brawer / osmdiffs / 41203795973

94%

Build Type

push

github

Committed by web-flow

Commit Message

fix(deps): upgrade to Rust 1.99.1 and bump dependencies (#870)

Pin rust-toolchain.toml to Rust 1.99.1, the latest stable release and
the version the Containerfile already builds with. This lets us take
s3 0.1.38, which moves to reqx 0.2 and quick-xml 0.42, so the release
binary no longer contains the vulnerable zstd 0.13.3 / zstd-safe 7.3.0
or quick-xml 0.41.0 from the S3 client.

- Bump s3 to 0.1.38, lru to 0.19, and refresh Cargo.lock.
- Enable the tokio features we use (fs, io-util, macros, net,
  rt-multi-thread, time) explicitly. We used to get them through the
  old s3/reqx dependency tree.
- Drop the five deny.toml advisory ignores for zstd and quick-xml, and
  the MPL-2.0 license allowance (option-ext is gone from the tree).
- Use as_chunks instead of chunks_exact, for the new clippy lint
  in Rust 1.99.


Claude-Session: https://claude.ai/code/session_01Ttfb2KibySRhAksoHwWgAL

Co-authored-by: Claude <noreply@anthropic.com>

Coverage Stats

21 of 26 new or added lines in 5 files covered. (80.77%)

1 existing line in 1 file now uncovered.

13556 of 14396 relevant lines covered (94.17%)

2601.05 hits per line