Skip to content

chore(deps): update Tier 1 + Tier 2 dependencies (backend & frontend) #177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
streamer45 merged 8 commits into from
Mar 21, 2026
Merged

chore(deps): update Tier 1 + Tier 2 dependencies (backend & frontend) #177

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
1ad3377
chore(deps): update Tier 1 + Tier 2 dependencies (backend & frontend)
streamkit-devin Mar 20, 2026
d448a2d
fix(ui): use Getter<T> instead of Signal<T> in waitForSignalValue
streamkit-devin Mar 20, 2026
f446558
fix(ui): regenerate bun lockfiles to deduplicate @codemirror/state
streamkit-devin Mar 21, 2026
943f395
speed up
streamer45 Mar 21, 2026
562a258
dedup
streamer45 Mar 21, 2026
3436e05
fix: wrong ui mirroring
streamer45 Mar 21, 2026
7def757
lint fix
streamer45 Mar 21, 2026
8902a53
fix lint
streamer45 Mar 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
225 changes: 148 additions & 77 deletions Cargo.lock
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ bytes = "1.11.0"
futures = "0.3.31"

serde = { version = "1.0.228", features = ["derive", "rc"] }
serde-saphyr = "0.0.21"
serde-saphyr = "0.0.22"
serde_json = "1.0"
indexmap = { version = "2.13", features = ["serde"] }

Expand Down
4 changes: 2 additions & 2 deletions apps/skit-cli/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ clap = { version = "4.6", features = ["derive"] }
# For HTTP client functionality
reqwest = { version = "0.13", features = ["multipart", "stream", "json"] }
# For WebSocket client
tokio-tungstenite = { version = "0.28.0", features = ["native-tls"] }
tokio-tungstenite = { version = "0.29", features = ["native-tls"] }
url = "2.5.8"

# For async runtime
Expand All @@ -49,7 +49,7 @@ uuid = { version = "1.22", features = ["v4"] }

# For load testing
toml = "1.0"
rand = "0.9"
rand = "0.10"
tokio-util = "0.7.18"
anyhow = "1.0"
serde = { workspace = true }
Expand Down
2 changes: 1 addition & 1 deletion apps/skit-cli/src/load_test/metrics.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
//
// SPDX-License-Identifier: MPL-2.0

use rand::Rng;
use rand::RngExt;
use serde::Serialize;
use std::collections::HashMap;
use std::sync::Arc;
Expand Down
2 changes: 1 addition & 1 deletion apps/skit-cli/src/load_test/scenarios.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
// SPDX-License-Identifier: MPL-2.0

use anyhow::Result;
use rand::{distr::Alphanumeric, Rng};
use rand::{distr::Alphanumeric, RngExt};
use std::sync::Arc;
use tokio::sync::{mpsc, Mutex};
use tokio::time::{sleep, Duration};
Expand Down
2 changes: 1 addition & 1 deletion apps/skit-cli/src/load_test/workers.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
//
// SPDX-License-Identifier: MPL-2.0

use rand::{distr::Alphanumeric, Rng};
use rand::{distr::Alphanumeric, RngExt};
use std::time::Instant;
use tokio::sync::mpsc;
use tracing::{debug, warn};
Expand Down
6 changes: 3 additions & 3 deletions apps/skit/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ multer = "3.1"
tar = "0.4"
zstd = "0.13"
flate2 = "1.1"
bzip2 = "0.5"
bzip2 = "0.6"

# For embedding static files
rust-embed = "8.11"
Expand Down Expand Up @@ -126,7 +126,7 @@ jsonwebtoken = { version = "10.2.0", default-features = false, features = ["aws_
sha2 = "0.10"
hex = "0.4"
thiserror = "2.0"
getrandom = "0.3"
getrandom = "0.4"
Copy link
Contributor Author

@staging-devin-ai-integration staging-devin-ai-integration bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚩 getrandom 0.3→0.4 may have API changes affecting auth key generation

The getrandom dependency was bumped from 0.3 to 0.4, a major version bump. The usage at apps/skit/src/auth/stores/file.rs:342 calls getrandom::fill(&mut seed).map_err(...) which expects fill to return a Result. In getrandom 0.4, the fill function signature or error type may have changed. While any incompatibility would be caught by the compiler, the reviewer should verify this code path works correctly since it's in the security-critical auth key generation flow.

Staging: Open in Devin

Was this helpful? React with 👍 or 👎 to provide feedback.

Debug

Playground

Copy link
Contributor Author

@staging-devin-ai-integration staging-devin-ai-integration bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good callout. I verified this compiles cleanly with cargo clippy --workspace — the getrandom::fill API in 0.4 is compatible (still returns Result). The getrandom 0.3→0.4 bump is a semver major but the fill() function signature is unchanged. The compiler would catch any breakage here regardless.

aws-lc-rs = "1"

# For MoQ auth path matching (optional, with moq feature)
Expand All @@ -146,7 +146,7 @@ compositor = ["streamkit-nodes/compositor", "streamkit-engine/compositor"]

[dev-dependencies]
tokio-test = "0.4.5"
tokio-tungstenite = "0.28"
tokio-tungstenite = "0.29"
futures-util = "0.3"
ogg = "0.9.2"
opus = "0.3.1"
Expand Down
2 changes: 1 addition & 1 deletion crates/api/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ readme = "README.md"
streamkit-core = { version = "0.2.0", path = "../core" }
serde = { version = "1.0.228", features = ["derive", "rc"] }
serde_json = "1.0"
serde-saphyr = "0.0.21"
serde-saphyr = "0.0.22"
ts-rs = { version = "12.0.1" }
indexmap = { version = "2.12", features = ["serde"] }

Expand Down
9 changes: 4 additions & 5 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,11 +70,6 @@ feature-depth = 1
# A list of advisory IDs to ignore. Note that ignored advisories will still
# output a note when they are encountered.
ignore = [
# paste is unmaintained but still functional. It's a transitive dependency from
# moq-transport and mp4-atom (via hang). No security vulnerability, just maintenance
# status. Will be resolved when upstream moq ecosystem migrates to pastey.
{ id = "RUSTSEC-2024-0436", reason = "transitive dep from moq ecosystem, no security issue" },

# rustls-pemfile is unmaintained. We upgraded axum-server to 0.8 which removed it,
# but moq-native still depends on it. Will be resolved when moq-native updates.
{ id = "RUSTSEC-2025-0134", reason = "transitive dep from moq-native, no security issue" },
Expand Down Expand Up @@ -119,6 +114,10 @@ exceptions = [
# Each entry is the crate and version constraint, and its specific allow
# list
#{ allow = ["Zlib"], crate = "adler32" },

# libbz2-rs-sys is a pure-Rust reimplementation of bzip2. It uses the original
# bzip2 license (BSD-style permissive) which isn't a standard SPDX identifier.
{ allow = ["bzip2-1.0.6"], crate = "libbz2-rs-sys" },
]

# Some crates don't have (easily) machine readable licensing information,
Expand Down
334 changes: 197 additions & 137 deletions docs/bun.lock
View file
Open in desktop

Large diffs are not rendered by default.

8 changes: 4 additions & 4 deletions docs/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@
"astro": "astro"
},
"dependencies": {
"@astrojs/starlight": "^0.37.3",
"astro": "^5.16.11",
"mermaid": "^11.12.2",
"sharp": "^0.34.2"
"@astrojs/starlight": "^0.37.7",
"astro": "^5.18.1",
"mermaid": "^11.13.0",
"sharp": "^0.34.5"
}
}
14 changes: 7 additions & 7 deletions e2e/bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions e2e/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@
"report": "playwright show-report"
},
"devDependencies": {
"@playwright/test": "^1.49.0",
"@types/node": "^25.0.9",
"@playwright/test": "^1.58.2",
"@types/node": "^25.5.0",
"typescript": "~5.9.3"
}
}
10 changes: 6 additions & 4 deletions e2e/tests/compositor-perf.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,15 +264,17 @@ test.describe('Compositor Slider Perf — Cascade Re-render Budget', () => {
// pre-PR-#89 regression where every slider tick caused 94+ fiber
// re-renders across the entire tree.
//
// Observed baseline: ~395 renders for the full 3-layer scenario.
// Observed baseline: ~440 renders / ~5800ms for the full 3-layer
// scenario (after crop-shape state was added to video layers).
// Echo-backs are skipped during slider drags (fire-and-forget with
// reconciliation on commit), keeping the count well bounded.
// Budget of 500 gives ~25% headroom while still catching regressions.
// Budget of 550 renders / 7500ms gives ~25% headroom while still
// catching cascade regressions.
const compositorData = snapshot.components['CompositorNode'];
if (compositorData) {
assertRenderBudget(snapshot, 'CompositorNode', {
max: 500,
maxDuration: 5_000,
max: 550,
maxDuration: 7_500,
});
}

Expand Down
Loading
Loading