Lock file maintenance #5786
Lock file maintenance #5786
Conversation
| @@ -15970,7 +15970,6 @@ | |||
| "signing_keypair": { | |||
| "nullable": true, | |||
| "description": "request signing key pair", | |||
| "default": null, | |||
There was a problem hiding this comment.
Unsure! Let me see if I can find out why this changed.
There was a problem hiding this comment.
First guess would be the schemars update.
There was a problem hiding this comment.
Yeah, it seems to have been the one PR in 0.8.18, which caused other breakage: oxidecomputer/dropshot#995
I don't know whether removing "default": null is problematic on its own.
There was a problem hiding this comment.
The Progenitor-generated oxide-client (that we have in this repo to use for end-to-end tests) doesn't have any differences from main to this branch (per cargo expand).
The generated API in the console does have this difference:
diff --git a/app/api/__generated__/validate.ts b/app/api/__generated__/validate.ts
index fcb58fb1..07fe33d0 100644
--- a/app/api/__generated__/validate.ts
+++ b/app/api/__generated__/validate.ts
@@ -2327,7 +2327,7 @@ export const SamlIdentityProviderCreate = z.preprocess(
idpEntityId: z.string(),
idpMetadataSource: IdpMetadataSource,
name: Name,
- signingKeypair: DerEncodedKeyPair.default(null).optional(),
+ signingKeypair: DerEncodedKeyPair.optional(),
sloUrl: z.string(),
spClientId: z.string(),
technicalContactEmail: z.string(),which seems to not introduce any typechecking issues.
There was a problem hiding this comment.
You would think the default value of a nullable would be null by default anyway! Thanks for checking the TS. That particular bit isn’t load-bearing anyway — we currently only use the generated validators in the mock server so we can 400 on bad request bodies.
|
Should we merge? I can also back out the dropshot/schemars updates (they need to go together, as dropshot bumped its dep to the most recent schemars recently). |
|
I'm like 95% confident it's fine but I'd want @ahl to confirm. |
|
Without objection; have we done any looking at the specific updates or "SBOM lol"? I'm good either way. |
|
I looked at most of the cryptography-related updates and saw nothing of concern. I think medium-term we should build some tooling around auditing crate updates and splitting the load of that. |
beep boop i am renovate bot
cargo update output