release-python-sdk.yml b/.github/workflows/release-python-sdk.yml index 7d43e0d7a..889eebf79 100644 --- a/.github/workflows/release-python-sdk.yml +++ b/.github/workflows/release-python-sdk.yml @@ -149,7 +149,7 @@ jobs: "$venv/bin/python" -m pytest -q "$GITHUB_WORKSPACE/crates/nokv-python/tests" - name: Upload wheel - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nokv-python-sdk-${{ needs.validate.outputs.commit }}-${{ matrix.name }} path: dist/*.whl @@ -179,7 +179,7 @@ jobs: ref: ${{ needs.validate.outputs.commit }} - name: Download every tested wheel - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: pattern: nokv-python-sdk-${{ needs.validate.outputs.commit }}-* merge-multiple: true diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 090dd710e..4e5a65928 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -128,7 +128,7 @@ jobs: - name: Upload source-bound qualification product id: qualification_product - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: phase1-product-${{ github.sha }} path: target/phase1-qualification/debug/nokv @@ -326,7 +326,7 @@ jobs: - name: Upload Phase 1 qualification evidence if: ${{ always() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: phase1-qualification-${{ github.sha }} path: ${{ runner.temp }}/phase1-qualification @@ -468,7 +468,7 @@ jobs: - name: Upload local-WAL recovery evidence if: ${{ always() && steps.local_wal_recovery.outcome != 'skipped' }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: local-wal-recovery-${{ github.sha }} path: ${{ runner.temp }}/local-wal-recovery-evidence @@ -538,7 +538,7 @@ jobs: - name: Upload live Workbench evidence if: ${{ always() && steps.live_workbench.outcome != 'skipped' }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: live-workbench-${{ github.sha }} path: ${{ runner.temp }}/live-workbench @@ -569,7 +569,7 @@ jobs: - name: Upload restore composition evidence if: ${{ always() && steps.restore_composition.outcome != 'skipped' }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: restore-composition-${{ github.sha }} path: ${{ runner.temp }}/restore-composition/evidence @@ -659,7 +659,7 @@ jobs: - name: Upload object namespace recovery evidence if: ${{ always() && steps.object_namespace_recovery.outcome != 'skipped' }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: object-namespace-recovery-${{ github.sha }} path: ${{ runner.temp }}/object-namespace-recovery-evidence @@ -743,7 +743,7 @@ jobs: - name: Upload fork restore recovery evidence if: ${{ always() && steps.fork_restore_recovery.outcome != 'skipped' }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: fork-restore-recovery-${{ github.sha }} path: ${{ runner.temp }}/fork-restore-recovery-evidence diff --git a/Cargo.lock b/Cargo.lock index 9f71134e3..5dc2f053c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -124,9 +124,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" [[package]] name = "base64" -version = "0.23.0" +version = "0.23.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b25655df2c3cdd83c5e5b293b88acd880332b2ddadd7c30ac43144fdc0033da9" +checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5" [[package]] name = "base64ct" @@ -479,9 +479,9 @@ dependencies = [ [[package]] name = "etcd-client" -version = "0.19.0" +version = "0.20.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef5da6e9a6ae89f4a91f80ba1caae45a5a924397a19947e18f5121a43285e9bc" +checksum = "d713f127cf89f965a6988a5a2016bdd7d87652cbffbb82c5ee7c9bbe1a29f589" dependencies = [ "http", "prost", @@ -1171,9 +1171,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2" [[package]] name = "libc" -version = "0.2.189" +version = "0.2.190" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2" +checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78" [[package]] name = "libm" @@ -1272,7 +1272,7 @@ checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084" name = "nokv" version = "0.11.1" dependencies = [ - "base64 0.23.0", + "base64 0.23.1", "nokv-agent", "nokv-client", "nokv-control", @@ -1283,7 +1283,7 @@ dependencies = [ "nokv-workbench-projection", "serde", "serde_json", - "sha2 0.10.9", + "sha2 0.11.0", "signal-hook", "tempfile", ] @@ -1292,12 +1292,12 @@ dependencies = [ name = "nokv-agent" version = "0.1.0" dependencies = [ - "base64 0.23.0", + "base64 0.23.1", "nokv-types", "serde", "serde_json", "serde_yaml", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] @@ -1316,7 +1316,7 @@ dependencies = [ "nokv-types", "serde", "serde_json", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] @@ -1327,7 +1327,7 @@ dependencies = [ "nokv-object", "nokv-protocol", "nokv-types", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] @@ -1348,7 +1348,7 @@ dependencies = [ "nokv-meta-holt", "nokv-meta-store", "nokv-types", - "sha2 0.10.9", + "sha2 0.11.0", "tempfile", ] @@ -1358,7 +1358,7 @@ version = "0.1.0" dependencies = [ "holt", "nokv-meta-store", - "sha2 0.10.9", + "sha2 0.11.0", "tempfile", ] @@ -1372,7 +1372,7 @@ version = "0.1.0" dependencies = [ "nokv-types", "opendal", - "sha2 0.10.9", + "sha2 0.11.0", "tempfile", "tokio", ] @@ -1384,7 +1384,7 @@ dependencies = [ "nokv-types", "rmp-serde", "serde", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] @@ -1415,7 +1415,7 @@ dependencies = [ "nokv-types", "rmp-serde", "serde", - "sha2 0.10.9", + "sha2 0.11.0", "tempfile", ] @@ -1799,9 +1799,9 @@ dependencies = [ [[package]] name = "pyo3" -version = "0.29.0" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c" +checksum = "700d18fa267b73b9b521fd7e13580e2f446916f176cacee1ab63fcc8191f1655" dependencies = [ "libc", "once_cell", @@ -1813,18 +1813,18 @@ dependencies = [ [[package]] name = "pyo3-build-config" -version = "0.29.0" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078" +checksum = "7b3fc0c4d08f6bb10e71fe39dfb9e2f59c6eb6854e22ec8092f50c69a4499adb" dependencies = [ "target-lexicon", ] [[package]] name = "pyo3-ffi" -version = "0.29.0" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b" +checksum = "dfc0b8e19df29aad7086cf977bb0c2a2f143e30567eb113e9cf72b62ca698330" dependencies = [ "libc", "pyo3-build-config", @@ -1832,9 +1832,9 @@ dependencies = [ [[package]] name = "pyo3-macros" -version = "0.29.0" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771" +checksum = "6100e8a4b5eba53afaa5ed078364851a0b2499c553a44c31026b929049b49dc6" dependencies = [ "proc-macro2", "pyo3-macros-backend", @@ -1844,9 +1844,9 @@ dependencies = [ [[package]] name = "pyo3-macros-backend" -version = "0.29.0" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362" +checksum = "6143877a16e82b5a727b7127ff4cd86858a24a28d745d72f43e6f227c7b1bdb3" dependencies = [ "heck", "proc-macro2", @@ -2504,9 +2504,9 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba" [[package]] name = "signal-hook" -version = "0.3.18" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2" +checksum = "b29ffa27d3d59a049bb328258de100f8012848d1b08d444e08bbc02ac468435e" dependencies = [ "libc", "signal-hook-registry", @@ -2715,9 +2715,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.1" +version = "1.53.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" dependencies = [ "bytes", "libc", diff --git a/Cargo.toml b/Cargo.toml index 4d88e609e..1e9afb5d0 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -42,14 +42,14 @@ nokv = { path = "crates/nokv", version = "0.11.0" } nokv-python = { path = "crates/nokv-python", version = "0.1.0" } nokv-bench = { path = "bench", version = "0.1.0" } holt = { version = "=0.8.6", default-features = false } -etcd-client = { version = "0.19.0", default-features = false } +etcd-client = { version = "0.20.0", default-features = false } opendal = { version = "0.57.0", default-features = false, features = ["blocking", "executors-tokio", "reqwest-rustls-tls", "services-s3"] } rmp-serde = "1.3" serde = { version = "1", features = ["derive"] } serde_json = "1" serde_yaml = "0.9" -sha2 = "0.10" -signal-hook = { version = "=0.3.18", default-features = false } +sha2 = "0.11" +signal-hook = { version = "=0.4.5", default-features = false } tempfile = "3" tokio = { version = "1", features = ["rt-multi-thread"] } xxhash-rust = { version = "0.8.15", features = ["xxh3"] } diff --git a/crates/nokv-agent/tests/sdk_facade.rs b/crates/nokv-agent/tests/sdk_facade.rs index 7bb29377b..4b0a5a9a8 100644 --- a/crates/nokv-agent/tests/sdk_facade.rs +++ b/crates/nokv-agent/tests/sdk_facade.rs @@ -1376,7 +1376,11 @@ fn generic_builtin_catalog_fields(field_prefix: Option<&str>) -> Vec String { - format!("sha256:{:x}", Sha256::digest(bytes)) + let hex: String = Sha256::digest(bytes) + .iter() + .map(|byte| format!("{byte:02x}")) + .collect(); + format!("sha256:{hex}") } fn fake_committed_summary() -> WorkbenchSummary { From 3bf670718f9cac4b64272550f1629ca7589dd8af Mon Sep 17 00:00:00 2001 From: wchwawa Date: Fri, 16 Oct 2026 16:19:32 +1100 Subject: [PATCH 2/2] test(workbench): requalify the exact signal-hook pin at 0.4.5 The local-WAL recovery gate contract pins the exact signal-hook version behind the async-safe SIGINT/SIGTERM flags installed before owner acquisition, so a version change has to move the contract with it. signal-hook 0.4 changes only the low-level pipe API; flag::register, consts, and the unchanged signal-hook-registry stay the same. The live interrupted local-WAL successor recovery gate, including the graceful SIGTERM release, passed on this branch with 0.4.5. Signed-off-by: wchwawa --- scripts/workbench/local_wal_recovery_gate_test.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/workbench/local_wal_recovery_gate_test.py b/scripts/workbench/local_wal_recovery_gate_test.py index 366b94df8..a6810cec8 100644 --- a/scripts/workbench/local_wal_recovery_gate_test.py +++ b/scripts/workbench/local_wal_recovery_gate_test.py @@ -166,7 +166,7 @@ def test_async_safe_signal_flags_are_installed_before_owner_acquisition( ) manifest = (REPO / "Cargo.toml").read_text() self.assertIn( - 'signal-hook = { version = "=0.3.18", default-features = false }', + 'signal-hook = { version = "=0.4.5", default-features = false }', manifest, )