Tracking issue for updating dependencies

[jtgeibel]

API Changes

These require code changes to address API changes.

• tar - a80193e
• openssl part 1 - b4fc94f
• openssl part 2 - 8036a78
• hyper - Update to new hyper API and run cargo update #1289
• flate2 - bd0cd6d
• envlogger - ac9d73d
• hex - dccee42
• lettre - 822735e
• oauth2 - Bump to oauth2:2.0.0 #1842
• jemalloc and jemalloc-ctl - to 0.3.2 - Upgrade jemallocator #1953 and Disable the background_threads jemallocator feature #1956
• cookie - 0.11 to 0.12, will also need to upstream a change to conduit-cookie Bump to alpha releases of conduit-* crates #2208
• dotenv - 0.11 to 0.15 - Update chrono, dotenv, num-*, migrations_macros, and derive_deref #1917
• hex - 0.3 to 0.4 Update hex to 0.4 #2256

Version bump

These should just be a version bump in Cargo.toml.

• url - 1.7 to 2.1 (needs to wait for newer oauth2 3.0 alpha)
• comrak - 0.4 to 0.7 - Bump to comrak 0.7 #2513
• dotenv - 0.10 to 0.11 - Bump dotenv #1391
• itertools - 0.6 to 0.7
• base64 - 0.6 to 0.9
• log - 0.3 to 0.4
• comrak - 0.2 to 0.4 Update to the latest comrak and ammonia for processing markdown #1664
• ammonia - 1.0 to 2.0 Update to the latest comrak and ammonia for processing markdown #1664
• git2 - 0.6 to 0.8 Bump git2 and remove dependency on cmake #1663
• env_logger - 0.5 to 0.7 - Update env_logger to 0.7 #2236
• docopt - 0.8 to 1.1 Bump docopt 0.8 -> 1.1.0 #1812
• toml - 0.4 to 0.5 Update toml to 0.5 #2430
• git2 - 0.8 to 0.13 Update git2 to 0.13 #2467
• ammonia - 2.0 to 3.0 - Ammonia 3.0 upgrade #1876
• rand - 0.6 to 0.7 - Bump to rand 0.7 #2512
• base64 - 0.9 to 0.11 (also bump in s3) Bump to alpha releases of conduit-* crates #2208
• parking_lot - 0.7 to 0.10 - Update parking_lot to 0.10 #2223
• handlebars - 2 to 3 Update handlebars to 3.0.1 #2259

External

conduit-git-http-backend

We could switch to libflate however it is no longer pulled in by reqwest by default and we've consolidated on a single version of flate2 so this isn't a priority.

• Bump to flate2 1.0 - Bump to alpha releases of conduit-* crates #2208

conduit-cookie

• base64 - we can bump to 0.11 in src/s3, but the old version is still pulled in and it would be nice to land Bump the version of base64 from 0.6 to 0.11 conduit-rust/conduit-cookie#6 - Bump to alpha releases of conduit-* crates #2208
• cookie - from 0.11 to 0.12 - Bump to alpha releases of conduit-* crates #2208
• ring - from 0.13 to 0.14 - Bump to alpha releases of conduit-* crates #2208
• ring - from 0.14 to 0.16

[sgrif]

@jtgeibel I think we should chat about a plan for this. Want to ping me on gitter and set up a call?

[jtgeibel]

@sgrif yeah that sounds good to me. I've just created a gitter account and will reach out to you there.

[jtgeibel]

I'm going to close this as effectively complete after 2+ years! The only remaining update is for url 1.7 to 2.1, however this would require bumping to an alpha release of oauth2. (We could also update to base64 0.12 however there is no point in pulling in a 4th version of this crate until it is pulled into the tree via some other dependency.)

There is a bit more work to do to incrementally cargo update portions of the dependency tree, but we've already made good progress on that and beyond the exceptions above no changes to Cargo.toml remain at this time.

[carols10cents]

Hooray!!!! Would we be able to and want to enable dependabot for Rust deps now?

[jtgeibel]

Would we be able to and want to enable dependabot for Rust deps now?

Very soon I hope! We just need to do a cargo update to get all semver compatible changes into the lockfile. The last few times we tried this we were getting segfaults in production, but it has been a while since we tried a full update like that and we've made a lot of progress since in updating portions of the tree without issue.

For instance we did a cargo update -p reqwest --aggressive which updated a good portion of dependencies. We can probably slice off a few other pieces of functionality like git, serde, and readme rendering. I think we can get there with another 3 PRs or so following this sort of conservative approach.