fix(deps): update rust crate sqlx to 0.9#94
Conversation
|
208d63e to
e461b46
Compare
Walkthroughバックエンドの ChangesSQLx 依存関係アップグレード
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/backend/Cargo.toml`:
- Line 56: The dependency line sqlx = { version = "0.9", features =
["runtime-tokio-rustls", "postgres", "time"] } requires MSRV 1.94.0, so add
rust-version = "1.94.0" to the same Cargo.toml containing that sqlx entry and
also pin the CI toolchain (create or update rust-toolchain.toml or set the
dtolnay/rust-toolchain action to channel 1.94.0) so CI uses Rust 1.94.0
consistently; ensure changes reference the existing sqlx declaration and the
rust-version key to make the MSRV explicit.
- Line 56: The public APIs in jobs (e.g., the connect/setup functions referenced
in apps/backend/src/jobs/mod.rs and apps/backend/src/jobs/github_webhook.rs)
expose Result<..., sqlx::Error>, which can clash because apalis-postgres pulls
sqlx 0.8 while the crate uses sqlx 0.9; change those function signatures to
return a non-sqlx public error type (for example anyhow::Error or Box<dyn
std::error::Error + Send + Sync>) or the apalis_postgres-specific error type,
and map/convert any internal sqlx errors to that chosen type before returning
(use .map_err(|e| e.into() / anyhow::Error::from(e)) in the connect/setup and
related functions so callers never see sqlx::Error across the crate boundary).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 3a24f089-ce72-475d-bfbd-d114de36b944
📒 Files selected for processing (1)
apps/backend/Cargo.toml
e461b46 to
1bb6dff
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
apps/backend/Cargo.toml (1)
56-56:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift既存の主要な懸念事項が未解決のまま、SQLx 0.9 の破壊的変更による影響確認が必要です
過去のレビューで指摘された2つの重大な問題(MSRV 1.94.0 の未設定、
apalis-postgresとの sqlx バージョン競合)が未解決です。さらに、PR の説明に記載されている SQLx 0.9 の破壊的変更(query*()のSqlStr要件、Migrateトレイトの変更、型・ライフタイムパラメータの調整、Postgres 固有の動作変更)がコードベースに影響を与えないか確認が必要です。以下のスクリプトで、sqlx 0.9 へのアップグレード後もコンパイルとテストが通るか検証してください:
#!/bin/bash set -euo pipefail echo "== Cargo.toml の sqlx バージョン確認 ==" rg -n 'sqlx.*version' apps/backend/Cargo.toml echo echo "== cargo check でコンパイル確認 ==" cd apps/backend cargo check 2>&1 | head -100 echo echo "== 依存関係の競合確認(sqlx 0.8 と 0.9 の混在) ==" cargo tree -p sqlx 2>&1 | head -50🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/backend/Cargo.toml` at line 56, The Cargo.toml upgrade to sqlx = "0.9" may break build and conflicts with apalis-postgres and MSRV requirements; run the provided verification script in the repository root to (1) confirm the sqlx version entry in apps/backend/Cargo.toml, (2) run cargo check in apps/backend to surface compile errors caused by sqlx 0.9 breaking changes (e.g., query*() requiring SqlStr, Migrate trait signature changes, type/lifetime parameter adjustments, Postgres-specific behavior), and (3) inspect cargo tree -p sqlx to detect mixed 0.8/0.9 dependencies and apalis-postgres version mismatches; if issues appear, either pin sqlx back to a compatible 0.8 version or update dependent crates (including apalis-postgres) and adjust code paths that use query*(), Migrate implementations, and any Postgres-specific APIs to the sqlx 0.9 signatures, and ensure MSRV is set to >=1.94.0 in CI/toolchain configuration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@apps/backend/Cargo.toml`:
- Line 56: The Cargo.toml upgrade to sqlx = "0.9" may break build and conflicts
with apalis-postgres and MSRV requirements; run the provided verification script
in the repository root to (1) confirm the sqlx version entry in
apps/backend/Cargo.toml, (2) run cargo check in apps/backend to surface compile
errors caused by sqlx 0.9 breaking changes (e.g., query*() requiring SqlStr,
Migrate trait signature changes, type/lifetime parameter adjustments,
Postgres-specific behavior), and (3) inspect cargo tree -p sqlx to detect mixed
0.8/0.9 dependencies and apalis-postgres version mismatches; if issues appear,
either pin sqlx back to a compatible 0.8 version or update dependent crates
(including apalis-postgres) and adjust code paths that use query*(), Migrate
implementations, and any Postgres-specific APIs to the sqlx 0.9 signatures, and
ensure MSRV is set to >=1.94.0 in CI/toolchain configuration.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e9ffbdff-e52a-40fb-b04b-4fe96b1d928c
📒 Files selected for processing (1)
apps/backend/Cargo.toml
1bb6dff to
ac6de56
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/backend/Cargo.toml (1)
9-18:⚠️ Potential issue | 🟠 MajorSeaORM側はsqlx 0.9に追従できているが、sqlx 0.8/0.9の同居が残っている点を要確認
apps/backend/Cargo.tomlではsea-orm = 2.0.0-rc.38を指定している一方、Cargo.lock上はsea-orm = 2.0.0-rc.40に解決されており、sea-ormが必要とするsqlx/sqlx-coreは0.9.0になっている(SeaORM→sqlx 0.9 の互換性懸念は、解決済みのrc.40前提では解消している)。- ただし
Cargo.lockにはsqlx 0.8.6 / sqlx-core 0.8.6も残存しており、sqlx 0.8.xとsqlx 0.9.0が同居している(例:apalis-postgres = 1.0.0-rc.8側が0.8系を引いている可能性)。jobs/mod.rsのようにsqlx::Error等を公開APIの型として露出している場合は、型分裂による境界エラー/コンパイル不整合に繋がり得る。sqlx = 0.9の破壊的変更(直接利用しているPgPool/クエリAPI等)については、実コード上のsqlx依存箇所の洗い出しと反映が必要。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/backend/Cargo.toml` around lines 9 - 18, The crate currently has mixed sqlx 0.8/0.9 in the dependency graph (Cargo.toml lists sea-orm = 2.0.0-rc.38 while Cargo.lock resolved rc.40 -> sqlx 0.9), which risks type/ABI split especially where you publicly expose sqlx types (e.g., jobs/mod.rs exposing sqlx::Error). Fix by aligning dependencies: update Cargo.toml to depend on the sea-orm version that Cargo.lock resolved (or run cargo update -p sea-orm to rc.40) and ensure transitive crates (like apalis-postgres) are upgraded to versions that use sqlx 0.9, or add a [patch.crates-io] override to force sqlx = "0.9" (or upgrade the conflicting crate) so only sqlx 0.9 is present; additionally, in jobs/mod.rs stop exposing sqlx::Error in your public API—wrap/convert sqlx errors into your crate error type (or re-export a single sqlx type) to avoid cross-version type leakage.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/backend/Cargo.toml`:
- Line 56: The project has mixed sqlx 0.8 and 0.9 artifacts and jobs/mod.rs uses
apalis_postgres::PgPool::connect(...).await with a return type of sqlx::Error;
to fix, ensure sqlx and apalis-postgres are aligned: pick the sqlx major version
you intend (0.9 or 0.8), update apps/backend/Cargo.toml to depend on that exact
sqlx version (and adjust apalis-postgres version if it requires a specific
sqlx), run cargo update to regenerate Cargo.lock so only one sqlx is resolved,
and in apps/backend/src/jobs/mod.rs replace or reconcile the error type used in
the connect call (use the error type exported by the chosen apalis_postgres
version or the matching sqlx::Error from the aligned sqlx) so types match
apalis_postgres::PgPool::connect signature.
---
Outside diff comments:
In `@apps/backend/Cargo.toml`:
- Around line 9-18: The crate currently has mixed sqlx 0.8/0.9 in the dependency
graph (Cargo.toml lists sea-orm = 2.0.0-rc.38 while Cargo.lock resolved rc.40 ->
sqlx 0.9), which risks type/ABI split especially where you publicly expose sqlx
types (e.g., jobs/mod.rs exposing sqlx::Error). Fix by aligning dependencies:
update Cargo.toml to depend on the sea-orm version that Cargo.lock resolved (or
run cargo update -p sea-orm to rc.40) and ensure transitive crates (like
apalis-postgres) are upgraded to versions that use sqlx 0.9, or add a
[patch.crates-io] override to force sqlx = "0.9" (or upgrade the conflicting
crate) so only sqlx 0.9 is present; additionally, in jobs/mod.rs stop exposing
sqlx::Error in your public API—wrap/convert sqlx errors into your crate error
type (or re-export a single sqlx type) to avoid cross-version type leakage.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6222f3bd-3ba8-48c5-a1e1-8c4ccb2fafa9
📒 Files selected for processing (1)
apps/backend/Cargo.toml
ac6de56 to
2a19cab
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/backend/Cargo.toml`:
- Around line 55-56: The project mixes sqlx 0.9 with apalis-postgres =
"1.0.0-rc.8" which depends on sqlx ^0.8.1 causing duplicate sqlx versions and
trait/type mismatches; either bump apalis-postgres to a release that explicitly
supports sqlx 0.9 or revert sqlx to the 0.8.x series so only one sqlx version is
resolved (then regenerate Cargo.lock), and add an explicit MSRV declaration
(e.g. rust-version = "1.94" in Cargo.toml or add .tool-versions/.rust-version)
so the CI and contributors target the required Rust toolchain. Ensure references
to apalis-postgres and sqlx in Cargo.toml are updated consistently and verify
cargo build passes without multiple sqlx versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 488f548d-daf0-4929-8381-5fe04a854dd3
📒 Files selected for processing (1)
apps/backend/Cargo.toml
| apalis-postgres = { version = "1.0.0-rc.8", default-features = false, features = ["migrate", "tokio-comp", "time"] } | ||
| sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "time"] } | ||
| sqlx = { version = "0.9", features = ["runtime-tokio-rustls", "postgres", "time"] } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: プロジェクトの rust-version と apalis-postgres の sqlx 依存を検証
echo "== 1) プロジェクトの rust-version / MSRV 設定 =="
rg -n 'rust-version\s*=' Cargo.toml apps/*/Cargo.toml || echo "rust-version が Cargo.toml に見つかりません"
echo ""
echo "== 2) .tool-versions / .rust-version =="
cat .tool-versions 2>/dev/null || echo ".tool-versions が見つかりません"
cat .rust-version 2>/dev/null || echo ".rust-version が見つかりません"
echo ""
echo "== 3) CI 設定での Rust バージョン(参考)=="
fd -e yml -e yaml . .github/workflows | head -n 5 | xargs rg 'rust.*version|toolchain' 2>/dev/null || echo "CI 設定が見つかりません"
echo ""
echo "== 4) Cargo.lock 内の sqlx バージョン解決状況 =="
rg -A 2 'name = "sqlx"' apps/backend/Cargo.lock | head -n 30
echo ""
echo "== 5) apalis-postgres の Cargo.toml 依存(crates.io メタデータ確認)=="
# apalis-postgres 1.0.0-rc.8 が sqlx 0.9 をサポートしているか確認
curl -s https://crates.io/api/v1/crates/apalis-postgres/1.0.0-rc.8/dependencies | \
jq '.dependencies[] | select(.crate_id == "sqlx") | {crate_id, req}'Repository: koyori-app/task
Length of output: 922
🌐 Web query:
apalis-postgres 1.0.0-rc.8 は sqlx 0.9 をサポートしていますか?
💡 Result:
apalis-postgres バージョン 1.0.0-rc.8 は、sqlx 0.9 をサポートしていません。 公式の依存関係情報によると、apalis-postgres 1.0.0-rc.8 は sqlx のバージョンとして「^0.8.1」を要求しています [1][2]。そのため、sqlx 0.9 との互換性はありません。
Citations:
sqlx 0.9 アップグレードは apalis-postgres との依存互換性(+MSRV明示)を見直す必要あり
apalis-postgres1.0.0-rc.8 はsqlx ^0.8.1を要求しておりsqlx0.9 としては噛み合わないため、apps/backend/Cargo.lockにsqlx 0.8.6とsqlx 0.9.0が併存しています(型/trait 不整合の原因になります)。- MSRV:
rust-version/.rust-version/.tool-versionsの明示がなく、sqlx 0.9の Rust 1.94.0+ 要求をプロジェクト要件として担保できません(CI は stable 固定のみ)。
apalis-postgres を sqlx 0.9 対応のバージョンへ上げる(または sqlx を 0.8 系へ戻す)+ rust-version = "1.94" 等で MSRV を明示してください。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/backend/Cargo.toml` around lines 55 - 56, The project mixes sqlx 0.9
with apalis-postgres = "1.0.0-rc.8" which depends on sqlx ^0.8.1 causing
duplicate sqlx versions and trait/type mismatches; either bump apalis-postgres
to a release that explicitly supports sqlx 0.9 or revert sqlx to the 0.8.x
series so only one sqlx version is resolved (then regenerate Cargo.lock), and
add an explicit MSRV declaration (e.g. rust-version = "1.94" in Cargo.toml or
add .tool-versions/.rust-version) so the CI and contributors target the required
Rust toolchain. Ensure references to apalis-postgres and sqlx in Cargo.toml are
updated consistently and verify cargo build passes without multiple sqlx
versions.
This PR contains the following updates:
0.8→0.9Release Notes
launchbadge/sqlx (sqlx)
v0.9.0Compare Source
Important Announcements
New Github Organization
Shortly after this release is published, the SQLx repository will be transferred to a new GitHub organization:
https://github.com/transact-rs/
This is because SQLx has not been owned or maintained by LaunchBadge, LLC. for a few years now, and has since been
informally transferred to the collective ownership of its principal authors. Moving the repository to a new
organization makes this change more clear, and also allows for potentially inviting outside collaborators.
Cargo.lockRemoved from TrackingThe
Cargo.lockhas been removed from tracking in Git. CI should now always test with the latest versions ofall dependencies by default, alongside our pass that checks with
cargo generate-lockfile -Z minimal-versions.This should eliminate the need for any PRs that update dependencies to also update
Cargo.lockorcontend with an endless stream of merge conflicts against it.
N.B.
cargo install --locked sqlx-cliwill no longer work. However,cargo install sqlx-clihas alwaysused the latest dependencies by default, ignoring the lockfile, so most users should not be affected. For users
requiring reproducible builds, consider maintaining your own lockfile instead; historically, we only ran
cargo updatesporadically, so relying on SQLx's lockfile offered few guarantees anyway.
See the manual page for
cargo installfor details.Breaking
As per our MSRV policy, the supported Rust version for this release cycle is
1.94.0.sqlx.tomlformat [[@abonander]]sqlx-clinow support per-crate configuration files (sqlx.toml)DATABASE_URLfor a crate (for multi-database workspaces)_sqlx_migrationstable (for multiple crates using the same database)sqlx-tomlto use.sqlx-clihas it enabled by default, butsqlxdoes not.so it's better to keep the default feature set as limited as possible.
This is something we learned the hard way.
sqlx::_configmodule in documentation.DATABASE_URLrenaming and global type overrides: [Link]_sqlx_migrationsrenaming and multiple schemas: [Link]chronowhentimeis enabled (e.g. when usingtower-sessions-sqlx-store): [Link]bigdecimalwhenrust_decimalis enabled is also shown, but problems withchrono/timeare more common.Migratetraitsqlx::migrate::resolve_blocking()is now#[doc(hidden)]and thus SemVer-exempt.tracinglogs from SQLx will need to update the spelling.PgAdvisoryLockGuard[[@bonsairobo]]Migrator::set_ignore_missingandset_lockingnow return&mut Selfinstead of&Selfwhich may break code in rare circumstances.
query!()macros for certain queries in Postgres.RawSqllifetime issues [[@abonander]]DBtype parameter to all methods ofRawSqlDecode,EncodeandTypeforBox,Arc,CowandRc[[@joeydewaal]]impl Decode for Cownow always decodesCow::Owned, lifetime is unlinkedquery*()functions now takeimpl SqlSafeStrwhich is only implemented for
&'static strandAssertSqlSafe.For all others, wrap in
AssertSqlSafe(<query>).Query<'static, DB>.SqlSafeStrtrait is deliberately similar tostd::panic::UnwindSafe,serving as a speedbump to warn users about naïvely building queries with
format!()while allowing a workaround for advanced usage that is easy to spot on code review.
PgConnectOptions::options()are now automatically escaped.Manual escaping of options is no longer necessary and may cause incorrect behavior.
runtime-tokio-native-tls)TransactionManagertrait insqlx.#[doc(hidden)],but it will break SeaORM if not proactively fixed.
str[[@abonander]]Vec<u8>will be inferred to beString(this should ultimately fix more code than it breaks).
SET NAMES utf8mb4 COLLATE utf8_general_ciis no longer sent by default; instead,SET NAMES utf8mb4is sent toallow the server to select the appropriate default collation (since this is version- and configuration-dependent).
MySqlConnectOptions::charset()and::collation()now imply::set_names(true)because they don't do anything otherwise.charsetdoesn't change what's sent in theProtocol::HandshakeResponse41packet as that normally onlymatters for error messages before
SET NAMESis sent.The default collation if
set_names = falseisutf8mb4_general_ci.RawSql::fetch_optional()now returnssqlx::Result<Option<DB::Row>>instead of
sqlx::Result<DB::Row>. Whoops.libsqlite3-sysversioning, feature flags, safety changes [[@abonander]]libsqlite3-sysversion is now specified using a range.The maximum of the range may now be increased in any backwards-compatible release.
The minimum of the range may only be increased in major releases.
If you have
libsqlite3-sysin your dependencies, Cargo should choose a compatible version automatically.If otherwise unconstrained, Cargo should choose the latest version supported.
sqlx-tomlfeature) is nowunsafe.sqlite-deserializeenablingSqliteConnection::serialize()andSqliteConnection::deserialize()sqlite-load-extensionenablingSqliteConnectOptions::extension()and::extension_with_entrypoint()sqlite-unlock-notifyenables internal use ofsqlite3_unlock_notify()SqliteValueandSqliteValueRefchanges:sqlite3_value*interface reserves the right to be stateful.Without protection, any call could theoretically invalidate values previously returned, leading to dangling pointers.
SqliteValueis now!SyncandSqliteValueRefis!Sendto prevent data races from concurrent accesses.SqliteValueinMutex, or convert theSqliteValueRefto an owned value.SqliteValueand any derivedSqliteValueRefs now internally track if that value has been used to decode aborrowed
&[u8]or&strand errors if it's used to decode any other type.per
SqliteValue/SqliteValueRef.SqliteValuefor details.PgLTree::fromtoFrom<Vec<PgLTreeLabel>>implementation [[@JerryQ17]]SqliteArguments[[@iamjpotts]].pgpassfile handling did not process backslash-escapes in the password part.Now it does, which may change what password is sent to the server.
#[derive(sqlx::Type)]automatically generateimpl PgHasArrayTypeby default for newtype structs [[@papaj-na-wrotkach]]Delete the manual impl or add
#[sqlx(no_pg_array)]where conflicts occur.offlineoptional to allow building withoutserde[[@CathalMullan]]mysql-rsafeatureor an error will be generated at runtime. RSA encryption is only used for plaintext (non-TLS) connections.
AnyTypeInfo[[@abonander]]Added
Arc<str>andArc<[u8]>(andRcequivalents) [[@joeydewaal]]runtime-smolandruntime-async-global-executorfeatures to replace usages of the deprecatedasync-stdcrate.no_txmigration support [[@AlexTMjugador]]Migrator::with_migrations()constructor [[@xb284524239]]sqlx.toml, update SQLite extension example [[@supleed2]]Json::into_inner()[[@chrxn1c]]SqlStr[[@joeydewaal]]PgNotificationstruct clone [[@michaelvanstraten]]Changed
OnceCell/Lazywith stdOnceLock/LazyLock[[@paolobarbolini]]Debugimplementations acrossPgRow,MySqlRowandSqliteRow[[@davidcornu]]QueryLoggerback [[@joeydewaal]].bind()inREADME.md[[@sobolevn]]randetceterato0.11.0libsqlite3-sysversion range to<0.38.0Fixed
futuresandfutures-util[[@paolobarbolini]]Pool.close: close all connections before returning [[@jpmelos]]ROLLBACKtransaction when dropped duringBEGIN. [[@kevincox]].envloading, caching, and invalidation [[@abonander]]which served as a useful comparison.
Command::cargo_bin()[[@abonander]]SASLprep[[@var4yn]]from_utf8_uncheckedwithfrom_utf8in SQLite column name handling [[@barry3406]]StdSocket::poll_ready()[[@abonander]]Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Summary by CodeRabbit