Skip to content

deps(deps): bump oci-client from 0.13.0 to 0.17.0 - #551

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/oci-client-0.17.0
Open

deps(deps): bump oci-client from 0.13.0 to 0.17.0#551
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/oci-client-0.17.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps oci-client from 0.13.0 to 0.17.0.

Release notes

Sourced from oci-client's releases.

v0.17.0

What's Changed

New Contributors

Full Changelog: oras-project/rust-oci-client@v0.16.1...v0.17.0

v0.16.1

What's Changed

New Contributors

Full Changelog: oras-project/rust-oci-client@v0.16.0...v0.16.1

v0.16.0

What's Changed

... (truncated)

Commits
  • 1f9a41e Merge pull request #249 from michaelvanstraten/artifact-type-property-descrip...
  • d18b715 fix: include artifact_type in ImageIndexEntry Display impl
  • a56d692 feat(v1.1): Add artifactType property to OciDescriptor (fixes 248)
  • 2af71fe Merge pull request #258 from oras-project/dependabot/github_actions/EmbarkStu...
  • c3eedfc ci: fix cargo deny configuration
  • ebb9390 chore(deps): Bump EmbarkStudios/cargo-deny-action from 2.0.17 to 2.0.18
  • a4d5141 Merge pull request #259 from flavio/fix-implement-referrers-fallback
  • a1155c4 fix: add OCI referrers tag schema fallback to pull_referrers
  • 2eff50a doc: fix cargo docs warnings
  • c9f347c Merge pull request #246 from ocx-sh/feature/catalog
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 28, 2026
@dependabot dependabot Bot mentioned this pull request Jul 28, 2026
Closed
@covenant-talos

covenant-talos Bot commented Jul 28, 2026

Copy link
Copy Markdown

Walkthrough

This PR bumps the oci-client dependency from 0.13.0 to 0.17.0, a cross-major-version upgrade that pulls in several transitive dependency changes. Notable upstream shifts include replacing jwt with jsonwebtoken, moving sha2 to 0.11, upgrading reqwest from 0.12 to 0.13, bumping oci-spec to 0.9, and adding the untrusted 0.7.1 crate alongside the existing 0.9.0. The only repository code change is the version specifier in Cargo.toml; everything else is lockfile churn.

Changes

Cohort / File(s) Change Summary
Dependency declaration: Cargo.toml Bumps oci-client version specifier from "0.13" to "0.17" while preserving rustls-tls feature config.
Lockfile updates: Cargo.lock Refreshes oci-client and its transitive deps: jwt→jsonwebtoken, sha2 0.10→0.11, reqwest 0.12→0.13, oci-spec 0.7→0.9, strum 0.26→0.27, plus assorted windows-sys and untrusted version bumps.

Estimated review effort: 2/5 (mechanical dependabot bump, but spans four upstream minor/major versions so compile-level verification matters).

Instant overview - a deep technical review follows as a separate comment.

@covenant-talos

covenant-talos Bot commented Jul 28, 2026

Copy link
Copy Markdown

PR #551: deps(deps): bump oci-client from 0.13.0 to 0.17.0 (by dependabot[bot])

Summary

Dependabot bumps oci-client — the crate basilica uses for "Docker image validation" per the Cargo.toml comment — from 0.13.0 to 0.17.0, a span of four breaking (0.x minor) upstream releases. The only hand-edited change is one line in Cargo.toml (version = "0.13" → "0.17", features unchanged); everything else is Cargo.lock regeneration. The lock delta is largely beneficial: the duplicate reqwest 0.12.28 is eliminated (the whole workspace now unifies on the already-present reqwest 0.13.1), the unmaintained jwt 0.16.0 crate is replaced by jsonwebtoken 10.4.0 (backed by aws-lc-rs), and oci-spec moves 0.7.1 → 0.9.0. The regeneration also swept in unrelated transitive updates (windows-sys 0.59→0.61.2/0.60.2 across several packages, strum 0.26→0.27, a new duplicate untrusted 0.7.1).

Architecture

No structural impact. The change is local to the dependency manifest/lockfile; its only architectural side effect is positive — the HTTP/TLS client stack is deduplicated to a single reqwest/rustls line instead of two parallel ones.

Issues Found

CRITICAL Issues (Must Fix Before Merge)

None found.

HIGH Severity Issues (Advised to Fix Before Merge)

  1. Verify compilation and image-validation behavior against four breaking upstream releases before merging
    Functional Correctness | HIGH | Effort: involved
    • Why: The bump crosses v0.14, v0.15, v0.16, and v0.17, whose release notes (quoted in the PR body) document breaking and behavioral changes: refactor(client)!: Reduces allocations of streaming data (fix(validator): add multi-layer retry for binary validation race conditions #209, breaking), str -> Digest in calculate_and_validate (fix: sdk release #222, signature change), Switch to oci_spec's arch and os implementation (Feat/k3s fuse storage #228), and — most relevant to basilica — client: report manifest list digest for multi-arch images (fix(wireguard): ensure peer persistence and idempotent iptables rules #250). The lockfile simultaneously moves oci-spec 0.7.1 → 0.9.0. Yet the diff contains zero Rust source changes — only Cargo.toml (oci-client = { version = "0.17", ... }) and Cargo.lock. Given Cargo.toml documents this crate's role as "OCI client for Docker image validation", a silent change in which digest is reported for multi-arch images could alter validation outcomes without any code change, and any use of the refactored streaming/digest APIs would fail to compile. I cannot see basilica's call sites from this diff, so I cannot confirm breakage — but the burden of proof is on verification, not assumption, for a validation-critical path.
    • How: (a) Confirm CI is green, including the musl/static target the repo supports. (b) Grep the workspace for oci_client usage and compare each call site against the 0.14–0.17 changelogs — specifically pull, pull_manifest, fetch_manifest_digest, calculate_and_validate, and any blob-streaming code. (c) Run the image-validation flow against a known multi-arch image and assert the expected digest, pinning the fix(wireguard): ensure peer persistence and idempotent iptables rules #250 behavior (manifest-list digest vs. resolved manifest digest) to whatever basilica's validation logic expects.
    • Prompt for AI agents
In the one-covenant/basilica repo, after the oci-client 0.13.0 -> 0.17.0 bump:
1. Run `grep -rn "oci_client\|oci-client" --include="*.rs" crates/ | grep -v target` to find all call sites.
2. Run `cargo check --workspace` and fix any compile errors caused by upstream breaking changes: calculate_and_validate now takes &Digest instead of &str (rust-oci-client #222), the blob streaming API was refactored (#209), arch/os types moved to oci-spec (#228), and OciDescriptor gained artifactType (#249).
3. Locate the Docker image validation logic that consumes manifest digests and confirm whether it expects the image manifest digest or the manifest-list/index digest for multi-arch references, since #250 changed which digest is reported; adjust the comparison or add an explicit resolution step if needed.
4. Validate with `cargo test -p <validation crate>` and a manual pull/validate of a known multi-arch image (e.g., a pinned alpine digest), asserting the recorded digest matches expectations. Also run `cargo check --target x86_64-unknown-linux-musl` to confirm the musl build still passes.

MEDIUM Severity Issues (Optional to Fix Before Merge)

None found.

LOW Severity Issues (Minor Improvements)

  1. Resolve or accept the new duplicate untrusted crate versions
    Maintainability & Coherency | LOW | Effort: quick win

    • Why: The lockfile now contains both untrusted 0.7.1 (newly added, pulled in via aws-lc-rs's dependency list in the first hunk) and untrusted 0.9.0 (used by ring/rustls-webpki), forcing disambiguated references like "untrusted 0.9.0" throughout the lock. sha2 0.10.9 also remains alongside the new sha2 0.11.0. If the repo runs cargo-deny with a bans policy, this may fail CI; otherwise it is minor binary/graph bloat.
    • How: Run cargo deny check bans (or cargo tree -d) and either allow-list the duplication or track an upstream fix; no code change required in this PR.

  2. Confirm the musl build given jsonwebtoken's mandatory aws-lc-rs backend
    Operability | LOW | Effort: quick win

    • Why: The new jsonwebtoken 10.4.0 entry depends on aws-lc-rs unconditionally (lockfile hunk at line ~4496), and Cargo.toml carries an explicit "MUSL COMPATIBILITY" comment, showing this pipeline has been burned by crypto/TLS build requirements before. aws-lc-sys was already in the tree via the rustls stack, so the C toolchain requirement is not new — but the musl/cross target should still be confirmed green, since this adds a second consumer of it.
    • How: Ensure the CI matrix entry for the musl target runs on this PR; no change to the PR itself is needed.

  3. Commit message type deps does not follow Conventional Commits
    Maintainability & Coherency | LOW | Effort: quick win

    • Why: The commit/PR title deps(deps): bump oci-client from 0.13.0 to 0.17.0 is structurally valid (type(scope): description) but uses type deps, which is not a Conventional Commits type (expected: feat, fix, docs, chore, refactor, test, style, perf, build, ci). This is likely the repo's configured Dependabot prefix, so it may be an accepted convention — flagging per commit standards.
    • How: If intentional, no action; otherwise set Dependabot's commit-message.prefix to produce e.g. build(deps): bump oci-client from 0.13.0 to 0.17.0.

Security Review

Sweep performed: this diff's entire security surface is third-party dependency changes for a network client that talks to OCI registries.

  • Trust boundaries / input validation: oci-client parses registry manifests and bearer tokens; the bump replaces the stale jwt 0.16.0 (2021-era) with actively maintained jsonwebtoken 10.4.0, and pulls upstream auth fixes (fix: Insert opaque tokens into cache again, v0.16.1) — a net improvement in token-handling robustness.
  • Crypto: Token verification moves to aws-lc-rs (audited, FIPS-capable); TLS stays on rustls with rustls-platform-verifier — no native-tls introduced, consistent with the repo's musl stance. The removed reqwest 0.12.28 also removes the old webpki-roots 1.0.6 consumption from hyper-rustls.
  • Secret handling: Registry credentials flow through oci-client unchanged from basilica's side; no credential handling in this diff.
  • Injection / deserialization: No new surfaces in-repo; oci-spec 0.7→0.9 changes manifest deserialization types upstream — covered by the HIGH verification finding.
  • Supply chain: New crates entering the tree: jsonwebtoken 10.4.0, hex, const_format, sha2 0.11.0, untrusted 0.7.1 (duplicate of 0.9.0). All are mainstream; the duplicate aged untrusted 0.7.1 is flagged above. I cannot query an advisory database from this diff; a cargo audit run in CI should gate the merge.
  • DoS / resource exhaustion: Unchanged; upstream pull_blob flush fix (v0.16.1) actually removes a data-corruption/truncation risk.

No security-blocking findings; the supply-chain delta is net positive.

Suggestions for Improvements

  • Add (or confirm existence of) a regression test that validates a pinned multi-arch image reference and asserts the expected digest, locking in the client: report manifest list digest for multi-arch images oras-project/rust-oci-client#250 behavior so future bumps can't silently flip it.
  • Keep Dependabot lock regeneration scoped where possible (cargo update -p oci-client) to reduce unrelated churn like the windows-sys 0.59→0.61.2 sweep across six-plus packages, which inflates review surface.
  • Run cargo audit and cargo deny check in CI on dependency PRs as a standing gate.

Positive Observations

  • Eliminates the duplicate HTTP stack: reqwest 0.12.28 is fully removed and the workspace unifies on reqwest 0.13.1, dropping webpki-roots from the hyper-rustls feature set.
  • Replaces unmaintained jwt 0.16.0 with maintained jsonwebtoken 10.4.0 on aws-lc-rs.
  • Inherits upstream correctness fixes directly relevant to basilica: pull_blob data-loss fix (missing flush), opaque-token auth caching, and the OCI referrers tag-schema fallback for registries without the referrers API.
  • Feature hygiene preserved: default-features = false with only rustls-tls, matching the repo's musl-compatibility requirement.

Recommendation and Next Steps

COMMENT — The bump is hygienic and security-positive, but because it spans four breaking upstream releases on the image-validation path with zero accompanying source changes, it should merge only after CI (including the musl target and cargo audit) is green and a maintainer has verified that the multi-arch manifest-list digest change (rust-oci-client #250) does not alter basilica's validation results.

@dependabot
deps(deps): bump oci-client from 0.13.0 to 0.17.0
ef01f61 
Bumps [oci-client](https://github.com/oras-project/rust-oci-client) from 0.13.0 to 0.17.0.
- [Release notes](https://github.com/oras-project/rust-oci-client/releases)
- [Commits](oras-project/rust-oci-client@v0.13.0...v0.17.0)

---
updated-dependencies:
- dependency-name: oci-client
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/oci-client-0.17.0 branch from 7bc4c1c to ef01f61 Compare August 24, 2026 14:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants