spacedrive icon indicating copy to clipboard operation
spacedrive copied to clipboard

Rust 1.75, Tauri 1.5.4 and major dependency update

Open brxken128 opened this issue 1 year ago • 1 comments

This extends upon @julianbraha's work and previous PR.

This:

  • Resolves RUSTSEC-2024-0006 and RUSTSEC-2024-0003, caused by outdated versions of shlex and h2, respectively (thank you @julianbraha!)
  • Updates Tauri to 1.5.4
  • Updates our Tauri git patch and rebases it onto 1.5.4
  • Updates the vast, vast majority of our Rust dependencies
  • Updates the project's default Rust version to 1.75

The main dependencies I couldn't update were hyper, axum and ort. I got 99% of the way there with hyper/axum (I still have the stash for when it becomes possible - there were a LOT of HTTP Bodys that needed to be changed and optimised), but rspc is using an older version of axum (via httpz) so the endpoint wouldn't translate over within sd-server correctly. I'd be more than happy to upgrade axum and hyper once rspc supports the newer version.

I have tested this on MacOS and it builds successfully, but of course this will require some very thorough testing across all 3 platforms, and across Linux' AppImage and .deb builds.

brxken128 avatar Jan 25 '24 19:01 brxken128

The latest updates on your projects. Learn more about Vercel for Git ↗︎

2 Ignored Deployments
Name Status Preview Updated (UTC)
spacedrive-landing ⬜️ Ignored (Inspect) Jan 25, 2024 7:32pm
spacedrive-web ⬜️ Ignored (Inspect) Jan 25, 2024 7:32pm

vercel[bot] avatar Jan 25 '24 19:01 vercel[bot]

I'm closing this in favour of a re-based branch that's more up-to-date.

brxken128 avatar Mar 04 '24 09:03 brxken128

@brxken128 Can you upgrade axum and hyper to the latest version

RustLoverTheCoder avatar Apr 03 '24 11:04 RustLoverTheCoder

@brxken128 Can you upgrade axum and hyper to the latest version

They're specifically ones I can't upgrade as that'd require refactoring/plain rewriting a good amount amount of code (that I'm not familiar with at all), as well as maybe doing the same for a few of our dependencies.

I'd love to, as they offer some great performance and security enhancements, but it's likely not worth the time at the minute.

They'll be upgraded eventually, just not yet.

brxken128 avatar Apr 03 '24 12:04 brxken128