Take two dependency majors: md-5 0.11, reqwest 0.13 - #110
Merged
Conversation
Two of the six majors that Dependabot's grouping split out. Both are
single call sites.
md-5 0.11 returns a hybrid_array::Array from finalize(), which does not
implement UpperHex the way the old GenericArray did, so `{:X}` no longer
compiles. The hex is written out by hand instead.
That digest is the `#CD=` line an ICF file ends with, and the ID-52
rejects a file whose digest it disagrees with — so "still compiles" is
not the bar. The existing tests could not catch a change here: they
compute their expected digest with digest_of itself, so they agree with
any implementation including a wrong one. Added a pin against published
MD5 constants instead — MD5("abc") and MD5("") — which is ground truth
this module cannot influence. It passed before the bump and after it,
which is what makes it evidence.
reqwest 0.13 did not remove RequestBuilder::query; it moved it behind a
`query` feature that used to be implicit. Adding the feature is the whole
change — no rewriting of the Nominatim call.
Verified: 431 tests pass, clippy clean, and cargo tree confirms the lib
links md-5 0.11.0 (the 0.10.6 still in the lock belongs to sqlx-mysql and
sqlx-postgres, drivers this app does not use).
Four majors left: sqlx 0.9, TypeScript 7, Vite 8, plugin-react 6.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JaRQYbdzNiZaN4cbY5VFMx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two of the six majors that the new Dependabot grouping split out. Both are single call sites.
md-5 0.11
finalize()now returns ahybrid_array::Array, which doesn't implementUpperHexthe way the oldGenericArraydid, soformat!("{:X}", …)no longer compiles. The hex is written out by hand."Still compiles" isn't the bar here. That digest is the
#CD=line an ICF file ends with, and the ID-52 rejects a file whose digest it disagrees with.The existing tests couldn't have caught a change: they compute their expected digest with
digest_ofitself, so they agree with any implementation, including a wrong one. Added a pin against published MD5 constants instead —MD5("abc")andMD5("")— which is ground truth this module can't influence. It passed before the bump and after it, which is what makes it evidence rather than decoration.reqwest 0.13
It didn't remove
RequestBuilder::query— it moved it behind aqueryfeature that used to be implicit. Adding the feature is the entire change; the Nominatim geocoder call is untouched.Verification
cargo treeconfirms the lib links md-5 0.11.0. The 0.10.6 still in the lock belongs tosqlx-mysqlandsqlx-postgres— drivers this app doesn't use. I initially misread the lockfile and thought the bump hadn't taken; it had.Four majors left: sqlx 0.9, TypeScript 7, Vite 8, plugin-react 6.
🤖 Generated with Claude Code
https://claude.ai/code/session_01JaRQYbdzNiZaN4cbY5VFMx