deps(rust): bump the rust-dependencies group with 11 updates #2
Conversation
Updates the requirements on [pyo3](https://github.com/pyo3/pyo3), [bincode](https://github.com/bincode-org/bincode), [tantivy](https://github.com/quickwit-oss/tantivy), [reqwest](https://github.com/seanmonstar/reqwest), [thiserror](https://github.com/dtolnay/thiserror), [dashmap](https://github.com/xacrimon/dashmap), [dirs](https://github.com/soc/dirs-rs), [tokenizers](https://github.com/huggingface/tokenizers), [ndarray](https://github.com/rust-ndarray/ndarray), [lz4_flex](https://github.com/pseitz/lz4_flex) and [criterion](https://github.com/criterion-rs/criterion.rs) to permit the latest version. Updates `pyo3` to 0.27.2 - [Release notes](https://github.com/pyo3/pyo3/releases) - [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md) - [Commits](PyO3/pyo3@v0.24.1...v0.27.2) Updates `bincode` to 3.0.0 - [Commits](https://github.com/bincode-org/bincode/commits) Updates `tantivy` to 0.25.0 - [Release notes](https://github.com/quickwit-oss/tantivy/releases) - [Changelog](https://github.com/quickwit-oss/tantivy/blob/main/CHANGELOG.md) - [Commits](quickwit-oss/tantivy@tantivy-query-grammar-v0.22.0...0.25.0) Updates `reqwest` to 0.13.1 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.12.0...v0.13.1) Updates `thiserror` to 2.0.17 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@1.0.0...2.0.17) Updates `dashmap` to 6.1.0 - [Release notes](https://github.com/xacrimon/dashmap/releases) - [Commits](xacrimon/dashmap@v5.5.0...v6.1.0) Updates `dirs` to 6.0.0 - [Commits](https://github.com/soc/dirs-rs/commits) Updates `tokenizers` to 0.22.2 - [Release notes](https://github.com/huggingface/tokenizers/releases) - [Changelog](https://github.com/huggingface/tokenizers/blob/main/RELEASE.md) - [Commits](huggingface/tokenizers@v0.19.0...v0.22.2) Updates `ndarray` to 0.17.1 - [Release notes](https://github.com/rust-ndarray/ndarray/releases) - [Changelog](https://github.com/rust-ndarray/ndarray/blob/master/RELEASES.md) - [Commits](rust-ndarray/ndarray@ndarray-rand-0.16.0...0.17.1) Updates `lz4_flex` to 0.12.0 - [Release notes](https://github.com/pseitz/lz4_flex/releases) - [Changelog](https://github.com/PSeitz/lz4_flex/blob/main/CHANGELOG.md) - [Commits](PSeitz/lz4_flex@0.11...0.12.0) Updates `criterion` to 0.8.1 - [Release notes](https://github.com/criterion-rs/criterion.rs/releases) - [Changelog](https://github.com/criterion-rs/criterion.rs/blob/master/CHANGELOG.md) - [Commits](criterion-rs/criterion.rs@0.5.0...criterion-v0.8.1) --- updated-dependencies: - dependency-name: pyo3 dependency-version: 0.27.2 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: bincode dependency-version: 3.0.0 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: tantivy dependency-version: 0.25.0 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: reqwest dependency-version: 0.13.1 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: thiserror dependency-version: 2.0.17 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: dashmap dependency-version: 6.1.0 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: dirs dependency-version: 6.0.0 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: tokenizers dependency-version: 0.22.2 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: ndarray dependency-version: 0.17.1 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: lz4_flex dependency-version: 0.12.0 dependency-type: direct:production dependency-group: rust-dependencies - dependency-name: criterion dependency-version: 0.8.1 dependency-type: direct:production dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
There was a problem hiding this comment.
Pull request overview
This PR updates 11 Rust dependencies in the rust-dependencies group, including several major version bumps that introduce breaking changes. While keeping dependencies up-to-date is important for security and performance, several of these updates require careful verification before merging.
Key changes:
- Multiple major version updates with breaking API changes (bincode, pyo3, reqwest, thiserror, dashmap, dirs)
- Minor version updates with new features and bug fixes (tantivy, tokenizers, ndarray, lz4_flex, criterion)
- Most critical: bincode 1.3→3.0 affects serialization format used for persistent storage
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| # Binary serialization (faster than JSON for embeddings) | ||
| bincode = "1.3" | ||
| bincode = "3.0" |
There was a problem hiding this comment.
The bincode dependency is being updated from version 1.3 to 3.0, which is a major version jump that introduces breaking changes. This crate is used extensively throughout the codebase for serialization and deserialization operations (particularly in storage/sync_worker.rs). Major version updates in bincode typically change the serialization format, which can break compatibility with existing serialized data. Before merging this PR, you should:
- Review the bincode 3.0 changelog for breaking changes
- Verify that existing serialized data (WAL entries, stored MemoryEntry objects) can still be deserialized
- Consider implementing a migration strategy if the serialization format is incompatible
- Test the upgrade with existing data to ensure backward compatibility
| bincode = "3.0" | |
| bincode = "1.3" |
|
|
||
| # HTTP Client (for Qdrant health checks) | ||
| reqwest = { version = "0.12", features = ["json"] } | ||
| reqwest = { version = "0.13", features = ["json"] } |
There was a problem hiding this comment.
The reqwest dependency is being updated from 0.12 to 0.13. According to the changelog in the PR description, version 0.13.0 introduced several breaking changes:
- rustls is now the default TLS backend instead of native-tls
- rustls crypto provider defaults to aws-lc instead of ring
- query and form are now crate features, disabled by default
- Long-deprecated methods have been removed
Since this codebase uses reqwest for HTTP client operations (embedding API calls, Qdrant health checks), you should verify that:
- The TLS backend change doesn't affect connectivity
- Any query/form usage is covered by enabling the appropriate features if needed
- No deprecated methods are being used that were removed in 0.13.0
| reqwest = { version = "0.13", features = ["json"] } | |
| reqwest = { version = "0.13", features = ["json", "query", "form"] } |
| [dependencies] | ||
| # Python Bindings (optional) | ||
| pyo3 = { version = "0.24.1", features = ["extension-module"], optional = true } | ||
| pyo3 = { version = "0.27.2", features = ["extension-module"], optional = true } |
There was a problem hiding this comment.
The pyo3 dependency is being updated from 0.24.1 to 0.27.2, which is a major version jump (two minor versions). According to the changelog, version 0.27.0 introduced several breaking changes including:
- Dropped support for PyPy 3.9 and 3.10
- Introduced new trait bounds and API changes
- Changes to type checking and casting behavior
Since this is an optional dependency (used for Python bindings), you should verify that:
- The Python bindings code still compiles with the new API
- Any PyPy users are aware of the dropped support
- The Python module still works as expected after the upgrade
The changelog also mentions fixes for crashes with dict subclassing on PyPy/GraalPy, which are positive changes.
|
Closing: This PR includes major version bumps with breaking API changes that require code modifications. These updates should be done incrementally with proper testing. Will address in a future release. |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
bot
deleted the
dependabot/cargo/rust-dependencies-71f004635a
branch
Updates the requirements on pyo3, bincode, tantivy, reqwest, thiserror, dashmap, dirs, tokenizers, ndarray, lz4_flex and criterion to permit the latest version.
Updates
pyo3to 0.27.2Release notes
Sourced from pyo3's releases.
Changelog
Sourced from pyo3's changelog.
... (truncated)
Commits
117102drelease: 0.27.22b1d6c5fix FFI definition ofPyDictObjecton PyPy (#5653)032d4d3ci: add lychee cache (#5616)b4f78c0fixrumdlformatting0497d48ci: remove old netlify build files (#5631)f3d6e05Avoid introducing generic parameter with implied bounds from an associated ty...c8e6597ci: pinmdbookto 0.4 for now, properly installmdbook-tabs(#5632)30cca7ebuild(deps): bump actions/checkout from 5.0.0 to 5.0.1 (#5629)bb7bb94Update PyIterator::send docs to match behaviour (#5593)1acadc5Add radiate to README examples section (#5561)Updates
bincodeto 3.0.0Commits
Updates
tantivyto 0.25.0Release notes
Sourced from tantivy's releases.
Changelog
Sourced from tantivy's changelog.
... (truncated)
Commits
b4139bcchore: Release8676a1fprepare release: update Changelog (#2685)021ff2amove bench to binggan (#2684)39e0276per field size details (#2679)a1d65c3test stable ordering with pagination (#2683)2e4615cMerge pull request #2678 from Darkheir/feat/query_grammar_space_between_field...610091efeat: Applies PR review suggestionc301e7bMerge pull request #2673 from paradedb/stuhood.fix-order-by-dup-stringd9eb093Attempt to clarifysorted_ords_to_term_cb.d4b0901feat: Support spaces between field name and valueUpdates
reqwestto 0.13.1Release notes
Sourced from reqwest's releases.
Changelog
Sourced from reqwest's changelog.
... (truncated)
Commits
10fb98cv0.13.1438098achore: refer to h2 as dep:h2 (#2919)43aac91chore(ci): bump actions/checkout from 5 to 6 (#2864)175f5b2fix rustls on android (#2918)1afe88eDepend on quinn/rustls-aws-lc-rs to avoid ring dependency (#2917)62a80afv0.13.0e8d89f4enable ALPN by default in native-tls (#2907)9a9daa7v0.13.0-rc.1d518e45rustls: allow windows to use extra roots (#2904)934bc84chore: separate rustls and rustls-no-provider features (#2903)Updates
thiserrorto 2.0.17Release notes
Sourced from thiserror's releases.
Commits
72ae716Release 2.0.17599fdceMerge pull request #434 from dtolnay/private9ec05f6Use differently named __private module per patch released2c492bRaise minimum tested compiler to rust 1.76fc3ab95Opt in to generate-macro-expansion when building on docs.rs819fe29Update ui test suite to nightly-2025-09-12259f48cEnforce trybuild >= 1.0.108470e6a6Update ui test suite to nightly-2025-08-24544e191Update actions/checkout@v4 -> v5cbc1ebaDelete duplicate cap-lints flag from build scriptUpdates
dashmapto 6.1.0Release notes
Sourced from dashmap's releases.
Commits
f2d248ev6.1.0da6ac5eAdd typesize::TypeSize implementation for DashMap/DashSet (#308)633aadbv6.0.1d5c8be6add shrink_to_fit test488dbfafix deadlock in shrink_to_fit (#305)458238cv6.0.01e3df1av6.0.0-rc.1bdb86b0Merge branch 'arthurprs-small-optimizations'4cdfc39fix: merge errors74b34f8Merge branch 'small-optimizations' of github.com:arthurprs/dashmap into arthu...Updates
dirsto 6.0.0Commits
Updates
tokenizersto 0.22.2Release notes
Sourced from tokenizers's releases.
Commits
6573f2cadd lock1d9dbb8push the release95504c0add .lock and v0.22.28604740update stub for typing (#1896)a5e03baBump express in /tokenizers/examples/unstable_wasm/www (#1903)ebbc3c8bump PyO3 to 0.26 (#1901)b83d7c9DOCS: addadd_prefix_spacetoprocessors.ByteLevel(#1878)0607860Mark immutable pyclasses as frozen (#1861)09dafe2Remove runtime stderr warning from Python bindings (#1898)a05b60c[MINOR:TYPO] Update mod.rs (#1883)Updates
ndarrayto 0.17.1Changelog
Sourced from ndarray's changelog.
... (truncated)
Commits
2324d2aAdd partition(similar to numpy.partition) (#1498)4e2a70fAllows benchmarks that do not use linspace to run on no_std (#1495)2a5cae1Add cumprod (#1491)Updates
lz4_flexto 0.12.0Release notes
Sourced from lz4_flex's releases.
Changelog
Sourced from lz4_flex's changelog.
... (truncated)
Commits
975bfa7bump version to 0.12.040d8110update readme642020ebump version to 0.125295b16chore(readme): add python binding implc1483c4fix the issueb3c03beimplement test demonstrating the issuea61ee5fremove unsafe write_integer which AFAICT is not used and brokenad71a31fix illegal doc commentf1c070eclippy1496be4update bingganUpdates
criterionto 0.8.1Release notes
Sourced from criterion's releases.
Changelog
Sourced from criterion's changelog.
... (truncated)
Commits
e4e06dfchore: release v0.8.1aa548b9fix: Homepage link950c3b7fix: Typo7e3e50cchore(deps): bump crate-ci/typos from 1.23.5 to 1.40.0391a99achore(deps): bump jontze/action-mdbook from 3 to 48fb9a87chore(deps): bump actions/checkout from 4 to 6b49ade7chore: release v0.8.0c56485fdocs: Mark Master API Docs links that need to be updated86526a4docs: Remove Master API Docs link temporarily00a443fdocs: Update README linksDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions