From 47b4470dc2e0fa9fecc82af04c88fcd57d389df4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 00:41:10 +0000 Subject: [PATCH 1/2] chore(deps): bump turso_core from 0.8.1 to 0.8.2-pre.2 Bumps [turso_core](https://github.com/tursodatabase/turso) from 0.8.1 to 0.8.2-pre.2. - [Release notes](https://github.com/tursodatabase/turso/releases) - [Changelog](https://github.com/tursodatabase/turso/blob/main/CHANGELOG.md) - [Commits](https://github.com/tursodatabase/turso/compare/v0.8.1...v0.8.2-pre.2) --- updated-dependencies: - dependency-name: turso_core dependency-version: 0.8.2-pre.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 9a5aa6713..be816a454 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -976,7 +976,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1705,7 +1705,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4773,7 +4773,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4831,7 +4831,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5576,7 +5576,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5914,9 +5914,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" [[package]] name = "turso_core" -version = "0.8.1" +version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "58e5f09aaead5dfc87c5a22a2b3e95fb85e2d666e27e5f4a2474c42198af20ec" +checksum = "4fa832d4ab648bf139f1b18b29bef6d653b18fbd4a77b0e4846c57aaf28c215c" dependencies = [ "aegis", "aes 0.8.4", @@ -5986,9 +5986,9 @@ dependencies = [ [[package]] name = "turso_ext" -version = "0.8.1" +version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3902472c63d19191d5982d28542595d1babef787a8482175422ecf7f28100261" +checksum = "07d9b915ee3c37d552597b07c05c127702a926ca0eac8843f248d693f4368155" dependencies = [ "chrono", "getrandom 0.4.3", @@ -5997,9 +5997,9 @@ dependencies = [ [[package]] name = "turso_macros" -version = "0.8.1" +version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "63bd5f0f7186707a8b4cf54bbaddff9056c218823befab15508ef6e7502c2340" +checksum = "476aa46d793a8aaae6d7a12f591d85eff039129264b1d441586528c88c3feacd" dependencies = [ "proc-macro2", "quote", @@ -6008,9 +6008,9 @@ dependencies = [ [[package]] name = "turso_parser" -version = "0.8.1" +version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "25b6d3428f16fff69a13bf7f966628d9fc8e0d097fec6cd84ce1af3d5a9be6b1" +checksum = "7e03bf6489a80da2e9bf08f22d0b8af4eb391dfa5e6f71e787031cd61a921a3c" dependencies = [ "bitflags 2.13.2", "memchr", @@ -6663,7 +6663,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] From e9141950f79c4b05f29cecf29e26cf321e91a74a Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Tue, 6 Oct 2026 23:38:08 -0500 Subject: [PATCH 2/2] chore(deps): audit Turso 0.8.2 and pin SQLite CSV reference Co-Authored-By: yolop --- .../integration/sqlite_differential_tests.rs | 10 ++++++-- knowledge/operations/testing.md | 6 +++++ supply-chain/audits.toml | 24 +++++++++++++++++++ 3 files changed, 38 insertions(+), 2 deletions(-) diff --git a/crates/bashkit/tests/integration/sqlite_differential_tests.rs b/crates/bashkit/tests/integration/sqlite_differential_tests.rs index c6de07119..c1a2ec932 100644 --- a/crates/bashkit/tests/integration/sqlite_differential_tests.rs +++ b/crates/bashkit/tests/integration/sqlite_differential_tests.rs @@ -58,8 +58,14 @@ macro_rules! require_sqlite3 { /// Run `sqlite3 :memory: ` with the given flags. Returns stdout /// (errors go through `unwrap` since we control the inputs). fn run_real_sqlite3(flags: &[&str], sql: &str) -> String { - let mut child = Command::new("sqlite3") - .args(flags) + let mut command = Command::new("sqlite3"); + command.args(flags); + // Newer host shells default CSV rows to CRLF. Pin our LF contract + // without normalizing embedded newlines inside quoted field values. + if flags.contains(&"-csv") { + command.args(["-cmd", r#".separator , "\n""#]); + } + let mut child = command .arg(":memory:") .stdin(Stdio::piped()) .stdout(Stdio::piped()) diff --git a/knowledge/operations/testing.md b/knowledge/operations/testing.md index 6d76f6094..c27e6ded1 100644 --- a/knowledge/operations/testing.md +++ b/knowledge/operations/testing.md @@ -295,6 +295,12 @@ Quarterly import process: 4. CI runs the same feature-complete, network-free lane. Schema, provenance, unique IDs, classifications, and limitation references are test-enforced. +## SQLite CLI Differential Tests + +CSV comparisons explicitly set the host CLI row separator to LF. SQLite +shell releases differ in their default CSV row endings (LF versus CRLF); +field contents, including embedded newlines, remain compared byte-for-byte. + ## Differential Fuzzing Grammar-based property testing using proptest generates random valid bash diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index b04511698..131ad0ee2 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -531,6 +531,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.14 -> 0.8.1" notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (295 files, 293 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." +[[audits.turso_core]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" +notes = "Reviewed complete published package diff. Only Rust change fixes CDC UPDATE register indexing for virtual generated columns: skip virtual columns, use ColumnLayout.to_reg_offset, and consistently allocate and serialize twice num_non_virtual_cols registers. Both changed and unchanged column branches use the same mapping. No new unsafe code, host access, build scripts, or dependencies. Other changes are release metadata and matching Turso dependency versions." + [[audits.turso_ext]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -549,6 +555,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.14 -> 0.8.1" notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (8 files, 6 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." +[[audits.turso_ext]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" +notes = "Reviewed complete published package diff. Source files are byte-identical; only Cargo.toml, Cargo.lock, and .cargo_vcs_info.json release metadata changes. No runtime, unsafe, host access, or build-script changes." + [[audits.turso_macros]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -567,6 +579,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.14 -> 0.8.1" notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (13 files, 12 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." +[[audits.turso_macros]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" +notes = "Reviewed complete published package diff. Source files are byte-identical; only Cargo.toml, Cargo.lock, and .cargo_vcs_info.json release metadata changes. No runtime, unsafe, host access, or build-script changes." + [[audits.turso_parser]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -585,6 +603,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.14 -> 0.8.1" notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (11 files, 9 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." +[[audits.turso_parser]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" +notes = "Reviewed complete published package diff. Source files are byte-identical; only Cargo.toml, Cargo.lock, and .cargo_vcs_info.json release metadata changes. No runtime, unsafe, host access, or build-script changes." + [[audits.twox-hash]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy"