From 5d6167a4d3c13f5094ad56075a2c75f1bb2e239c Mon Sep 17 00:00:00 2001 From: J3vb <192430104+J3vb@users.noreply.github.com> Date: Wed, 19 Aug 2026 06:48:40 +0200 Subject: [PATCH] fix(deps): bump h2 to 0.4.16 to clear RUSTSEC-2026-0258 (#1390) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(deps): bump h2 to 0.4.16 to clear RUSTSEC-2026-0258 The Rust dependency audit step in Tauri Full Build fails on h2 0.4.13, which RustSec patches at >=0.4.16. h2 is transitive (hyper -> reqwest), so this is a lockfile-only bump. Edited the h2 stanza directly rather than running `cargo update -p h2 --precise`: that command also re-unified ten unrelated windows-sys references down a minor, churn this change has no reason to carry. `cargo metadata --locked` accepts the edited lockfile, which is the resolver confirming it is a valid resolution. reqwest (0.12.28, 0.13.2), hyper 1.8.1, hyper-rustls 0.27.7 and rustls 0.23.43 are all unchanged, so the preconfigured-ClientConfig seam that tauri-plugin-updater's minor pin protects is untouched. cargo audit now exits 0; the 19 remaining entries are unmaintained/yanked warnings (atk and the rest of the GTK3 tree under wry), which the audit does not fail on and which only Tauri upstream can retire. Co-Authored-By: Claude Opus 5 (1M context) * test(ws): join the load-soak drain goroutines instead of racing goleak TestTheLoadTest closed each anchor's stopDrain channel and then relied on a 300ms sleep for the drain goroutines to actually exit before the deferred goleak.VerifyNone ran. Closing the channel only makes those goroutines runnable — it does not wait for the scheduler to run them. On windows-latest the whole test takes ~126s under -race with 20 churn workers and 6 broadcasters saturating the runner, and goleak's bounded retry window can expire while all 8 drains are still sitting in state "runnable". CI then fails with "found unexpected goroutines" pointing at load_soak_test.go:127 even though nothing actually leaks. Track the drains on a WaitGroup and join them right after the stopDrain channels close. The wait happens in the test body, and goleak.VerifyNone is deferred, so the check can no longer observe a drain that has been signalled but not yet scheduled. Co-Authored-By: Claude Opus 5 (1M context) --------- Co-authored-by: Claude Opus 5 (1M context) --- Client/tauri-client/src-tauri/Cargo.lock | 4 ++-- Server/ws/load_soak_test.go | 8 ++++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/Client/tauri-client/src-tauri/Cargo.lock b/Client/tauri-client/src-tauri/Cargo.lock index d82b92ee..d460e07b 100644 --- a/Client/tauri-client/src-tauri/Cargo.lock +++ b/Client/tauri-client/src-tauri/Cargo.lock @@ -1766,9 +1766,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.13" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54" +checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" dependencies = [ "atomic-waker", "bytes", diff --git a/Server/ws/load_soak_test.go b/Server/ws/load_soak_test.go index a00b9585..b79ddc03 100644 --- a/Server/ws/load_soak_test.go +++ b/Server/ws/load_soak_test.go @@ -112,6 +112,11 @@ func TestTheLoadTest(t *testing.T) { stopDrain chan struct{} } anchors := make([]anchor, 0, numAnchors) + // Joined explicitly after the stopDrain channels close: closing `stop` + // only makes these goroutines runnable, it does not wait for them to be + // scheduled. Without the join, goleak's bounded retry races the scheduler + // and fails on a loaded runner even though the drains do exit. + var drainWG sync.WaitGroup for i := range numAnchors { u := seedOwnerUser(t, database, fmt.Sprintf("load-anchor-%d", i)) send := make(chan []byte, 1024) @@ -122,7 +127,9 @@ func TestTheLoadTest(t *testing.T) { // full-buffer auto-disconnect (BUG-124 behavior) — that disconnect is // correct production behavior but not what this test means to probe. stop := make(chan struct{}) + drainWG.Add(1) go func(ch chan []byte, stop chan struct{}) { + defer drainWG.Done() for { select { case <-ch: @@ -285,6 +292,7 @@ func TestTheLoadTest(t *testing.T) { for _, a := range anchors { close(a.stopDrain) } + drainWG.Wait() // SendMessage fires mention-count bookkeeping with a bare `go fn()` and // deliberately does not wait for it (see MessageService.bg) — that is the