chore(deps): openframe-client deps (major)#1916
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe openframe-client Cargo manifest updates several dependency version requirements, including runtime crates, ChangesCargo dependency upgrades
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Allure Report follow link: 📈 Test status: skipped |
ivan-flamingo
force-pushed
the
renovate/major-openframe-client-deps
branch
14 times, most recently
from
b2a536e to
cdff232
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@clients/openframe-client/Cargo.toml`:
- Line 54: Verify that the UpdateManager and related velopack APIs used in
clients/openframe-client/src/updater.rs are compatible with velopack 1.0.0
breaking changes. Review the updater implementation for any usage of renamed CLI
arguments (such as --signSkipDll which is now --signExclude), internal API
changes, and verify that the vpk CLI version installed in the development
environment matches the velopack 1.0.0 library version requirement. Test the
update functionality to ensure it works correctly with the upgraded version.
- Line 82: The rustls-pemfile 2.0 upgrade changed the certs() function to return
an iterator instead of a collection. In local_tls_config_provider.rs, find the
call to rustls_pemfile::certs() that currently passes the result directly to
context(). Update this code to collect the iterator into a Result type first by
calling collect with the type annotation Result<Vec<_>, _> before applying the
context method for error handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 11b9245f-8afd-4f55-98f2-6f8670083959
⛔ Files ignored due to path filters (1)
clients/openframe-client/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
clients/openframe-client/Cargo.toml
| bytes = "1.10.1" | ||
| async-nats = { git = "https://github.com/flamingo-stack/nats.rs.git", branch = "main", features = ["websockets"] } | ||
| rustls-pemfile = "1.0" | ||
| rustls-pemfile = "2.0" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find rustls-pemfile usage
echo "=== rustls-pemfile usage ==="
rg -n "rustls_pemfile" --type rust -C 3
rg -n "use.*pemfile" --type rust -C 2
# Find embed-resource usage (typically in build.rs)
echo "=== embed-resource usage ==="
fd -e rs "build.rs" --exec cat {}Repository: flamingo-stack/openframe-oss-tenant
Length of output: 1804
🌐 Web query:
rustls-pemfile 2.0 breaking changes rust
💡 Result:
The rustls-pemfile crate reached version 2.0.0 in November 2023 [1], introducing significant changes as the project transitioned to using the rustls-pki-types crate for its core functionality [2]. Key breaking changes in the 2.0.0 release included: Integration with rustls-pki-types: The crate began using types from the rustls-pki-types crate to improve API stability [2]. Item Enum Renaming: The Item enum variants were renamed to better align with the new type system [2]. Specifically, the variants were changed as follows: Item::RSAKey became Item::Pkcs1Key [2] Item::PKCS8Key became Item::Pkcs8Key [2] Item::ECKey became Item::Sec1Key [2] Important Note on Status: As of mid-2025, the rustls-pemfile crate is officially unmaintained and the repository is archived [3][4]. Users are strongly encouraged to migrate directly to the PEM parsing functionality provided by the rustls-pki-types crate [4]. The final version, 2.2.0, remains available as a wrapper over rustls-pki-types, but no further development is expected [3][1]. Migration guidance from the maintainers suggests replacing legacy rustls-pemfile functions with corresponding PemObject trait methods in rustls-pki-types [4][5]. For example: rustls_pemfile::private_key(io::BufRead) should be replaced by PrivateKeyDer::from_pem_reader(io::Read) [6][5]. rustls_pemfile::certs(io::BufRead) should be replaced by CertificateDer::pem_reader_iter(io::Read) [6][5]. Comprehensive mapping tables for these replacements are available in the documentation for the latest version of the crate [5].
Citations:
- 1: https://crates.io/crates/rustls-pemfile/2.2.0
- 2: https://github.com/rustls/pemfile/releases
- 3: Archived - please see rustls-pki-types instead rustls/pemfile#61
- 4: https://rustsec.org/advisories/RUSTSEC-2025-0134.html
- 5: https://docs.rs/crate/rustls-pemfile/latest
- 6: https://crates.io/crates/rustls-pemfile
🌐 Web query:
embed-resource 3.0 breaking changes rust
💡 Result:
The primary breaking change introduced in the 3.0 release of the embed-resource crate involves the handling of Windows manifests [1][2][3]. In versions prior to 3.0, the crate behaved by default as if the manifest was optional [1][2]. In version 3.0 and later, you must explicitly call either.manifest_optional.unwrap or.manifest_required.unwrap on the result of every embed_resource::compile and embed_resource::compile_for* call [1][4][3]. This change is enforced by the fact that the CompilationResult type is now marked with the #[must_use] attribute, which will trigger compiler warnings or errors if you neglect to specify how the manifest should be handled [1][2][3]. Summary of updates required for 3.0: - Use.manifest_optional.unwrap if the manifest is cosmetic, such as for an icon [2][5]. - Use.manifest_required.unwrap if the manifest is necessary for security, entry points, or other critical requirements [1][2]. Example update pattern: // Old approach (< 3.0) embed_resource::compile("my_resource.rc", embed_resource::NONE); // New approach (3.0+) embed_resource::compile("my_resource.rc", embed_resource::NONE).manifest_optional.unwrap;
Citations:
- 1: https://github.com/nabijaczleweli/rust-embed-resource/blob/master/README.md
- 2: https://docs.rs/crate/embed-resource/latest/source/README.md
- 3: https://github.com/nabijaczleweli/rust-embed-resource
- 4: https://docs.rs/crate/embed-resource/^3.0
- 5: https://docs.rs/crate/embed-resource/latest
🏁 Script executed:
#!/bin/bash
# Check Cargo.toml for both dependencies at specified lines
echo "=== Cargo.toml around line 82 (rustls-pemfile) ==="
sed -n '78,86p' clients/openframe-client/Cargo.toml
echo ""
echo "=== Cargo.toml around line 96 (embed-resource) ==="
sed -n '92,100p' clients/openframe-client/Cargo.toml
echo ""
echo "=== Check build.rs for embed-resource imports ==="
fd -e rs "build.rs" -x grep -n "embed.resource\|embed_resource" {} +
echo ""
echo "=== Local TLS config full implementation ==="
cat clients/openframe-client/src/services/local_tls_config_provider.rsRepository: flamingo-stack/openframe-oss-tenant
Length of output: 3136
🌐 Web query:
rustls-pemfile 2.0 certs function signature API changes
💡 Result:
In the transition to rustls-pemfile 2.0, the signature of the certs function (and other helper functions like rsa_private_keys and pkcs8_private_keys) was changed from returning a Vec (or similar collection) to returning an iterator [1]. Specifically, in version 2.0 and later, the function signature for certs is: pub fn certs(rd: &mut dyn io::BufRead) -> impl Iterator<Item = Result<CertificateDer<'static>, io::Error>> + '_ This change allows for streaming PEM files rather than loading the entire file into memory at once [1]. Because the function now returns an iterator, code that previously expected a collection must now collect the results if a collection is still required (e.g., using.collect::<Result<Vec<_>, _>>) [1]. Note that the rustls-pemfile crate is currently unmaintained as of late 2025 [2]. It is recommended to depend directly on the PEM parsing functionality provided by the rustls-pki-types crate (specifically using the PemObject trait), which powers the rustls-pemfile wrapper [3][2]. Migrating to rustls-pki-types generally involves replacing calls like rustls_pemfile::certs(rd) with CertificateDer::pem_reader_iter(rd) [4][3].
Citations:
- 1: rustls/pemfile@004a5d9
- 2: https://rustsec.org/advisories/RUSTSEC-2025-0134.html
- 3: https://github.com/rustls/pemfile
- 4: https://docs.rs/crate/rustls-pemfile/latest
Fix rustls-pemfile 2.0 API incompatibility in certificate parsing.
The upgrade to rustls-pemfile 2.0 introduces a breaking API change: the certs() function now returns an iterator instead of a collection, requiring code updates at line 31 in local_tls_config_provider.rs.
Current code fails to compile:
let certs = rustls_pemfile::certs(&mut cursor)
.context("Failed to parse certificate")?;Update to handle the iterator return type:
let certs = rustls_pemfile::certs(&mut cursor)
.collect::<Result<Vec<_>, _>>()
.context("Failed to parse certificate")?;Note: The embed-resource dependency at line 96 is declared in [build-dependencies] but is not actually used in build.rs, so the 3.0 breaking changes (manifest handling) are not applicable to this project.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@clients/openframe-client/Cargo.toml` at line 82, The rustls-pemfile 2.0
upgrade changed the certs() function to return an iterator instead of a
collection. In local_tls_config_provider.rs, find the call to
rustls_pemfile::certs() that currently passes the result directly to context().
Update this code to collect the iterator into a Result type first by calling
collect with the type annotation Result<Vec<_>, _> before applying the context
method for error handling.
0a1d412 to
330e8e7
Compare
ivan-flamingo
force-pushed
the
renovate/major-openframe-client-deps
branch
24 times, most recently
from
c2d423b to
1a3ecf0
Compare
ivan-flamingo
force-pushed
the
renovate/major-openframe-client-deps
branch
from
1a3ecf0 to
14a5946
Compare
2 participants
This PR contains the following updates:
5.0→6.02.4→3.01.0→2.01.0→2.00.8→1.00.0.1213-g57cf68d→1.0.01.4→2.00.6→8.0Release Notes
nabijaczleweli/rust-embed-resource (embed-resource)
v3.0.9Compare Source
v3.0.8Compare Source
v3.0.7Compare Source
v3.0.6Compare Source
v3.0.5Compare Source
v3.0.4Compare Source
v3.0.3Compare Source
v3.0.2Compare Source
v3.0.1Compare Source
dtolnay/thiserror (thiserror)
v2.0.18Compare Source
needless_lifetimes = "forbid"(#443, thanks @LucaCappelletti94)v2.0.17Compare Source
v2.0.16Compare Source
v2.0.15Compare Source
Error::provideAPI becoming unavailable from a future new compiler lint (#427)v2.0.14Compare Source
v2.0.13Compare Source
v2.0.12Compare Source
v2.0.11Compare Source
v2.0.10Compare Source
v2.0.9Compare Source
missing_inline_in_public_itemsclippy restriction being triggered in macro-generated code (#404)v2.0.8Compare Source
derive(Error)call sites (#399)v2.0.7Compare Source
v2.0.6Compare Source
v2.0.5Compare Source
v2.0.4Compare Source
Fromimpls (#391, thanks @matt-phylum)v2.0.3Compare Source
v2.0.2Compare Source
v2.0.1Compare Source
v2.0.0Compare Source
Breaking changes
Referencing keyword-named fields by a raw identifier like
{r#type}inside a format string is no longer accepted; simply use the unraw name like{type}(#347)This aligns thiserror with the standard library's formatting macros, which gained support for implicit argument capture later than the release of this feature in thiserror 1.x.
Trait bounds are no longer inferred on fields whose value is shadowed by an explicit named argument in a format message (#345)
Tuple structs and tuple variants can no longer use numerical
{0}{1}access at the same time as supplying extra positional arguments for a format message, as this makes it ambiguous whether the number refers to a tuple field vs a different positional arg (#354)Code containing invocations of thiserror's
derive(Error)must now have a direct dependency on thethiserrorcrate regardless of the error data structure's contents (#368, #369, #370, #372)Features
Support disabling thiserror's standard library dependency by disabling the default "std" Cargo feature:
thiserror = { version = "2", default-features = false }(#373)Support using
r#sourceas field name to opt out of a field named "source" being treated as an error'sError::source()(#350)Infinite recursion in a generated Display impl now produces an
unconditional_recursionwarning (#359)A new attribute
#[error(fmt = path::to::myfmt)]can be used to write formatting logic for an enum variant out-of-line (#367)Enums with an enum-level format message are now able to have individual variants that are
transparentto supersede the enum-level message (#366)toml-rs/toml (toml)
v1.1.2Compare Source
v1.1.1Compare Source
v1.1.0Compare Source
v1.0.7Compare Source
v1.0.6Compare Source
v1.0.5Compare Source
v1.0.4Compare Source
v1.0.3Compare Source
v1.0.2Compare Source
v1.0.1Compare Source
v1.0.0Compare Source
v0.9.12Compare Source
v0.9.11Compare Source
v0.9.10Compare Source
v0.9.9Compare Source
v0.9.8Compare Source
v0.9.7Compare Source
v0.9.6Compare Source
v0.9.5Compare Source
v0.9.4Compare Source
v0.9.3Compare Source
v0.9.2Compare Source
v0.9.1Compare Source
v0.9.0Compare Source
velopack/velopack (velopack)
v1.2.0Compare Source
What's Changed
Full Changelog: velopack/velopack@1.1.1...1.2.0
v1.1.1Compare Source
What's Changed
SemanticVersion.TryParse()by @AeonSake in #917New Contributors
Full Changelog: velopack/velopack@1.0.1...1.1.1
v1.0.1Compare Source
What's Changed
alloc_c_stringbefore use in c++ wrapper by @msouchon in #698New Contributors
Dependency Updates
Expand to see all changed dependencies
Full Changelog: velopack/velopack@0.0.1298...1.0.1
v0.0.1298Compare Source
What's Changed
Full Changelog: velopack/velopack@0.0.1297...0.0.1298
v0.0.1297Compare Source
What's Changed
New Contributors
Dependency Updates
Expand to see all changed dependencies
Full Changelog: velopack/velopack@0.0.1251...0.0.1297
v0.0.1251Compare Source
What's Changed
New Contributors
Dependency Updates
Expand to see all changed dependencies
Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.
Summary by CodeRabbit