tari-project / tari / 29010347179
61%

DEFAULT BRANCH: development
Ran
Jobs 1
Files 703
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 61.952% (+0.001%) from 61.951%
29010347179

push

github

web-flow 
chore(deps): update cucumber junit path (#7915)

Description
---
Updates the integration-test Cucumber/JUnit dependency path without
keeping a global `junit-report` patch override.

This bumps `cucumber` from `0.22.1` to `0.23.0` and lets Cargo resolve
crates.io `junit-report 0.9.0`. That moves the JUnit output path from:

```text
cucumber 0.22.1 -> junit-report 0.8.3 -> quick-xml 0.31.0
```

to:

```text
cucumber 0.23.0 -> junit-report 0.9.0 -> quick-xml 0.39.4
```

Refs #7912.
Refs #7914.

Motivation and Context
---
Issues #7912 and #7914 report RustSec advisories against `quick-xml
0.31.0`. In this workspace that dependency is pulled only through the
integration-test JUnit output path:

```text
cucumber -> junit-report -> quick-xml
```

The integration workflow still uploads
`integration_tests/cucumber-output-junit.xml`, so this keeps the
`output-junit` feature instead of removing JUnit reporting.

Review note: crates.io `junit-report 0.9.0` still resolves `quick-xml
0.39.4`, which is below the advisory fixed range of `quick-xml
>=0.41.0`. A previous revision temporarily patched `junit-report` to an
upstream commit that used `quick-xml 0.41.0`, but that global override
was removed after review because it would keep forcing `junit-report`
for all dependants until a crates.io release catches up.

How Has This Been Tested?
---
- `cargo tree -i quick-xml --locked`
- `cargo tree -i crossbeam-epoch --locked`
- `cargo +1.93.0 test --no-run --locked --all-features --package
tari_integration_tests --test cucumber`
- `cargo +nightly fmt --all -- --check`
- `git diff --check`
- `cargo audit`

Audit note: `cargo audit` still reports `RUSTSEC-2026-0194` and
`RUSTSEC-2026-0195` for `quick-xml 0.39.4`. That residual finding is
expected with the normal crates.io `junit-report 0.9.0` path and should
be revisited when `junit-report` publishes a release that depends on
`quick-xml >=0.41.0`.

What process can a PR reviewer use to test or verify this change?
---
- Run ... (continued)

72566 of 117133 relevant lines covered (61.95%)

223220.81 hits per line

Coverage Regressions

Lines Coverage ∆ File
11
60.51
 -1.04% comms/core/src/connectivity/manager.rs
2
84.28
 0.0% comms/core/src/connection_manager/peer_connection.rs
1
93.76
 -0.19% base_layer/core/src/proof_of_work/monero_rx/merkle_tree.rs
1
90.56
 -0.29% comms/core/src/multiplexing/yamux.rs
Jobs
ID Job ID Ran Files Coverage
1 29010347179.1 703
61.95
 GitHub Action Run
Source Files on build 29010347179