20211 Commits

Author SHA1 Message Date
Weihang Lo
db99ddc418
test(rustfix): Use snapbox for snapshot testing (#15429)
### What does this PR try to resolve?

- separates each test into different test cases
- `snapbox` is used to test the snapshots
  - difference in `.json` file alone should never cause a test to fail
- `.json` files updated only if expected fix != actual fix &&
`SNAPSHOTS=overwrite`
- when `.json` files are updated, the json is pretty printed
- replaced environment variables `RUSTFIX_TEST_*` for overwriting test
snapshots with `SNAPSHOTS=overwrite`
-  The `RUSTFIX_TEST_RECORD_FIXED_RUST` feature is removed (generate a
`*.fixed.rs` on demand`). We can add it back whenever needed.

Fixes #13891

### How should we test and review this PR?

Run tests with:
```sh
cargo test -p rustfix
```
All the test should run as different test cases
nightly tests run only when using nightly version of rustc is used
2025-04-14 17:21:24 +00:00
Pyrode
2c4f3e4030 test(rustfix): change test multiple-solutions from nightly to stable 2025-04-14 21:27:05 +05:30
Pyrode
a2e42dc67c test(rustfix): Using snapbox for snapshot testing
`.json` files will have pretty printed json when updated
2025-04-14 00:32:03 +05:30
Pyrode
ba411d6a65 test(rustfix): Seperated tests to different testcases 2025-04-14 00:24:24 +05:30
Eric Huss
c6b777deaf
chore(deps): update rust crate gix to 0.71.0 [security] (#15391)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [gix](https://redirect.github.com/GitoxideLabs/gitoxide) |
workspace.dependencies | minor | `0.70.0` -> `0.71.0` |

### GitHub Vulnerability Alerts

####
[CVE-2025-31130](https://redirect.github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6)

### Summary
gitoxide uses SHA-1 hash implementations without any collision
detection, leaving it vulnerable to hash collision attacks.

### Details
gitoxide uses the `sha1_smol` or `sha1` crate, both of which implement
standard SHA-1 without any mitigations for collision attacks. This means
that two distinct Git objects with colliding SHA-1 hashes would break
the Git object model and integrity checks when used with gitoxide.

The SHA-1 function is considered cryptographically insecure. However, in
the wake of the SHAttered attacks, this issue was mitigated in Git
2.13.0 in 2017 by using the
[sha1collisiondetection](https://redirect.github.com/crmarcstevens/sha1collisiondetection)
algorithm by default and producing an error when known SHA-1 collisions
are detected. Git is in the process of migrating to using SHA-256 for
object hashes, but this has not been rolled out widely yet and gitoxide
does not support SHA-256 object hashes.

### PoC
The following program demonstrates the problem, using the two [SHAttered
PDFs](https://shattered.io/):

```rust
use sha1_checked::{CollisionResult, Digest};

fn sha1_oid_of_file(filename: &str) -> gix::ObjectId {
    let mut hasher = gix::features:#️⃣:hasher(gix:#️⃣:Kind::Sha1);
    hasher.update(&std::fs::read(filename).unwrap());
    gix::ObjectId::Sha1(hasher.digest())
}

fn sha1dc_oid_of_file(filename: &str) -> Result<gix::ObjectId, String> {
    // Matches Git’s behaviour.
    let mut hasher = sha1_checked::Builder::default().safe_hash(false).build();
    hasher.update(&std::fs::read(filename).unwrap());
    match hasher.try_finalize() {
        CollisionResult::Ok(digest) => Ok(gix::ObjectId::Sha1(digest.into())),
        CollisionResult::Mitigated(_) => unreachable!(),
        CollisionResult::Collision(digest) => Err(format!(
            "Collision attack: {}",
            gix::ObjectId::Sha1(digest.into()).to_hex()
        )),
    }
}

fn main() {
    dbg!(sha1_oid_of_file("shattered-1.pdf"));
    dbg!(sha1_oid_of_file("shattered-2.pdf"));
    dbg!(sha1dc_oid_of_file("shattered-1.pdf"));
    dbg!(sha1dc_oid_of_file("shattered-2.pdf"));
}
```

The output is as follows:

```
[src/main.rs:24:5] sha1_oid_of_file("shattered-1.pdf") = Sha1(38762cf7f55934b34d179ae6a4c80cadccbb7f0a)
[src/main.rs:25:5] sha1_oid_of_file("shattered-2.pdf") = Sha1(38762cf7f55934b34d179ae6a4c80cadccbb7f0a)
[src/main.rs:26:5] sha1dc_oid_of_file("shattered-1.pdf") = Err(
    "Collision attack: 38762cf7f55934b34d179ae6a4c80cadccbb7f0a",
)
[src/main.rs:27:5] sha1dc_oid_of_file("shattered-2.pdf") = Err(
    "Collision attack: 38762cf7f55934b34d179ae6a4c80cadccbb7f0a",
)
```

The latter behaviour matches Git.

Since the SHAttered PDFs are not in a valid format for Git objects, a
direct proof‐of‐concept using higher‐level APIs cannot be immediately
demonstrated without significant computational resources.

### Impact
An attacker with the ability to mount a collision attack on SHA-1 like
the [SHAttered](https://shattered.io/) or [SHA-1 is a
Shambles](https://sha-mbles.github.io/) attacks could create two
distinct Git objects with the same hash. This is becoming increasingly
affordable for well‐resourced attackers, with the Shambles researchers
in 2020 estimating $45k for a chosen‐prefix collision or $11k for a
classical collision, and projecting less than $10k for a chosen‐prefix
collision by 2025. The result could be used to disguise malicious
repository contents, or potentially exploit assumptions in the logic of
programs using gitoxide to cause further vulnerabilities.

This vulnerability affects any user of gitoxide, including `gix-*`
library crates, that reads or writes Git objects.

---

### Release Notes

<details>
<summary>GitoxideLabs/gitoxide (gix)</summary>

###
[`v0.71.0`](https://redirect.github.com/GitoxideLabs/gitoxide/releases/tag/gix-v0.71.0):
gix v0.71.0

[Compare
Source](https://redirect.github.com/GitoxideLabs/gitoxide/compare/gix-v0.70.0...gix-v0.71.0)

##### Changed

-   read config losslessly even without `debug_assertions`
    This should hopefully not be a breaking change, as the same code
    could produce the same behaviour if compiled with different flags,
    and the semantic meaning of the resulting configuration should be
    the same. But Hyrum’s law is always lurking…

##### Documentation

-   specify ThreadSafeRepository is not Send/Sync without "parallel"

##### New Features

-   add `Repository::checkout_options()`.
    It's a low-level set of options to drive (quite unsafe) checkouts.
They are unsafe as they may be configured to overwrite, and are in no
    way similar to `git checkout`.
-   add `Repository::head_tree_id_or_empty()` for convenience.
- add `Repository::workdir_path()` to easily obtain a `Path` for
worktree items.
- add `Repository::workdir()` as replacement for
`Repository::work_dir()`.
    Keep the latter as deprecated though.
- `filter::Pipeline::worktree_file_to_object()` now can add `Commit`
type objects.
-   add `filter::Pipeline::worktree_file_to_object()`.
    That way it's easier to correctly add whole files into the object
    database.
-   make internal `repo` fields public for ease of use.
    That way, functions or methods taking such a type as argument
    have access to the underlying repository so it doesn't need
    to be passed as separate argument.
- add
`blob::platform::Resource::intern_source_strip_newline_separators()`
That way it will be easier to have typical Git-style patches diffs
around
    files that don't end with a newline.
- add `Repository::big_file_threshold()` to easily learn what Git
considers a big file.

##### Bug Fixes

-   Don't panic when rev-parsing `^^^` and similar
- `filter::Pipeline::convert_to_git()` now also works on Windows under
all circumstances.
-   assure `Repository::commit_as()` also uses the committer for reflogs
Previously it would retrieve the configured committer, or trigger an
error
if there was none despite the commiter being provided to `commit_as()`.

This als adds `Repository::edit_references_as(committer)` to allow
passing
    a given committer.

##### Other

- <csr-id-866affde8ef17f201884b8a4b36cc4c7f449d6fe/>
`Repository::commit()` now explains how to create a commit without ref
updates.

##### Changed (BREAKING)

-   drop obsolete SHA‐1 features
    The hashing API has moved to `gix_hash::hasher`, and we now use
    `sha1-checked` unconditionally.

##### Bug Fixes (BREAKING)

- make clear what `with_pruned()` is doing by renaming it to
`with_boundary()`.
This is how it acts, and it's not at all the same as `hide()` in `git2`.

##### Commit Statistics

-   57 commits contributed to the release.
- 17 commits were understood as
[conventional](https://www.conventionalcommits.org).
- 2 unique issues were worked on:
[#&#8203;1829](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1829),
[#&#8203;1914](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1914)

##### Thanks Clippy

[Clippy](https://redirect.github.com/rust-lang/rust-clippy) helped 1
time to make code idiomatic.

##### Commit Details

<csr-read-only-do-not-edit/>

<details><summary>view details</summary>

-
**[#&#8203;1829](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1829)**
- Assure `Repository::commit_as()` also uses the committer for reflogs
([`9bec947`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/9bec947))
-
**[#&#8203;1914](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1914)**
- Don't panic when rev-parsing `^^^` and similar
([`aa8daf8`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/aa8daf8))
-   **Uncategorized**
- Release gix-sec v0.10.12, gix-config v0.44.0, gix-prompt v0.10.0,
gix-url v0.30.0, gix-credentials v0.28.0, gix-discover v0.39.0, gix-dir
v0.13.0, gix-mailmap v0.26.0, gix-revision v0.33.0, gix-merge v0.4.0,
gix-negotiate v0.19.0, gix-pack v0.58.0, gix-odb v0.68.0, gix-refspec
v0.29.0, gix-shallow v0.3.0, gix-packetline v0.18.4, gix-transport
v0.46.0, gix-protocol v0.49.0, gix-status v0.18.0, gix-submodule
v0.18.0, gix-worktree-state v0.18.0, gix v0.71.0, gix-fsck v0.10.0,
gitoxide-core v0.46.0, gitoxide v0.42.0
([`ada5a94`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/ada5a94))
- Release gix-date v0.9.4, gix-utils v0.2.0, gix-actor v0.34.0,
gix-features v0.41.0, gix-hash v0.17.0, gix-hashtable v0.8.0, gix-path
v0.10.15, gix-validate v0.9.4, gix-object v0.48.0, gix-glob v0.19.0,
gix-quote v0.5.0, gix-attributes v0.25.0, gix-command v0.5.0,
gix-packetline-blocking v0.18.3, gix-filter v0.18.0, gix-fs v0.14.0,
gix-commitgraph v0.27.0, gix-revwalk v0.19.0, gix-traverse v0.45.0,
gix-worktree-stream v0.20.0, gix-archive v0.20.0, gix-tempfile v17.0.0,
gix-lock v17.0.0, gix-index v0.39.0, gix-config-value v0.14.12,
gix-pathspec v0.10.0, gix-ignore v0.14.0, gix-worktree v0.40.0, gix-diff
v0.51.0, gix-blame v0.1.0, gix-ref v0.51.0, gix-config v0.44.0,
gix-prompt v0.10.0, gix-url v0.30.0, gix-credentials v0.28.0,
gix-discover v0.39.0, gix-dir v0.13.0, gix-mailmap v0.26.0, gix-revision
v0.33.0, gix-merge v0.4.0, gix-negotiate v0.19.0, gix-pack v0.58.0,
gix-odb v0.68.0, gix-refspec v0.29.0, gix-shallow v0.3.0, gix-packetline
v0.18.4, gix-transport v0.46.0, gix-protocol v0.49.0, gix-status
v0.18.0, gix-submodule v0.18.0, gix-worktree-state v0.18.0, gix v0.71.0,
gix-fsck v0.10.0, gitoxide-core v0.46.0, gitoxide v0.42.0, safety bump
48 crates
([`b41312b`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/b41312b))
- Update changelogs prior to release
([`38dff41`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/38dff41))
- Merge pull request
[#&#8203;1915](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1915)
from emilazy/push-qvyqmopsoltr
([`4660f7a`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/4660f7a))
- Migrate `gix_object::{try_ =>}compute_hash` users
([`3d7e379`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/3d7e379))
- Migrate hashing API users to fallible versions
([`fbf6cc8`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/fbf6cc8))
- Drop obsolete SHA‐1 features
([`fd12ef8`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/fd12ef8))
- Merge pull request
[#&#8203;1851](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1851)
from GitoxideLabs/fix-1850
([`cd96b64`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/cd96b64))
- Adapt to changes in `gix-features`
([`5f8bff8`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/5f8bff8))
- Merge pull request
[#&#8203;1916](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1916)
from GitoxideLabs/fix-1914
([`32b54b3`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/32b54b3))
- Merge pull request
[#&#8203;1909](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1909)
from cruessler/take-to-components-in-fs-stack
([`5cb5337`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/5cb5337))
- Use `gix_fs::stack::ToNormalPathComponents` everywhere.
([`1f98edb`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/1f98edb))
- Update MSRV to 1.75 for access to `impl` returns in traits.
([`569c186`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/569c186))
- Merge pull request
[#&#8203;1911](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1911)
from GitoxideLabs/improvements
([`bfa3253`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/bfa3253))
- `filter::Pipeline::convert_to_git()` now also works on Windows under
all circumstances.
([`dcdb8ea`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/dcdb8ea))
- Merge pull request
[#&#8203;1907](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1907)
from EliahKagan/run-ci/raw
([`7b17da6`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/7b17da6))
- Drop trailing `,` just before `)` on same line in function calls
([`66a5ae1`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/66a5ae1))
- Use raw literals for more strings with backslashes
([`01bd76d`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/01bd76d))
- Merge pull request
[#&#8203;1898](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1898)
from GitoxideLabs/improvements
([`7255a5f`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/7255a5f))
- Improve documentation of a field that one can easily get wrong
otherwise.
([`5a1b3d6`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/5a1b3d6))
- Merge pull request
[#&#8203;1873](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1873)
from NobodyXu/zlib-rs
([`316f113`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/316f113))
- Review adjustments for zlib-rs support.
([`5e618b6`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/5e618b6))
- Add new feature zlib-rs
([`8b1b55c`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/8b1b55c))
- Revert "Instrument make_remote_repos.sh to view `config` corruption"
([`9061fc4`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/9061fc4))
- Instrument make_remote_repos.sh to view `config` corruption
([`d290ad9`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/d290ad9))
- Merge pull request
[#&#8203;1884](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1884)
from GitoxideLabs/improvements
([`0bf1d5b`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/0bf1d5b))
- Merge pull request
[#&#8203;1876](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1876)
from joshtriplett/fix-tests-in-environments-with-env-variables-set
([`dc8bd63`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/dc8bd63))
- Fix tests when `GIT_AUTHOR_NAME` or `GIT_COMMITTER_NAME` are set
([`94dda22`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/94dda22))
- Add `Repository::checkout_options()`.
([`5054780`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/5054780))
- Add `Repository::head_tree_id_or_empty()` for convenience.
([`02878c9`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/02878c9))
- Add `Repository::workdir_path()` to easily obtain a `Path` for
worktree items.
([`776f9be`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/776f9be))
- Add `Repository::workdir()` as replacement for
`Repository::work_dir()`.
([`518fbbc`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/518fbbc))
- Merge pull request
[#&#8203;1882](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1882)
from emilazy/push-ylwwuwymlmwt
([`10e41ee`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/10e41ee))
- Fix cargo-deny using a prodash-update and ignore directive
([`cf7f34d`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/cf7f34d))
- Read config losslessly even without `debug_assertions`
([`9800e9c`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/9800e9c))
- Merge pull request
[#&#8203;1854](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1854)
from GitoxideLabs/montly-report
([`16a248b`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/16a248b))
- Thanks clippy
([`8e96ed3`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/8e96ed3))
- Merge pull request
[#&#8203;1837](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1837)
from GitoxideLabs/improvements
([`b4fe425`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/b4fe425))
- `Repository::commit()` now explains how to create a commit without ref
updates.
([`866affd`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/866affd))
- Merge pull request
[#&#8203;1835](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1835)
from GitoxideLabs/fixes
([`503098d`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/503098d))
- Merge pull request
[#&#8203;1834](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1834)
from GitoxideLabs/improvements
([`5c327bb`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/5c327bb))
- `filter::Pipeline::worktree_file_to_object()` now can add `Commit`
type objects.
([`27e62d7`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/27e62d7))
- Merge pull request
[#&#8203;1833](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1833)
from GitoxideLabs/improvements
([`c042813`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/c042813))
- Add `filter::Pipeline::worktree_file_to_object()`.
([`70ebd5f`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/70ebd5f))
- Make internal `repo` fields public for ease of use.
([`23d2bed`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/23d2bed))
- Merge pull request
[#&#8203;1821](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1821)
from GitoxideLabs/improvements
([`914bf28`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/914bf28))
- Add
`blob::platform::Resource::intern_source_strip_newline_separators()`
([`37582b0`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/37582b0))
- Merge pull request
[#&#8203;1820](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1820)
from GitoxideLabs/improvements
([`daa6d4a`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/daa6d4a))
- Make clear what `with_pruned()` is doing by renaming it to
`with_boundary()`.
([`b78e7dd`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/b78e7dd))
- Merge pull request
[#&#8203;1807](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1807)
from bryceberger/bryce/push-xqrmpyoxlosq
([`79cb655`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/79cb655))
- Refactor
([`d7ddbb7`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/d7ddbb7))
- Specify ThreadSafeRepository is not Send/Sync without "parallel"
([`687322b`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/687322b))
- Merge pull request
[#&#8203;1785](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1785)
from GitoxideLabs/improvements
([`1a69c40`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/1a69c40))
- Add `Repository::big_file_threshold()` to easily learn what Git
considers a big file.
([`f3257f3`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/f3257f3))
- Merge pull request
[#&#8203;1778](https://redirect.github.com/GitoxideLabs/gitoxide/issues/1778)
from GitoxideLabs/new-release
([`8df0db2`](https://redirect.github.com/GitoxideLabs/gitoxide/commit/8df0db2))

</details>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/rust-lang/cargo).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMjcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjIyNy4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
2025-04-12 15:50:16 +00:00
Weihang Lo
ef7d315894
Make sure search paths inside OUT_DIR precede external paths (#15221)
If a library exists both in an added folder inside OUT_DIR and in the
OS, prefer to use the one within OUT_DIR. Folders within OUT_DIR and
folders outside OUT_DIR do not change their relative order between
themselves.

This is accomplished by sorting by whether we think the path is inside
the search path or outside.

### What does this PR try to resolve?

Fixes #15220. If a Rust crates builds a dynamic library & that same
dynamic library is installed in the host OS, the result of the build's
success & consistent behavior of executed tools depends on whether or
not the user has the conflicting dynamic library in the external search
path. If they do, then the host OS library will always be used which is
unexpected - updates to your Rust dependency will still have you linking
& running against an old host OS library (i.e. someone who doesn't have
that library has a different silent behavior).

### How should we test and review this PR?

This is what I did to verify my issue got resolved but I'm sure there's
a simpler example one could construct.

* Make sure Alsa and libllama.so are installed (on Arch I installed
alsa-lib and llama.cpp-cuda).
* Clone llama-cpp-2 & init llama.cpp submodule & update the submodule to
point to https://github.com/ggml-org/llama.cpp/pull/11997 instead.
* Add plumbing to expose the new method within llama-cpp-2 as a public
facing function on the LlamaModel struct (it's basically the same code
as for n_head, just calling n_head_kv from llama.cpp).
* Add cpal as a dependency in crate "foo"
* Add llama-cpp-2 via path as a dependency in crate "foo" and enable the
`dynamic-link` feature.
* Add code using the newly expose n_head_kv method in crate "foo" in
main.rs. NOTE: Code just needs to compile & be exported, doesn't have to
be correct (fn main is probably easiest.
* Add some basic code that tries to initialize cpal in crate "foo" in fn
main.
* Try to build / run crate "foo"

Before my change, it fails with a linker error saying it can't find
`llama_model_n_head_kv` because /usr/lib appears in the search path
before the directory that contains the libllama.so that was built
internally by the crate. This is because cpal depends on alsa-sys which
uses pkg-config which adds /usr/lib to the search path before the
llama-cpp-sys-2 build.rs is run.

### Additional information

I'm not sure how to add tests so open to some help on that. I wanted to
make sure that this approach is even correct. I coded this to change
Cargo minimally and defensively since I don't know the internals of
Cargo very well (e.g. I don't know if I have to compare against both
`script_out_dir` / `script_out_dir_when_generated` since I don't know
the difference & there's not really any explanation on what they are).

It's possible this over-complicates the implementation so open to any
feedback. Additionally, the sort that happens prior to each build up of
the rustc environment is not where I'd ideally place it. I think it
would be more efficient to have the list of search paths be
free-floating and not tied to a BuildOutput so that they could be kept
updated live & resorted only on insertion (since it's changed less
frequently than rustc is invoked). Additionally, the generalized sort is
correct but pessimistic - maintaining the list sorted could be done
efficiently with some minor book keeping (i.e. you'd only need to sort
the new paths & then could quickly inject into the middle of a
VecDeque).

And of course in terms of correctness, I didn't do a thorough job
testing across all possible platforms. From first principles this seems
directionally correct but it's always possible this breaks someone
else's workflow. I'm also uneasy that the relative position of `-L` /
`-l` arguments changes in this PR & I'm not sure if that's observable
behavior or not (i.e. it used to be -L for a crate followed by `-l` for
a crate), but now it's `-L` for all crates, still grouped by crated
internally, followed by `-l` by crate).
2025-04-12 14:04:50 +00:00
Weihang Lo
864f74d4ea
chore: Bump build-rs version (#15421)
### What does this PR try to resolve?

Follow up to #15420

### How should we test and review this PR?

### Additional information
2025-04-11 20:37:27 +00:00
Ed Page
2ce0898758 chore: Bump build-rs version 2025-04-11 15:04:23 -05:00
Weihang Lo
338e3f8d8a
fix(build): Correct name of CARGO_CFG_FEATURE (#15420)
### What does this PR try to resolve?

Bad copy/paste in #14902

### How should we test and review this PR?

### Additional information

Found this when looking at how we handle MSRV in `build-rs`
2025-04-11 19:21:30 +00:00
Ed Page
a7e0e44994
Revert "fix(package): detect dirtiness for symlinks to submodule" (#15419)
### What does this PR try to resolve?

This reverts commit 71ea2e5c5fa285e8e0336d51fd03ba4a427154bf.

`Repository::discover` and `Repository::status_file` are too expenstive
to run inside a loop. And `cargo package` are doing a lot of duplicate
works for checking submodule VCS status.

Alternative fixes might look like

* Let `status_submodules` function returns a path entry set, so
  Cargo can check whether a source file is dirty based on that.
* When listing files in `PathSource`, attach the VCS status of a
  path entry assoicated with. Then subsequent operations can skip
  status check entirely.

However, the above solutions are not trivial, and the dirtiness check is
informational only based on T-cargo conclusion, so we should be
good just reverting the change now.

Again, the caveat of this is that we can't really detect
dirty symlinks that link into a Git submodule.

### How should we test and review this PR?

Should be good to merge. We still got #15384 fixed via
d760263afb02c747a246bb0471a4f51e09075246

### Additional information

See
<https://github.com/rust-lang/cargo/issues/15384#issuecomment-2797064033>.
2025-04-11 18:41:15 +00:00
Ed Page
bb349213ce fix(build): Correct name of CARGO_CFG_FEATURE 2025-04-11 13:37:49 -05:00
Weihang Lo
314df11c74
Revert "fix(package): detect dirtiness for symlinks to submodule"
This reverts commit 71ea2e5c5fa285e8e0336d51fd03ba4a427154bf.

`Repository::discover` and `Repository::status_file` are too expenstive
to run inside a loop. And `cargo package` are doing a lot of duplicate
works for checking submodule VCS status.

The possible fix might look like

* Let `status_submodules` function returns a path entry set, so
  Cargo can check whether a source file is dirty based on that.
* When listing files in `PathSource`, attach the VCS status of a
  path entry assoicated with. Then subsequent operations can skip
  status check entirely.

The above solutions are not trivial, and the dirtiness check is
informational only based on T-cargo conclusion, so we should be
good just reverting the change now.

Again, the caveat of this is that we can't really detect
dirty symlinks that links into a Git submodule.
2025-04-11 14:04:38 -04:00
Ed Page
3cc0b1a54c
Improved error message when build-dir template var is invalid (#15418)
### What does this PR try to resolve?

This PR improves the error message when an invalid template variable is
used in the `build.build-dir` config.
I am using `closest_msg` to find a close match. If there are no close
matches, we simply print the available template variables list.

See #14125

r? @epage
2025-04-11 17:56:30 +00:00
Ross Sullivan
fac2aafa11
feat(build-dir): Added improved error message when template is invalid 2025-04-12 02:20:15 +09:00
Vitali Lovich
6c6b34ea27 Search cargo build directories before system for libraries
Regardless of crate search paths emitted, always prefer searching search
paths pointing into the artifacts directory to those pointing outside.
This way libraries built by Cargo are preferred even if the same library
name exists in the system & a crate earlier in the build process emitted
a system library path for searching.
2025-04-11 09:42:11 -07:00
Vitali Lovich
f94b75aeb6 Add test case for current behavior. 2025-04-11 09:42:11 -07:00
Ross Sullivan
389f263a79
test(build-dir): Add test for build-dir template nearest suggestion 2025-04-12 01:20:05 +09:00
Vitali Lovich
c1f7bb9285 Refactor get_dynamic_search_path
Will need it in a follow-up PR
2025-04-11 09:13:55 -07:00
Eric Huss
2253485048 Set gix-transport/http-client-insecure-credentials while testing
This is needed because some tests send HTTP auth headers, and by default
gix will refuse to do that over an insecure channel.
2025-04-11 08:42:09 -07:00
Ed Page
27366fdea4
Added validation for unmatched brackets in build-dir template (#15414)
### What does this PR try to resolve?

This PR adds validation for unmatched brackets (which are used for
template variables) in `build.build-dir` paths.

See
https://github.com/rust-lang/cargo/issues/14125#issuecomment-2790803287
in #14125
2025-04-11 15:29:28 +00:00
Ross Sullivan
ad3e593e53
feat(build-dir): Added validation for unmatched brackets in template 2025-04-11 20:50:54 +09:00
Ross Sullivan
2a11c26af2
test(build-dir): Added test for unmatched brackets in build-dir path 2025-04-11 20:50:06 +09:00
Ed Page
f2c4849792
fix(package): detect dirtiness for symlinks to submodule (#15416)
### What does this PR try to resolve?

If a there is a symlink into a git repository/submodule,
when checking its git status with the wrong outer repo,
we'll get an NotFound error,
as the object doesn't belong to the outer repository.
This kind of error blocked the entire `cargo package` operation.

This fix additionally discovers the nearest Git repository,
and then checks status with that,
assuming the repo is the parent of the source file of the symlink.
This is a best effort solution, so if the check fails we ignore.

### How should we test and review this PR?

If we don't want the complication,
we could drop the last commit, ignore the error, and forget about
handling submodules

fixes #15384
fixes #15413
2025-04-10 17:25:19 +00:00
Weihang Lo
71ea2e5c5f
fix(package): detect dirtiness for symlinks to submodule
If a there is a symlink into a git repository/submodule,
when checking its git status with the wrong outer repo,
we'll get an NotFound error,
as the object doesn't belong to the outer repository.
This kind of error blocked the entire `cargo package` operation.

This fix additionally discovers the nearest Git repository,
and then checks status with that,
assuming the repo is the parent of the source file of the symlink.
This is a best effort solution, so if the check fails we ignore.
2025-04-10 12:43:10 -04:00
Folkert de Vries
97f6819d32
use zlib-rs for gzip compression in rust code
Various C dependencies (curl, git) still rely on `libz-sys`, so for the time being a system libc is still required. But, using zlib-rs via flate2 is straightforward, and gives good speedup for `cargo package`. It is also extremely portable, because it's just rust code.
2025-04-10 18:02:51 +02:00
Ed Page
0acc1dbf7d
chore(deps): bump crossbeam-channel from 0.5.14 to 0.5.15 (#15415)
Bumps [crossbeam-channel](https://github.com/crossbeam-rs/crossbeam)
from 0.5.14 to 0.5.15.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/crossbeam-rs/crossbeam/releases">crossbeam-channel's
releases</a>.</em></p>
<blockquote>
<h2>crossbeam-channel 0.5.15</h2>
<ul>
<li>Fix regression introduced in 0.5.12 that can lead to a double free
when dropping unbounded channel. (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1187">#1187</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d35ffde18a"><code>d35ffde</code></a>
Prepare for the next release</li>
<li><a
href="6ec74ecae8"><code>6ec74ec</code></a>
crossbeam-channel: prevent double free on Drop (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1187">#1187</a>)</li>
<li>See full diff in <a
href="https://github.com/crossbeam-rs/crossbeam/compare/crossbeam-channel-0.5.14...crossbeam-channel-0.5.15">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=crossbeam-channel&package-manager=cargo&previous-version=0.5.14&new-version=0.5.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/rust-lang/cargo/network/alerts).

</details>
2025-04-10 15:27:17 +00:00
Weihang Lo
d760263afb
fix(package): ignore status check failure
Dirtiness check for symlinks is mostly informational.
And changes in submodule would fail git-status as well (see #15384).
To avoid adding complicated logic to handle that,
for now we ignore the status check failure.
2025-04-10 11:11:51 -04:00
Weihang Lo
79473988e5
test(package): show symlink to submodule failed the check 2025-04-10 11:11:44 -04:00
dependabot[bot]
b1f88352bd
chore(deps): bump crossbeam-channel from 0.5.14 to 0.5.15
Bumps [crossbeam-channel](https://github.com/crossbeam-rs/crossbeam) from 0.5.14 to 0.5.15.
- [Release notes](https://github.com/crossbeam-rs/crossbeam/releases)
- [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/master/CHANGELOG.md)
- [Commits](https://github.com/crossbeam-rs/crossbeam/compare/crossbeam-channel-0.5.14...crossbeam-channel-0.5.15)

---
updated-dependencies:
- dependency-name: crossbeam-channel
  dependency-version: 0.5.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-04-10 14:45:17 +00:00
Weihang Lo
210ebb5d11
docs(metadata): Added build_directory to cargo metadata documentation (#15410)
<!--
Thanks for submitting a pull request 🎉! Here are some tips for you:

* If this is your first contribution, read "Cargo Contribution Guide"
first:
  https://doc.crates.io/contrib/
* Run `cargo fmt --all` to format your code changes.
* Small commits and pull requests are always preferable and easy to
review.
* If your idea is large and needs feedback from the community, read how:
  https://doc.crates.io/contrib/process/#working-on-large-features
* Cargo takes care of compatibility. Read our design principles:
  https://doc.crates.io/contrib/design.html
* When changing help text of cargo commands, follow the steps to
generate docs:

https://github.com/rust-lang/cargo/tree/master/src/doc#building-the-man-pages
* If your PR is not finished, set it as "draft" PR or add "WIP" in its
title.
* It's ok to use the CI resources to test your PR, but please don't
abuse them.

### What does this PR try to resolve?

Explain the motivation behind this change.
A clear overview along with an in-depth explanation are helpful.

You can use `Fixes #<issue number>` to associate this PR to an existing
issue.

### How should we test and review this PR?

Demonstrate how you test this change and guide reviewers through your
PR.
With a smooth review process, a pull request usually gets reviewed
quicker.

If you don't know how to write and run your tests, please read the
guide:
https://doc.crates.io/contrib/tests

### Additional information

Other information you want to mention in this PR, such as prior arts,
future extensions, an unresolved problem, or a TODO list.
-->

### What does this PR try to resolve?

Follow up to #15377 that documents `build_directory` in the cargo
metadata docs.

I did not mention that this feature is not stable yet, let me know if it
would be better to a note that this is nightly only.
Not sure how we normally handle documenting non-stable features

cc: #14125
2025-04-09 14:53:45 +00:00
Ross
7edd5b23cf docs(metadata): Added build_directory to cargo metadata documentation 2025-04-09 22:13:59 +09:00
Weihang Lo
7ade57b15f
Added symlink resolution for workspace-path-hash (#15400)
### What does this PR try to resolve?

This PR adds logic to resolve symlinks before hashing the
`workspace-path-hash` template variable for `build.build-dir`.
See
https://github.com/rust-lang/cargo/issues/14125#issuecomment-2751658701

cc: #14125

Note: The behavior on unix systems is unchanged, as the manifest_path
was already canonicalized (at least on my system and in CI). However,
the Windows behavior did not do this previous.

### How should we test and review this PR?

I added a test which runs `cargo build` twice, once from the real
directory and once from inside of a symlinked directory, then verifies
that hashes match.

The change is only a few lines. Most of the diffs are testing code

r? @epage
2025-04-08 15:31:34 +00:00
Ross Sullivan
50533934d0
feat(build-dir): Resolve symlinks before hashing workspace-path-hash
This commit resolves symlinks in the manifest path before hashing it.
2025-04-08 22:48:13 +09:00
Ross Sullivan
dc0d1133f9
test(build-dir): Added test for workspace-path-hash symlink handling 2025-04-08 22:48:07 +09:00
Weihang Lo
9bdf6b0595
feat: print target and package names formatted as file hyperlinks (#15405)
Resolves #15401

Here is an example of the feature in
[kitty](https://sw.kovidgoyal.net/kitty/) `0.40.1` with the following
config set in `~/.config/kitty/kitty.conf`

```conf
underline_hyperlinks always
show_hyperlink_targets yes
allow_hyperlinks yes
# ...
```

![cargo-target-file-hyperlik-kitty-showcase](https://github.com/user-attachments/assets/04155d5a-a254-4e80-a35e-a02cc4671ae4)

Tested on `uname -a`:
```
Linux nixos 6.14.0 #1-NixOS SMP PREEMPT_DYNAMIC Mon Mar 24 14:02:41 UTC 2025 x86_64 GNU/Linux
```
Terminals tested with:
- [x] [kitty](https://sw.kovidgoyal.net/kitty/) `0.40.1`
- [x] [ghostty](https://ghostty.org/) `1.1.4-6f1b22a-nix`

![image](https://github.com/user-attachments/assets/afeb250f-009b-429a-8854-6c3053449f9e)
- [x] [alacritty](https://alacritty.org/index.html) `0.15.1`

![image](https://github.com/user-attachments/assets/9742cd72-13e5-4e90-8ece-dd101553e5cc)

- [x] VScode's version `1.98` integrated terminal aka.
[xterm.js](https://xtermjs.org/)

![image](https://github.com/user-attachments/assets/f02ce77a-18e4-47dd-b428-7b82bc013021)

The following `cargo` invocations will have their output be modified by
this change:
```shell
cargo run # If multiple binaries are defined in the manifest and [package.default-bin] is not defined
cargo run --bin
cargo run --example
cargo run --package
cargo build --bin
cargo build --example
cargo build --package
cargo test --test
cargo test --bench
```

In addition I have done a slight refactor to have the printed indent of
targets and packages be the same by using a shared constant named `const
ITEM_INDENT: &str = " ";`

This is my first PR to the cargo codebase, so I am not familiar with
what is expected in terms of test for a feature such as this.

<!--
Thanks for submitting a pull request 🎉! Here are some tips for you:

* If this is your first contribution, read "Cargo Contribution Guide"
first:
  https://doc.crates.io/contrib/
* Run `cargo fmt --all` to format your code changes.
* Small commits and pull requests are always preferable and easy to
review.
* If your idea is large and needs feedback from the community, read how:
  https://doc.crates.io/contrib/process/#working-on-large-features
* Cargo takes care of compatibility. Read our design principles:
  https://doc.crates.io/contrib/design.html
* When changing help text of cargo commands, follow the steps to
generate docs:

https://github.com/rust-lang/cargo/tree/master/src/doc#building-the-man-pages
* If your PR is not finished, set it as "draft" PR or add "WIP" in its
title.
* It's ok to use the CI resources to test your PR, but please don't
abuse them.

### What does this PR try to resolve?

Explain the motivation behind this change.
A clear overview along with an in-depth explanation are helpful.

You can use `Fixes #<issue number>` to associate this PR to an existing
issue.

### How should we test and review this PR?

Demonstrate how you test this change and guide reviewers through your
PR.
With a smooth review process, a pull request usually gets reviewed
quicker.

If you don't know how to write and run your tests, please read the
guide:
https://doc.crates.io/contrib/tests

### Additional information

Other information you want to mention in this PR, such as prior arts,
future extensions, an unresolved problem, or a TODO list.
-->
2025-04-07 21:33:37 +00:00
Weihang Lo
c7be0601a7
docs(ref): Use better example value in CARGO_CFG_TARGET_ABI (#15404)
`target_abi = "sim"` may be deprecated in the future. See
https://github.com/rust-lang/rust/pull/139451.
2025-04-06 23:54:02 +00:00
Eric Huss
7987d4bfe6
chore: Bump cargo-util-schemas to 0.8.2 (#15403)
### What does this PR try to resolve?

This is required due to a SemVer breaking change introduced in 0.7.3.

See

* <https://github.com/rust-lang/cargo/issues/15387>
* <https://github.com/rust-lang/cargo/pull/15397>
* <https://github.com/rust-lang/cargo/pull/15402>
2025-04-06 16:15:17 +00:00
kpbaks
33ee639738 feat: print target names formatted as file hyperlinks
This resolves #15401
2025-04-06 17:28:55 +02:00
Mads Marquart
fb8520350a docs(ref): Use better example value in CARGO_CFG_TARGET_ABI
`target_abi = "sim"` may be deprecated in the future.
2025-04-06 17:18:22 +02:00
Scott Schafer
df915190e3
chore: Bump cargo-util-schemas to 0.8.2 2025-04-04 22:54:51 -06:00
Scott Schafer
8855150d30
chore: Bump cargo-util-schemas to 0.8.1 2025-04-04 22:45:21 -06:00
Scott Schafer
66991b5a33
chore: Bump cargo-util-schemas to 0.8.0 2025-04-04 22:44:24 -06:00
Eric Huss
0e93c5bf6a
chore(deps): bump openssl from 0.10.71 to 0.10.72 (#15394)
Bumps [openssl](https://github.com/sfackler/rust-openssl) from 0.10.71
to 0.10.72.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sfackler/rust-openssl/releases">openssl's
releases</a>.</em></p>
<blockquote>
<h2>openssl-v0.10.72</h2>
<h2>What's Changed</h2>
<ul>
<li>make set_rsa_oaep_md visible to boringssl config by <a
href="https://github.com/frncs-rss"><code>@​frncs-rss</code></a> in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2372">sfackler/rust-openssl#2372</a></li>
<li>Fix typo in openssl-sys build script by <a
href="https://github.com/rushilmehra"><code>@​rushilmehra</code></a> in
<a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2375">sfackler/rust-openssl#2375</a></li>
<li>Unify the two BoringSSL codepaths a bit and simplify init by <a
href="https://github.com/davidben"><code>@​davidben</code></a> in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2377">sfackler/rust-openssl#2377</a></li>
<li>pkey_ctx: Fix link to the corresponding OpenSSL function by <a
href="https://github.com/Jakuje"><code>@​Jakuje</code></a> in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2378">sfackler/rust-openssl#2378</a></li>
<li>fix test on MSRV by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2383">sfackler/rust-openssl#2383</a></li>
<li>Add support for AWS-LC to openssl and openssl-sys crates by <a
href="https://github.com/skmcgrail"><code>@​skmcgrail</code></a> in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/1805">sfackler/rust-openssl#1805</a></li>
<li>Enable additional capabilities for AWS-LC by <a
href="https://github.com/skmcgrail"><code>@​skmcgrail</code></a> in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2386">sfackler/rust-openssl#2386</a></li>
<li>Use --experimental with bindgen-cli with aws-lc build by <a
href="https://github.com/skmcgrail"><code>@​skmcgrail</code></a> in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2389">sfackler/rust-openssl#2389</a></li>
<li>Fixed two UAFs and bumped versions for release by <a
href="https://github.com/alex"><code>@​alex</code></a> in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2390">sfackler/rust-openssl#2390</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Jakuje"><code>@​Jakuje</code></a> made
their first contribution in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/2378">sfackler/rust-openssl#2378</a></li>
<li><a href="https://github.com/skmcgrail"><code>@​skmcgrail</code></a>
made their first contribution in <a
href="https://redirect.github.com/sfackler/rust-openssl/pull/1805">sfackler/rust-openssl#1805</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.71...openssl-v0.10.72">https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.71...openssl-v0.10.72</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="87085bd678"><code>87085bd</code></a>
Merge pull request <a
href="https://redirect.github.com/sfackler/rust-openssl/issues/2390">#2390</a>
from alex/uaf-fix</li>
<li><a
href="d1a12e2157"><code>d1a12e2</code></a>
Fixed two UAFs and bumped versions for release</li>
<li><a
href="7c7b2e6c9f"><code>7c7b2e6</code></a>
Merge pull request <a
href="https://redirect.github.com/sfackler/rust-openssl/issues/2389">#2389</a>
from skmcgrail/aws-lc-follow-up</li>
<li><a
href="34a477bff2"><code>34a477b</code></a>
Use --experimental with bindgen-cli with aws-lc build</li>
<li><a
href="d4bf071064"><code>d4bf071</code></a>
Merge pull request <a
href="https://redirect.github.com/sfackler/rust-openssl/issues/2386">#2386</a>
from skmcgrail/aws-lc-follow-up</li>
<li><a
href="a86bf670c4"><code>a86bf67</code></a>
Remove comment</li>
<li><a
href="705dbfb2ee"><code>705dbfb</code></a>
Fix test</li>
<li><a
href="e0df413d46"><code>e0df413</code></a>
Skip final call for LibreSSL 4.1.0 for CCM mode</li>
<li><a
href="2f1164b5e8"><code>2f1164b</code></a>
Enable additional capabilities for AWS-LC</li>
<li><a
href="dde9ffb360"><code>dde9ffb</code></a>
Merge pull request <a
href="https://redirect.github.com/sfackler/rust-openssl/issues/1805">#1805</a>
from skmcgrail/aws-lc-support-final</li>
<li>Additional commits viewable in <a
href="https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.71...openssl-v0.10.72">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=openssl&package-manager=cargo&previous-version=0.10.71&new-version=0.10.72)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/rust-lang/cargo/network/alerts).

</details>
2025-04-05 00:00:24 +00:00
Eric Huss
609d608df7 Fix deprecated method names 2025-04-04 16:27:53 -07:00
Eric Huss
05847378cf
chore(ci): restore cargo-util semver check (#15389)
### What does this PR try to resolve?

Basically a revert of <https://github.com/rust-lang/cargo/pull/15222>.
2025-04-04 23:23:22 +00:00
dependabot[bot]
19fa740c79
chore(deps): bump openssl from 0.10.71 to 0.10.72
Bumps [openssl](https://github.com/sfackler/rust-openssl) from 0.10.71 to 0.10.72.
- [Release notes](https://github.com/sfackler/rust-openssl/releases)
- [Commits](https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.71...openssl-v0.10.72)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.72
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-04-04 20:55:34 +00:00
renovate[bot]
333aa65691
chore(deps): update rust crate gix to 0.71.0 [security] 2025-04-04 19:26:45 +00:00
Weihang Lo
b955cd1822
chore(ci): restore cargo-util semver check 2025-04-04 08:05:43 -07:00
Eric Huss
b909a8be44
docs(changelog): polish changelog items (#15379)
They are supposed to be sorted and have proper prefixes.
2025-04-03 17:08:55 +00:00
Eric Huss
59f0fcfbb9
chore(deps): update msrv (1 version) to v1.86 (#15381)
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [MSRV:1](https://redirect.github.com/rust-lang/rust) | minor | `1.85`
-> `1.86` |

---

### Release Notes

<details>
<summary>rust-lang/rust (MSRV:1)</summary>

###
[`v1.86`](https://redirect.github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1860-2025-04-03)

[Compare
Source](https://redirect.github.com/rust-lang/rust/compare/1.85.0...1.86.0)

\==========================

<a id="1.86.0-Language"></a>

## Language

- [Stabilize upcasting trait objects to
supertraits.](https://redirect.github.com/rust-lang/rust/pull/134367)
- [Allow safe functions to be marked with the `#[target_feature]`
attribute.](https://redirect.github.com/rust-lang/rust/pull/134090)
- [The `missing_abi` lint now
warns-by-default.](https://redirect.github.com/rust-lang/rust/pull/132397)
- Rust now lints about double negations, to catch cases that might have
intended to be a prefix decrement operator (`--x`) as written in other
languages. This was previously a clippy lint, `clippy::double_neg`, and
is [now available directly in Rust as
`double_negations`.](https://redirect.github.com/rust-lang/rust/pull/126604)
- [More pointers are now detected as definitely not-null based on their
alignment in const
eval.](https://redirect.github.com/rust-lang/rust/pull/133700)
- [Empty `repr()` attribute applied to invalid items are now correctly
rejected.](https://redirect.github.com/rust-lang/rust/pull/133925)
- [Inner attributes `#![test]` and `#![rustfmt::skip]` are no longer
accepted in more places than
intended.](https://redirect.github.com/rust-lang/rust/pull/134276)

<a id="1.86.0-Compiler"></a>

## Compiler

- [Debug-assert that raw pointers are non-null on
access.](https://redirect.github.com/rust-lang/rust/pull/134424)
- [Change `-O` to mean `-C opt-level=3` instead of `-C opt-level=2` to
match Cargo's
defaults.](https://redirect.github.com/rust-lang/rust/pull/135439)
- [Fix emission of `overflowing_literals` under certain macro
environments.](https://redirect.github.com/rust-lang/rust/pull/136393)

<a id="1.86.0-Platform-Support"></a>

## Platform Support

- [Replace `i686-unknown-redox` target with
`i586-unknown-redox`.](https://redirect.github.com/rust-lang/rust/pull/136698)
- [Increase baseline CPU of `i686-unknown-hurd-gnu` to Pentium
4.](https://redirect.github.com/rust-lang/rust/pull/136700)
-   New tier 3 targets:
-
[`{aarch64-unknown,x86_64-pc}-nto-qnx710_iosock`](https://redirect.github.com/rust-lang/rust/pull/133631).
        For supporting Neutrino QNX 7.1 with `io-socket` network stack.
-
[`{aarch64-unknown,x86_64-pc}-nto-qnx800`](https://redirect.github.com/rust-lang/rust/pull/133631).
        For supporting Neutrino QNX 8.0 (`no_std`-only).
-
[`{x86_64,i686}-win7-windows-gnu`](https://redirect.github.com/rust-lang/rust/pull/134609).
Intended for backwards compatibility with Windows 7.
`{x86_64,i686}-win7-windows-msvc` are the Windows MSVC counterparts that
already exist as Tier 3 targets.
-
[`amdgcn-amd-amdhsa`](https://redirect.github.com/rust-lang/rust/pull/134740).
-
[`x86_64-pc-cygwin`](https://redirect.github.com/rust-lang/rust/pull/134999).
-
[`{mips,mipsel}-mti-none-elf`](https://redirect.github.com/rust-lang/rust/pull/135074).
        Initial bare-metal support.
-
[`m68k-unknown-none-elf`](https://redirect.github.com/rust-lang/rust/pull/135085).
- [`armv7a-nuttx-{eabi,eabihf}`, `aarch64-unknown-nuttx`, and
`thumbv7a-nuttx-{eabi,eabihf}`](https://redirect.github.com/rust-lang/rust/pull/135757).

Refer to Rust's \[platform support page]\[platform-support-doc]
for more information on Rust's tiered platform support.

<a id="1.86.0-Libraries"></a>

## Libraries

- The type of `FromBytesWithNulError` in
`CStr::from_bytes_with_nul(bytes: &[u8]) -> Result<&Self,
FromBytesWithNulError>` was [changed from an opaque struct to an
enum](https://redirect.github.com/rust-lang/rust/pull/134143), allowing
users to examine why the conversion failed.
- [Remove `RustcDecodable` and
`RustcEncodable`.](https://redirect.github.com/rust-lang/rust/pull/134272)
- [Deprecate libtest's `--logfile`
option.](https://redirect.github.com/rust-lang/rust/pull/134283)
- [On recent versions of Windows, `std::fs::remove_file` will now remove
read-only
files.](https://redirect.github.com/rust-lang/rust/pull/134679)

<a id="1.86.0-Stabilized-APIs"></a>

## Stabilized APIs

-
[`{float}::next_down`](https://doc.rust-lang.org/stable/std/primitive.f64.html#method.next_down)
-
[`{float}::next_up`](https://doc.rust-lang.org/stable/std/primitive.f64.html#method.next_up)
-
[`<[_]>::get_disjoint_mut`](https://doc.rust-lang.org/stable/std/primitive.slice.html#method.get_disjoint_mut)
-
[`<[_]>::get_disjoint_unchecked_mut`](https://doc.rust-lang.org/stable/std/primitive.slice.html#method.get_disjoint_unchecked_mut)
-
[`slice::GetDisjointMutError`](https://doc.rust-lang.org/stable/std/slice/enum.GetDisjointMutError.html)
-
[`HashMap::get_disjoint_mut`](https://doc.rust-lang.org/std/collections/hash_map/struct.HashMap.html#method.get_disjoint_mut)
-
[`HashMap::get_disjoint_unchecked_mut`](https://doc.rust-lang.org/std/collections/hash_map/struct.HashMap.html#method.get_disjoint_unchecked_mut)
-
[`NonZero::count_ones`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.count_ones)
-
[`Vec::pop_if`](https://doc.rust-lang.org/std/vec/struct.Vec.html#method.pop_if)
-
[`sync::Once::wait`](https://doc.rust-lang.org/stable/std/sync/struct.Once.html#method.wait)
-
[`sync::Once::wait_force`](https://doc.rust-lang.org/stable/std/sync/struct.Once.html#method.wait_force)
-
[`sync::OnceLock::wait`](https://doc.rust-lang.org/stable/std/sync/struct.OnceLock.html#method.wait)

These APIs are now stable in const contexts:

-
[`hint::black_box`](https://doc.rust-lang.org/stable/std/hint/fn.black_box.html)
-
[`io::Cursor::get_mut`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_mut)
-
[`io::Cursor::set_position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.set_position)
-
[`str::is_char_boundary`](https://doc.rust-lang.org/stable/std/primitive.str.html#method.is_char_boundary)
-
[`str::split_at`](https://doc.rust-lang.org/stable/std/primitive.str.html#method.split_at)
-
[`str::split_at_checked`](https://doc.rust-lang.org/stable/std/primitive.str.html#method.split_at_checked)
-
[`str::split_at_mut`](https://doc.rust-lang.org/stable/std/primitive.str.html#method.split_at_mut)
-
[`str::split_at_mut_checked`](https://doc.rust-lang.org/stable/std/primitive.str.html#method.split_at_mut_checked)

<a id="1.86.0-Cargo"></a>

## Cargo

- [When merging, replace rather than combine configuration keys that
refer to a program path and its
arguments.](https://redirect.github.com/rust-lang/cargo/pull/15066/)
- [Error if both `--package` and `--workspace` are passed but the
requested package is
missing.](https://redirect.github.com/rust-lang/cargo/pull/15071/) This
was previously silently ignored, which was considered a bug since
missing packages should be reported.
- [Deprecate the token argument in `cargo login` to avoid shell history
leaks.](https://redirect.github.com/rust-lang/cargo/pull/15057/)
- [Simplify the implementation of `SourceID`
comparisons.](https://redirect.github.com/rust-lang/cargo/pull/14980/)
This may potentially change behavior if the canonicalized URL compares
differently in alternative registries.

<a id="1.86.0-Rustdoc"></a>

## Rustdoc

- [Add a sans-serif font
setting.](https://redirect.github.com/rust-lang/rust/pull/133636)

<a id="1.86.0-Compatibility-Notes"></a>

## Compatibility Notes

- [The `wasm_c_abi` future compatibility warning is now a hard
error.](https://redirect.github.com/rust-lang/rust/pull/133951)
Users of `wasm-bindgen` should upgrade to at least version 0.2.89,
otherwise compilation will fail.
- [Remove long-deprecated no-op attributes `#![no_start]` and
`#![crate_id]`.](https://redirect.github.com/rust-lang/rust/pull/134300)
- [The future incompatibility lint `cenum_impl_drop_cast` has been made
into a hard
error.](https://redirect.github.com/rust-lang/rust/pull/135964) This
means it is now an error to cast a field-less enum to an integer if the
enum implements `Drop`.
- [SSE2 is now required for "i686" 32-bit x86 hard-float targets;
disabling it causes a warning that will become a hard error
eventually.](https://redirect.github.com/rust-lang/rust/pull/137037)
    To compile for pre-SSE2 32-bit x86, use a "i586" target instead.

<a id="1.86.0-Internal-Changes"></a>

## Internal Changes

These changes do not affect any public interfaces of Rust, but they
represent
significant improvements to the performance or internals of rustc and
related
tools.

- [Build the rustc on AArch64 Linux with ThinLTO +
PGO.](https://redirect.github.com/rust-lang/rust/pull/133807)
The ARM 64-bit compiler (AArch64) on Linux is now optimized with ThinLTO
and PGO, similar to the optimizations we have already performed for the
x86-64 compiler on Linux. This should make it up to 30% faster.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "* * * * *" (UTC), Automerge - At any
time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/rust-lang/cargo).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMjcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjIyNy4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
2025-04-03 14:46:30 +00:00