Repository navigation
chore(deps): upgrade the CLI's Rust dependencies and cargo-dist - #83
Merged
Merged
Conversation
`cargo update` moves 155 crates to their latest versions that satisfy Cargo.toml. Among them, rustls goes from 0.23.41 to 0.23.45, which fixes RUSTSEC-2026-0285 (GHSA-2mjx-qc3c-rqvc). Before that fix, TLS 1.3 handshake messages were accepted across a key change in the same record. The handshake transcript stays authenticated, so the impact is limited to protocol conformance. The RustCrypto crates under the keyring stores (aes, cbc, cipher, digest, hmac, hkdf) move to their next releases. Their dependents already allow those versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
The client encodes and decodes binary paste content with the GeneralPurpose STANDARD engine, which behaves the same in 0.23. The release adds SIMD engines behind a default feature and makes InvalidLastSymbol errors carry the decoded value. No code changes are needed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
The CLI reads and writes its settings file with toml::from_str and to_string_pretty, using plain strings, tables and booleans. 1.0 changed only Time fields, which the settings don't use. The 1.1 parser also accepts TOML 1.1 syntax, such as multi-line inline tables and trailing commas, in hand-edited settings files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
reqwest 0.13 reorganises its TLS features. `rustls-tls` (ring plus bundled Mozilla roots from webpki-roots) is gone. Its `rustls` feature uses the aws-lc-rs provider, which rustls now defaults to, and checks certificates with rustls-platform-verifier, which trusts the operating system's certificate store. The CLI therefore trusts what the machine trusts. A self-hosted server whose certificate chains to a company or private CA in the system store now works without extra setup, where before it failed with an unknown issuer. Public servers verify as before, because the system stores include the same public roots. `RequestBuilder::query` moved behind a `query` feature, which the client uses to send paste fields alongside raw uploads. Proxy environment variables are still honoured; the off-by-default `system-proxy` feature only adds macOS and Windows system proxy settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
The CLI uses lumis only to colour `textbin show` output in a terminal, through TerminalBuilder with the onedark theme. Most of the breaking changes since 0.12 are in the HTML formatter, annotations and render budgets, which the CLI doesn't use. The calls it makes compile unchanged. The output was checked against the previous build: a highlighted Elixir paste shown under a pseudo-terminal gives every visible character the same colour. 0.14 merges adjacent spans with the same scope, so the new output uses fewer escape sequences. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
Textbin ships the shell and PowerShell installers that dist generates. 0.32 fixes two things in them: the PowerShell installer now reports the underlying exception when a download fails, and Windows paths in the install receipt are escaped correctly. It also bumps the GitHub Actions it generates and swaps attest-build-provenance@v3 for attest@v4. release.yml is maintained by hand (`allow-dirty = ["ci"]`), so only the installer pin moves here. `dist plan` with 0.32 gives the same four targets and two installers, and `dist build --artifacts=global` produces both installers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6
darwin67
marked this pull request as ready for review
October 11, 2026 22:44
darwin67
added a commit
that referenced
this pull request
Oct 11, 2026
This brings the asset toolchain up to date. It is independent of #82, #83 and #84. The Hex `esbuild` and `tailwind` packages were already current; the binary versions in `config/config.exs` and the vendored JS were behind. | Commit | Change | Effect | |---|---|---| | topbar | 3.0.0 → 3.0.1 (vendored) | The canvas gets `role="presentation"` and is hidden with the `hidden` attribute. Checked in Chromium: shown during `phx:page-loading`, hidden afterwards. | | esbuild | 0.25.4 → 0.28.2 | The breaking releases don't touch this build. The binaries now need Linux 3.2+ and macOS 12+. The bundle differs only in esbuild's CommonJS wrapper. | | Tailwind | 4.1.7 → 4.3.3 | Additive utilities, plus a deprecation of `start-*`/`end-*`, which aren't used. CSS is 3.5 KB smaller. This matches what Phoenix 1.8.15 generates. | | daisyUI | 5.0.35 → 5.7.47 (vendored) | No breaking changes flagged. CSS grows by 51 KB raw, **3.7 KB gzipped**, from extra `@supports` fallbacks and state rules. | ### Visual check I screenshotted nine pages in light and dark, at 1280 and 390 px, before and after each CSS change, and diffed the pixels. The pages were login, pastes, new paste, paste detail with highlighting, deleted, workspace settings, search, user settings and orgs. Two runs with no change differed by at most 6 pixels. - **Tailwind:** no real change. The largest difference was 11 pixels of anti-aliasing on a button edge. - **daisyUI** made two small visible changes: - `badge-sm` pills (audience, syntax, expiry) are a few pixels wider, so they sit about 5 px further left on the list and detail pages; - `select` fields have about 4 px less left padding before their text. Nothing else moves. None of the 36 screenshots logged a console or page error. The LiveView flows (create, live navigation, search, delete, restore, socket reconnect) pass on the new bundle. `mix test` passes (582 tests). `assets/vendor/daisyui-theme.js` is not referenced by `app.css`, so it is left as it is. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6 --- _Generated by [Claude Code](https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This brings the CLI and client crates up to date. OSV reports no advisories against the new
Cargo.lock(377 crates). The only crate not at its latest version iscc, which a transitive requirement holds at 1.2.Timefields, and hand-edited files may now use TOML 1.1 syntaxrustls-tls→rustls, plusqueryCargo.tomland in the installer URL inrelease.ymlBehaviour change to review: TLS trust
reqwest 0.13's
rustlsfeature uses the aws-lc-rs crypto provider and rustls-platform-verifier. Before, the CLI used ring with Mozilla roots bundled into the binary. The CLI now trusts the operating system's certificate store. For a self-hosted product this is the better default: a server with a certificate from a company or private CA that the machine already trusts now works. Before, it failed with an unknown-issuer error. Public servers verify as before.Not yet verified: release targets other than x86_64 Linux
aws-lc-rs builds C code (aws-lc-sys) for each target. It builds here on x86_64 Linux. The per-target
distbuilds (aarch64 Linux, aarch64 macOS, x86_64 Windows MSVC) are skipped on ordinary PRs, including this one. They run on the release PR (release/next), so after this merges, #28's CLI jobs are the first to build aws-lc-sys on those targets. If one of them fails, the release is blocked and nothing ships. Windows MSVC is the most likely to need attention.Verification
cargo clippy --workspace --all-features -D warnings,cargo fmt --checkandcargo test --workspace(63 tests) pass.@fileupload read back byte-identical;deleted --json, restore andauth whoami --jsonall work;textbin showagainst an HTTPS server, through a TLS-intercepting proxy whose CA is only in the system store, completes the handshake.dist planwith 0.32 gives the same four targets and two installers, anddist build --artifacts=globalproduces both installers.🤖 Generated with Claude Code
https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6