From 8b7cfb5710efb3c22704596b543b3ad48ad7ca05 Mon Sep 17 00:00:00 2001 From: chrishayuk Date: Thu, 6 Aug 2026 00:33:04 +0100 Subject: [PATCH 1/5] deps(security): clear every open RUSTSEC advisory, and correct the MSRV MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wasmtime 29.0.1 -> 36.0.13, closing RUSTSEC-2026-0021 / -0085 / -0086 / -0087 / -0088. Issue #166 scoped this to `crates/model-compute`, where wasmtime sits behind the optional `wasm` feature, and concluded that anyone not enabling that feature was unexposed. That is not the whole picture. `larql-inference` also carried `wasmtime = "29"` *and* `wasmtime-wasi = "29"` as mandatory entries in `[dependencies]`, and it is in `default-members` — so every default build of this workspace resolved the vulnerable version. Both crates move together here. The requirement is `^36.0.7` (the 36.0.x LTS line) rather than the open `>=36.0.7` the issue suggested. wasmtime 45+ declares rust-version 1.93, so an open range would let a routine `cargo update` drag the workspace MSRV up by seven releases as a side effect of a security patch. Compiled-module caches survive this: `load_module` deserializes a `.cwasm` only inside `if let Ok(..)`, and wasmtime rejects artefacts from a different version, so a stale cache costs one failed read and a recompile. pyo3 0.24.2 -> 0.29.2 with numpy 0.24 -> 0.29 (version-locked to pyo3), closing RUSTSEC-2026-0176 / -0177. The bindings already used the `Bound<'py, T>` API, so nothing in the 4k lines of binding code needed rewriting. The one change is opting the six `Clone` + `#[pyclass]` types into `from_py_object`: 0.29 deprecates the automatic `FromPyObject` derive ahead of making it opt-in. `PyEdge` genuinely needs it — `Graph::add_edges` extracts a `Vec` — and the other five are opted in to keep today's behaviour byte-for-byte rather than to quietly narrow the Python API. Two more advisories that no issue had recorded, both fixed by lockfile bumps alone: quinn-proto 0.11.14 -> 0.11.16 RUSTSEC-2026-0185, 7.5 high: remote memory exhaustion from unbounded out-of-order stream reassembly crossbeam-epoch 0.9.18 -> 0.9.20 RUSTSEC-2026-0204 and two unsoundness notices cleared the same way: anyhow 1.0.102 -> 1.0.104 (RUSTSEC-2026-0190) and memmap2 0.9.10 -> 0.9.11 (RUSTSEC-2026-0186). `cargo audit` now reports zero vulnerabilities against this lockfile. Four warnings remain — number_prefix, paste, rustls-pemfile, scc — every one of them pinned by an upstream dependant we do not control, and each recorded with its reasoning in deny.toml. Lastly `rust-version` moves 1.80 -> 1.88. 1.80 was not merely optimistic, it was unusable: time, image, cookie_store and home all declare 1.88, so resolution itself failed and the declared minimum described a build nobody could perform. 1.88 is the real floor, taken from the resolved graph and verified with `cargo +1.88.0 check --workspace --all-targets`. The 17 member crates that were not already inheriting it now carry `rust-version.workspace = true`, so the claim is checkable per crate instead of being a single unenforced line at the workspace root. Closes #166 Closes #167 Closes #168 --- Cargo.lock | 760 +++++++++++++----------- Cargo.toml | 2 +- crates/larql-cli/Cargo.toml | 1 + crates/larql-compute-metal/Cargo.toml | 1 + crates/larql-compute/Cargo.toml | 1 + crates/larql-core/Cargo.toml | 1 + crates/larql-demos/Cargo.toml | 1 + crates/larql-execution/Cargo.toml | 1 + crates/larql-factory/Cargo.toml | 1 + crates/larql-inference/Cargo.toml | 5 +- crates/larql-lql/Cargo.toml | 1 + crates/larql-models/Cargo.toml | 1 + crates/larql-python/Cargo.toml | 5 +- crates/larql-python/src/lib.rs | 4 +- crates/larql-python/src/vindex.rs | 8 +- crates/larql-router-protocol/Cargo.toml | 1 + crates/larql-router/Cargo.toml | 1 + crates/larql-server/Cargo.toml | 1 + crates/larql-vindex-spec/Cargo.toml | 1 + crates/larql-vindex/Cargo.toml | 1 + crates/model-compute/Cargo.toml | 3 +- nix/README.md | 2 +- 22 files changed, 450 insertions(+), 353 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 830e68bb0..dca732ea5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1,6 +1,6 @@ # This file is automatically @generated by Cargo. # It is not intended for manual editing. -version = 3 +version = 4 [[package]] name = "accelerate-src" @@ -8,6 +8,15 @@ version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "415ed64958754dbe991900f3940677e6a7eefb4d7367afd70d642677b0c7d19d" +[[package]] +name = "addr2line" +version = "0.25.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b" +dependencies = [ + "gimli", +] + [[package]] name = "adler2" version = "2.0.1" @@ -116,18 +125,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" - -[[package]] -name = "ar_archive_writer" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7eb93bbb63b9c227414f6eb3a0adfddca591a8ce1e9b60661bb08969b87e340b" -dependencies = [ - "object 0.37.3", -] +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "arbitrary" @@ -521,6 +521,17 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +[[package]] +name = "chacha20" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "rand_core 0.10.1", +] + [[package]] name = "chrono" version = "0.4.44" @@ -756,20 +767,47 @@ dependencies = [ "libc", ] +[[package]] +name = "cpufeatures" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201" +dependencies = [ + "libc", +] + +[[package]] +name = "cranelift-assembler-x64" +version = "0.123.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5f8e1303ae2128891cb59691a74de4547dd208bc8511a2f287cca2b93bb3c728" +dependencies = [ + "cranelift-assembler-x64-meta", +] + +[[package]] +name = "cranelift-assembler-x64-meta" +version = "0.123.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "58b2740a5936332028d9a1e8f29a199de2fd386e426d44da5fea70cf8e3f8e75" +dependencies = [ + "cranelift-srcgen", +] + [[package]] name = "cranelift-bforest" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e15d04a0ce86cb36ead88ad68cf693ffd6cda47052b9e0ac114bc47fd9cd23c4" +checksum = "37fd128d3629fb105e433bda09744c5a2959cd1da04617a455c4cc17dff1ebef" dependencies = [ "cranelift-entity", ] [[package]] name = "cranelift-bitset" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7c6e3969a7ce267259ce244b7867c5d3bc9e65b0a87e81039588dfdeaede9f34" +checksum = "24a88f6d5a6cf6fcbc6386415d48948094721dfa4585d6615938b11ca938f20a" dependencies = [ "serde", "serde_derive", @@ -777,11 +815,12 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2c22032c4cb42558371cf516bb47f26cdad1819d3475c133e93c49f50ebf304e" +checksum = "daa4a357d030bdd586d8fe3da56b394f7f6b6ded506e59f945e7b32b1e126b71" dependencies = [ "bumpalo", + "cranelift-assembler-x64", "cranelift-bforest", "cranelift-bitset", "cranelift-codegen-meta", @@ -790,44 +829,50 @@ dependencies = [ "cranelift-entity", "cranelift-isle", "gimli", - "hashbrown 0.14.5", + "hashbrown 0.15.5", "log", + "pulley-interpreter", "regalloc2", "rustc-hash", "serde", "smallvec", "target-lexicon", + "wasmtime-internal-math", ] [[package]] name = "cranelift-codegen-meta" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c904bc71c61b27fc57827f4a1379f29de64fe95653b620a3db77d59655eee0b8" +checksum = "4121e36a8757dea6fb237435ee5095eba25bc13ecc2eaee57eb9bffd4b27784f" dependencies = [ + "cranelift-assembler-x64-meta", "cranelift-codegen-shared", + "cranelift-srcgen", + "heck", + "pulley-interpreter", ] [[package]] name = "cranelift-codegen-shared" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "40180f5497572f644ce88c255480981ae2ec1d7bb4d8e0c0136a13b87a2f2ceb" +checksum = "5173265fc30b9e42205cf06dfca9a272ee949667ce4115d975ed2c08d466e2f8" [[package]] name = "cranelift-control" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26d132c6d0bd8a489563472afc171759da0707804a65ece7ceb15a8c6d7dd5ef" +checksum = "9b6ca8a393e66dc13f915c6f456bdcf496d78fac4995792f7022b7806352d7a4" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b2d0d9618275474fbf679dd018ac6e009acbd6ae6850f6a67be33fb3b00b323" +checksum = "e609d9ba416bc26d774f343295a1d411515248a6a6d83d5f7492a0dd919569fa" dependencies = [ "cranelift-bitset", "serde", @@ -836,9 +881,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fac41e16729107393174b0c9e3730fb072866100e1e64e80a1a963b2e484d57" +checksum = "90a3a277b1a0aff1123f6bae61c080a4bcb6df964829ed427f98e18dff14257f" dependencies = [ "cranelift-codegen", "log", @@ -848,21 +893,27 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ca20d576e5070044d0a72a9effc2deacf4d6aa650403189d8ea50126483944d" +checksum = "be53dd9b3a4cbeb9ced45c4a543ea8417ccfb334c3ba1cbb2233f4b25fb2531f" [[package]] name = "cranelift-native" -version = "0.116.1" +version = "0.123.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8dee82f3f1f2c4cba9177f1cc5e350fe98764379bcd29340caa7b01f85076c7" +checksum = "ca62ab1d9f48cad97da5843b913ccf96c3dfde935af5d750cb5a6d367ccfb262" dependencies = [ "cranelift-codegen", "libc", "target-lexicon", ] +[[package]] +name = "cranelift-srcgen" +version = "0.123.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a13b72860f54a2a19d3756bd47575fd8bddeafd6e5bbbf16372cdfebc482628a" + [[package]] name = "crc32fast" version = "1.5.0" @@ -920,9 +971,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] @@ -1070,33 +1121,13 @@ dependencies = [ "crypto-common", ] -[[package]] -name = "dirs" -version = "4.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ca3aa72a6f96ea37bbc5aa912f6788242832f75369bdfdadcb0e38423f100059" -dependencies = [ - "dirs-sys 0.3.7", -] - [[package]] name = "dirs" version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e" dependencies = [ - "dirs-sys 0.5.0", -] - -[[package]] -name = "dirs-sys" -version = "0.3.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6" -dependencies = [ - "libc", - "redox_users 0.4.6", - "winapi", + "dirs-sys", ] [[package]] @@ -1107,7 +1138,7 @@ checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab" dependencies = [ "libc", "option-ext", - "redox_users 0.5.2", + "redox_users", "windows-sys 0.61.2", ] @@ -1493,11 +1524,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" dependencies = [ "cfg-if", - "js-sys", "libc", "r-efi 5.3.0", "wasip2", - "wasm-bindgen", ] [[package]] @@ -1507,17 +1536,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" dependencies = [ "cfg-if", + "js-sys", "libc", "r-efi 6.0.0", + "rand_core 0.10.1", "wasip2", "wasip3", + "wasm-bindgen", ] [[package]] name = "gimli" -version = "0.31.1" +version = "0.32.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f" +checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7" dependencies = [ "fallible-iterator", "indexmap", @@ -1597,15 +1629,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "hashbrown" -version = "0.14.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1" -dependencies = [ - "ahash", -] - [[package]] name = "hashbrown" version = "0.15.5" @@ -1653,7 +1676,7 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "aef3982638978efa195ff11b305f51f1f22f4f0a6cabee7af79b383ebee6a213" dependencies = [ - "dirs 6.0.0", + "dirs", "http", "indicatif 0.18.4", "libc", @@ -2015,15 +2038,6 @@ dependencies = [ "web-time", ] -[[package]] -name = "indoc" -version = "2.0.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706" -dependencies = [ - "rustversion", -] - [[package]] name = "io-extras" version = "0.18.4" @@ -2082,15 +2096,6 @@ dependencies = [ "either", ] -[[package]] -name = "itertools" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569" -dependencies = [ - "either", -] - [[package]] name = "itertools" version = "0.14.0" @@ -2702,9 +2707,9 @@ dependencies = [ [[package]] name = "memmap2" -version = "0.9.10" +version = "0.9.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3" +checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0" dependencies = [ "libc", ] @@ -2715,15 +2720,6 @@ version = "0.3.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "38d1115007560874e373613744c6fba374c17688327a71c1476d1a5954cc857b" -[[package]] -name = "memoffset" -version = "0.9.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a" -dependencies = [ - "autocfg", -] - [[package]] name = "metal" version = "0.29.0" @@ -2993,9 +2989,9 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3" [[package]] name = "numpy" -version = "0.24.0" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7cfbf3f0feededcaa4d289fe3079b03659e85c5b5a177f4ba6fb01ab4fb3e39" +checksum = "6a5b15d63a5ff39e378daed0e1340d3a5964703ea9712eb09a0dc66fade996f4" dependencies = [ "libc", "ndarray", @@ -3018,9 +3014,9 @@ dependencies = [ [[package]] name = "object" -version = "0.36.7" +version = "0.37.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87" +checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe" dependencies = [ "crc32fast", "hashbrown 0.15.5", @@ -3028,15 +3024,6 @@ dependencies = [ "memchr", ] -[[package]] -name = "object" -version = "0.37.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe" -dependencies = [ - "memchr", -] - [[package]] name = "once_cell" version = "1.21.4" @@ -3097,7 +3084,7 @@ version = "0.10.15" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fccd2c4f5271ab871f2069cb6f1a13ef2c0db50e1145ce03428ee541f4c63c4f" dependencies = [ - "dirs 6.0.0", + "dirs", "openblas-build", "pkg-config", "vcpkg", @@ -3442,25 +3429,26 @@ dependencies = [ ] [[package]] -name = "psm" -version = "0.1.31" +name = "pulley-interpreter" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "645dbe486e346d9b5de3ef16ede18c26e6c70ad97418f4874b8b1889d6e761ea" +checksum = "2662666315cb90dfb4d99a652ee053d4d8598f71c474209e84da031ca56ae5a4" dependencies = [ - "ar_archive_writer", - "cc", + "cranelift-bitset", + "log", + "pulley-macros", + "wasmtime-internal-math", ] [[package]] -name = "pulley-interpreter" -version = "29.0.1" +name = "pulley-macros" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "62d95f8575df49a2708398182f49a888cf9dc30210fb1fd2df87c889edcee75d" +checksum = "bb9a7d9ed2618f94b6d054aba3eb2768c9b489fe16b4ef8847fbc6ed41b707bb" dependencies = [ - "cranelift-bitset", - "log", - "sptr", - "wasmtime-math", + "proc-macro2", + "quote", + "syn", ] [[package]] @@ -3471,37 +3459,32 @@ checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f" [[package]] name = "pyo3" -version = "0.24.2" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e5203598f366b11a02b13aa20cab591229ff0a89fd121a308a5df751d5fc9219" +checksum = "4688ddedf473e32662b9b067670129a8afb8c18e351482c70d62ba4a88171e8b" dependencies = [ - "cfg-if", - "indoc", "libc", - "memoffset", "once_cell", "portable-atomic", "pyo3-build-config", "pyo3-ffi", "pyo3-macros", - "unindent", ] [[package]] name = "pyo3-build-config" -version = "0.24.2" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "99636d423fa2ca130fa5acde3059308006d46f98caac629418e53f7ebb1e9999" +checksum = "f41027e41b4bd03f6e60f9f417fe24a6341a6bb744edd62b6f709f2a52ea30e9" dependencies = [ - "once_cell", "target-lexicon", ] [[package]] name = "pyo3-ffi" -version = "0.24.2" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78f9cf92ba9c409279bc3305b5409d90db2d2c22392d443a87df3a1adad59e33" +checksum = "e591a95526fead067432c3b3a33fc74770b87b1e04e73671090d9c2055a2b327" dependencies = [ "libc", "pyo3-build-config", @@ -3509,9 +3492,9 @@ dependencies = [ [[package]] name = "pyo3-macros" -version = "0.24.2" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b999cb1a6ce21f9a6b147dcf1be9ffedf02e0043aec74dc390f3007047cecd9" +checksum = "73225868fc1cd84eef2c3c230ddb91273bf1de46aeb8a4248da76d32a0924a1c" dependencies = [ "proc-macro2", "pyo3-macros-backend", @@ -3521,13 +3504,12 @@ dependencies = [ [[package]] name = "pyo3-macros-backend" -version = "0.24.2" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "822ece1c7e1012745607d5cf0bcb2874769f0f7cb34c4cde03b9358eb9ef911a" +checksum = "571575aa3749fa6216757dd47d2a3e7ef360f329a40f0666a9fbd14889024952" dependencies = [ "heck", "proc-macro2", - "pyo3-build-config", "quote", "syn", ] @@ -3561,14 +3543,15 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.14" +version = "0.11.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098" +checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" dependencies = [ "bytes", - "getrandom 0.3.4", + "getrandom 0.4.2", "lru-slab", - "rand 0.9.4", + "rand 0.10.2", + "rand_pcg", "ring", "rustc-hash", "rustls", @@ -3591,7 +3574,7 @@ dependencies = [ "once_cell", "socket2 0.6.3", "tracing", - "windows-sys 0.59.0", + "windows-sys 0.60.2", ] [[package]] @@ -3646,6 +3629,17 @@ dependencies = [ "rand_core 0.9.5", ] +[[package]] +name = "rand" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" +dependencies = [ + "chacha20", + "getrandom 0.4.2", + "rand_core 0.10.1", +] + [[package]] name = "rand_chacha" version = "0.3.1" @@ -3684,6 +3678,12 @@ dependencies = [ "getrandom 0.3.4", ] +[[package]] +name = "rand_core" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + [[package]] name = "rand_distr" version = "0.4.3" @@ -3694,6 +3694,15 @@ dependencies = [ "rand 0.8.6", ] +[[package]] +name = "rand_pcg" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" +dependencies = [ + "rand_core 0.10.1", +] + [[package]] name = "rawpointer" version = "0.2.1" @@ -3762,17 +3771,6 @@ dependencies = [ "bitflags 2.11.1", ] -[[package]] -name = "redox_users" -version = "0.4.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43" -dependencies = [ - "getrandom 0.2.17", - "libredox", - "thiserror 1.0.69", -] - [[package]] name = "redox_users" version = "0.5.2" @@ -3786,9 +3784,9 @@ dependencies = [ [[package]] name = "regalloc2" -version = "0.11.2" +version = "0.12.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc06e6b318142614e4a48bc725abbf08ff166694835c43c9dae5a9009704639a" +checksum = "5216b1837de2149f8bc8e6d5f88a9326b63b8c836ed58ce4a0a29ec736a59734" dependencies = [ "allocator-api2", "bumpalo", @@ -4258,7 +4256,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" dependencies = [ "cfg-if", - "cpufeatures", + "cpufeatures 0.2.17", "digest", ] @@ -4269,7 +4267,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", - "cpufeatures", + "cpufeatures 0.2.17", "digest", ] @@ -4282,15 +4280,6 @@ dependencies = [ "lazy_static", ] -[[package]] -name = "shellexpand" -version = "2.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7ccc8076840c4da029af4f87e4e8daeb0fca6b87bbb02e10cb60b791450e11e4" -dependencies = [ - "dirs 4.0.0", -] - [[package]] name = "shlex" version = "1.3.0" @@ -4377,12 +4366,6 @@ dependencies = [ "unicode-segmentation", ] -[[package]] -name = "sptr" -version = "0.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b9b39299b249ad65f3b7e96443bad61c02ca5cd3589f46cb6d610a0fd6c0d6a" - [[package]] name = "stable_deref_trait" version = "1.2.1" @@ -4904,17 +4887,6 @@ dependencies = [ "tracing-log", ] -[[package]] -name = "trait-variant" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70977707304198400eb4835a78f6a9f928bf41bba420deb8fdb175cd965d77a7" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - [[package]] name = "try-lock" version = "0.2.5" @@ -4988,12 +4960,6 @@ version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e" -[[package]] -name = "unindent" -version = "0.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3" - [[package]] name = "unit-prefix" version = "0.5.2" @@ -5238,12 +5204,12 @@ dependencies = [ [[package]] name = "wasm-encoder" -version = "0.221.3" +version = "0.236.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc8444fe4920de80a4fe5ab564fff2ae58b6b73166b89751f8c6c93509da32e5" +checksum = "724fccfd4f3c24b7e589d333fc0429c68042897a7e8a5f8694f31792471841e7" dependencies = [ - "leb128", - "wasmparser 0.221.3", + "leb128fmt", + "wasmparser 0.236.1", ] [[package]] @@ -5280,9 +5246,9 @@ dependencies = [ [[package]] name = "wasmparser" -version = "0.221.3" +version = "0.236.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d06bfa36ab3ac2be0dee563380147a5b81ba10dd8885d7fbbc9eb574be67d185" +checksum = "a9b1e81f3eb254cf7404a82cee6926a4a3ccc5aad80cc3d43608a070c67aa1d7" dependencies = [ "bitflags 2.11.1", "hashbrown 0.15.5", @@ -5316,21 +5282,22 @@ dependencies = [ [[package]] name = "wasmprinter" -version = "0.221.3" +version = "0.236.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7343c42a97f2926c7819ff81b64012092ae954c5d83ddd30c9fcdefd97d0b283" +checksum = "2df225df06a6df15b46e3f73ca066ff92c2e023670969f7d50ce7d5e695abbb1" dependencies = [ "anyhow", "termcolor", - "wasmparser 0.221.3", + "wasmparser 0.236.1", ] [[package]] name = "wasmtime" -version = "29.0.1" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11976a250672556d1c4c04c6d5d7656ac9192ac9edc42a4587d6c21460010e69" +checksum = "93d881c5dcff5f230368d84fcf110ca25fe47badc694e7d559c3891492159916" dependencies = [ + "addr2line", "anyhow", "async-trait", "bitflags 2.11.1", @@ -5338,76 +5305,99 @@ dependencies = [ "cc", "cfg-if", "encoding_rs", - "hashbrown 0.14.5", + "hashbrown 0.15.5", "indexmap", "libc", "log", "mach2", "memfd", - "object 0.36.7", + "object", "once_cell", - "paste", "postcard", - "psm", "pulley-interpreter", - "rustix 0.38.44", + "rustix 1.1.4", "semver", "serde", "serde_derive", "smallvec", - "sptr", "target-lexicon", - "trait-variant", - "wasmparser 0.221.3", - "wasmtime-asm-macros", - "wasmtime-component-macro", - "wasmtime-component-util", - "wasmtime-cranelift", + "wasmparser 0.236.1", "wasmtime-environ", - "wasmtime-fiber", - "wasmtime-jit-icache-coherence", - "wasmtime-math", - "wasmtime-slab", - "wasmtime-versioned-export-macros", - "wasmtime-winch", - "windows-sys 0.59.0", + "wasmtime-internal-asm-macros", + "wasmtime-internal-component-macro", + "wasmtime-internal-component-util", + "wasmtime-internal-cranelift", + "wasmtime-internal-fiber", + "wasmtime-internal-jit-debug", + "wasmtime-internal-jit-icache-coherence", + "wasmtime-internal-math", + "wasmtime-internal-slab", + "wasmtime-internal-unwinder", + "wasmtime-internal-versioned-export-macros", + "wasmtime-internal-winch", + "windows-sys 0.60.2", ] [[package]] -name = "wasmtime-asm-macros" -version = "29.0.1" +name = "wasmtime-environ" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1f178b0d125201fbe9f75beaf849bd3e511891f9e45ba216a5b620802ccf64f2" +checksum = "a4b25534a3ff9dd844701c2bc997f76cb1f97bf2af0546a7066ae96f49c2e068" +dependencies = [ + "anyhow", + "cranelift-bitset", + "cranelift-entity", + "gimli", + "indexmap", + "log", + "object", + "postcard", + "semver", + "serde", + "serde_derive", + "smallvec", + "target-lexicon", + "wasm-encoder 0.236.1", + "wasmparser 0.236.1", + "wasmprinter", + "wasmtime-internal-component-util", +] + +[[package]] +name = "wasmtime-internal-asm-macros" +version = "36.0.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1d02832d760351fb3a1aa99eb8f7b95596c0f4e4e52df1547fcdb295ea5c780c" dependencies = [ "cfg-if", ] [[package]] -name = "wasmtime-component-macro" -version = "29.0.1" +name = "wasmtime-internal-component-macro" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d74de6592ed945d0a602f71243982a304d5d02f1e501b638addf57f42d57dfaf" +checksum = "ba2ed6dbe24607573f7bcc59222f3bc2e7f7d31609466055c67b9484045a374a" dependencies = [ "anyhow", "proc-macro2", "quote", "syn", - "wasmtime-component-util", - "wasmtime-wit-bindgen", - "wit-parser 0.221.3", + "wasmtime-internal-component-util", + "wasmtime-internal-wit-bindgen", + "wit-parser 0.236.1", ] [[package]] -name = "wasmtime-component-util" -version = "29.0.1" +name = "wasmtime-internal-component-util" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "707dc7b3c112ab5a366b30cfe2fb5b2f8e6a0f682f16df96a5ec582bfe6f056e" +checksum = "e21aadbf677ee3503ef2580ce3c6955508e90a2810e961739b30f79585af254c" [[package]] -name = "wasmtime-cranelift" -version = "29.0.1" +name = "wasmtime-internal-cranelift" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "366be722674d4bf153290fbcbc4d7d16895cc82fb3e869f8d550ff768f9e9e87" +checksum = "65821bab751956cddfc6ee957beb13a0e2a6cf682050d75dfb7a0228db2ed499" dependencies = [ "anyhow", "cfg-if", @@ -5417,100 +5407,131 @@ dependencies = [ "cranelift-frontend", "cranelift-native", "gimli", - "itertools 0.12.1", + "itertools 0.14.0", "log", - "object 0.36.7", + "object", + "pulley-interpreter", "smallvec", "target-lexicon", - "thiserror 1.0.69", - "wasmparser 0.221.3", + "thiserror 2.0.18", + "wasmparser 0.236.1", "wasmtime-environ", - "wasmtime-versioned-export-macros", + "wasmtime-internal-math", + "wasmtime-internal-versioned-export-macros", ] [[package]] -name = "wasmtime-environ" -version = "29.0.1" +name = "wasmtime-internal-fiber" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cdadc1af7097347aa276a4f008929810f726b5b46946971c660b6d421e9994ad" +checksum = "18cf73e5e8d28a2b30d86454430c7dea3b593598dcbbc0ebb927ca2716222d41" dependencies = [ "anyhow", - "cranelift-bitset", - "cranelift-entity", - "gimli", - "indexmap", - "log", - "object 0.36.7", - "postcard", - "semver", - "serde", - "serde_derive", - "smallvec", - "target-lexicon", - "wasm-encoder 0.221.3", - "wasmparser 0.221.3", - "wasmprinter", - "wasmtime-component-util", + "cc", + "cfg-if", + "libc", + "rustix 1.1.4", + "wasmtime-internal-asm-macros", + "wasmtime-internal-versioned-export-macros", + "windows-sys 0.60.2", ] [[package]] -name = "wasmtime-fiber" -version = "29.0.1" +name = "wasmtime-internal-jit-debug" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ccba90d4119f081bca91190485650730a617be1fff5228f8c4757ce133d21117" +checksum = "4279dc3147ddaa21e5b3d2c0eaff117881c4f937747bdd2379eb361665843bd3" dependencies = [ - "anyhow", "cc", - "cfg-if", - "rustix 0.38.44", - "wasmtime-asm-macros", - "wasmtime-versioned-export-macros", - "windows-sys 0.59.0", + "wasmtime-internal-versioned-export-macros", ] [[package]] -name = "wasmtime-jit-icache-coherence" -version = "29.0.1" +name = "wasmtime-internal-jit-icache-coherence" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec5e8552e01692e6c2e5293171704fed8abdec79d1a6995a0870ab190e5747d1" +checksum = "a8eb677944201839c0be19b39b0f19dcd663efbcbc05a09c73f26fec7bdf0331" dependencies = [ "anyhow", "cfg-if", "libc", - "windows-sys 0.59.0", + "windows-sys 0.60.2", ] [[package]] -name = "wasmtime-math" -version = "29.0.1" +name = "wasmtime-internal-math" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "29210ec2aa25e00f4d54605cedaf080f39ec01a872c5bd520ad04c67af1dde17" +checksum = "db9a153e184878df396a11f8912444531c2e4d0c7a1d9e9a52b30d9853d89cb9" dependencies = [ "libm", ] [[package]] -name = "wasmtime-slab" -version = "29.0.1" +name = "wasmtime-internal-slab" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fcb5821a96fa04ac14bc7b158bb3d5cd7729a053db5a74dad396cd513a5e5ccf" +checksum = "b771494bead25e1f0c4c89a9476dd0b65eacca314ed82125f1e197fbc3f0396b" [[package]] -name = "wasmtime-versioned-export-macros" -version = "29.0.1" +name = "wasmtime-internal-unwinder" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "86ff86db216dc0240462de40c8290887a613dddf9685508eb39479037ba97b5b" +checksum = "90199caed6925420434a923861d8ad813689ca8533d2c679f805d12e35b40a4b" +dependencies = [ + "anyhow", + "cfg-if", + "cranelift-codegen", + "log", + "object", +] + +[[package]] +name = "wasmtime-internal-versioned-export-macros" +version = "36.0.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ae71687aa834f9cc9eb5b0f97c85184d7dc70b84d32fd8927af0887998a1ba35" dependencies = [ "proc-macro2", "quote", "syn", ] +[[package]] +name = "wasmtime-internal-winch" +version = "36.0.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5d0ba45c0d766dd56257d97702d3284b6f69efdd4c53ca981a0754cc0a139df0" +dependencies = [ + "anyhow", + "cranelift-codegen", + "gimli", + "object", + "target-lexicon", + "wasmparser 0.236.1", + "wasmtime-environ", + "wasmtime-internal-cranelift", + "winch-codegen", +] + +[[package]] +name = "wasmtime-internal-wit-bindgen" +version = "36.0.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41a64d5112c06f9d54b41e61f0b757d3a5a52361bf359f01131cc7cb8551ac73" +dependencies = [ + "anyhow", + "bitflags 2.11.1", + "heck", + "indexmap", + "wit-parser 0.236.1", +] + [[package]] name = "wasmtime-wasi" -version = "29.0.1" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8d1be69bfcab1bdac74daa7a1f9695ab992b9c8e21b9b061e7d66434097e0ca4" +checksum = "82e4772f39340104c70837d421c71c50364c185936f07eaee19e46cb0754c9e1" dependencies = [ "anyhow", "async-trait", @@ -5525,45 +5546,29 @@ dependencies = [ "futures", "io-extras", "io-lifetimes", - "rustix 0.38.44", + "rustix 1.1.4", "system-interface", - "thiserror 1.0.69", + "thiserror 2.0.18", "tokio", "tracing", - "trait-variant", "url", "wasmtime", + "wasmtime-wasi-io", "wiggle", - "windows-sys 0.59.0", + "windows-sys 0.60.2", ] [[package]] -name = "wasmtime-winch" -version = "29.0.1" +name = "wasmtime-wasi-io" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fdbabfb8f20502d5e1d81092b9ead3682ae59988487aafcd7567387b7a43cf8f" +checksum = "b1267c55a52d9ce27da6ff522ddb5b847e811cf477b0ef4c7c1155dd544c25ac" dependencies = [ "anyhow", - "cranelift-codegen", - "gimli", - "object 0.36.7", - "target-lexicon", - "wasmparser 0.221.3", - "wasmtime-cranelift", - "wasmtime-environ", - "winch-codegen", -] - -[[package]] -name = "wasmtime-wit-bindgen" -version = "29.0.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8358319c2dd1e4db79e3c1c5d3a5af84956615343f9f89f4e4996a36816e06e6" -dependencies = [ - "anyhow", - "heck", - "indexmap", - "wit-parser 0.221.3", + "async-trait", + "bytes", + "futures", + "wasmtime", ] [[package]] @@ -5646,14 +5651,14 @@ dependencies = [ [[package]] name = "wiggle" -version = "29.0.1" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b9af35bc9629c52c261465320a9a07959164928b4241980ba1cf923b9e6751d" +checksum = "3185c97adf4d5f4c0d2abfea7f0bdeb21b486970acd2cf19c7a7fd95308f1764" dependencies = [ "anyhow", "async-trait", "bitflags 2.11.1", - "thiserror 1.0.69", + "thiserror 2.0.18", "tracing", "wasmtime", "wiggle-macro", @@ -5661,24 +5666,23 @@ dependencies = [ [[package]] name = "wiggle-generate" -version = "29.0.1" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2cf267dd05673912c8138f4b54acabe6bd53407d9d1536f0fadb6520dd16e101" +checksum = "13a019367ecff91d714d8f6cba589c36d7b16195eff0598236f9ce5aaf8b811d" dependencies = [ "anyhow", "heck", "proc-macro2", "quote", - "shellexpand", "syn", "witx", ] [[package]] name = "wiggle-macro" -version = "29.0.1" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "08c5c473d4198e6c2d377f3809f713ff0c110cab88a0805ae099a82119ee250c" +checksum = "5e2f5a33059321aee91888c331b45de1d6e9f9d0f89ab88398ef1fda2d3ee1fb" dependencies = [ "proc-macro2", "quote", @@ -5719,20 +5723,22 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" [[package]] name = "winch-codegen" -version = "29.0.1" +version = "36.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f849ef2c5f46cb0a20af4b4487aaa239846e52e2c03f13fa3c784684552859c" +checksum = "82ea9625459ce35d6a4188cf0f07c9095cbb0e5afd86f711d63955bfc4216e64" dependencies = [ "anyhow", + "cranelift-assembler-x64", "cranelift-codegen", "gimli", "regalloc2", "smallvec", "target-lexicon", - "thiserror 1.0.69", - "wasmparser 0.221.3", - "wasmtime-cranelift", + "thiserror 2.0.18", + "wasmparser 0.236.1", "wasmtime-environ", + "wasmtime-internal-cranelift", + "wasmtime-internal-math", ] [[package]] @@ -5811,7 +5817,7 @@ version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d" dependencies = [ - "windows-targets", + "windows-targets 0.52.6", ] [[package]] @@ -5820,7 +5826,16 @@ version = "0.59.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" dependencies = [ - "windows-targets", + "windows-targets 0.52.6", +] + +[[package]] +name = "windows-sys" +version = "0.60.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb" +dependencies = [ + "windows-targets 0.53.5", ] [[package]] @@ -5838,14 +5853,31 @@ version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" dependencies = [ - "windows_aarch64_gnullvm", - "windows_aarch64_msvc", - "windows_i686_gnu", - "windows_i686_gnullvm", - "windows_i686_msvc", - "windows_x86_64_gnu", - "windows_x86_64_gnullvm", - "windows_x86_64_msvc", + "windows_aarch64_gnullvm 0.52.6", + "windows_aarch64_msvc 0.52.6", + "windows_i686_gnu 0.52.6", + "windows_i686_gnullvm 0.52.6", + "windows_i686_msvc 0.52.6", + "windows_x86_64_gnu 0.52.6", + "windows_x86_64_gnullvm 0.52.6", + "windows_x86_64_msvc 0.52.6", +] + +[[package]] +name = "windows-targets" +version = "0.53.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3" +dependencies = [ + "windows-link", + "windows_aarch64_gnullvm 0.53.1", + "windows_aarch64_msvc 0.53.1", + "windows_i686_gnu 0.53.1", + "windows_i686_gnullvm 0.53.1", + "windows_i686_msvc 0.53.1", + "windows_x86_64_gnu 0.53.1", + "windows_x86_64_gnullvm 0.53.1", + "windows_x86_64_msvc 0.53.1", ] [[package]] @@ -5854,48 +5886,96 @@ version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53" + [[package]] name = "windows_aarch64_msvc" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" +[[package]] +name = "windows_aarch64_msvc" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006" + [[package]] name = "windows_i686_gnu" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" +[[package]] +name = "windows_i686_gnu" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3" + [[package]] name = "windows_i686_gnullvm" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" +[[package]] +name = "windows_i686_gnullvm" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c" + [[package]] name = "windows_i686_msvc" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" +[[package]] +name = "windows_i686_msvc" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2" + [[package]] name = "windows_x86_64_gnu" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" +[[package]] +name = "windows_x86_64_gnu" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499" + [[package]] name = "windows_x86_64_gnullvm" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1" + [[package]] name = "windows_x86_64_msvc" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" +[[package]] +name = "windows_x86_64_msvc" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650" + [[package]] name = "winx" version = "0.36.4" @@ -5984,9 +6064,9 @@ dependencies = [ [[package]] name = "wit-parser" -version = "0.221.3" +version = "0.236.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "896112579ed56b4a538b07a3d16e562d101ff6265c46b515ce0c701eef16b2ac" +checksum = "16e4833a20cd6e85d6abfea0e63a399472d6f88c6262957c17f546879a80ba15" dependencies = [ "anyhow", "id-arena", @@ -5997,7 +6077,7 @@ dependencies = [ "serde_derive", "serde_json", "unicode-xid", - "wasmparser 0.221.3", + "wasmparser 0.236.1", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index a3c232827..a110a203f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -47,7 +47,7 @@ default-members = [ [workspace.package] version = "0.1.0" edition = "2021" -rust-version = "1.80" +rust-version = "1.88" authors = [] license = "Apache-2.0" repository = "https://github.com/chrishayuk/chuk-larql-rs" diff --git a/crates/larql-cli/Cargo.toml b/crates/larql-cli/Cargo.toml index 740cd3154..9418c04af 100644 --- a/crates/larql-cli/Cargo.toml +++ b/crates/larql-cli/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "CLI for LARQL knowledge graph extraction and querying" [[bin]] diff --git a/crates/larql-compute-metal/Cargo.toml b/crates/larql-compute-metal/Cargo.toml index 3ad2b7a92..d03ed2538 100644 --- a/crates/larql-compute-metal/Cargo.toml +++ b/crates/larql-compute-metal/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Metal GPU backend for LARQL. Implements `larql_compute::ComputeBackend` on Apple Silicon via `metal-rs` + custom MSL shaders. Decoupled from larql-compute so non-Mac hosts skip the build entirely." keywords = ["metal", "gpu", "apple-silicon", "matmul", "quantization"] categories = ["science"] diff --git a/crates/larql-compute/Cargo.toml b/crates/larql-compute/Cargo.toml index 59a82a1b1..a510dd271 100644 --- a/crates/larql-compute/Cargo.toml +++ b/crates/larql-compute/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Compute backend trait + CPU implementation for LARQL. GPU backends ship as sibling crates (larql-compute-metal, future larql-compute-vulkan / larql-compute-cuda)." keywords = ["matmul", "cpu", "blas", "quantization", "trait"] categories = ["science"] diff --git a/crates/larql-core/Cargo.toml b/crates/larql-core/Cargo.toml index 92a36ae44..95e2f8151 100644 --- a/crates/larql-core/Cargo.toml +++ b/crates/larql-core/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Core graph engine for LARQL — knowledge graphs extracted from neural network weights" keywords = ["knowledge-graph", "llm", "interpretability", "graph"] categories = ["data-structures", "science"] diff --git a/crates/larql-demos/Cargo.toml b/crates/larql-demos/Cargo.toml index a7739df3b..fb80d6291 100644 --- a/crates/larql-demos/Cargo.toml +++ b/crates/larql-demos/Cargo.toml @@ -11,6 +11,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Runnable demonstrations of larql's shipped capabilities" publish = false autoexamples = false # folders mirror the source crate; all declared below diff --git a/crates/larql-execution/Cargo.toml b/crates/larql-execution/Cargo.toml index ceac1a569..89904acd2 100644 --- a/crates/larql-execution/Cargo.toml +++ b/crates/larql-execution/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Execution-refusal semantics shared across LARQL's runtime crates. Zero larql-* deps." keywords = ["execution", "refusal", "runtime"] categories = ["data-structures"] diff --git a/crates/larql-factory/Cargo.toml b/crates/larql-factory/Cargo.toml index dc49e8ac0..b80112150 100644 --- a/crates/larql-factory/Cargo.toml +++ b/crates/larql-factory/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Vindex Factory recipe schema, build_id canonicaliser, and structural validator (docs/vindex-factory.md)" keywords = ["vindex", "factory", "recipe", "schema"] categories = ["data-structures", "encoding"] diff --git a/crates/larql-inference/Cargo.toml b/crates/larql-inference/Cargo.toml index 199f7b53d..0656b1adc 100644 --- a/crates/larql-inference/Cargo.toml +++ b/crates/larql-inference/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Transformer inference engine — forward pass, attention, FFN, layer norm from safetensors weights" keywords = ["transformer", "inference", "llm", "interpretability"] categories = ["science"] @@ -71,8 +72,8 @@ async-stream = "0.3" futures = "0.3" # WASM expert registry -wasmtime = { version = "29", default-features = false, features = ["cranelift", "runtime"] } -wasmtime-wasi = "29" +wasmtime = { version = "36.0.7", default-features = false, features = ["cranelift", "runtime"] } +wasmtime-wasi = "36.0.7" anyhow = "1" diff --git a/crates/larql-lql/Cargo.toml b/crates/larql-lql/Cargo.toml index d98df1c88..45d3ed382 100644 --- a/crates/larql-lql/Cargo.toml +++ b/crates/larql-lql/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "LQL parser, executor, and REPL for LARQL" [dependencies] diff --git a/crates/larql-models/Cargo.toml b/crates/larql-models/Cargo.toml index 9f81ce0e9..e10a210f0 100644 --- a/crates/larql-models/Cargo.toml +++ b/crates/larql-models/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Model architecture definitions for LARQL — traits, config parsing, tensor key mappings" keywords = ["transformer", "model-config", "llm", "architecture"] categories = ["data-structures"] diff --git a/crates/larql-python/Cargo.toml b/crates/larql-python/Cargo.toml index 4c0189a42..79ef5f406 100644 --- a/crates/larql-python/Cargo.toml +++ b/crates/larql-python/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Python bindings for LARQL knowledge graph engine and vindex" [lib] @@ -17,8 +18,8 @@ larql-kv = { path = "../larql-kv" } larql-models = { path = "../larql-models" } larql-vindex = { path = "../larql-vindex" } larql-lql = { path = "../larql-lql" } -pyo3 = { version = "0.24", features = ["extension-module"] } -numpy = "0.24" +pyo3 = { version = "0.29", features = ["extension-module"] } +numpy = "0.29" ndarray = "0.16" memmap2 = "0.9" serde = { workspace = true } diff --git a/crates/larql-python/src/lib.rs b/crates/larql-python/src/lib.rs index 36f47c785..c19a7a09d 100644 --- a/crates/larql-python/src/lib.rs +++ b/crates/larql-python/src/lib.rs @@ -40,7 +40,7 @@ fn parse_merge_strategy(s: &str) -> lq::MergeStrategy { // ── PyEdge ── -#[pyclass(name = "Edge")] +#[pyclass(name = "Edge", from_py_object)] #[derive(Clone)] pub struct PyEdge { inner: lq::Edge, @@ -209,7 +209,7 @@ impl PyEdge { // ── PyNode ── -#[pyclass(name = "Node")] +#[pyclass(name = "Node", from_py_object)] #[derive(Clone)] pub struct PyNode { inner: lq::core::node::Node, diff --git a/crates/larql-python/src/vindex.rs b/crates/larql-python/src/vindex.rs index 154e118cb..ac3488d89 100644 --- a/crates/larql-python/src/vindex.rs +++ b/crates/larql-python/src/vindex.rs @@ -156,7 +156,7 @@ fn is_content_token(tok: &str) -> bool { // ── PyDescribeEdge ── -#[pyclass(name = "DescribeEdge")] +#[pyclass(name = "DescribeEdge", from_py_object)] #[derive(Clone)] pub struct PyDescribeEdge { #[pyo3(get)] @@ -190,7 +190,7 @@ impl PyDescribeEdge { // ── PyRelation ── -#[pyclass(name = "Relation")] +#[pyclass(name = "Relation", from_py_object)] #[derive(Clone)] pub struct PyRelation { #[pyo3(get)] @@ -215,7 +215,7 @@ impl PyRelation { // ── PyFeatureMeta ── -#[pyclass(name = "FeatureMeta")] +#[pyclass(name = "FeatureMeta", from_py_object)] #[derive(Clone)] pub struct PyFeatureMeta { inner: FeatureMeta, @@ -261,7 +261,7 @@ impl PyFeatureMeta { // ── PyWalkHit ── -#[pyclass(name = "WalkHit")] +#[pyclass(name = "WalkHit", from_py_object)] #[derive(Clone)] pub struct PyWalkHit { inner_layer: usize, diff --git a/crates/larql-router-protocol/Cargo.toml b/crates/larql-router-protocol/Cargo.toml index a30effaa9..4d4f723a4 100644 --- a/crates/larql-router-protocol/Cargo.toml +++ b/crates/larql-router-protocol/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "gRPC protocol types for the larql-router self-assembling grid" [dependencies] diff --git a/crates/larql-router/Cargo.toml b/crates/larql-router/Cargo.toml index 38a7aab72..efe0a95d2 100644 --- a/crates/larql-router/Cargo.toml +++ b/crates/larql-router/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Layer-sharding router for distributed larql-server deployments" [lib] diff --git a/crates/larql-server/Cargo.toml b/crates/larql-server/Cargo.toml index db123fdec..35bfa5ab5 100644 --- a/crates/larql-server/Cargo.toml +++ b/crates/larql-server/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "HTTP server for vindex knowledge queries and inference" [lib] diff --git a/crates/larql-vindex-spec/Cargo.toml b/crates/larql-vindex-spec/Cargo.toml index 6a2ee7b06..459d80264 100644 --- a/crates/larql-vindex-spec/Cargo.toml +++ b/crates/larql-vindex-spec/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Public contract for the vindex on-disk format: Rust types, JSON Schema, validation thresholds. Zero larql-* deps." keywords = ["vindex", "spec", "schema", "manifest"] categories = ["data-structures", "encoding"] diff --git a/crates/larql-vindex/Cargo.toml b/crates/larql-vindex/Cargo.toml index 1bfaf3a4f..70d2e9f51 100644 --- a/crates/larql-vindex/Cargo.toml +++ b/crates/larql-vindex/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Vindex — the queryable model format. Storage, KNN index, build, load, mutate." keywords = ["transformer", "vindex", "knn", "interpretability"] categories = ["science"] diff --git a/crates/model-compute/Cargo.toml b/crates/model-compute/Cargo.toml index 3cc974590..731557634 100644 --- a/crates/model-compute/Cargo.toml +++ b/crates/model-compute/Cargo.toml @@ -4,6 +4,7 @@ version.workspace = true edition.workspace = true authors.workspace = true license.workspace = true +rust-version.workspace = true description = "Bounded-cost compute for neural-model pipelines: native Rust kernels (default) and wasmtime-hosted WASM modules (opt-in)" keywords = ["wasm", "kernel", "deterministic", "solver", "aot"] categories = ["wasm", "mathematics"] @@ -21,7 +22,7 @@ evalexpr = { version = "11", optional = true } chrono = { version = "0.4", optional = true, default-features = false, features = ["std", "clock"] } # Feature: wasm host -wasmtime = { version = "29", optional = true, default-features = false, features = ["cranelift", "runtime", "std"] } +wasmtime = { version = "36.0.7", optional = true, default-features = false, features = ["cranelift", "runtime", "std"] } [dev-dependencies] wat = "1" diff --git a/nix/README.md b/nix/README.md index 039d2ff2d..0fb88d151 100644 --- a/nix/README.md +++ b/nix/README.md @@ -53,7 +53,7 @@ The Nix development environment provides the following (from nixpkgs unstable): | Package | Purpose | |---------|---------| -| Rust (~1.92) | Compiler and cargo (well above `rust-version = "1.75"` minimum) | +| Rust (~1.92) | Compiler and cargo (above the `rust-version = "1.88"` minimum) | | OpenBLAS | BLAS backend for `ndarray` (Linux) | | Accelerate | BLAS backend (macOS, via Apple framework) | | protobuf | gRPC code generation for `larql-server` | From 76ee5f6d3a9820a59c975ad60641f6731d6819ac Mon Sep 17 00:00:00 2001 From: chrishayuk Date: Thu, 6 Aug 2026 00:33:48 +0100 Subject: [PATCH 2/5] ci: add workspace supply-chain gates, and re-enable larql-cli clippy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The per-crate workflows each cover fmt / check / clippy / test / coverage for one crate. Nothing looked at the dependency graph as a whole, so a RUSTSEC advisory against a transitive crate was invisible to CI — which is exactly how five wasmtime advisories and two pyo3 ones sat in a Cargo.lock nobody had reason to touch. `quality.yml` adds five jobs: audit cargo-audit over Cargo.lock. Vulnerabilities fail; the unmaintained/unsound warnings do not, because all four outstanding ones are pinned by upstream crates we cannot move, and a permanently red gate is one people learn to ignore. They still print, and deny.toml records why. deny cargo-deny, split into a four-way matrix so a licence failure and an advisory failure are distinguishable at a glance rather than both reading "cargo-deny failed". msrv `cargo check` at the toolchain named by the workspace's own `rust-version`, read out of Cargo.toml at run time so there is no second place to forget to bump. This is deliberately not `cargo msrv verify`: that bisects many toolchains to *discover* a minimum, and the only question CI needs answered is whether the number we already claim is true. proto-lint buf lint + buf build over the four gRPC schemas. mutants cargo-mutants on the PR diff, informational. The workflow has no `paths:` filter and runs weekly on a schedule. That is the point of it: advisories are published against code that has not changed, so a gate that only fires when Cargo.lock is edited cannot catch the class of problem that motivated it. deny.toml sets the licence allow-list from the licences actually present (every third-party crate in the graph declares an SPDX expression, so there is nothing to clarify from licence-file text). MPL-2.0 is the only non-permissive entry, carried by `colored` and `option-ext`; its copyleft is file-level and both are consumed unmodified, so Apache-2.0 distribution is unaffected. `bans.wildcards` is "warn" rather than "deny", and that is temporary. The workspace's crates depend on each other by bare `path` with no `version`, which cargo-deny counts as a wildcard, and its `allow-wildcard-paths` escape hatch only exempts crates marked `publish = false`. Giving each intra-workspace path dependency a `version` is required before any of these can be published anyway, so it belongs with the release work in ADR-0026, not here. buf.yaml lints BASIC minus the two rules that would require moving .proto files on disk and rewriting both crates' tonic_build include paths. STANDARD stays off for a stronger reason: it demands a dedicated `Request`/`Response` pair per RPC, which would rename GridService.Join's ServerMessage/RouterMessage, ExpertService's ExpertLayerInput/Output and the shared AdminAck — a change to generated Rust types and every call site, and not something to do as a side effect of adding a lint config. What BASIC does still enforce is schema content: field, message, enum and service naming, enum zero-values, reserved-field hygiene. That catches mistakes in new schemas without demanding a layout migration first. Separately, larql-cli's clippy step comes back. It was commented out on 2026-05-10 against ~82 pre-existing errors under default features and ~112 under `--no-default-features`. That backlog has since been cleared by other work: both feature shapes now report zero under `-D warnings`, so this needed no code changes at all, only the step. The feature split mirrors the Check steps above it, and `--no-deps` matches the other crates' workflows so a lint in a path dependency reds that dependency's workflow rather than this one. Verified locally: cargo-deny all four checks pass individually as the matrix runs them, cargo-audit exits 0, buf lint and buf build pass, `cargo +1.88.0 check --workspace --all-targets` passes, and clippy is clean on larql-cli in both feature shapes. The Linux and Windows cfg paths in larql-cli could not be checked here — cross-compiling needs a cross-gcc this machine lacks — so CI is the first real test of those six cfg sites. Closes #165 Closes #169 --- .github/workflows/larql-cli.yml | 26 +++- .github/workflows/quality.yml | 221 ++++++++++++++++++++++++++++++++ buf.yaml | 48 +++++++ deny.toml | 125 ++++++++++++++++++ 4 files changed, 414 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/quality.yml create mode 100644 buf.yaml create mode 100644 deny.toml diff --git a/.github/workflows/larql-cli.yml b/.github/workflows/larql-cli.yml index cfec2aaed..dba18ed11 100644 --- a/.github/workflows/larql-cli.yml +++ b/.github/workflows/larql-cli.yml @@ -104,12 +104,26 @@ jobs: if: runner.os == 'macOS' run: cargo check -p larql-cli --bins --tests - # Clippy is intentionally skipped: as of 2026-05-10 `larql-cli` - # carries ~82 pre-existing errors under default features and ~112 - # under `--no-default-features` (mostly `large_enum_variant` and - # `dead_code` on metal-only paths). Re-enable once that backlog - # is cleared; the other crates' workflows already enforce - # `clippy -- -D warnings`. + # Re-enabled 2026-08-06 (issue #169). The backlog this step was + # disabled for on 2026-05-10 — ~82 errors under default features and + # ~112 under `--no-default-features`, mostly `large_enum_variant` and + # `dead_code` on metal-only paths — has since been cleared by other + # work. Both feature shapes now report zero under `-D warnings`. + # + # `--no-deps` matches the other crates' workflows: it keeps the gate + # on larql-cli's own code, so a lint that fires in a path dependency + # reds that dependency's workflow rather than this one. + # + # The feature split mirrors the Check steps above, and for the same + # reason: `gpu` pulls in larql-compute-metal, which only exists on + # macOS. + - name: Clippy (CPU only) on Linux/Windows + if: runner.os != 'macOS' + run: cargo clippy -p larql-cli --bins --tests --no-default-features --no-deps -- -D warnings + + - name: Clippy (default features incl. gpu) on macOS + if: runner.os == 'macOS' + run: cargo clippy -p larql-cli --bins --tests --no-deps -- -D warnings - name: Tests (CPU only) on Linux/Windows if: runner.os != 'macOS' diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml new file mode 100644 index 000000000..c441ed37c --- /dev/null +++ b/.github/workflows/quality.yml @@ -0,0 +1,221 @@ +# Workspace-level quality and supply-chain gates. +# +# The per-crate workflows (larql-*.yml) each cover fmt / check / clippy / +# test / coverage for one crate. Nothing there looks at the dependency +# graph as a whole, so until this workflow existed a RUSTSEC advisory +# against a transitive crate was invisible to CI. See issue #165. +# +# Jobs: +# audit — RustSec advisory scan of Cargo.lock (blocking) +# deny — licences, advisories, sources, bans (blocking) +# msrv — the declared rust-version really compiles (blocking) +# proto-lint — buf lint over the four gRPC schemas (blocking) +# mutants — mutation testing on the PR diff (informational) +# +# NOTE ON `schedule`: this workflow deliberately has no `paths:` filter and +# runs weekly. Advisories are published against code that has not changed — +# the wasmtime and pyo3 findings that motivated #165 sat in a Cargo.lock +# nobody had touched for months. A workflow that only fires when +# Cargo.lock changes cannot catch that class of problem. + +name: quality + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + # Mondays 06:00 UTC — a fresh advisory-db scan against unchanged code. + - cron: '0 6 * * 1' + workflow_dispatch: {} + +permissions: + contents: read + +jobs: + audit: + name: cargo-audit + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - uses: actions/checkout@v7 + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - name: Install cargo-audit + uses: taiki-e/install-action@cargo-audit + + # Vulnerabilities fail the build. Unmaintained/unsound *warnings* do + # not: the four currently outstanding (number_prefix, paste, + # rustls-pemfile, scc) are all pinned by upstream crates we do not + # control, so failing on them would mean a permanently red gate that + # people learn to ignore. They are still printed in the log, and the + # rationale for each is recorded in deny.toml. + - name: Scan Cargo.lock for advisories + run: cargo audit --color always + + deny: + name: cargo-deny · ${{ matrix.check }} + runs-on: ubuntu-latest + timeout-minutes: 15 + strategy: + fail-fast: false + matrix: + # Split so a licence failure and an advisory failure are + # distinguishable at a glance in the checks list. + check: [advisories, licenses, bans, sources] + steps: + - uses: actions/checkout@v7 + + - name: cargo-deny ${{ matrix.check }} + uses: EmbarkStudios/cargo-deny-action@v2 + with: + command: check ${{ matrix.check }} + + msrv: + # Named without the version: a job-level `name` cannot reference `steps`, + # and hardcoding a number here would be a second place to forget to bump. + name: MSRV (declared rust-version) + runs-on: ubuntu-latest + timeout-minutes: 45 + steps: + - uses: actions/checkout@v7 + + # Read the declared MSRV out of Cargo.toml rather than hardcoding it + # here, so bumping rust-version in one place updates the gate too. + - name: Read declared rust-version + id: msrv + run: | + version=$(sed -n 's/^rust-version = "\(.*\)"/\1/p' Cargo.toml | head -1) + if [ -z "$version" ]; then + echo "::error::no rust-version found in workspace Cargo.toml" + exit 1 + fi + echo "version=$version" >> "$GITHUB_OUTPUT" + echo "declared MSRV: $version" + + - name: Install Rust ${{ steps.msrv.outputs.version }} + uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ steps.msrv.outputs.version }} + + - name: Install OpenBLAS + run: | + sudo apt-get update + sudo apt-get install -y libopenblas-dev pkg-config + + - name: Cache cargo registry + build artefacts + uses: actions/cache@v6 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + key: ${{ runner.os }}-cargo-msrv-${{ steps.msrv.outputs.version }}-${{ hashFiles('**/Cargo.lock') }} + restore-keys: | + ${{ runner.os }}-cargo-msrv-${{ steps.msrv.outputs.version }}- + + # This is `cargo check` at the pinned toolchain rather than + # `cargo msrv verify`. cargo-msrv bisects across many toolchains to + # *discover* the minimum; we already know what we claim, and the only + # question CI needs answered is whether the claim is true. One pinned + # check answers it in a fraction of the time. + # + # `--locked` matters: without it cargo may resolve a newer dependency + # than Cargo.lock pins and the job would test a graph nobody ships. + - name: Check workspace at declared MSRV + run: cargo check --workspace --all-targets --locked + + proto-lint: + name: buf lint + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v7 + + - name: Install buf + uses: bufbuild/buf-action@v1 + with: + setup_only: true + + - name: Lint gRPC schemas + run: buf lint + + # Catches a malformed schema that lint alone would not (bad imports, + # duplicate field numbers, unresolvable types). + - name: Build descriptor set + run: buf build --output /dev/null + + mutants: + name: cargo-mutants (informational) + runs-on: ubuntu-latest + timeout-minutes: 45 + # PR-only: --in-diff needs a base to diff against, and a full-workspace + # mutation run is many hours of compute. + if: github.event_name == 'pull_request' + continue-on-error: true + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - name: Install cargo-mutants + uses: taiki-e/install-action@cargo-mutants + + - name: Install OpenBLAS + run: | + sudo apt-get update + sudo apt-get install -y libopenblas-dev pkg-config + + - name: Compute PR diff + run: | + git diff "origin/${{ github.base_ref }}...HEAD" > /tmp/pr.diff + echo "diff is $(wc -l < /tmp/pr.diff) lines" + + # This job is a signal, not a gate, and it is capped twice over: + # `--in-diff` restricts mutants to lines the PR touched, and + # `timeout-minutes: 45` bounds the job. + # + # Read a *timed-out* run as "incomplete", never as "clean". If the job + # hits the wall clock the runner kills this step and the summary below + # never prints — the only evidence is the job's own timeout status. + # `--no-shuffle` at least makes the mutants it did get through a + # deterministic prefix rather than a random sample, and the report + # upload runs `if: always()` so partial results survive. + - name: Mutation-test the diff + run: | + set +e + cargo mutants --in-diff /tmp/pr.diff --timeout 120 --no-shuffle + echo "cargo-mutants exit status: $?" + + # Summarise from the per-outcome text files rather than + # outcomes.json — these filenames are cargo-mutants' stable + # surface, and one line per mutant is what a reviewer wants in + # the log anyway. + echo "--- mutation summary ---" + for f in caught missed timeout unviable; do + path="mutants.out/$f.txt" + if [ -f "$path" ]; then + printf '%5d %s\n' "$(wc -l < "$path")" "$f" + fi + done + + if [ -s mutants.out/missed.txt ]; then + echo + echo "Mutants that survived — the tests did not notice these edits:" + cat mutants.out/missed.txt + fi + exit 0 + + - name: Upload mutants report + if: always() + uses: actions/upload-artifact@v7 + with: + name: mutants-report + path: mutants.out/ + if-no-files-found: ignore diff --git a/buf.yaml b/buf.yaml new file mode 100644 index 000000000..bd9b8a1c6 --- /dev/null +++ b/buf.yaml @@ -0,0 +1,48 @@ +# buf configuration for the workspace's gRPC schemas. +# +# Linted in CI by `.github/workflows/quality.yml`. Two modules, one per crate +# that owns .proto files: +# crates/larql-router-protocol/proto — larql.grid.v1, larql.shard.v1, +# larql.expert.v1 +# crates/larql-server/proto — vindex +version: v2 + +modules: + - path: crates/larql-router-protocol/proto + - path: crates/larql-server/proto + +lint: + use: + - BASIC + except: + # Both remaining BASIC rules are about *where files sit on disk*, not + # about whether a schema is well-formed, and both would require moving + # the .proto files: + # + # PACKAGE_DIRECTORY_MATCH — wants larql/grid/v1/grid.proto rather than + # proto/grid.proto, for all four schemas. + # DIRECTORY_SAME_PACKAGE — wants the three larql.*.v1 packages split + # into one directory each, instead of sharing proto/. + # + # Moving them means rewriting the `tonic_build` include paths in both + # crates' build.rs, and the layout buf wants is only load-bearing if + # these schemas are ever published to a buf registry. Nothing here + # depends on it today. + # + # Everything BASIC actually checks about schema content — field, message, + # enum and service naming, enum zero-values, reserved-field hygiene — + # stays enforced, which is the point: it catches mistakes in *new* + # schemas without demanding a layout migration first. + - PACKAGE_DIRECTORY_MATCH + - DIRECTORY_SAME_PACKAGE + + # Deliberately NOT enabling the STANDARD category. It requires every RPC to + # take a dedicated `Request`/`Response` pair, which would + # rename GridService.Join's ServerMessage/RouterMessage, ExpertService's + # ExpertLayerInput/Output, and the shared AdminAck — changing the generated + # Rust types and every call site. Worth doing as its own change, not as a + # side effect of a lint config. + +breaking: + use: + - FILE diff --git a/deny.toml b/deny.toml new file mode 100644 index 000000000..2da24fe29 --- /dev/null +++ b/deny.toml @@ -0,0 +1,125 @@ +# cargo-deny configuration for the larql workspace. +# +# Checked in CI by `.github/workflows/quality.yml`. Four independent checks run: +# advisories — RustSec database scan (vulnerabilities are hard failures) +# licenses — SPDX allow-list; anything outside it fails +# bans — duplicate-version and banned-crate policy +# sources — registries and git remotes crates may come from +# +# Schema targets cargo-deny 0.20.x. + +[graph] +# Evaluate every target the workspace actually supports, so a Windows-only or +# Linux-only dependency cannot smuggle in an unreviewed licence or advisory. +targets = [ + "aarch64-apple-darwin", + "x86_64-apple-darwin", + "x86_64-unknown-linux-gnu", + "aarch64-unknown-linux-gnu", + "x86_64-pc-windows-msvc", +] +all-features = true + +[output] +feature-depth = 1 + +# --------------------------------------------------------------------------- +# Advisories +# --------------------------------------------------------------------------- +[advisories] +db-urls = ["https://github.com/rustsec/advisory-db"] +# Vulnerabilities and unmaintained/unsound notices are all errors by default in +# 0.20; everything we cannot act on is listed explicitly below with a reason. +yanked = "deny" + +ignore = [ + # --- unmaintained, pinned by upstream crates we do not control ----------- + # number_prefix <- indicatif 0.17. No maintained fork; indicatif has not + # cut a release that drops it. Formatting-only crate, no untrusted input. + { id = "RUSTSEC-2025-0119", reason = "number_prefix is pulled by indicatif 0.17; no upstream release drops it yet" }, + # paste <- tokenizers 0.21, metal 0.29, macro_rules_attribute. Proc-macro + # that expands at compile time only; nothing of it survives into a binary. + { id = "RUSTSEC-2024-0436", reason = "paste is a compile-time proc-macro pulled by tokenizers/metal; no runtime surface" }, + # rustls-pemfile <- axum-server 0.7. Superseded by rustls-pki-types, which + # axum-server has not migrated to. + { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is pulled by axum-server 0.7; upstream has not migrated to rustls-pki-types" }, + + # NOTE: RUSTSEC-2026-0205 (scc 2.4.0, unsound `Array::insert`) is *not* + # listed here. cargo-deny's dependency graph does not reach it, so an + # ignore entry would only produce an `advisory-not-detected` warning. + # `cargo audit`, which scans Cargo.lock entry-by-entry, does report it as + # a warning. It stays a warning deliberately: scc arrives solely as a + # dev-dependency of serial_test, which pins `scc ^2` while the fix landed + # in scc 3.x. It is never linked into a shipped artefact. +] + +# --------------------------------------------------------------------------- +# Licenses +# --------------------------------------------------------------------------- +# The workspace itself ships under Apache-2.0. Everything below is either +# permissive or (MPL-2.0) file-level copyleft that we satisfy by not modifying +# the upstream files. +[licenses] +allow = [ + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "MIT", + "MIT-0", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "Zlib", + "0BSD", + "BSL-1.0", # clipboard-win, error-code, ryu (as an OR alternative) + "CC0-1.0", # dunce (offered alongside MIT-0/Apache-2.0) + "Unlicense", # offered alongside MIT by the `byteorder` family + "Unicode-3.0", # the ICU4X crates behind idna/url + "CDLA-Permissive-2.0", # webpki-roots: a certificate *data* set, not code + "MPL-2.0", # colored, option-ext — see note below +] +# `confidence-threshold` governs fuzzy matching of licence *files* for crates +# that ship text rather than an SPDX expression. Every crate in the current +# graph declares an expression, so this only guards future additions. +confidence-threshold = 0.93 + +# On MPL-2.0, the only non-permissive licence in the allow-list above. +# It is file-level copyleft: the obligation to publish source attaches to +# modified MPL-licensed *files*, not to anything that links against them. +# The two crates carrying it — `colored` (terminal colour codes) and +# `option-ext` (an Option extension trait, via dirs-sys) — are consumed +# unmodified from crates.io, so Apache-2.0 distribution of larql is +# unaffected. If either is ever vendored and patched, that patch must ship +# under MPL-2.0. +# +# No `[[licenses.clarify]]` entries are needed: every crate in the graph +# declares an SPDX expression in its manifest, so there is nothing to +# disambiguate from licence-file text. + +# --------------------------------------------------------------------------- +# Bans +# --------------------------------------------------------------------------- +[bans] +multiple-versions = "warn" # informational: the graph legitimately carries + # several windows-sys / syn generations +highlight = "all" + +# `wildcards` is "warn", not "deny", and that is a deliberate, temporary +# setting. The workspace's own crates depend on each other by bare `path` +# with no `version` key, which cargo-deny counts as a wildcard. Its +# `allow-wildcard-paths` escape hatch does not apply here because it only +# exempts crates marked `publish = false`, and all but larql-demos are +# publishable. The real fix is to give each intra-workspace path dependency +# a `version` alongside its `path` — required anyway before any of these can +# be published to crates.io, and therefore owned by the release work in +# ADR-0026 rather than by this security pass. Flip this to "deny" once that +# lands. +wildcards = "warn" + +# --------------------------------------------------------------------------- +# Sources +# --------------------------------------------------------------------------- +[sources] +unknown-registry = "deny" +unknown-git = "deny" +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +allow-git = [] From d7a427be1d7381384b3b307701b831aa574f3d47 Mon Sep 17 00:00:00 2001 From: chrishayuk Date: Thu, 6 Aug 2026 01:04:18 +0100 Subject: [PATCH 3/5] fix: clear the lints the MSRV bump unsuppressed, and split the MSRV job by platform MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two CI failures, both consequences of the previous commit rather than of anything in the crates they surfaced in. **clippy in larql-kv** (all three platforms, and larql-vindex too) Clippy gates some lints on the declared `rust-version`: it will not suggest an API that does not exist at your stated minimum. At 1.80 it stayed quiet about `is_multiple_of` (stabilised 1.87) and `is_none_or` (1.82). Moving the declaration to 1.88 makes both fair game, so three lints in larql-kv — a crate this branch never edited — went from suppressed to `-D warnings` errors: boundary_kv/engine.rs:140 manual_is_multiple_of markov_residual/compute.rs:348 unnecessary_map_or turbo_quant/engine.rs:256 manual_is_multiple_of `compute.rs` is the instructive one: it carried a comment reading "`is_none_or` is MSRV 1.82; project pins MSRV 1.80" — the workaround existed *because* of the stale pin, so raising the pin retires both the code and the comment. Both `is_multiple_of` rewrites are exact, not approximate. `x % n == 0` and `x.is_multiple_of(n)` differ only when `n == 0`, where the former panics and the latter returns `x == 0`; neither divisor can be zero. `chunk_tokens()` ends in `.max(1)` and has a test pinning that floor, and `detect_head_dim` draws `hd` from the literal `[256, 128, 64, 32]`. larql-vindex was failing on the *same three* lints, not a fourth problem: its workflow lints without `--no-deps`, so it reports its path dependencies' lints as its own. The wider lesson is about scope. I checked clippy on the crates whose files I had edited, but a `rust-version` change is a workspace-wide lint change — the blast radius is every crate, not the diff. All 15 of CI's clippy invocations now pass locally. **MSRV job** Not an MSRV problem at all: `--workspace --all-targets` on a Linux runner tried to build `larql-compute-metal`'s examples, which `extern crate blas_src` unconditionally while the crate takes `blas-src` only under `cfg(target_os = "macos")`. They cannot compile on Linux at any toolchain, which is why that crate's own workflow is macOS-only. This job was simply the first Linux job to ever attempt a workspace-wide `--all-targets` build. Rather than drop `--all-targets` — which would silently stop MSRV-checking every example in the workspace — the job is now a two-arm matrix: Linux checks the workspace minus that crate, covering the cfg(linux) OpenBLAS paths, and macOS checks the crate Linux cannot. Between them every member crate is gated, with no silent hole. Verified: all 15 CI clippy invocations, `cargo fmt --all --check`, `cargo test -p larql-kv` (861 passing), and both matrix arms at 1.88 with `--locked`. --- .github/workflows/quality.yml | 28 ++++++++++++++++--- .../src/engines/boundary_kv/engine.rs | 2 +- .../src/engines/markov_residual/compute.rs | 9 +++--- .../src/engines/turbo_quant/engine.rs | 2 +- 4 files changed, 31 insertions(+), 10 deletions(-) diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c441ed37c..888ae16ae 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -77,9 +77,28 @@ jobs: msrv: # Named without the version: a job-level `name` cannot reference `steps`, # and hardcoding a number here would be a second place to forget to bump. - name: MSRV (declared rust-version) - runs-on: ubuntu-latest + name: MSRV · ${{ matrix.os }} + runs-on: ${{ matrix.os }} timeout-minutes: 45 + strategy: + fail-fast: false + # Split by platform because no single runner can build the whole + # workspace. `larql-compute-metal` takes `blas-src` only under + # `cfg(target_os = "macos")` while its examples `extern crate blas_src` + # unconditionally, so on Linux they fail to resolve at *any* toolchain — + # nothing to do with the MSRV. Its own workflow is macOS-only for the + # same reason. + # + # So: Linux checks the workspace minus that crate (covering the + # cfg(linux) OpenBLAS paths in larql-compute and larql-inference), and + # macOS checks the crate Linux cannot. Between them every member crate + # is MSRV-gated with no silent hole. + matrix: + include: + - os: ubuntu-latest + args: --workspace --all-targets --exclude larql-compute-metal + - os: macos-14 + args: -p larql-compute-metal --all-targets steps: - uses: actions/checkout@v7 @@ -102,6 +121,7 @@ jobs: toolchain: ${{ steps.msrv.outputs.version }} - name: Install OpenBLAS + if: runner.os == 'Linux' run: | sudo apt-get update sudo apt-get install -y libopenblas-dev pkg-config @@ -125,8 +145,8 @@ jobs: # # `--locked` matters: without it cargo may resolve a newer dependency # than Cargo.lock pins and the job would test a graph nobody ships. - - name: Check workspace at declared MSRV - run: cargo check --workspace --all-targets --locked + - name: Check at declared MSRV + run: cargo check ${{ matrix.args }} --locked proto-lint: name: buf lint diff --git a/crates/larql-kv/src/engines/boundary_kv/engine.rs b/crates/larql-kv/src/engines/boundary_kv/engine.rs index c3e8ae61d..8b3a6c789 100644 --- a/crates/larql-kv/src/engines/boundary_kv/engine.rs +++ b/crates/larql-kv/src/engines/boundary_kv/engine.rs @@ -137,7 +137,7 @@ impl BoundaryKvEngine { /// True iff `abs_position` (the just-completed step) lands on a chunk /// boundary. Position 0 is never a boundary. fn at_chunk_boundary(&self) -> bool { - self.abs_position > 0 && self.abs_position % self.chunk_tokens() == 0 + self.abs_position > 0 && self.abs_position.is_multiple_of(self.chunk_tokens()) } /// The archive chain id frames are currently emitted under. diff --git a/crates/larql-kv/src/engines/markov_residual/compute.rs b/crates/larql-kv/src/engines/markov_residual/compute.rs index 6ede1cd6c..242b52202 100644 --- a/crates/larql-kv/src/engines/markov_residual/compute.rs +++ b/crates/larql-kv/src/engines/markov_residual/compute.rs @@ -342,10 +342,11 @@ pub(crate) fn markov_inplace_kv_enabled() -> bool { } fn markov_walk_kv_diag_layer(layer: usize) -> bool { - // `is_none_or` is MSRV 1.82; project pins MSRV 1.80. Equivalent - // semantics: env-var absent → true (diag applies to all layers), - // env-var present → check the comma-list. - read_markov_env("LARQL_MARKOV_WALK_KV_LAYERS").map_or(true, |spec| layer_in_spec(&spec, layer)) + // Env-var absent → true (diag applies to all layers); present → check + // the comma-list. This was a `map_or(true, ..)` while the workspace + // pinned MSRV 1.80, since `is_none_or` stabilised in 1.82; the MSRV is + // 1.88 now, so it says what it means. + read_markov_env("LARQL_MARKOV_WALK_KV_LAYERS").is_none_or(|spec| layer_in_spec(&spec, layer)) } fn layer_in_spec(spec: &str, layer: usize) -> bool { diff --git a/crates/larql-kv/src/engines/turbo_quant/engine.rs b/crates/larql-kv/src/engines/turbo_quant/engine.rs index de1ab812e..5b6239981 100644 --- a/crates/larql-kv/src/engines/turbo_quant/engine.rs +++ b/crates/larql-kv/src/engines/turbo_quant/engine.rs @@ -253,7 +253,7 @@ impl CompressedLayer { pub(super) fn detect_head_dim(kv_dim: usize) -> usize { for &hd in &[256usize, 128, 64, 32] { - if kv_dim % hd == 0 { + if kv_dim.is_multiple_of(hd) { return hd; } } From 56afa00f6730b818432e9cd6461b4429b1c6ba27 Mon Sep 17 00:00:00 2001 From: chrishayuk Date: Fri, 7 Aug 2026 00:55:56 +0100 Subject: [PATCH 4/5] fix(inference): gate decode_vs_prefill on macOS, not just the gpu feature MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The new MSRV job builds `--workspace --all-targets` on ubuntu. Feature unification turns `larql-inference/gpu` on for that build, which satisfies the example's `required-features = ["gpu"]`, so cargo compiles it on Linux — where `larql_compute_metal::MetalBackend` is `#[cfg(target_os = "macos")]` and therefore absent: error[E0433]: failed to resolve: could not find `MetalBackend` in `larql_compute_metal` `required-features` cannot express a target_os constraint, so the example has to carry the cfg itself. This mirrors the sibling `cpu_gpu_diag.rs`, which already gates every item on `all(feature = "gpu", target_os = "macos")` and provides a stub `main` elsewhere — that example passes the same ubuntu job today. Pre-existing, not introduced by the MSRV bump; the job is simply the first Linux build that reaches this example. --- .../examples/decode_vs_prefill.rs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/crates/larql-inference/examples/decode_vs_prefill.rs b/crates/larql-inference/examples/decode_vs_prefill.rs index c8b5aaae5..12cb2026f 100644 --- a/crates/larql-inference/examples/decode_vs_prefill.rs +++ b/crates/larql-inference/examples/decode_vs_prefill.rs @@ -24,18 +24,27 @@ //! cargo run --release --features metal -p larql-inference \ //! --example decode_vs_prefill -- [prompt] +#[cfg(all(feature = "gpu", target_os = "macos"))] extern crate blas_src; +#[cfg(all(feature = "gpu", target_os = "macos"))] use std::path::PathBuf; +#[cfg(all(feature = "gpu", target_os = "macos"))] use std::time::Instant; +#[cfg(all(feature = "gpu", target_os = "macos"))] use larql_compute::{ComputeBackend, DecodeBackend}; +#[cfg(all(feature = "gpu", target_os = "macos"))] use larql_inference::layer_graph::generate::generate; +#[cfg(all(feature = "gpu", target_os = "macos"))] use larql_inference::layer_graph::CachedLayerGraph; +#[cfg(all(feature = "gpu", target_os = "macos"))] use larql_inference::wrap_chat_prompt; +#[cfg(all(feature = "gpu", target_os = "macos"))] const DEFAULT_EXAMPLE_KV_CACHE_MAX_SEQ: usize = 4096; +#[cfg(all(feature = "gpu", target_os = "macos"))] fn main() -> Result<(), Box> { let mut args = std::env::args().skip(1); let vindex_path = PathBuf::from( @@ -322,6 +331,7 @@ fn main() -> Result<(), Box> { // ── Helpers ───────────────────────────────────────────────────────────────── +#[cfg(all(feature = "gpu", target_os = "macos"))] fn build_layers<'a>( weights: &'a larql_inference::model::ModelWeights, index: &'a larql_vindex::VectorIndex, @@ -358,6 +368,7 @@ fn build_layers<'a>( ) } +#[cfg(all(feature = "gpu", target_os = "macos"))] fn compare(a: &[f32], b: &[f32]) -> (f32, f32, f32, f32) { let mut dot = 0.0f64; let mut an = 0.0f64; @@ -381,3 +392,8 @@ fn compare(a: &[f32], b: &[f32]) -> (f32, f32, f32, f32) { }; (cos, max_abs, an.sqrt() as f32, bn.sqrt() as f32) } + +#[cfg(not(all(feature = "gpu", target_os = "macos")))] +fn main() { + eprintln!("decode_vs_prefill requires `--features metal` on macOS."); +} From 47c704ba3baaf994e4566aafe3ccf60fc76cd7e2 Mon Sep 17 00:00:00 2001 From: chrishayuk Date: Fri, 7 Aug 2026 01:50:07 +0100 Subject: [PATCH 5/5] fix(cli): gate shannon decode-diff on macOS, not just the gpu feature MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Third instance of the same defect class in this branch's blast radius, and the one that is breaking `main`: `shannon-verify` passed on 2a7c4083 and fails on e7ae7d26, where #208 re-homed the decode-pass diff into `shannon_trace/decode_diff.rs`. error[E0433]: cannot find `MetalBackend` in `larql_compute_metal` --> crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs:71:44 `feature = "gpu"` compiles on every target, but `larql_compute_metal::MetalBackend` is `#[cfg(target_os = "macos")]`. A Linux release build with the feature on therefore reaches for a type that is not there. Cargo cannot express "this feature, on this OS" — not via `required-features`, not via a feature predicate — so the call site has to carry the target_os itself. Same shape as the `decode_vs_prefill` gate earlier in this branch, and the same shape as `cpu_gpu_diag.rs`, which has always carried it and has always passed. The refusal message now names the OS as well as the feature, since a Linux build with `--features gpu` now lands there rather than failing to compile. Checked both ways locally: `-p larql-cli --features gpu` on macOS takes the real path, and the CPU-only build takes the refusal arm. --- .../src/commands/primary/shannon_trace/decode_diff.rs | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs b/crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs index 2afe673b2..b120e0ec1 100644 --- a/crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs +++ b/crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs @@ -29,17 +29,22 @@ use larql_inference::residual_diff::{compare_captures, ParityThreshold, Residual use super::DecodeDiffArgs; pub fn run_decode_diff(args: DecodeDiffArgs) -> Result<(), Box> { - #[cfg(not(feature = "gpu"))] + // The `gpu` feature alone is not enough: it compiles on every target, + // but `larql_compute_metal::MetalBackend` is `#[cfg(target_os = + // "macos")]`, so a Linux build with the feature on reaches for a type + // that is not there. Cargo cannot express "this feature, on this OS", + // so the call site carries it. + #[cfg(not(all(feature = "gpu", target_os = "macos")))] { let _ = args; return Err(format!( "decode-diff compares the CPU and Metal backends, so it needs the \ - `gpu` feature; rebuild with --features gpu" + `gpu` feature on macOS; rebuild with --features gpu on a Mac" ) .into()); } - #[cfg(feature = "gpu")] + #[cfg(all(feature = "gpu", target_os = "macos"))] { let vindex = &args.vindex; if !vindex.is_dir() {