Fix library dependency issues #3901
Merged
+38
−3
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation and Context
Our CI and release pipeline have revealed several areas where a Cargo.lock file should be included but is currently missing. This has led to issues when building SDKs with our MSRV of 1.78.0, using the latest dependencies (specifically
arbitrary
1.4.0 andidna
1.0.3). The following compilation error occurs:This issue arises because these versions of the arbitrary and idna crates depend on a recently stabilized feature that remains unstable in our MSRV.
Below is a list of additional places where dependencies need to be locked:
sdk-adhoc-test
client-codegen-test
check-semver-hazards
(this compares two versions of the SDKs: one from a feature branch and the other from the most recent release of the SDKs inaws-sdk-rust
. Note that it does not usecargo-semver-checks
)canary
cargo semver-checks
(this compares two different versions of runtime crates and SDKs between a feature branch and the main branch within the repository)This PR adds lockfiles for the first three locations. However, we were unable to add lockfiles for the fourth and fifth locations.
canary
canary-runner
generatesCargo.toml
on the fly, so this place cannot have a lockfile. The fix is to pin the offending dependencies directly within the code that renders theCargo.toml
.cargo semver-checks
This will remain broken until we upgrade MSRV to 1.81.0.
cargo semver-checks
runs as part of a PR workflow and is not a required check for CI. The reason we cannot fix this until we upgrade our MSRV to 1.81, which stabilizeserror_in_core
, is thatcargo-semver-checks
creates a temporary wrapper crate calledrustdoc
whoseCargo.toml
looks like this:This crate is placed under a directory looking like
smithy-rs/target/semver-checks/local-aws_sdk_timestreamwrite-0_0_0_local-3131265f731d9f1d
, and we cannot add a lockfile or manually edit itsCargo.toml
. Whencargo semver-checks
builds thisrustdoc
crate, it pulls in offending dependencies such asidna
1.0.3 andarbitrary
1.4.0 (please refer to the diagram in this PR for illustration of how semver-checks.py organizes crates during execution).In short,
cargo semver-checks
acts as a client of AWS SDKs, building their dependencies that require MSRV 1.81.0 using our MSRV 1.78.0, which causes the error.Testing
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.