Upgrade dependencies across Rust and Node.js projects#967
Upgrade dependencies across Rust and Node.js projects#967moose-code wants to merge 4 commits intomainfrom
Conversation
NPM (minor/patch): - @clickhouse/client 1.12.1 → 1.17.0 - @elastic/ecs-pino-format 1.4.0 → 1.5.0 - bignumber.js 9.1.2 → 9.3.1 - pino 10.1.0 → 10.3.1 - prom-client 15.0.0 → 15.1.3 - viem 2.21.0 → 2.46.2 - @rescript/react 0.14.0 → 0.14.1 - ink 6.5.1 → 6.8.0 Rust (minor/patch): - clap 4.2.2 → 4.5, alloy-* 1.0 → 1.5 - handlebars 6.0.0 → 6.4, tokio 1.28.2 → 1.49 - serde 1.0.159 → 1.0.228, serde_json 1.0.95 → 1.0.149 - regex 1.5 → 1.12, anyhow 1.0.72 → 1.0.101 - open 5.0.0 → 5.3, insta 1.34 → 1.46 - openssl 0.10.63 → 0.10.75 (security patches) - Plus minor/patch bumps for clap-markdown, graphql-parser, include_dir, pathdiff, sha2, subenum, async-recursion, tempdir, paste, tracing-subscriber, pretty_assertions Pin schemars to =1.0.0-alpha.2 to prevent cargo update from pulling in the breaking 1.2.1 stable release (separate upgrade). All 211 Rust tests pass. No snapshot changes required. https://claude.ai/code/session_01Jz7WG9kiURW412Gjn366vX
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: defaults Review profile: CHILL Plan: Pro ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
📝 WalkthroughWalkthroughDependency updates across JavaScript and Rust packages. Key upgrades include viem (2.21.0 → 2.46.2), bignumber.js (9.1.2 → 9.3.1), prom-client (15.0.0 → 15.1.3), Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@DZakh Many dependencies had fallen significantly behind their latest Notable upgrades:
Also pin schemars to =1.0.0-alpha.2 to prevent cargo update from Intentionally deferred (breaking/high-risk):
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
codegenerator/cli/npm/envio/package.json (1)
49-49:⚠️ Potential issue | 🟠 MajorMove
tsxfromdependenciestodevDependencies
tsx(4.21.0) is currently in production dependencies but is not used at runtime by the envio package. Inscenarios/test_codegen/package.json,tsxis correctly placed indevDependenciesand is only used in the test scripts viaNODE_OPTIONS='--import tsx'. Moving it todevDependencieshere will reduce unnecessary bloat for end users.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@codegenerator/cli/npm/envio/package.json` at line 49, Remove the "tsx": "4.21.0" entry from the dependencies block in package.json and add the same "tsx": "4.21.0" entry under devDependencies; ensure no runtime code imports rely on tsx and update package.json so all build/test scripts that need tsx still work but it is not shipped as a production dependency.
🧹 Nitpick comments (3)
codegenerator/integration_tests/Cargo.toml (1)
14-21:"full"subsumes all other listed tokio features
"full"is tokio's all-inclusive meta-feature that enables every sub-crate. Listing"macros","process","rt-multi-thread","time", and"test-util"alongside it is redundant. Either drop"full"and keep only the features you actually need, or drop all individual features and keep just"full".♻️ Suggested simplification (keep only what's needed)
-tokio = { version = "1.49", features = [ - "macros", - "process", - "rt-multi-thread", - "time", - "full", - "test-util", -] } +tokio = { version = "1.49", features = [ + "macros", + "process", + "rt-multi-thread", + "time", + "test-util", +] }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@codegenerator/integration_tests/Cargo.toml` around lines 14 - 21, The tokio dependency in Cargo.toml currently lists both the "full" meta-feature and individual features ("macros", "process", "rt-multi-thread", "time", "test-util"), which is redundant; update the tokio = { version = "1.49", features = [...] } entry to either remove "full" and keep only the specific features you need, or remove all individual features and keep only "full" so that the features list is not duplicated (edit the features array for the tokio dependency accordingly).codegenerator/cli/Cargo.toml (2)
47-47:schemarspinned to an alpha prerelease — document as intentional technical debt
=1.0.0-alpha.2uses an exact-version constraint which prevents any automatic upgrade. Alpha releases carry no stability guarantee, and this pin will require a manual migration when the team is ready to adopt the stableschemars 1.xAPI. Adding a# TODOcomment here preserves the rationale for future contributors.📝 Suggested comment
-schemars = { version = "=1.0.0-alpha.2", features = ["preserve_order"] } +# Pinned to alpha to avoid breaking API changes introduced in schemars 1.0 stable. +# TODO: migrate to stable schemars 1.x once the breaking changes are addressed. +schemars = { version = "=1.0.0-alpha.2", features = ["preserve_order"] }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@codegenerator/cli/Cargo.toml` at line 47, The schemars dependency is pinned to an exact alpha prerelease (=1.0.0-alpha.2) which blocks automatic upgrades; add a concise TODO comment next to the schemars = { version = "=1.0.0-alpha.2", features = ["preserve_order"] } line in Cargo.toml documenting that this exact pin is intentional technical debt, why the alpha was chosen (e.g., required feature/behavior), and that it must be revisited/migrated when schemars 1.x stabilizes so future contributors understand the rationale.
52-52: Replacetempdirwithtempfilefor consistency and to use a maintained crateThe
tempdircrate was archived in August 2021 and is no longer maintained. Thetempfilecrate is the official replacement (RustSec advisory RUSTSEC-2018-0017) and is already in use incodegenerator/integration_tests/Cargo.toml(v3.2.0). Thetempdir::TempDirAPI is fully compatible withtempfile::TempDir.♻️ Suggested replacement
-tempdir = "0.3.7" +tempfile = "3.2.0"Usages of
tempdir::TempDirintemplate_dirs.rsandconfig_parsing/graph_migration/mod.rscan remain unchanged, as the APIs are identical.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@codegenerator/cli/Cargo.toml` at line 52, Replace the deprecated crate entry tempdir = "0.3.7" with tempfile = "3.2.0" in Cargo.toml and update any crate import paths from tempdir::TempDir to tempfile::TempDir if present; keep usages in template_dirs.rs and config_parsing/graph_migration/mod.rs unchanged functionally since tempfile's TempDir API is compatible, but ensure Cargo.toml dependency name matches and run cargo update/build to verify resolution.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@codegenerator/cli/npm/envio/package.json`:
- Line 49: Remove the "tsx": "4.21.0" entry from the dependencies block in
package.json and add the same "tsx": "4.21.0" entry under devDependencies;
ensure no runtime code imports rely on tsx and update package.json so all
build/test scripts that need tsx still work but it is not shipped as a
production dependency.
---
Duplicate comments:
In `@codegenerator/cli/npm/envio/package.json.tmpl`:
- Line 60: The template file's dependencies list places the "tsx" entry in
dependencies (the line with "tsx": "4.21.0") which duplicates the same placement
problem noted in codegenerator/cli/npm/envio/package.json; if "tsx" is a
build/dev-only tool, move that "tsx" entry from dependencies to devDependencies
in this template (package.json.tmpl) so both the template and the actual
package.json consistently declare "tsx" under devDependencies.
---
Nitpick comments:
In `@codegenerator/cli/Cargo.toml`:
- Line 47: The schemars dependency is pinned to an exact alpha prerelease
(=1.0.0-alpha.2) which blocks automatic upgrades; add a concise TODO comment
next to the schemars = { version = "=1.0.0-alpha.2", features =
["preserve_order"] } line in Cargo.toml documenting that this exact pin is
intentional technical debt, why the alpha was chosen (e.g., required
feature/behavior), and that it must be revisited/migrated when schemars 1.x
stabilizes so future contributors understand the rationale.
- Line 52: Replace the deprecated crate entry tempdir = "0.3.7" with tempfile =
"3.2.0" in Cargo.toml and update any crate import paths from tempdir::TempDir to
tempfile::TempDir if present; keep usages in template_dirs.rs and
config_parsing/graph_migration/mod.rs unchanged functionally since tempfile's
TempDir API is compatible, but ensure Cargo.toml dependency name matches and run
cargo update/build to verify resolution.
In `@codegenerator/integration_tests/Cargo.toml`:
- Around line 14-21: The tokio dependency in Cargo.toml currently lists both the
"full" meta-feature and individual features ("macros", "process",
"rt-multi-thread", "time", "test-util"), which is redundant; update the tokio =
{ version = "1.49", features = [...] } entry to either remove "full" and keep
only the specific features you need, or remove all individual features and keep
only "full" so that the features list is not duplicated (edit the features array
for the tokio dependency accordingly).
| "@clickhouse/client": "1.12.1", | ||
| "@elastic/ecs-pino-format": "1.4.0", | ||
| "@clickhouse/client": "1.17.0", | ||
| "@elastic/ecs-pino-format": "1.5.0", |
There was a problem hiding this comment.
Need to downgrade it to 1.4.0 to keep the old logs format
DZakh
left a comment
DZakh
left a comment
There was a problem hiding this comment.
I left one comment. I hope it doesn't break more unexpected things 😵💫
The 1.5.0 release changes the log output format, which would break existing log parsing/monitoring. Keep 1.4.0 to preserve the current logs format. https://claude.ai/code/session_01Jz7WG9kiURW412Gjn366vX
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
codegenerator/cli/npm/envio/package.json.tmpl (1)
60-60:⚠️ Potential issue | 🟡 MinorMove
tsxfromdependenciestodevDependenciesor remove it entirely.
tsxis a TypeScript execution tool used only in test/scenario packages for running mocha tests (viaNODE_OPTIONS='--import tsx'). The envio CLI's entry point (local-bin.mjs) does not invoketsxat runtime, and no source code imports or spawns it. Includingtsxin productiondependenciesunnecessarily bloats the published package for all npm users. If this template is used for local development, move it todevDependencies; otherwise, remove it.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@codegenerator/cli/npm/envio/package.json.tmpl` at line 60, The package.json template currently lists "tsx" in dependencies which is unnecessary for runtime; move the "tsx": "4.21.0" entry out of the "dependencies" object into "devDependencies" (or remove it entirely) so it is not shipped as a production dependency—verify that no runtime files (e.g., local-bin.mjs) import or spawn tsx before removing, and update the package.json's dependency objects accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@codegenerator/cli/npm/envio/package.json.tmpl`:
- Line 60: The package.json template currently lists "tsx" in dependencies which
is unnecessary for runtime; move the "tsx": "4.21.0" entry out of the
"dependencies" object into "devDependencies" (or remove it entirely) so it is
not shipped as a production dependency—verify that no runtime files (e.g.,
local-bin.mjs) import or spawn tsx before removing, and update the
package.json's dependency objects accordingly.
DZakh
left a comment
DZakh
left a comment
There was a problem hiding this comment.
Nice. Could you update the branch to resolve conflicts
Resolve conflicts from project restructuring (codegenerator/ → packages/): - Accept main's deletions of codegenerator/ files (moved to packages/) - Accept main's deletions of standalone scenario lockfiles (now in root workspace) - Regenerate Cargo.lock from updated Cargo.toml versions - Merge test_codegen: keep viem 2.46.2 upgrade, use new envio path - Regenerate pnpm lockfiles for workspace https://claude.ai/code/session_01Jz7WG9kiURW412Gjn366vX
3 participants
Summary
This PR updates dependencies across the codebase to their latest stable versions, improving security, performance, and compatibility.
Key Changes
Rust dependencies (codegenerator/cli):
clap(4.2.2 → 4.5),tokio(1.28.2 → 1.49),serde(1.0.159 → 1.0.228),serde_json(1.0.95 → 1.0.149)alloy-primitives,alloy-json-abi,alloy-dyn-abi(1.0 → 1.5)regex(1.5 → 1.12),anyhow(1.0.72 → 1.0.101),sha2(0.10.7 → 0.10.8),open(5.0.0 → 5.3)async-recursion(1.0.5 → 1.1),subenum(1.1.1 → 1.1.3)tempdir,paste,tracing-subscriber,pretty_assertions,instaschemarsto exact version (=1.0.0-alpha.2)Node.js dependencies (codegenerator/cli/npm/envio):
@clickhouse/client(1.12.1 → 1.17.0),pino(10.1.0 → 10.3.1),viem(2.21.0 → 2.46.2)prom-client(15.0.0 → 15.1.3)@rescript/react(0.14.0 → 0.14.1),ink(6.5.1 → 6.8.0)bignumber.js(9.1.2 → 9.3.1),@elastic/ecs-pino-format(1.4.0 → 1.5.0)Template and test dependencies:
package.json.tmplwith same Node.js dependency versionsviemandprom-clientversionstokioandanyhowversionsviemversionNotable Details
https://claude.ai/code/session_01Jz7WG9kiURW412Gjn366vX
Summary by CodeRabbit
Release Notes