viirya opened a new pull request, #35:
URL: https://github.com/apache/spark-connect-gateway/pull/35
### What changes were proposed in this pull request?
Two small dependency updates:
```
redis 1.6.0 -> 1.7.0 (Cargo.lock only)
base64 0.22 -> 0.23 (crates/auth dev-dependency)
```
The lock also picks up `combine` 4.6.7 -> 4.6.8, which is redis's parser
dependency coming along with it.
This supersedes #34 and #33, both closed.
### Why are the changes needed?
Routine dependency maintenance. The reason it is a hand-written PR rather
than
merging dependabot's two is worth stating, because it is not obvious from
their
diffs.
Both branches were cut before SPARK-59552 landed, so each one *also* reverts
`jsonwebtoken` from
```toml
{ version = "10", default-features = false, features = ["use_pem",
"rust_crypto"] }
```
back to `"9"`, dropping around 270 lines from `Cargo.lock` with it. That
would
silently undo the crypto provider selection — and because `jsonwebtoken =
"9"`
compiles cleanly and passes every test, **CI would not catch it**. Five of
the
current dependabot PRs share this property, so it is worth knowing about when
triaging the rest of the batch. Applying the two updates directly avoids
waiting
for dependabot to rebase.
One deliberate difference from #34: it also narrowed the manifest
requirement from
`redis = "1"` to `"1.7"`. That narrowing is unnecessary — the existing `"1"`
requirement already admits 1.7.0 — so the root `Cargo.toml` is untouched
here and
only `Cargo.lock` moves.
### Does this PR introduce _any_ user-facing change?
No. Dependency versions only.
### How was this patch tested?
The two updates carry different risk, so they were checked differently rather
than uniformly.
**`redis` is a production dependency and backs the affinity store**, so it
was
exercised against a real Redis instead of being taken as verified because it
compiles. All nine Redis integration tests pass:
```
scg-store-redis (5) session_bind_resolve_forget_roundtrip
op_reverse_index_roundtrip
session_ttl_expires
bind_session_if_absent_is_atomic
two_stores_against_same_redis_share_state
scg-ratelimit (4) burst_admits_then_rejects
refill_admits_after_wait
tenants_are_independent
two_replicas_share_the_bucket
```
These are the `#[ignore]`d tests that CI's `integration` job runs; they
cover the
atomicity and TTL behaviour the affinity store depends on, which a build
cannot
speak to.
**`base64` is a dev-dependency of `crates/auth` only** — its 30 tests pass.
**Full workspace:**
| check | result |
|---|---|
| `cargo test --workspace` | 204 passed, 0 failed, 10 ignored — same as the
baseline on `main` |
| `cargo clippy --workspace --all-targets -- -D warnings` | clean |
| `cargo fmt --all --check` | clean |
I also confirmed the provider selection survived, since that is the specific
thing
the dependabot versions would have broken: `Cargo.lock` still resolves
`jsonwebtoken` 10.4.0, and the only `scg-auth` dependency line that changed
is
`base64 0.22.1` -> `0.23.1`.
### Was this patch authored or co-authored using generative AI tooling?
Yes, co-authored with Claude Code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
