Skip to content

build(deps): Upgrade Rust and Python dependencies - #744

Merged
jan-auer merged 4 commits into
mainfrom
claude/upgrade-dependencies-8a41be
Oct 30, 2026
Merged

jan-auer merged 4 commits into
mainfrom
claude/upgrade-dependencies-8a41be

Conversation

@jan-auer

@jan-auer jan-auer commented Oct 30, 2026 •

Copy link
Copy Markdown
Member

Updates dependencies. The public API of the published crates, objectstore-client and objectstore-types, stays the same.

Compatible Rust updates change only Cargo.lock. The minimum versions in Cargo.toml stay the same. Users of the published crates do not have to upgrade their own dependencies.

These Rust crates move to a new major version. They need no code changes, and none of their types are part of a public API:

  • base64 0.23, infer 0.22, zstd 0.14 and zstd-safe 8
  • lru 0.19, quick-xml 0.42 and serde-vars 0.4
  • sketches-ddsketch 0.4, used only by the benchmark and stress-test tools

All Python dependencies are at their latest versions, including mypy 2.

Three crates stay on their current major version because the published crates expose their types. A separate PR will update them as a breaking change:

  • jsonwebtoken 11: objectstore_client::Error::TokenError wraps its error type.
  • mediatype 0.23: objectstore_types::metadata::Error::ContentType wraps its error type.
  • ed25519-dalek 3: objectstore_types::presign re-exports its key types. Also, jsonwebtoken 11 still depends on ed25519-dalek 2.

The minimum supported Rust version of the client (1.89) does not change.

Changelog Entry

Upgrade dependencies. utils::guess_mime_type now detects a PDF when %PDF occurs anywhere in the first 1024 bytes, not only at the start. Text content that contains %PDF near the start can now return application/pdf.

@jan-auer
jan-auer requested a review from a team as a code owner October 30, 2026 10:09
@github-actions

Copy link
Copy Markdown

Semver Impact of This PR

⚪ None (no workspace changed)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).


This PR does not change any workspace, so it will not appear in any changelog.


🤖 This preview updates automatically when you update the PR.

@codecov

codecov Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.55%. Comparing base (45ae04d) to head (c44cecd).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #744      +/-   ##
==========================================
- Coverage   91.56%   91.55%   -0.02%     
==========================================
  Files         116      116              
  Lines       22084    22088       +4     
==========================================
  Hits        20222    20222              
- Misses       1862     1866       +4     
Components Coverage Δ
Rust Backend 94.74% <ø> (ø)
Rust Client 84.29% <ø> (ø)
Python Client 93.88% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@jan-auer
jan-auer merged commit 546e375 into main Oct 30, 2026
26 checks passed
@jan-auer
jan-auer deleted the claude/upgrade-dependencies-8a41be branch October 30, 2026 10:34
jan-auer added a commit that referenced this pull request Oct 30, 2026
The published crates expose error types from two dependencies. Because
of this, a major upgrade of these dependencies is a breaking change for
our users. #744 keeps them on their current versions for this reason.

This PR makes the breaking change once, so that later upgrades are not
breaking:

- `objectstore_client::Error::TokenError` now contains
`objectstore_client::TokenError` instead of
`jsonwebtoken::errors::Error`.
- `objectstore_types::metadata::Error::ContentType` now contains
`objectstore_types::metadata::InvalidContentType` instead of
`mediatype::MediaTypeError`.

The new types are opaque. They show the message of the underlying error,
so errors are as descriptive as before. The public API no longer has
`From` conversions from the dependency error types.

The token error message now also gives context, for example `failed to
create auth token: InvalidKeyFormat` instead of only `InvalidKeyFormat`.
jan-auer added a commit that referenced this pull request Nov 4, 2026
This is a leftover from #744. `PrefetchingTokenProvider` now holds its
refresh task in an `AbortOnDropHandle`, which replaces the custom `Drop`
impl.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants