collin/anvil · d230eb4f

Bump every remaining dep except toasty, rusqlite and gix

Collin Richards · 2026-08-25 05:00 UTC · d230eb4f5808259b9820e050172e0506429b450d · parent 05ebb7f1 · browse files

modifiedCargo.lock+263 −218

modifiedCargo.toml+22 −19

modifiedcrates/anvil-agent/src/container.rs+23 −18

modifiedcrates/anvil-agent/src/supervisor.rs+1 −1

modifiedcrates/anvil-core/src/lib.rs+1 −0

modifiedcrates/anvil-core/src/secrets.rs+4 −2

modifiedcrates/anvil-docker/src/lib.rs+3 −3

modifiedcrates/anvil-ssh/src/lib.rs+5 −2

modifiedcrates/anvil-web/Cargo.toml+4 −2

modifiedcrates/anvil-worker/src/executor.rs+13 −10

⋯ 25 unchanged lines
26	26		# Repo secrets (docs/secrets.md): sealed to users' ssh-ed25519 keys with
27	27		# X25519 + HKDF-SHA256 + AES-256-GCM. AES-GCM rather than ChaCha20-Poly1305
28	28		# because the browser is the encryptor and WebCrypto has no ChaCha.
29		-	# Both are pinned to the exact pre-releases already in the lockfile: cargo
30		-	# unifies each onto a single version tree-wide, and asking for the final
31		-	# release instead walks russh (and half of RustCrypto) backwards to a set
32		-	# that does not compile. X25519 comes from `MontgomeryPoint::mul_clamped`
33		-	# rather than the x25519-dalek wrapper, which would want its own
34		-	# curve25519-dalek.
	29	+	# Both track whatever russh is on, because cargo unifies each onto a single
	30	+	# version tree-wide: these used to be `=`-pinned to pre-releases for that
	31	+	# reason, and russh 0.63 moving to the final releases is what let the pins go.
	32	+	# Bumping either ahead of russh puts them back. X25519 comes from
	33	+	# `MontgomeryPoint::mul_clamped` rather than the x25519-dalek wrapper, which
	34	+	# would want its own curve25519-dalek.
35	35
36	36		# HTTP client for the CD deploy webhook. No TLS feature on purpose: the deploy
37	37		# receiver is host-local plaintext HTTP, and enabling rustls would drag in
⋯ 7 unchanged lines
45	45		# talks to whatever anvil you self-host, including one behind a private or
46	46		# local CA — portless's `.localhost` certificates being the everyday case. The
47	47		# deploy image installs ca-certificates, so the server side is unaffected.
	48	+	# reqwest 0.13 folded the old `rustls-tls-native-roots-no-provider` into
	49	+	# `rustls-no-provider`, which verifies against the platform trust store —
	50	+	# same intent, one feature.
48	51
49	52		# Used directly only for idempotent schema shims on existing databases; the
50	53		# version tracks what toasty-driver-sqlite already pulls in.
⋯ 16 unchanged lines
67	70		# ssh-key parsing/fingerprinting, shared by anvil-core (storage) and anvil-ssh
68	71		# (auth). Pinned to match russh's transitive ssh-key so fingerprints agree.
69	72
70		-	aes-gcm = { version = "=0.11.0-rc.4" }
	73	+	aes-gcm = { version = "0.11.1" }
71	74		anyhow = { version = "1" }
72	75		argon2 = { version = "0.5", features = ["std"] }
73	76		async-trait = { version = "0.1" }
74	77		axum = { version = "0.8", features = ["ws"] }
75		-	axum-extra = { version = "0.10", features = ["cookie"] }
76		-	base64 = { version = "0.22" }
77		-	bollard = { version = "0.18" }
	78	+	axum-extra = { version = "0.12.6", features = ["cookie"] }
	79	+	base64 = { version = "0.23.1" }
	80	+	bollard = { version = "0.21.1" }
78	81		clap = { version = "4", features = ["derive"] }
79		-	curve25519-dalek = { version = "=5.0.0-rc.0" }
	82	+	curve25519-dalek = { version = "5.0.0" }
80	83		flate2 = { version = "1" }
81	84		futures-util = { version = "0.3" }
82	85		gitserver-core = { path = "vendor/gitserver-core" }
83	86		gix = { version = "0.84", default-features = false, features = ["sha1", "max-performance-safe", "blob-diff", "revision"] }
84	87		gix-pack = { version = "0.71", features = ["sha1"] }
85		-	hmac = { version = "0.12" }
86		-	lru = { version = "0.12" }
	88	+	hmac = { version = "0.13.0" }
	89	+	lru = { version = "0.18.2" }
87	90		maud = { version = "0.27", features = ["axum"] }
88	91		pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
89	92		rand = { version = "0.10" }
90		-	reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots-no-provider"] }
	93	+	reqwest = { version = "0.13.4", default-features = false, features = ["form", "json", "rustls-no-provider"] }
91	94		ring = { version = "0.17" }
92	95		rpassword = { version = "7" }
93	96		rusqlite = { version = "0.39" }
94		-	russh = { version = "0.61", default-features = false, features = ["flate2", "ring", "rsa"] }
	97	+	russh = { version = "0.63.1", default-features = false, features = ["flate2", "ring", "rsa"] }
95	98		rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
96	99		serde = { version = "1", features = ["derive"] }
97	100		serde_json = { version = "1" }
98	101		serde_yaml = { version = "0.9" }
99		-	sha2 = { version = "0.10" }
	102	+	sha2 = { version = "0.11.0" }
100	103		similar = { version = "3.2.0" }
101		-	ssh-key = { version = "0.7.0-rc.10" }
	104	+	ssh-key = { version = "0.7.0-rc.11" }
102	105		syntect = { version = "5", default-features = false, features = ["default-onig"] }
103	106		tar = { version = "0.4" }
104	107		thiserror = { version = "2" }
⋯ 1 unchanged line
106	109		toasty = { version = "0.7", features = ["sqlite"] }
107	110		tokio = { version = "1", features = ["full"] }
108	111		tokio-util = { version = "0.7", features = ["io"] }
109		-	toml = { version = "0.8" }
	112	+	toml = { version = "1.1.4" }
110	113		tower = { version = "0.5" }
111		-	tower-http = { version = "0.6", features = ["trace", "fs"] }
	114	+	tower-http = { version = "0.7.0", features = ["trace", "fs"] }
112	115		tracing = { version = "0.1" }
113	116		tracing-subscriber = { version = "0.3", features = ["env-filter"] }

⋯ 10 unchanged lines
11	11		use anvil_core::config::AgentConfig;
12	12		use bollard::{
13	13		Docker,
14		-	container::{
15		-	Config,
16		-	CreateContainerOptions,
17		-	DownloadFromContainerOptions,
18		-	RemoveContainerOptions,
19		-	StartContainerOptions,
20		-	UploadToContainerOptions,
21		-	},
	14	+	body_full,
22	15		exec::{
23	16		CreateExecOptions,
24	17		ResizeExecOptions,
25	18		StartExecOptions,
26	19		StartExecResults,
27	20		},
28		-	models::HostConfig,
	21	+	models::{
	22	+	ContainerCreateBody,
	23	+	HostConfig,
	24	+	},
	25	+	query_parameters::{
	26	+	CreateContainerOptions,
	27	+	DownloadFromContainerOptions,
	28	+	RemoveContainerOptions,
	29	+	StartContainerOptions,
	30	+	UploadToContainerOptions,
	31	+	},
29	32		};
30	33		use futures_util::StreamExt;
31	34
⋯ 51 unchanged lines
83	86		let mut cmd = vec!["anvil-session".to_string()];
84	87		cmd.extend(command.iter().cloned());
85	88
86		-	let config = Config {
	89	+	let config = ContainerCreateBody {
87	90		image: Some(cfg.image.clone()),
88	91		cmd: Some(cmd),
89	92		env: Some(
⋯ 22 unchanged lines
112	115		};
113	116
114	117		let created = docker
115		-	.create_container(None::<CreateContainerOptions<String>>, config)
	118	+	.create_container(None::<CreateContainerOptions>, config)
116	119		.await
117	120		.map_err(\|e\| format!("create session container: {e}"))?;
118	121		Ok(created.id)
⋯ 8 unchanged lines
127	130		path: "/".to_string(),
128	131		..Default::default()
129	132		}),
130		-	tar.into(),
	133	+	body_full(tar.into()),
131	134		)
132	135		.await
133	136		.map_err(\|e\| format!("upload to session container: {e}"))
⋯ 141 unchanged lines
275	278		/// Start a created container.
276	279		pub async fn start(docker: &Docker, id: &str) -> Result<(), String> {
277	280		docker
278		-	.start_container(id, None::<StartContainerOptions<String>>)
	281	+	.start_container(id, None::<StartContainerOptions>)
279	282		.await
280	283		.map_err(\|e\| format!("start session container: {e}"))
281	284		}
⋯ 195 unchanged lines
477	480		/// Startup uses this to reconcile rows against reality: the registry is
478	481		/// in-memory, so after a restart every one of these is an orphan.
479	482		pub async fn list_sessions(docker: &Docker) -> Result<Vec<(String, i64)>, String> {
480		-	use bollard::container::ListContainersOptions;
	483	+	use bollard::query_parameters::ListContainersOptions;
481	484
482	485		let containers = docker
483		-	.list_containers(Some(ListContainersOptions::<String> {
	486	+	.list_containers(Some(ListContainersOptions {
484	487		all: true,
485		-	filters: [("label".to_string(), vec![LABEL_SESSION.to_string()])]
486		-	.into_iter()
487		-	.collect(),
	488	+	filters: Some(
	489	+	[("label".to_string(), vec![LABEL_SESSION.to_string()])]
	490	+	.into_iter()
	491	+	.collect(),
	492	+	),
488	493		..Default::default()
489	494		}))
490	495		.await
⋯ 110 unchanged lines

⋯ 311 unchanged lines
312	312		// shutdown request from the sweep / an operator.
313	313		let mut wait = docker.wait_container(
314	314		&container_id,
315		-	None::<bollard::container::WaitContainerOptions<String>>,
	315	+	None::<bollard::query_parameters::WaitContainerOptions>,
316	316		);
317	317
318	318		let (final_status, exit_code) = tokio::select! {
⋯ 143 unchanged lines

⋯ 124 unchanged lines
125	125		pub fn csrf_token(&self, session_token: &str) -> String {
126	126		use hmac::{
127	127		Hmac,
	128	+	KeyInit,
128	129		Mac,
129	130		};
130	131		let mut mac = Hmac::<sha2::Sha256>::new_from_slice(self.csrf_secret.as_slice())
⋯ 35 unchanged lines

⋯ 373 unchanged lines
374	374		}
375	375
376	376		/// HKDF-SHA256 (RFC 5869) for a single 32-byte output — extract, then one
377		-	/// expand block. Written out rather than pulled in as a dependency: the `hkdf`
378		-	/// crate tracks a newer `sha2`/`digest` generation than the rest of the tree.
	377	+	/// expand block. Written out rather than pulled in as a dependency: two HMAC
	378	+	/// calls are not worth one, and it was originally a `sha2`/`digest`
	379	+	/// generation ahead of the rest of the tree.
379	380		fn hkdf_sha256(ikm: &[u8], salt: &[u8], info: &[u8]) -> [u8; 32] {
380	381		use hmac::{
381	382		Hmac,
	383	+	KeyInit,
382	384		Mac,
383	385		};
384	386		type H = Hmac<sha2::Sha256>;
⋯ 704 unchanged lines

⋯ 39 unchanged lines
40	40		server::{
41	41		self,
42	42		Auth,
	43	+	ChannelOpenHandle,
43	44		Handler,
44	45		Msg,
45	46		Server as _,
⋯ 107 unchanged lines
153	154		async fn channel_open_session(
154	155		&mut self,
155	156		channel: Channel<Msg>,
	157	+	reply: ChannelOpenHandle,
156	158		_session: &mut Session,
157		-	) -> Result<bool, Self::Error> {
	159	+	) -> Result<(), Self::Error> {
158	160		self.channel = Some(channel);
159		-	Ok(true)
	161	+	reply.accept().await;
	162	+	Ok(())
160	163		}
161	164
162	165		async fn env_request(
⋯ 145 unchanged lines

⋯ 43 unchanged lines
44	44		# signs its own id tokens. ring, which verifies them on anvil's side, can only
45	45		# verify with an RSA key, not make one.
46	46		rsa = { version = "0.9" }
47		-	# `oid` for the DigestInfo prefix PKCS#1 v1.5 (and so RS256) signs over.
48		-	sha2 = { workspace = true, features = ["oid"] }
	47	+	# `oid` for the DigestInfo prefix PKCS#1 v1.5 (and so RS256) signs over. Its
	48	+	# own 0.10 rather than the workspace's 0.11: `rsa` 0.9 is still on `digest`
	49	+	# 0.10, and a `Sha256` from the newer generation does not satisfy its bounds.
	50	+	sha2 = { version = "0.10", features = ["oid"] }

⋯ 26 unchanged lines
27	27		};
28	28		use bollard::{
29	29		Docker,
30		-	container::{
31		-	Config,
	30	+	body_full,
	31	+	models::{
	32	+	ContainerCreateBody,
	33	+	HostConfig,
	34	+	},
	35	+	query_parameters::{
32	36		CreateContainerOptions,
33	37		DownloadFromContainerOptions,
34	38		LogsOptions,
⋯ 2 unchanged lines
37	41		UploadToContainerOptions,
38	42		WaitContainerOptions,
39	43		},
40		-	models::HostConfig,
41	44		};
42	45		use futures_util::StreamExt;
43	46
⋯ 47 unchanged lines
91	94		network_mode: (!sb.network).then(\|\| "none".to_string()),
92	95		..Default::default()
93	96		};
94		-	let config = Config {
	97	+	let config = ContainerCreateBody {
95	98		image: Some(spec.image.clone()),
96	99		cmd: Some(vec![
97	100		"sh".to_string(),
⋯ 10 unchanged lines
108	111		// An explicit platform needs the options struct; without one, pass None so
109	112		// the daemon picks its native architecture exactly as before.
110	113		let opts = spec.platform.as_ref().map(\|p\| CreateContainerOptions {
111		-	name: String::new(),
112		-	platform: Some(p.clone()),
	114	+	name: None,
	115	+	platform: p.clone(),
113	116		});
114	117		let created = docker
115	118		.create_container(opts, config)
⋯ 9 unchanged lines
125	128		path: "/".to_string(),
126	129		..Default::default()
127	130		}),
128		-	tar.into(),
	131	+	body_full(tar.into()),
129	132		)
130	133		.await
131	134		.map_err(\|e\| format!("upload checkout: {e}"))?;
132	135
133	136		docker
134		-	.start_container(&id, None::<StartContainerOptions<String>>)
	137	+	.start_container(&id, None::<StartContainerOptions>)
135	138		.await
136	139		.map_err(\|e\| format!("start container: {e}"))?;
137	140
⋯ 3 unchanged lines
141	144		let run = async {
142	145		let mut logs = docker.logs(
143	146		&id,
144		-	Some(LogsOptions::<String> {
	147	+	Some(LogsOptions {
145	148		follow: true,
146	149		stdout: true,
147	150		stderr: true,
⋯ 12 unchanged lines
160	163
161	164		// Non-zero exit codes surface as a wait error in bollard.
162	165		let mut code = 0i64;
163		-	let mut wait = docker.wait_container(&id, None::<WaitContainerOptions<String>>);
	166	+	let mut wait = docker.wait_container(&id, None::<WaitContainerOptions>);
164	167		while let Some(item) = wait.next().await {
165	168		match item {
166	169		Ok(resp) => code = resp.status_code,
⋯ 198 unchanged lines

⋯ 31 unchanged lines
32	32
33	33		[[package]]
34	34		name = "aes-gcm"
35		-	version = "0.11.0-rc.4"
	35	+	version = "0.11.1"
36	36		source = "registry+https://github.com/rust-lang/crates.io-index"
37		-	checksum = "da8c919c118108f144adecad74b425b804ad075580d605d9b33c2d6d1c62a2f8"
	37	+	checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
38	38		dependencies = [
39	39		"aead",
40	40		"aes",
41	41		"cipher",
42	42		"ctr",
	43	+	"ctutils",
43	44		"ghash",
44		-	"subtle",
45	45		"zeroize",
46	46		]
47	47
⋯ 134 unchanged lines
182	182		"anvil-job",
183	183		"argon2 0.5.3",
184	184		"async-trait",
185		-	"base64",
	185	+	"base64 0.23.1",
186	186		"curve25519-dalek",
187	187		"gix",
188		-	"hmac 0.12.1",
	188	+	"hmac",
189	189		"jaq-core",
190	190		"jaq-json",
191	191		"jaq-std",
⋯ 2 unchanged lines
194	194		"serde",
195	195		"serde_json",
196	196		"serde_yaml",
197		-	"sha2 0.10.9",
	197	+	"sha2 0.11.0",
198	198		"ssh-key",