chore(deps): bump sqlx from 0.8.6 to 0.9.0

[InstaZDLL]

Summary

• Bumps sqlx from 0.8.6 → 0.9.0 in src-tauri.
• Migrates 12 dynamic-SQL call sites through sqlx::AssertSqlSafe(...) — sqlx 0.9 narrowed query*() to impl SqlSafeStr (only &'static str or AssertSqlSafe-wrapped owned strings) as a guard rail against format!()-built queries. All migrated sites build SQL from internal templates (whitelisted ORDER BY clauses, ?,?,? placeholders), never from user input — bind() carries every dynamic value.
• Adapts Migration::sql (now SqlStr) in db::migration_heal and the per-connection ATTACH DATABASE in db::profile_db which lost its &str leniency to the new 'static + Execute<'q> bound.

Replaces #151 (Dependabot PR that did the version bump only, leaving 14 compile errors).

Test plan

• cargo check --manifest-path src-tauri/Cargo.toml --all-targets
• cargo test --manifest-path src-tauri/Cargo.toml → 110 passed
• CI green (Rust ubuntu + windows)
• Manual smoke: launch app, switch profile, scan library, regenerate smart playlists (exercises every migrated query path + the ATTACH hook)

Summary by CodeRabbit

• Chores

  • Mise à jour de la dépendance sqlx vers 0.9
  • Renforcement de la validation/sûreté des requêtes SQL côté application

• Documentation

  • Ajustements de mise en forme dans la doc des smart‑playlists et de l’UI

• Style

  • Plusieurs retouches de formatage et mise en forme du code sans changement fonctionnel

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a61c9235-2060-4d82-b686-3dc75ec98803

📥 Commits

Reviewing files that changed from the base of the PR and between e8d76ee and c3f5a51.

📒 Files selected for processing (10)

• docs/features/smart-playlists.md
• docs/features/ui.md
• src-tauri/src/commands/integration.rs
• src-tauri/src/db/profile_db.rs
• src-tauri/src/smart_playlists/cover.rs
• src-tauri/src/smart_playlists/on_repeat.rs
• src/components/player/AudioPipelinePopover.tsx
• src/components/views/SettingsView.tsx
• src/components/views/settings/HiResBadgeCard.tsx
• src/lib/tauri/playlist.ts

---

📝 Walkthrough

Walkthrough

Upgrade de sqlx 0.8 → 0.9 et adaptation des appels pour fournir les requêtes SQL dynamiques via sqlx::AssertSqlSafe(...), plus ajustements mineurs dans la gestion des migrations/connexions et plusieurs retouches cosmétiques/docs/UI.

Changes

sqlx 0.8 → 0.9 upgrade et adoption AssertSqlSafe

Layer / File(s)	Summary
Dependency upgrade to sqlx 0.9 src-tauri/Cargo.toml	sqlx passe de 0.8 à 0.9 en conservant les mêmes features.
SQL safety wrapping in command queries src-tauri/src/commands/browse.rs, src-tauri/src/commands/edit.rs, src-tauri/src/commands/radio.rs, src-tauri/src/commands/similar.rs, src-tauri/src/commands/track.rs	Les requêtes SQL dynamiques des commandes (list_albums, list_artists, sync_db, pick_candidate_tracks, cached_similar_library_ids, get_similar_artists, list_tracks, search_tracks_advanced) passent de &sql à sqlx::AssertSqlSafe(sql) lors des appels sqlx::query*.
SQL safety wrapping in smart playlist generators src-tauri/src/smart_playlists/custom.rs, src-tauri/src/smart_playlists/generator.rs	Les fonctions de playlists intelligentes (run_query, top_artists_with_bpm, first_track_artwork_paths, pick_tracks_for_artists) utilisent désormais sqlx::AssertSqlSafe(sql) pour leurs requêtes dynamiques.
Database layer compatibility adjustments src-tauri/src/db/migration_heal.rs, src-tauri/src/db/profile_db.rs	migration_heal.rs utilise migration.sql.as_str().as_bytes() pour le calcul des hash; profile_db.rs retire Executor inutilisé et exécute l'ATTACH via sqlx::query(AssertSqlSafe(...)).execute(&mut *conn).
Formatting, docs et UI petits changements docs/features/*, src-tauri/src/smart_playlists/*, src/components/*, src/lib/tauri/playlist.ts, src-tauri/src/commands/integration.rs	Divers ajustements de mise en forme, tables Markdown et petites réécritures de signatures/JSX sans changement fonctionnel.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• InstaZDLL/WaveFlow#53: Modifications autour de migration_heal / heal_line_ending_drift — chevauchement sur le traitement des octets de migration.
• InstaZDLL/WaveFlow#148: Changements antérieurs dans smart_playlists/generator.rs touchant des requêtes similaires à celles adaptées ici.
• InstaZDLL/WaveFlow#137: Travaux récents sur commands/track.rs (mapping/contrat de réponse) — touche au même fichier track.rs.

Poem

✨ Sqlx monte en version, sûreté assurée,
De &sql à AssertSqlSafe la requête est portée,
Migrations et ATTACH réajustés et nettoyés,
Docs et UI rafraîchis sans rien casser,
Build prêt, la base peut chanter 🎶

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Le titre suit précisément la convention Conventional Commits avec le type 'chore', le scope 'deps' en kebab-case, et un sujet clair résumant la mise à jour de sqlx 0.8.6 vers 0.9.0.
Description check	✅ Passed	La description couvre complètement les objectifs : changements, justification, impact API, sites migrés et validation (cargo check, tests, CI). Le template vérifie que le titre suit Conventional Commits (✓), que les commandes de build/lint ont été exécutées (✓), et les checklist relevantes sont cochées.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-sqlx-0.9

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src-tauri/Cargo.toml (1)

68-74: ⚠️ Potential issue | 🟠 Major | ⚖️ Poor tradeoff

Vérifier la compatibilité de sqlx 0.9 (SqlSafeStr / AssertSqlSafe)

• En sqlx 0.9, les query*() acceptent désormais impl SqlSafeStr : les littéraux &'static str fonctionnent, mais tout SQL construit dynamiquement à partir de String/&str non static doit être enveloppé avec sqlx::AssertSqlSafe(...) (sinon ça casse la compilation et contourne l’opt-in explicite de sécurité).
• Auditer toutes les utilisations de query*() (et variantes) pour s’assurer qu’aucune chaîne non littérale n’est passée sans AssertSqlSafe.
• Vérifier aussi les autres breaking changes 0.9 pertinentes pour le codebase, notamment le comportement autour de PgConnectOptions::options() (si utilisé) avec l’échappement automatique.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src-tauri/Cargo.toml` around lines 68 - 74, Audit all usages of sqlx query
builders (e.g., query(), query_as(), query_scalar(), query_unchecked(), and any
call sites taking SQL strings) and ensure any non-literal SQL constructed from
String/&str is wrapped with sqlx::AssertSqlSafe(...) because sqlx 0.9 requires
impl SqlSafeStr; replace unsafe dynamic string arguments by either converting to
parameterized queries or wrapping them with AssertSqlSafe where an explicit
opt-in is intended, and run cargo build to catch remaining errors; additionally
review any uses of PgConnectOptions::options() and other sqlx 0.9
breaking-change APIs and update call sites to the new behavior/signature as
required.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@src-tauri/Cargo.toml`:
- Around line 68-74: Audit all usages of sqlx query builders (e.g., query(),
query_as(), query_scalar(), query_unchecked(), and any call sites taking SQL
strings) and ensure any non-literal SQL constructed from String/&str is wrapped
with sqlx::AssertSqlSafe(...) because sqlx 0.9 requires impl SqlSafeStr; replace
unsafe dynamic string arguments by either converting to parameterized queries or
wrapping them with AssertSqlSafe where an explicit opt-in is intended, and run
cargo build to catch remaining errors; additionally review any uses of
PgConnectOptions::options() and other sqlx 0.9 breaking-change APIs and update
call sites to the new behavior/signature as required.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7870a014-acc1-407e-9866-ed26b8d75bd1

📥 Commits

Reviewing files that changed from the base of the PR and between 58e32d0 and e8d76ee.

⛔ Files ignored due to path filters (1)

• src-tauri/Cargo.lock is excluded by !**/*.lock, !src-tauri/Cargo.lock

📒 Files selected for processing (10)

• src-tauri/Cargo.toml
• src-tauri/src/commands/browse.rs
• src-tauri/src/commands/edit.rs
• src-tauri/src/commands/radio.rs
• src-tauri/src/commands/similar.rs
• src-tauri/src/commands/track.rs
• src-tauri/src/db/migration_heal.rs
• src-tauri/src/db/profile_db.rs
• src-tauri/src/smart_playlists/custom.rs
• src-tauri/src/smart_playlists/generator.rs