From 58a7f21b126c6782e8b588bd18e31f87f3dd8c9e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 2 Oct 2026 10:19:11 +0000 Subject: [PATCH 1/2] chore(deps): bump turso_core from 0.8.0-pre.14 to 0.8.0 Bumps [turso_core](https://github.com/tursodatabase/turso) from 0.8.0-pre.14 to 0.8.0. - [Release notes](https://github.com/tursodatabase/turso/releases) - [Changelog](https://github.com/tursodatabase/turso/blob/main/CHANGELOG.md) - [Commits](https://github.com/tursodatabase/turso/compare/v0.8.0-pre.14...v0.8.0) --- updated-dependencies: - dependency-name: turso_core dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index bff366edc..d66660364 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -918,7 +918,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -1482,7 +1482,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4450,7 +4450,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4508,7 +4508,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5235,10 +5235,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5567,9 +5567,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" [[package]] name = "turso_core" -version = "0.8.0-pre.14" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1f164caffe00e4708c52b60dd3e28fd43ba2c96118f95c3c1991febef557fea2" +checksum = "58e5f09aaead5dfc87c5a22a2b3e95fb85e2d666e27e5f4a2474c42198af20ec" dependencies = [ "aegis", "aes 0.8.4", @@ -5639,9 +5639,9 @@ dependencies = [ [[package]] name = "turso_ext" -version = "0.8.0-pre.14" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a8875338b1a32565e29eeb3edf653a9d0072c153c03c7f787d2de7d3fa14e250" +checksum = "3902472c63d19191d5982d28542595d1babef787a8482175422ecf7f28100261" dependencies = [ "chrono", "getrandom 0.4.3", @@ -5650,9 +5650,9 @@ dependencies = [ [[package]] name = "turso_macros" -version = "0.8.0-pre.14" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69152450bbc46492069cec2f960b2f17b799dfffc273874a653c024fddea1e4f" +checksum = "63bd5f0f7186707a8b4cf54bbaddff9056c218823befab15508ef6e7502c2340" dependencies = [ "proc-macro2", "quote", @@ -5661,9 +5661,9 @@ dependencies = [ [[package]] name = "turso_parser" -version = "0.8.0-pre.14" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2170ba7e2fafdd0187ae8d39456b782b9c7c890b4b256504e826f6ce91d41b43" +checksum = "25b6d3428f16fff69a13bf7f966628d9fc8e0d097fec6cd84ce1af3d5a9be6b1" dependencies = [ "bitflags 2.13.2", "memchr", @@ -5680,7 +5680,7 @@ version = "2.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5283634e518fe9e82c7b20520bb4bc209009fd16c82077c802f8111ecbb0117a" dependencies = [ - "rand 0.9.5", + "rand 0.10.3", ] [[package]] @@ -6049,7 +6049,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] From d922ac70ca47d3bc21148b8baa978873b298bd07 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Sat, 3 Oct 2026 09:20:50 +0000 Subject: [PATCH 2/2] chore(deps): certify turso 0.8.1 for cargo-vet MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bump itself is green except for `cargo vet --locked`, which had no path to 0.8.1 for any of the four turso crates and failed the Audit job (and with it the aggregate Check gate). The delta is empty. For each of turso_core, turso_ext, turso_macros and turso_parser, every file in the published package except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes identically between 0.8.0-pre.14 and 0.8.1 — 295 files for turso_core alone, 293 of them Rust — and the three that differ carry only version strings and the upstream release commit sha. 0.8.1 is the stable cut of the pre-release already in use, not a code change. Note this is 0.8.1, not the 0.8.0 the PR title names: 0.8.0 and 0.8.1 were both published, the manifest requirement is `0.8.0-pre.1` (so anything `>=0.8.0, <0.9.0` resolves), and the resolver takes the newest. Getting off a pre-release is the point of the bump — `0.8.2-pre.*` cannot be selected, because cargo only matches a pre-release when the requirement names one for the same base version. Per the pre-PR checklist a turso bump calls for `just bench-sqlite`, since it moves the engine under the sqlite builtin. Not run, deliberately: the compiled source is byte-identical, so there is nothing a benchmark could measure. The usual reason to run it — new engine code changing the cost of the MemoryIO or VfsIO path — does not apply to a version stamp. Tests: `cargo vet --locked` succeeds (26 fully audited, 71 partially audited, 519 exempted). Claude-Session: https://claude.ai/code/session_011LreyTqM6VT51zNTJSD4Pi --- supply-chain/audits.toml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 07d0ce730..8525efaa2 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -519,6 +519,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.7 -> 0.8.0-pre.8" notes = "Reviewed production delta: unchecked UTF8 requires all-ASCII aggregate; unique uninitialized Arc chunk assembly checks every index and complete size before assume_init. IO children link before submission, builder token prevents premature callbacks, SeqCst completion fires once with owned buffers. Transaction retry/abandonment retains write ownership and releases writer leases. Attached database sync is explicit; FTS storage remains in memory with descriptor bounds. No new host filesystem, network or process access. Source safety review, not formal transactional proof." +[[audits.turso_core]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.0-pre.14 -> 0.8.1" +notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (295 files, 293 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." + [[audits.turso_ext]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -531,6 +537,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.11 -> 0.8.0-pre.14" notes = "Reviewed the complete package diff: package versions, the vendored commit id, and one build-script fix replacing a cfg!(target_os = ...) test, which reports the *host* in a build script, with the CARGO_CFG_TARGET_OS env var, which reports the target. Extension source is otherwise unchanged; no new runtime, unsafe, or ambient capability." +[[audits.turso_ext]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.0-pre.14 -> 0.8.1" +notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (8 files, 6 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." + [[audits.turso_macros]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -543,6 +555,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.11 -> 0.8.0-pre.14" notes = "Reviewed the complete package diff: only the package version and the vendored commit id change. Macro source is byte-identical. No runtime, unsafe, host access, or build-script changes." +[[audits.turso_macros]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.0-pre.14 -> 0.8.1" +notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (13 files, 12 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." + [[audits.turso_parser]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -555,6 +573,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.11 -> 0.8.0-pre.14" notes = "Reviewed the complete package diff. Adds GENERATED ALWAYS to the column-constraint AST and its formatter; adds blob_literal_bytes, which decodes already-validated hex with chunks_exact(2) so the pairing is bounded (its expect() calls rest on the parser's prior validation); quotes identifiers that begin with a digit, which previously round-tripped as invalid unquoted SQL; and makes an unrecognised STORED/VIRTUAL token a parse error instead of silently yielding None. All safe Rust, fail-closed, no new unsafe or host capability." +[[audits.turso_parser]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.0-pre.14 -> 0.8.1" +notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (11 files, 9 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." + [[audits.twox-hash]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy"