From 38e973b9993d1cb75ad34e8da762b9609b6b032e Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Tue, 13 Oct 2026 10:06:44 +0000 Subject: [PATCH] chore(deps): bump turso_core from 0.8.2 to 0.8.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Records the supply-chain delta audits the bump needs, which is what the dependabot PR (#2707) was missing: every rust job was green there except `Audit`, where `cargo vet --locked` reported the four turso crates unvetted at 0.8.3. Reviewed each published package diff against 0.8.2. turso_ext, turso_macros and turso_parser have no Rust source change at all — zero differing .rs files, only version strings and release metadata. turso_core changes nine Rust files, with no new dependencies, no new unsafe, and no new host filesystem, network or process access: * AUTOINCREMENT explicit-rowid advance now reads the backing table's is_called column, so a fresh sequence row (1, is_called = 0) no longer leaves the next generated id at a rowid an explicit INSERT already used. * An abandoned MVCC commit releases the connection's read transaction and, for the main database only, resets transaction state — state the dropped CommitStateMachine does not own and previously leaked. * Cursor seek reuse narrows from "position matches the seek key" to "position is the only row for that key". * The logical-log header upgrade returns the CRC-filled header for the caller to adopt instead of publishing it before the write lands, so a failed header write keeps the previous on-disk header and retries. turso_core remains BETA and gated behind the non-default `sqlite` feature, as knowledge/runtimes/sqlite-builtin.md describes. --- Cargo.lock | 28 ++++++++++++++-------------- supply-chain/audits.toml | 24 ++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 14 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6e73b4be8..47da8f4b8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -978,7 +978,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1722,7 +1722,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4800,7 +4800,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4858,7 +4858,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5603,7 +5603,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5941,9 +5941,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" [[package]] name = "turso_core" -version = "0.8.2" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fa832d4ab648bf139f1b18b29bef6d653b18fbd4a77b0e4846c57aaf28c215c" +checksum = "810ee7b139fd6aa9304cb2fa278c1be0bb964c92457e2a24c1d384196ce5e217" dependencies = [ "aegis", "aes 0.8.4", @@ -6013,9 +6013,9 @@ dependencies = [ [[package]] name = "turso_ext" -version = "0.8.2" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "07d9b915ee3c37d552597b07c05c127702a926ca0eac8843f248d693f4368155" +checksum = "e5003ed7e98f082fe4114627c8d7c7ab569c27766e9bd350a0c09af06ad3fd46" dependencies = [ "chrono", "getrandom 0.4.3", @@ -6024,9 +6024,9 @@ dependencies = [ [[package]] name = "turso_macros" -version = "0.8.2" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "476aa46d793a8aaae6d7a12f591d85eff039129264b1d441586528c88c3feacd" +checksum = "74770c0d0c8b272b479b5343f19dbd2f8f2677d85a4d6222fc214dcac2882beb" dependencies = [ "proc-macro2", "quote", @@ -6035,9 +6035,9 @@ dependencies = [ [[package]] name = "turso_parser" -version = "0.8.2" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e03bf6489a80da2e9bf08f22d0b8af4eb391dfa5e6f71e787031cd61a921a3c" +checksum = "a69bb856ec8306ad7ed1c13fc61de6a79452bf646ca53d99bb4cc646d5bfc4ff" dependencies = [ "bitflags 2.13.2", "memchr", @@ -6690,7 +6690,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 46e1c37a2..c7973901a 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -609,6 +609,12 @@ criteria = "safe-to-deploy" delta = "0.8.1 -> 0.8.2" notes = "Reviewed complete published package diff. Only Rust change fixes CDC UPDATE register indexing for virtual generated columns: skip virtual columns, use ColumnLayout.to_reg_offset, and consistently allocate and serialize twice num_non_virtual_cols registers. Both changed and unchanged column branches use the same mapping. No new unsafe code, host access, build scripts, or dependencies. Other changes are release metadata and matching Turso dependency versions." +[[audits.turso_core]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.2 -> 0.8.3" +notes = "Reviewed complete published package diff: nine Rust files changed, no new dependencies, no new unsafe code, no new build scripts, and no new host filesystem, network or process access. AUTOINCREMENT explicit-rowid advance now also reads the backing table's is_called column, so a fresh sequence row (1, is_called = 0) no longer leaves the next generated id at a rowid an explicit INSERT already used; the single Le comparison becomes Lt/Gt plus an is_called test, with the descending case mirrored. An abandoned MVCC commit now releases the connection's read transaction and, for the main database only, resets transaction state - state the dropped CommitStateMachine does not own and previously leaked. MVCC tombstone insertion for B-tree-resident rows moves into its own helper with the visibility and write-write conflict rules unchanged. Cursor seek reuse narrows from 'position matches the seek key' to 'position is the only row for that key', which requires a rowid, a whole index entry, or every column of a UNIQUE index with no NULL. The logical-log header upgrade returns the CRC-filled header for the caller to adopt instead of publishing it before the write lands, so a failed header write keeps the previous on-disk header and retries; a new fault-injecting file covers that path. Source safety review, not formal transactional proof." + [[audits.turso_ext]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -633,6 +639,12 @@ criteria = "safe-to-deploy" delta = "0.8.1 -> 0.8.2" notes = "Reviewed complete published package diff. Source files are byte-identical; only Cargo.toml, Cargo.lock, and .cargo_vcs_info.json release metadata changes. No runtime, unsafe, host access, or build-script changes." +[[audits.turso_ext]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.2 -> 0.8.3" +notes = "Reviewed complete published package diff: zero differing .rs files across the two published trees. Only the crate version and its matching turso_macros dependency version, plus Cargo.lock and .cargo_vcs_info.json release metadata. No runtime, unsafe, host access, or build-script changes; nothing to review beyond the version stamp." + [[audits.turso_macros]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -657,6 +669,12 @@ criteria = "safe-to-deploy" delta = "0.8.1 -> 0.8.2" notes = "Reviewed complete published package diff. Source files are byte-identical; only Cargo.toml, Cargo.lock, and .cargo_vcs_info.json release metadata changes. No runtime, unsafe, host access, or build-script changes." +[[audits.turso_macros]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.2 -> 0.8.3" +notes = "Reviewed complete published package diff: zero differing .rs files across the two published trees. Only the crate version, plus Cargo.lock and .cargo_vcs_info.json release metadata. No runtime, unsafe, host access, or build-script changes; nothing to review beyond the version stamp." + [[audits.turso_parser]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -681,6 +699,12 @@ criteria = "safe-to-deploy" delta = "0.8.1 -> 0.8.2" notes = "Reviewed complete published package diff. Source files are byte-identical; only Cargo.toml, Cargo.lock, and .cargo_vcs_info.json release metadata changes. No runtime, unsafe, host access, or build-script changes." +[[audits.turso_parser]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.2 -> 0.8.3" +notes = "Reviewed complete published package diff: zero differing .rs files across the two published trees. Only the crate version and its matching turso_macros dependency version, plus Cargo.lock and .cargo_vcs_info.json release metadata. No runtime, unsafe, host access, or build-script changes; nothing to review beyond the version stamp." + [[audits.twox-hash]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy"