S44 deps: triage the 5 open Dependabot PRs — #253 breaks the tokio hold - #255
Open
hyperxpro wants to merge 1 commit into
Open
S44 deps: triage the 5 open Dependabot PRs — #253 breaks the tokio hold#255hyperxpro wants to merge 1 commit into
hyperxpro wants to merge 1 commit into
Conversation
…ld and CI cannot catch it Versions checked against crates.io, not against the handoff's numbers. The important finding is #253 (21-crate group). It widens the workspace constraint from `tokio = ">=1.51, <1.52"` to `"<1.54"` and moves the lock from 1.51.1 to 1.53.1, crossing the boundary the hold exists to defend. That bound is the guard rail for the measured ~10x H2->H3 relay throughput collapse on 1.52.x (CF-S37-D-TOKIO-1.52-RELAY). The dangerous part is that CI would go GREEN. The regression is a throughput collapse, there is no perf gate among the 16 CI jobs, and the canary (h2h3_fcap1 ~30MiB stall) only appears in the perf/soak lane, which does not run per-PR. #253 currently fails for an unrelated reason -- a genuine aya 0.14 breaking change (E0432 unresolved import aya::programs::XdpFlags, E0061 arity) -- so if someone fixed only the compile error, a 10x relay regression would ship behind a full green checkmark. Recommend closing #253 and re-opening it split, with tokio excluded, plus a Dependabot ignore rule for tokio so automation cannot widen the bound again. The hold has survived since S37 on discipline alone. Also measured: four of the five PRs are based on pre-S43 commits (5 to 9 behind main), so their reds are STALE -- they are the same three S43 already closed (the two RUSTSEC advisories and the nightly fetch_update fuzz break) plus the Coverage coin flip that PR #254 corrects. Their current check results carry no information about the bumps themselves; rebase before reading them. Both quiche PRs (#238, #237) target the stale 0.29.2 when 0.29.3 is out; recommend closing both for a single 0.29.1 -> 0.29.3 bump covering the workspace and /fuzz together, gated on h3spec staying at 12 named waivers (S31 showed a quiche bump can move h3spec). hyper 1.11.0 is deliberately NOT treated as a routine bump here -- it is the CF-S27-2 WS-H2 un-gate and needs its own session with the S30 repro, R8/R13 evidence, and h2spec 146/1/0 as a hard blocker.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only — no source or gate changes. Versions checked against crates.io, not against the handoff's numbers.
Headline: #253 must not merge as-is, and CI would not catch why
PR #253 (21-crate group) widens the workspace constraint and crosses the tokio hold:
That
<1.52bound is the guard rail for the measured ~10× H2→H3 relay throughput collapse on 1.52.x (CF-S37-D-TOKIO-1.52-RELAY).The dangerous part is that CI would go green. The regression is a throughput collapse; there is no perf gate among the 16 CI jobs, and the canary (
h2h3_fcap1~30 MiB stall) only appears in the perf/soak lane, which does not run per-PR.#253 currently fails for an unrelated reason — a genuine
aya0.14 breaking change:So if someone fixed only the compile error, a 10× relay regression would ship behind a full green checkmark.
Recommend: close #253, re-open split with
tokioexcluded, and add a Dependabotignorerule fortokioso automation cannot widen the bound again. The hold has survived since S37 on discipline alone.Most of the other red is STALE — measured, not assumed
e9df7cca1a4e4fae1a4e4faeffac8705ffac8705The stale reds are exactly the three S43 closed (both RUSTSEC advisories, the nightly
fetch_updatefuzz break) plus theCoveragecoin flip that #254 corrects. Rebase before reading any of these verdicts — their current results carry no information about the bumps themselves.quiche
Both quiche PRs target the stale 0.29.2 when 0.29.3 is out. Recommend closing both for a single 0.29.1 → 0.29.3 bump covering the workspace and
/fuzz, gated on h3spec staying at 12 named waivers — S31 showed a quiche bump can move h3spec.hyper
hyper1.11.0 is deliberately not treated as a routine bump here. It is the CF-S27-2 WS-H2 un-gate and needs its own session with the S30 repro, R8/R13 evidence, and h2spec 146/1/0 as a hard blocker.Full detail, including recommended sequencing:
audit/ci/s44-deps-triage.md.