jcoffey-dev
a53c309bad
Dependabot #10: lru's IterMut violates Stacked Borrows, fixed in 0.16.3. lru was transitive through tantivy 0.22.1, which pins lru ^0.12.0, so there was no in-range fix -- cargo update -p lru locks nothing. The advisory was also not reachable: tantivy calls only get, put, len, peek_lru and new on its LruCache, never iter_mut. Upgrading rather than dismissing because it is early enough that carrying four versions of drift costs more than paying it now, and the alert then closes on its own evidence rather than on an argument. lru resolves to 0.16.4, past the patch line. One API change across the four releases. TopDocs no longer implements Collector on its own -- an ordering has to be chosen rather than defaulted into. order_by_score() is exactly what bare TopDocs did in 0.22, so result order is preserved rather than quietly changed, which matters for a search endpoint whose contract is "most relevant first". Index compatibility checked rather than assumed, since a format change would have meant a reindex for every existing deployment. Against a live index of 1757 documents written by 0.22: the service opened it without error, a document indexed hours earlier by 0.22 is still findable, new documents written by 0.26 are findable, and a phrase query spans both. No migration needed. The compliance inventory is regenerated for the new graph: 17 crates added, 5 gone, 20 bumped, and three duplicate-version entries collapsed where the graph no longer needs two. Nothing newly flagged -- every addition is permissive -- and cargo-deny check licenses, which is the gate CI actually runs, passes. Rows for crates whose name and version are unchanged are left byte-for-byte alone, so the diff shows the real change rather than 200 rows of SPDX term reordering. Signed-off-by: John Coffey <[email protected]>
47 lines
1.5 KiB
TOML
47 lines
1.5 KiB
TOML
[package]
|
|
name = "cairnobs-search"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
license = "AGPL-3.0-only"
|
|
description = "Cairn OBS Tantivy-backed full-text search service"
|
|
|
|
[[bin]]
|
|
name = "cairnobs-search"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
tokio = { version = "1", features = ["rt-multi-thread", "macros", "fs", "sync", "signal", "time"] }
|
|
tonic = "0.12"
|
|
prost = "0.13"
|
|
|
|
tantivy = "0.26"
|
|
rskafka = "0.6"
|
|
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# tenants.rs's only outbound HTTP call (GET enterprise-auth's
|
|
# /internal/active-tenants) -- default-features = false drops TLS
|
|
# support entirely, matching every other internal service-to-service
|
|
# call in this repo (plain HTTP, network placement is the trust
|
|
# boundary, not TLS -- see ingest/internal/grpcserver.
|
|
# HTTPTenantResolver's identical posture against the same service).
|
|
reqwest = { version = "0.12", default-features = false, features = ["json"] }
|
|
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
[build-dependencies]
|
|
tonic-build = "0.12"
|
|
|
|
[dev-dependencies]
|
|
# Already in the dependency graph transitively (tantivy/tonic-build both
|
|
# pull it in); promoted to a direct dev-dependency for test use.
|
|
tempfile = "3"
|
|
# tenants.rs's tests spin up a tiny real TCP server to exercise reqwest
|
|
# against, rather than pulling in a mocking crate -- needs tokio
|
|
# features the main binary doesn't (edition 2021's resolver keeps these
|
|
# out of the release build, test-only).
|
|
tokio = { version = "1", features = ["net", "io-util"] }
|