[PR #376] [MERGED] chore(deps): deduplicate crate versions in the dependency graph #389

New issue

Closed

opened 2026-10-29 14:22:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:22:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/376
Author: @yingdi-shan
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @yingdi-shan

Base: main ← Head: chore/dedup-crate-versions

📝 Commits (1)

a9bfb85 chore(deps): deduplicate crate versions in the dependency graph

📊 Changes

3 files changed (+101 additions, -235 deletions)

View changed files

📝 Cargo.lock (+99 -233)
📝 Cargo.toml (+1 -1)
📝 crates/test-support/Cargo.toml (+1 -1)

📄 Description

What

Remove crate versions that were duplicated because of our own manifests:

agentenv uses nix 0.30 (was 0.31), matching the storage crates and rtnetlink.
agentenv-test-support disables the legacy rustls default feature on aws-sdk-s3 and keeps sigv4a, default-https-client and rt-tokio.
docker_credential 1.3.2 → 1.4.0 in Cargo.lock.

Why

Each duplicate adds compile time and binary size. These three duplicates came from our own manifests, so we can remove them without upstream changes. The number of crates resolved at more than one version drops from 62 to 53 (cargo tree --workspace -e normal,build,dev -d).

Removed duplicates: nix 0.31, hyper 0.14, hyper-rustls 0.24, h2 0.3, rustls 0.21, rustls-webpki 0.101, tokio-rustls 0.24, socket2 0.5, base64 0.21.

None.

Scope and non-goals

Manifest and lockfile only; no Rust source changes. The remaining duplicates come from inside third-party crates and are out of scope:

reqwest 0.12 and rand 0.8 come from opendal 0.55. Upgrading to 0.59 would fix them but changes the API (follow-up).
netlink-packet-route and thiserror 1 come from rtnetlink 0.20. rtnetlink 0.23 uses 0.33, which still wouldn't match iroh's 0.31.
sha2/digest 0.11 and other RustCrypto crates come from iroh.
which 4 and bindgen 0.69 come from the pinned libublk-rs-sys commit.
tracing-log 0.1 comes from tracing-bunyan-formatter and phf 0.11 from tls-parser. Both are already at their latest releases.

Moving the storage crates to nix 0.31 wouldn't have removed the duplicate, because rtnetlink (0.20 and 0.23) requires nix 0.30.

Design and behavior changes

None at runtime. The MinIO test helper's S3 client now uses the SDK's default hyper 1 HTTPS client instead of the legacy hyper 0.14/rustls 0.21 connector.

Compatibility and operations

Public API or generated protocol: N/A, unchanged.
Configuration or defaults: N/A, unchanged.
Snapshot manifest, artifact layout, or storage format: N/A, unchanged.
Upgrade and rollback: N/A, dependency-only change.
Host requirements, permissions, ports, or dependencies: Fewer third-party crates; no new host requirements.

Validation

make fmt
make clippy
make test-unit
Relevant Rust integration tests
make -C services test (required when services/ changes)
Generated clients/server regenerated with the documented make target
Documentation updated
Benchmarks or performance comparison completed

Commands and results:

make clippy                                                    # passed (all targets/features, -D warnings)
cargo test -p agentenv --lib                                   # 962 passed, 4 ignored
cargo test -p overlaybd --test oss_backend_minio -- --ignored  # 7 passed (Docker MinIO, uses the changed S3 client)

Skipped checks and reasons:

make fmt: no Rust source changes.
make test-unit / make test / make test-ublk: not run here. These need delegated capabilities, and the change has no source edits. Clippy and the unit and MinIO tests above cover compilation and the changed S3 client.
make -C services test: services/ is unchanged.

Risks and reviewer notes

nix 0.31 → 0.30 is a downgrade for agentenv. The workspace compiles cleanly with no source changes, so it uses no 0.31-only APIs.
The aws-sdk-s3 feature change only affects crates/test-support (dev-only).

Checklist

The PR contains one coherent change and no unrelated formatting or refactoring.
New behavior is covered by tests, or I explained why testing is impractical.
Logs and examples contain no credentials, tokens, or private registry information.
I did not manually edit generated code without updating its source and regenerating it.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/376 **Author:** [@yingdi-shan](https://github.com/yingdi-shan) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@yingdi-shan](https://github.com/yingdi-shan) **Base:** `main` ← **Head:** `chore/dedup-crate-versions` --- ### 📝 Commits (1) - [`a9bfb85`](https://github.com/kvcache-ai/AgentENV/commit/a9bfb8548063412b3c2245759232f24600e4f262) chore(deps): deduplicate crate versions in the dependency graph ### 📊 Changes **3 files changed** (+101 additions, -235 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+99 -233) 📝 `Cargo.toml` (+1 -1) 📝 `crates/test-support/Cargo.toml` (+1 -1) </details> ### 📄 Description ## What Remove crate versions that were duplicated because of our own manifests: - `agentenv` uses `nix` 0.30 (was 0.31), matching the storage crates and `rtnetlink`. - `agentenv-test-support` disables the legacy `rustls` default feature on `aws-sdk-s3` and keeps `sigv4a`, `default-https-client` and `rt-tokio`. - `docker_credential` 1.3.2 → 1.4.0 in `Cargo.lock`. ## Why Each duplicate adds compile time and binary size. These three duplicates came from our own manifests, so we can remove them without upstream changes. The number of crates resolved at more than one version drops from 62 to 53 (`cargo tree --workspace -e normal,build,dev -d`). Removed duplicates: `nix` 0.31, `hyper` 0.14, `hyper-rustls` 0.24, `h2` 0.3, `rustls` 0.21, `rustls-webpki` 0.101, `tokio-rustls` 0.24, `socket2` 0.5, `base64` 0.21. ## Related issue None. ## Scope and non-goals Manifest and lockfile only; no Rust source changes. The remaining duplicates come from inside third-party crates and are out of scope: - `reqwest` 0.12 and `rand` 0.8 come from `opendal` 0.55. Upgrading to 0.59 would fix them but changes the API (follow-up). - `netlink-packet-route` and `thiserror` 1 come from `rtnetlink` 0.20. `rtnetlink` 0.23 uses 0.33, which still wouldn't match `iroh`'s 0.31. - `sha2`/`digest` 0.11 and other RustCrypto crates come from `iroh`. - `which` 4 and `bindgen` 0.69 come from the pinned `libublk-rs-sys` commit. - `tracing-log` 0.1 comes from `tracing-bunyan-formatter` and `phf` 0.11 from `tls-parser`. Both are already at their latest releases. Moving the storage crates to `nix` 0.31 wouldn't have removed the duplicate, because `rtnetlink` (0.20 and 0.23) requires `nix` 0.30. ## Design and behavior changes None at runtime. The MinIO test helper's S3 client now uses the SDK's default hyper 1 HTTPS client instead of the legacy hyper 0.14/rustls 0.21 connector. ## Compatibility and operations - Public API or generated protocol: N/A, unchanged. - Configuration or defaults: N/A, unchanged. - Snapshot manifest, artifact layout, or storage format: N/A, unchanged. - Upgrade and rollback: N/A, dependency-only change. - Host requirements, permissions, ports, or dependencies: Fewer third-party crates; no new host requirements. ## Validation - [ ] `make fmt` - [x] `make clippy` - [ ] `make test-unit` - [x] Relevant Rust integration tests - [ ] `make -C services test` (required when `services/` changes) - [ ] Generated clients/server regenerated with the documented `make` target - [ ] Documentation updated - [ ] Benchmarks or performance comparison completed Commands and results: ```text make clippy # passed (all targets/features, -D warnings) cargo test -p agentenv --lib # 962 passed, 4 ignored cargo test -p overlaybd --test oss_backend_minio -- --ignored # 7 passed (Docker MinIO, uses the changed S3 client) ``` Skipped checks and reasons: - `make fmt`: no Rust source changes. - `make test-unit` / `make test` / `make test-ublk`: not run here. These need delegated capabilities, and the change has no source edits. Clippy and the unit and MinIO tests above cover compilation and the changed S3 client. - `make -C services test`: `services/` is unchanged. ## Risks and reviewer notes - `nix` 0.31 → 0.30 is a downgrade for `agentenv`. The workspace compiles cleanly with no source changes, so it uses no 0.31-only APIs. - The `aws-sdk-s3` feature change only affects `crates/test-support` (dev-only). ## Checklist - [x] The PR contains one coherent change and no unrelated formatting or refactoring. - [x] New behavior is covered by tests, or I explained why testing is impractical. - [x] Logs and examples contain no credentials, tokens, or private registry information. - [x] I did not manually edit generated code without updating its source and regenerating it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-29 14:22:54 +00:00