deps(deps): bump etcetera from 0.8.0 to 0.11.0

[dependabot]

Bumps etcetera from 0.8.0 to 0.11.0.

Release notes

Sourced from etcetera's releases.

v0.11.0

What's Changed

• chore(README): fix documentation link by @​hasezoey in lunacookies/etcetera#34
• Small docs fix that confused me when I was looking at example on docs.rs by @​Ac5000 in lunacookies/etcetera#38
• crate: use std::env::home_dir, bump to edition 2024, raise MSRV to 1.87 by @​utkarshgupta137 in lunacookies/etcetera#39

New Contributors

• @​hasezoey made their first contribution in lunacookies/etcetera#34
• @​Ac5000 made their first contribution in lunacookies/etcetera#38

Full Changelog: lunacookies/etcetera@v0.10.0...v0.11.0

v0.10.0

What's Changed

• Allow compatibility with recent versions of home in lunacookies/etcetera#31
• Support non-UTF8 dirs in lunacookies/etcetera#32
• Add note about MSRV & fix CI in lunacookies/etcetera#33

This version raises MSRV to 1.81.0. But if you pin home to <0.5.11 in Cargo.lock, then the MSRV will be 1.70.0.

Full Changelog: lunacookies/etcetera@v0.9.0...v0.10.0

v0.9.0

What's Changed

• Make macOS bundle ID match the directories crate in lunacookies/etcetera#22
• Make the traits dyn-compatible in lunacookies/etcetera#25
• windows-sys: bump & replace SHGetFolderPathW with SHGetKnownFolderPath in lunacookies/etcetera#30
• crate: bump to edition 2021 & raise MSRV to 1.70.0 in lunacookies/etcetera#30

Full Changelog: lunacookies/etcetera@v0.8.0...v0.9.0

Commits

• 07b3f54 v0.11.0
• 064381b Merge pull request #39 from utkarshgupta137/home_dir
• f85260a crate: use std::env::home_dir, bump to edition 2024, raise MSRV to 1.87
• 62ed3be Merge pull request #38 from Ac5000/doc-change
• d0e1f90 Small docs fix that confused me when I was looking at example on docs.rs
• bf6fc7f Merge pull request #34 from hasezoey/fixREADME
• 4d2b3cd chore(README): fix documentation link
• 85d0dc2 v0.10.0
• 26338a9 Merge pull request #33 from utkarshgupta137/master
• c073fa0 Add note about MSRV & fix CI
• Additional commits viewable in compare view

[covenant-talos]

Walkthrough

This PR bumps the etcetera dependency from 0.8.0 to 0.11.0, as requested by Dependabot. Cargo.toml updates the version spec, and Cargo.lock resolves the new etcetera 0.11.0 crate plus associated transitive changes (notably windows-sys bumps from 0.59.0 to 0.60.2/0.61.2 across several crates). The upstream releases include dyn-compatible traits, non-UTF8 dir support, a macOS bundle ID fix, a switch to std::env::home_dir, edition 2024, and a raised MSRV to 1.87.

Changes

Cohort / File(s)	Change Summary
Manifest update / Cargo.toml	Bumps etcetera version spec from 0.8 to 0.11.
Lockfile resolution / Cargo.lock	Adds etcetera 0.11.0, updates dependents (basilica crates, sqlx retains 0.8.0) and bumps transitive windows-sys versions across multiple crates.

Estimated review effort: 1/5 (automated dependency bump with lockfile churn).

Instant overview - a deep technical review follows as a separate comment.

[covenant-talos]

PR #548: deps(deps): bump etcetera from 0.8.0 to 0.11.0

Summary

Dependabot bumps the workspace-level etcetera dependency from 0.8 to 0.11 (Cargo.toml: -etcetera = "0.8" / +etcetera = "0.11"), skipping two major releases. The lockfile gains etcetera 0.11.0 (deps: cfg-if, windows-sys 0.61.2), two workspace consumers are re-pointed at it, and several packages have their windows-sys edges re-resolved from 0.59.0 to 0.60.2/0.61.2. No Rust source changes are included, despite the bump spanning three semver-major releases with documented breaking changes (dyn-compatible traits in 0.9, macOS bundle-ID path alignment in 0.9, non-UTF8 dir support in 0.10, edition 2024 + MSRV 1.87 in 0.11).

Architecture

No structural impact. This is a dependency-only change; no source or component boundaries change.

Issues Found

CRITICAL Issues (Must Fix Before Merge)

None found.

HIGH Severity Issues (Advised to Fix Before Merge)

None found.

MEDIUM Severity Issues (Optional to Fix Before Merge)

1. Verify the toolchain floor of 1.87 (edition 2024) against rust-toolchain.toml, CI images, and release Dockerfiles
   Operability | MEDIUM | Effort: quick win

   • Why: The release notes quoted in the PR description state for v0.11.0: "crate: use std::env::home_dir, bump to edition 2024, raise MSRV to 1.87". Edition 2024 hard-requires rustc ≥ 1.85 and this crate declares 1.87. If any pinned toolchain in this repo (e.g., rust-toolchain.toml, FROM rust:1.8x-* Docker base images used for release builds) is older, the build fails outright. PR CI alone may not exercise the release Docker build.
   • How: Check the effective toolchain everywhere the workspace compiles: grep -r channel rust-toolchain*, and the rust: tags in all Dockerfiles. Bump any pin < 1.87, or hold this PR.

2. Assess the macOS config-path change shipped in etcetera 0.9 before releasing the CLI
   Functional Correctness | MEDIUM | Effort: quick win to assess; involved if migration is needed

   • Why: The PR description's changelog for v0.9.0 includes "Make macOS bundle ID match the directories crate" (Make macOS bundle ID match the directories crate lunacookies/etcetera#22). That changes the directory AppStrategy produces on macOS (~/Library/Application Support/<bundle id>). If basilica-cli or the SDK crate (the two consumers re-pointed in Cargo.lock) resolve their config/credentials directory via AppStrategy on macOS, existing users' config/API-key files will silently not be found after upgrade — a "logged out / lost config" regression that CI will not catch. I cannot see the call sites, so impact is conditional; if only choose_base_strategy() (XDG on macOS) is used, there is no path change.
   • How: Locate the etcetera usage (rg "etcetera|AppStrategy|choose_base_strategy" --type rust). If AppStrategy is used, verify the resolved path on macOS before/after and either ship a migration/fallback read of the old location or document the breaking change in the release notes.

3. One consumer still pins etcetera 0.8.0, leaving two versions in the build graph
   Maintainability & Coherency | MEDIUM | Effort: quick win

   • Why: The lockfile hunk at @@ -8438,7 +8448,7 @@ shows a package (deps include chrono, crc, dotenvy, futures-channel, futures-core, futures-util) whose edge was rewritten to + "etcetera 0.8.0", while the two workspace consumers now say + "etcetera 0.11.0". Version-qualified edges only appear when two copies coexist, so both 0.8.0 and 0.11.0 are now compiled. The dependency set strongly suggests a third-party sqlx crate (e.g., sqlx-postgres, which uses etcetera for ~/.pgpass resolution), which would make this unavoidable — but if the holdout is a workspace member declaring etcetera = "0.8" directly instead of inheriting from the workspace, this PR is incomplete and violates the workspace's DRY dependency management.
   • How: Run cargo tree -i etcetera@0.8.0 to identify the consumer. If it is a workspace crate, switch it to etcetera.workspace = true. If third-party (e.g., sqlx 0.8), accept the duplication and note it (sqlx has not yet moved to etcetera 0.11; dedupe when it does).

LOW Severity Issues (Minor Improvements)

4. Unrelated windows-sys re-resolution adds review surface to a single-dep bump
   Maintainability & Coherency | LOW | Effort: quick win

   • Why: The diff moves windows-sys edges from 0.59.0 to 0.61.2 for multiple packages (rustix-shaped entry at @@ -6739, tempfile at @@ -8961, rustls-native-certs at @@ -6852, the dirs-sys-shaped entry at @@ -2791, etc.) and to 0.60.2 for the tokio-shaped entry at @@ -6183. This is typical dependabot lockfile refresh of ranged requirements, and it is Windows-target-only churn, but note the provided diff does not show the corresponding windows-sys 0.60.2/0.61.2 [[package]] entries or the version bumps that permit the 0.60.2 edge, so the full lockfile diff is larger than what is shown here.
   • How: Skim the complete Cargo.lock diff on GitHub (not just the hunks above) and confirm the new windows-sys entries are present and checksummed; ensure the lockfile passes cargo metadata --locked / cargo check --locked in CI.

5. Three major versions with zero call-site changes lean entirely on CI for API compatibility
   Testing & Docs | LOW | Effort: quick win

   • Why: etcetera 0.9–0.11 contain breaking changes (traits made dyn-compatible in 0.9; non-UTF8 dir support in 0.10, which touched path handling; home crate replaced by std::env::home_dir in 0.11). The PR changes no Rust code, which is fine if usage is limited to stable APIs, but nothing in the repo demonstrates the config-dir resolution still behaves as expected at runtime.
   • How: Before the next release, smoke-test the flows that read/write config (login, config init) on Linux and macOS. If none exists, consider a small test asserting the resolved config directory is under the expected base.

Security Review

Sweep performed on a dependency-only diff:

• Supply chain: etcetera (lunacookies) is a small, widely-used crate in the sqlx ecosystem; the new version is checksum-pinned (checksum = "de48cc4d...") in the lockfile. The jump crosses three majors, so the combined changelog was reviewed (quoted in the PR description): no adversarial-relevant changes; two changes are mildly security-positive (0.9 replaces deprecated SHGetFolderPathW with SHGetKnownFolderPath; 0.11 drops the third-party home crate in favor of std::env::home_dir).
• Trust boundaries / input validation: etcetera resolves filesystem config paths. The only behavior-bearing change is where those paths land (finding Fixes/start up #2); this fails closed (config not found), not open. No injection, deserialization, or template surfaces.
• Authn/authz, secrets: No changes; the crate only locates files that may contain credentials — it does not handle them.
• Crypto/randomness, resource exhaustion: No surface.
• windows-sys bumps (0.60.2/0.61.2): first-party Microsoft bindings, checksum-pinned; no added capability surface.

No security findings result from this diff beyond the path-resolution behavior noted in finding #2.

Suggestions for Improvements

• Run cargo tree -i etcetera@0.8.0 and cargo tree -i etcetera@0.11.0 and paste the output into the PR for the record (resolves finding Create min_compute.yml #3 in one step).
• If the duplicate comes from sqlx, track an upstream sqlx release that moves to etcetera ≥ 0.11 so the tree dedupes later.
• Add a CHANGELOG/release note covering the etcetera jump if the config path on macOS is affected (finding Fixes/start up #2).
• Consider a cargo deny bans entry allowing exactly these two etcetera versions temporarily, so a third copy cannot slip in unnoticed.

Positive Observations

• Single-point bump in [workspace.dependencies] with consumers inheriting — correct DRY pattern for this workspace.
• The upgrade removes the home crate from the dependency tree and adopts std::env::home_dir, and picks up non-UTF8 path support (0.10) — a genuine robustness improvement.
• Lockfile is updated coherently: new package entry with checksum, and version-qualified edges ("etcetera 0.8.0" / "etcetera 0.11.0") correctly disambiguated.
• The dependabot commit/PR title deps(deps): bump etcetera from 0.8.0 to 0.11.0 follows the Conventional Commits format (type(scope): description); no commit-format findings.

Recommendation and Next Steps

COMMENT — the bump itself is well-formed, but it should land only after confirming (1) every toolchain that compiles this workspace is ≥ 1.87, (2) cargo tree -i etcetera@0.8.0 shows the remaining 0.8.0 consumer is third-party rather than a workspace crate, and (3) the macOS config-path change from etcetera 0.9 has been assessed for the CLI/SDK so users' existing config and credentials are not silently abandoned.