deps(core)(deps): update bincode requirement from 1 to 3 in /src/lib/mlxcel-core#10
deps(core)(deps): update bincode requirement from 1 to 3 in /src/lib/mlxcel-core#10dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [bincode](https://github.com/bincode-org/bincode) to permit the latest version. - [Commits](https://github.com/bincode-org/bincode/commits) --- updated-dependencies: - dependency-name: bincode dependency-version: 3.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
5a659c2 to
2f14fa3
Compare
|
Closing — superseded by the postcard migration scheduled for #8. The mlxcel team has decided to migrate
So this auto-generated security update is no longer applicable. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
…16) Closes #8. Migrates `mlxcel-core`'s `TokenLanguageIndex` on-disk cache off the unmaintained `bincode` 1.x (RUSTSEC-2025-0141 — project permanently ceased development) to `postcard` 1.x. ## Architectural choice — postcard - Drop-in serde-based API (`postcard::to_allocvec(&v)?` / `postcard::from_bytes::<T>(&bytes)?`) — minimal call-site change. - 1.0+ stable with frozen wire format — protects production users' cache compatibility across future dependency upgrades. - Embedded Rust ecosystem standard — natural fit for an inference-runtime cache. Alternatives considered: `bitcode` (faster but pre-1.0, wire-format changes between minors), `rkyv` (zero-copy over-engineering for a startup-time cache), `bincode` 2.x / 3.x (different maintainer team, name-confusion risk — Dependabot's auto-PR #10 to bincode 3.x was explicitly closed in favor of this approach). ## Cache compatibility — graceful degradation `lang_analyzer/cache.rs` already has corrupt-detection: a deserialization failure renames the existing bincode-format file to `*.broken.<epoch>.bak` and rebuilds the cache from source. Users upgrading from a prior mlxcel release will trip this path automatically on the first cache read — no explicit migration code needed. ## Scope (3 files + Cargo.lock) - `src/lib/mlxcel-core/Cargo.toml` — `bincode = "1"` → `postcard = { version = "1", features = ["alloc"] }` - `src/lib/mlxcel-core/src/lang_analyzer/cache.rs` — 3 call sites + doc comments - `src/lib/mlxcel-core/src/lang_analyzer/mod.rs` — error variant `Bincode` → `Postcard` (no external match-arms on it, safe rename) - `deny.toml` — RUSTSEC-2025-0141 `[advisories.ignore]` entry removed (no longer applicable) Verified locally: `cargo deny check` clean (advisories ok, bans ok, licenses ok, sources ok); `cargo tree -p mlxcel-core -i bincode` returns "package not found" — bincode is fully removed from the dependency tree. Self-hosted clippy + test gate is queued behind the PR #14 cold-build backlog at merge time; will run on main after the runner clears.
Updates the requirements on bincode to permit the latest version.
Commits