chore(deps): update rust crate sqlx to 0.9.0 #17
No reviewers
Labels
No labels
bug
duplicate
enhancement
help wanted
invalid
question
renovate-bot
renovate-security
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
LibrePages/conductor!17
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/sqlx-0.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
0.6.1->0.9.0Release Notes
launchbadge/sqlx (sqlx)
v0.9.0Compare Source
Important Announcements
New Github Organization
Shortly after this release is published, the SQLx repository will be transferred to a new GitHub organization:
https://github.com/transact-rs/
This is because SQLx has not been owned or maintained by LaunchBadge, LLC. for a few years now, and has since been
informally transferred to the collective ownership of its principal authors. Moving the repository to a new
organization makes this change more clear, and also allows for potentially inviting outside collaborators.
Cargo.lockRemoved from TrackingThe
Cargo.lockhas been removed from tracking in Git. CI should now always test with the latest versions ofall dependencies by default, alongside our pass that checks with
cargo generate-lockfile -Z minimal-versions.This should eliminate the need for any PRs that update dependencies to also update
Cargo.lockorcontend with an endless stream of merge conflicts against it.
N.B.
cargo install --locked sqlx-cliwill no longer work. However,cargo install sqlx-clihas alwaysused the latest dependencies by default, ignoring the lockfile, so most users should not be affected. For users
requiring reproducible builds, consider maintaining your own lockfile instead; historically, we only ran
cargo updatesporadically, so relying on SQLx's lockfile offered few guarantees anyway.
See the manual page for
cargo installfor details.Breaking
As per our MSRV policy, the supported Rust version for this release cycle is
1.94.0.sqlx.tomlformat [[@abonander]]sqlx-clinow support per-crate configuration files (sqlx.toml)DATABASE_URLfor a crate (for multi-database workspaces)_sqlx_migrationstable (for multiple crates using the same database)sqlx-tomlto use.sqlx-clihas it enabled by default, butsqlxdoes not.so it's better to keep the default feature set as limited as possible.
This is something we learned the hard way.
sqlx::_configmodule in documentation.DATABASE_URLrenaming and global type overrides: [Link]_sqlx_migrationsrenaming and multiple schemas: [Link]chronowhentimeis enabled (e.g. when usingtower-sessions-sqlx-store): [Link]bigdecimalwhenrust_decimalis enabled is also shown, but problems withchrono/timeare more common.Migratetraitsqlx::migrate::resolve_blocking()is now#[doc(hidden)]and thus SemVer-exempt.tracinglogs from SQLx will need to update the spelling.PgAdvisoryLockGuard[[@bonsairobo]]Migrator::set_ignore_missingandset_lockingnow return&mut Selfinstead of&Selfwhich may break code in rare circumstances.
query!()macros for certain queries in Postgres.RawSqllifetime issues [[@abonander]]DBtype parameter to all methods ofRawSqlDecode,EncodeandTypeforBox,Arc,CowandRc[[@joeydewaal]]impl Decode for Cownow always decodesCow::Owned, lifetime is unlinkedquery*()functions now takeimpl SqlSafeStrwhich is only implemented for
&'static strandAssertSqlSafe.For all others, wrap in
AssertSqlSafe(<query>).Query<'static, DB>.SqlSafeStrtrait is deliberately similar tostd::panic::UnwindSafe,serving as a speedbump to warn users about naïvely building queries with
format!()while allowing a workaround for advanced usage that is easy to spot on code review.
PgConnectOptions::options()are now automatically escaped.Manual escaping of options is no longer necessary and may cause incorrect behavior.
runtime-tokio-native-tls)TransactionManagertrait insqlx.#[doc(hidden)],but it will break SeaORM if not proactively fixed.
str[[@abonander]]Vec<u8>will be inferred to beString(this should ultimately fix more code than it breaks).
SET NAMES utf8mb4 COLLATE utf8_general_ciis no longer sent by default; instead,SET NAMES utf8mb4is sent toallow the server to select the appropriate default collation (since this is version- and configuration-dependent).
MySqlConnectOptions::charset()and::collation()now imply::set_names(true)because they don't do anything otherwise.charsetdoesn't change what's sent in theProtocol::HandshakeResponse41packet as that normally onlymatters for error messages before
SET NAMESis sent.The default collation if
set_names = falseisutf8mb4_general_ci.RawSql::fetch_optional()now returnssqlx::Result<Option<DB::Row>>instead of
sqlx::Result<DB::Row>. Whoops.libsqlite3-sysversioning, feature flags, safety changes [[@abonander]]libsqlite3-sysversion is now specified using a range.The maximum of the range may now be increased in any backwards-compatible release.
The minimum of the range may only be increased in major releases.
If you have
libsqlite3-sysin your dependencies, Cargo should choose a compatible version automatically.If otherwise unconstrained, Cargo should choose the latest version supported.
sqlx-tomlfeature) is nowunsafe.sqlite-deserializeenablingSqliteConnection::serialize()andSqliteConnection::deserialize()sqlite-load-extensionenablingSqliteConnectOptions::extension()and::extension_with_entrypoint()sqlite-unlock-notifyenables internal use ofsqlite3_unlock_notify()SqliteValueandSqliteValueRefchanges:sqlite3_value*interface reserves the right to be stateful.Without protection, any call could theoretically invalidate values previously returned, leading to dangling pointers.
SqliteValueis now!SyncandSqliteValueRefis!Sendto prevent data races from concurrent accesses.SqliteValueinMutex, or convert theSqliteValueRefto an owned value.SqliteValueand any derivedSqliteValueRefs now internally track if that value has been used to decode aborrowed
&[u8]or&strand errors if it's used to decode any other type.per
SqliteValue/SqliteValueRef.SqliteValuefor details.PgLTree::fromtoFrom<Vec<PgLTreeLabel>>implementation [[@JerryQ17]]SqliteArguments[[@iamjpotts]].pgpassfile handling did not process backslash-escapes in the password part.Now it does, which may change what password is sent to the server.
#[derive(sqlx::Type)]automatically generateimpl PgHasArrayTypeby default for newtype structs [[@papaj-na-wrotkach]]Delete the manual impl or add
#[sqlx(no_pg_array)]where conflicts occur.offlineoptional to allow building withoutserde[[@CathalMullan]]mysql-rsafeatureor an error will be generated at runtime. RSA encryption is only used for plaintext (non-TLS) connections.
AnyTypeInfo[[@abonander]]Added
Arc<str>andArc<[u8]>(andRcequivalents) [[@joeydewaal]]runtime-smolandruntime-async-global-executorfeatures to replace usages of the deprecatedasync-stdcrate.no_txmigration support [[@AlexTMjugador]]Migrator::with_migrations()constructor [[@xb284524239]]sqlx.toml, update SQLite extension example [[@supleed2]]Json::into_inner()[[@chrxn1c]]SqlStr[[@joeydewaal]]PgNotificationstruct clone [[@michaelvanstraten]]Changed
OnceCell/Lazywith stdOnceLock/LazyLock[[@paolobarbolini]]Debugimplementations acrossPgRow,MySqlRowandSqliteRow[[@davidcornu]]QueryLoggerback [[@joeydewaal]].bind()inREADME.md[[@sobolevn]]randetceterato0.11.0libsqlite3-sysversion range to<0.38.0Fixed
futuresandfutures-util[[@paolobarbolini]]Pool.close: close all connections before returning [[@jpmelos]]ROLLBACKtransaction when dropped duringBEGIN. [[@kevincox]].envloading, caching, and invalidation [[@abonander]]which served as a useful comparison.
Command::cargo_bin()[[@abonander]]SASLprep[[@var4yn]]from_utf8_uncheckedwithfrom_utf8in SQLite column name handling [[@barry3406]]StdSocket::poll_ready()[[@abonander]]v0.8.6Compare Source
9 pull requests were merged this release cycle.
Added
Changed
tempfiledependency [[@paolobarbolini]]Fixed
attrubutetypo in doc [[@kujeger]]v0.8.5Hotfix release to address two new issues:
sqlx-cli@0.8.4broke.envdefault resolution mechanismsqlx@0.8.4broke test fixture setupThe
0.8.4release will be yanked as of publishing this one.Added
sqlx-clinow accepts--no-dotenvin subcommand arguments.sqlx-clito CI.#[sqlx::test]twice in CI to cover cleanup.Fixed
sqlx-clicorrectly reads.envfiles by default again.#[sqlx::test].v0.8.4Hotfix release to address two new issues:
sqlx-cli@0.8.4broke.envdefault resolution mechanismsqlx@0.8.4broke test fixture setupThe
0.8.4release will be yanked as of publishing this one.Added
sqlx-clinow accepts--no-dotenvin subcommand arguments.sqlx-clito CI.#[sqlx::test]twice in CI to cover cleanup.Fixed
sqlx-clicorrectly reads.envfiles by default again.#[sqlx::test].v0.8.3Compare Source
41 pull requests were merged this release cycle.
Added
Uuidanduuid::fmt::Hyphenated[[@abonander]]Changed
.pgpassfile warning to a debug message. [[@denschub]]PgListener::try_recv[[@swlynch99]]UNION ALLinstead ofUNIONin nullable check [[@Suficio]]Fixed
no-transactionflag in down migrations [[@manifest]]sqlformat[[@tbar4]]query_as[[@xuehaonan27]]INTERVAL[][[@Ddystopia]]EXPLAINin nullability check for QuestDB [[@Suficio]]v0.8.2Compare Source
10 pull requests were merged this release cycle.
This release addresses a few regressions that have occurred, and refines SQLx's MSRV policy (see the FAQ).
Added
Changed
Cargo.tomlfiles in examples [[@carschandler]]Fixed
#[sqlx(no_pg_array)]being forbidden on#[derive(Type)]structs.PgListener,PgStream::recv()[[@abonander]]unknown message: "\\0"errorv0.8.1Compare Source
16 pull requests were merged this release cycle.
This release contains a fix for RUSTSEC-2024-0363.
Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated:
#3440 (comment)
MySQL and SQLite do not appear to be exploitable, but upgrading is recommended nonetheless.
Added
MySqlConnectOptions::no_engine_substitution()[[@kolinfluence]]MySqlConnectOptions::no_engine_subsitution()(oops) in favor of the correctly spelled version.Changed
spec_errormodule [[@abonander]]Use at your own risk.
libsqlite3-sys=0.30.1to support sqlite 3.46 [[@CommanderStorm]]ring(the existing implementation),and
aws-lc-rswhich has optional FIPS certification.runtime-tokio-rustls,runtime-async-std-rustls,tls-rustls)enable the
ringprovider of RusTLS to match the existing behavior so this should not be a breaking change.tls-rustls-aws-lc-rsfeature to use theaws-lc-rsprovider.runtime-tokio-rustlsorruntime-async-std-rustls,this will necessitate switching to the appropriate non-legacy runtime feature:
runtime-tokioorruntime-async-stdFixed
sqlx::Type[[@alu]]node12inSQLxaction [[@hamirmahal]]v0.18.1to avoid yankedv0.14.3[[@CommanderStorm]]v0.8.0Compare Source
70 pull requests were merged this release cycle.
#2697 was merged the same day as release 0.7.4 and so was missed by the automatic CHANGELOG generation.
Breaking
#[sqlx::test]usages are applied in the correct order now.MigrateError.-- no-transactionto the beginning.Migrationi64as intermediate when decoding [[@abonander]]#[derive(sqlx::Type)]in Postgres [[@abonander]]#[sqlx(no_pg_array)]where conflicts occur.PgTypeInfo::with_name()infers types that start with_to be arrays of the un-prefixed type. Wrap type names in quotes to bypass this behavior.FromRow, returnError::ColumnDecodeforTryFromerrors [[@abonander]]#[sqlx(try_from = "T")]now returnError::ColumnDecodeinstead ofError::ColumnNotFound.#[sqlx(default)]on an individual field or the struct itself would have previously suppressed the error.This doesn't seem like good behavior as it could result in some potentially very difficult bugs.
Fromand apply the default explicitly.#[sqlx(rename)]and#[sqlx(rename_all)]to match the expected behavior (renamewins).ConnectOptions::to_url_lossy()to match what parsing expects.Added
MySqlTime, auditmysql::typesfor panics [[@abonander]]NonZero*scalar types [[@AlphaKeks]]Changed
Sendtrait bound from argument binding [[@bobozaur]]libsqlite3-sysare not considered breaking changes as per our semver guarantees.MySqlConnectionto reduce sizes of futures [[@stepantubanov]]sqlx migrate add ...[[@CommanderStorm]]Fixed
ConnectionHandleRawtype [[@abonander]]docker composeinstead ofdocker-compose[[@abonander]]pathownership problems when usingsqlx_macros_unstable[[@lily-mosquitoes]]sqlx_postgres::any[[@Zarathustra2]]migrateerror message. (#3275) [[@nk9]]persistentquery setting when preparing queries with theAnydriver [[@etorreborre]]select_input_type!()being unhygenic [[@CommanderStorm]]MorCNotice fields are not UTF-8 [[@YgorSouza]]json-feature should activatesqlx-postgres?/jsonas well [[@CommanderStorm]]clockandstdfeatures ofworkspace.dependencies.chrono.v0.7.4Compare Source
38 pull requests were merged this release cycle.
This is officially the last release of the 0.7.x release cycle.
As of this release, development of 0.8.0 has begun on
mainand only high-priority bugfixes may be backported.Added
to_url_lossyto connect options [[@lily-mosquitoes]]query!for cargo-free systems [[@kshramt]]raw_sqlAPI [[@abonander]]prepared statement interfaces
query*()andquery!().query*()functions.execute_many()andfetch_many()on interfaces that use prepared statements.interface is the only way to execute SQL. All other database flavors forbid multiple statements in
one prepared statement string as an extra defense against SQL injection.
raw_sqlAPI retains this functionality because it explicitly does not use prepared statements.Raw or text-mode query interfaces generally allow multiple statements in one query string, and this is
supported by all current databases. Due to their nature, however, one cannot use bind parameters with them.
Changed
create_newinstead ofatomic-file-write[[@mattfbacon]]PgConnectOptions[[@Fyko]]#[sqlx::test][[@ciffelia]]Fixed
sqlx::migrate::Migrator.migrate!().v0.7.3Compare Source
38 pull requests were merged this release cycle.
Added
fixtures_pathin sqlx::test args [[@ripa1995]]fn PgConnectOptions::get_host(&self)[[@boris-lok]]FromRowfor the unit type [[@nanoqsh]]MySqlConnectOptions::get_database()[[@shiftrightonce]]Textadapter [[@abonander]]Changed
BOOLEANand the query macros [[@abonander]]NUMERICsupport [[@abonander]]libsqlite3-systo 0.27.0libsqlite3-sysis considered semver-exempt;see the release notes for 0.7.0 below for details.
Fixed
rust_decimal::Decimalfor high-precision values [[@abonander]]sqlx migrate addhelp text [[@cryeprecision]]try_stream!()[[@abonander]]cargo build[[@nyurik]]AtomicUsizefor thread IDs [[@abonander]]v0.7.2Compare Source
23 pull requests were merged this release cycle.
Added
FromRowderive [[@95ulisse]]Type,Decode, andEncodeforBox<str>andBox<[u8]>[[@grant0417]]Changed
remove_dir_allcrate fromsqlx-cli, fixes RUSTSEC-2023-0018 [[@aldur]]Fixed
min_connections[[@hakoerber]]v0.7.1Compare Source
This release mainly addresses issues reported with the 0.7.0 release.
16 pull requests were merged this release cycle.
Added
PgHasArrayTypewith#[derive(sqlx::Type)][[@abonander]]#[derive(sqlx::Type)]with#[sqlx(transparent)]regarding
PgHasArrayTypenot being implemented, add#[sqlx(no_pg_array)]to fix.Changed
Fixed
CloneforPoolOptionsmanually (#2548) [[@alilleybrinker]]tls-native-tlsin the documentation. [[@denschub]]v0.7.0Compare Source
At least 70 pull requests were merged this release cycle! (The exact count is muddied with pull requests for alpha
releases and such.) And we gained 43 new contributors! Thank you to everyone who helped make this release a reality.
Breaking
Many revisions were made to query analysis in the SQLite driver; these are all potentially breaking changes
as they can change the output of
sqlx::query!()et al. We'd like to thank [[@tyrelr]] for their numerous PRs tothis area.
The MSSQL driver has been removed as it was not nearly at the same maturity level as the other drivers.
As previously announced, we have plans to introduce a fully featured replacement as a premium offering,
alongside drivers for other proprietary databases, with the goal to support full-time development on SQLx.
If interested, please email your inquiry to sqlx@launchbadge.com.
The offline mode for the queries has been changed to use a separate file per
query!()invocation,which is intended to reduce the number of conflicts when merging branches in a project that both modified queries.
This means that CLI flag
--mergedis no longer supported. See [#2363] for details and make sure that yoursqlx-cliversion is in sync with thesqlxversion in your project.The type ascription override syntax for the query macros has been deprecated,
as parse support for it has been removed in
syn 2.0, which we'll be upgrading to in the next breaking release.This can be replaced with type overrides using casting syntax (
as).See [#2483] for details.
mssqlfeature and associated database driver has been deleted from the source tree. It will return as part of our planned SQLx Pro offering as a from-scratch rewrite with extra features (such as TLS) and type integrations that were previously missing.runtime-actix-*features have been deleted. They were previously changed to be aliases of theirruntime-tokio-*counterparts for backwards compatibility reasons, but their continued existence is misleading as SQLx has no special knowledge of Actix anymore.runtime-actix-*feature with itsruntime-tokio-*equivalent.git2feature has been removed. This was a requested integration from a while ago that over time made less and less sense to be part of SQLx itself. We have to be careful with the crates we add to our public API as each one introduces yet another semver hazard. The expected replacement is to make#[derive(sqlx::Type)]useful enough that users can write wrapper types for whatever they want to use without SQLx needing to be specifically aware of it.Executorimpls forTransactionandPoolConnectionhave been deleted because they cannot exist in the new crate architecture without rewriting theExecutortrait entirely.impl Executoris expected, as they both dereference to the inner connection type which will still implement it:&mut transaction->&mut *transaction&mut connection->&mut *connectionthe driver crates cannot provide their own impls due to the orphan rule.
This will mean another major release of SQLx but ideally most API usage will not need to change significantly, if at all.
Migratorare now#[doc(hidden)]and semver-exempt; they weren't meant to be public.offlinefeature has been removed from thesqlxfacade crate and is enabled unconditionally as most users are expected to have enabled it anyway and disabling it doesn't seem to appreciably affect compile times.decimalfeature has been renamed torust_decimalto match the crate it actually provides integrations for.AnyDriverandAnyConnectionnow require eithersqlx::any::install_drivers()orsqlx::any::install_default_drivers()to be called at some point during the process' lifetime before the first connection is made, as the set of possible drivers is now determined at runtime. This was determined to be the least painful way to provide knowledge of database drivers toAnywithout them being hardcoded.AnyEncodetrait has been removed.libsqlite3-systo be semver-exempt,and we reserve the right to upgrade it as necessary. If you are using
libsqlite3-sysdirectly or a crate thatlinks it such as
rusqlite, you should pin the versions of both crates to avoid breakages fromcargo update:time: Assume UTC when decoding a DATETIME column in sqlite [[@nstinus]]OffsetDateTimeto be the first type used when deserializing atimestamptype.Added
try_fromwhen derivingFromRow[[@95ulisse]]PRAGMA optimize;on close of a connection [[@miles170]]Connection::shrink_buffers,PoolConnection::close[[@abonander]]sqlx_macros_unstablein config.toml [[@df51d]]AsMutfor advisory lock types (#2520) [[@alilleybrinker]]Changed
tracing[[@CosmicHorrorDev]]let elsestatements in favor of macro [[@OverHash]]dirswithhome&etcetera[[@utkarshgupta137]]ConnectOptionstypes implFromStr[[@abonander]]Fixed
search_path[[@95ulisse]]sqlx::test[[@kenkoooo]]try_acquire[[@abonander]]tracked_path[[@df51d]]PrepareOkfails to decode [[@stepantubanov]]v0.6.3Compare Source
This is a hotfix to address the breakage caused by transitive dependencies upgrading to
syn = "2".We set
default-features = falsefor our dependency onsyn = "1"to be good crates.io citizens,but failed to enable the features we actually used, which went undetected because we transitively depended on
synwith the default features enabled through other crates,and so they were also on for us because features are additive.
When those other dependencies upgraded to
syn = "2"it was no longer enabling those features for us,and so compilation broke for projects that don't also depend on
syn = "1", transitively or otherwise.There is no PR for this fix as there was no longer a dedicated development branch for
0.6,but discussion can be found in issue #2418.
As of this release, the
0.7release is in alpha and so development is no longer occurring against0.6.This fix will be forward-ported to
0.7.Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: Cargo.lock
8ef837971c783ac62d7echore(deps): update rust crate sqlx to 0.7.0to chore(deps): update rust crate sqlx to 0.8.0783ac62d7e16576449021657644902ea55e05742chore(deps): update rust crate sqlx to 0.8.0to chore(deps): update rust crate sqlx to 0.9.0View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.