Bump uniffi from 0.24.3 to 0.31.2 - #180
Conversation
Bumps [uniffi](https://github.com/mozilla/uniffi-rs) from 0.24.3 to 0.31.2. - [Changelog](https://github.com/mozilla/uniffi-rs/blob/main/CHANGELOG.md) - [Commits](mozilla/uniffi-rs@v0.24.3...v0.31.2) --- updated-dependencies: - dependency-name: uniffi dependency-version: 0.31.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![ev-vaultkeeper[bot]](https://avatars.githubusercontent.com/u/47702631?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review — uniffi 0.24.3 → 0.31.2 (Dependabot)
This bump only touches kotlin-attestation-bindings/Cargo.toml and the root Cargo.lock. Despite Dependabot labelling it semver-minor, for a 0.x crate each minor is effectively a major, so this crosses several releases with breaking changes (0.25, 0.29, 0.30, 0.31).
Compiles? Most likely yes
I checked the three uniffi entry points this crate uses against the v0.31.2 source, and all still exist:
uniffi::include_scaffolding!("bindings")(lib.rs) — still exported fromuniffi_macros.uniffi::generate_scaffolding("src/bindings.udl")(build.rs) — still exported under thebuildfeature.uniffi::uniffi_bindgen_main()(uniffi-bindgen.rs) — still exported under theclifeature, matching howbuild-libs.shinvokes it (--features=uniffi/cli).
The UDL (namespace, bytes, sequence<PCRs>, and a dictionary of optional strings) doesn't use any of the removed/changed features (custom types / UniffiCustomTypeConverter, external types, UDL trait interfaces), so no source changes are required for it to build.
Note: I was unable to actually run
cargo build/cargo testin the review sandbox (no crates.io network egress), so the above is based on source inspection rather than a real build.
Concerns to address before merging
1. The committed generated bindings are stale and incompatible. kotlin-attestation-bindings/src/uniffi/bindings/bindings.kt was generated with uniffi 0.24 (it still uses the Int-based RustBuffer layout and pre-JNA-direct-mapping helpers). Between 0.24 and 0.31 the Kotlin runtime layer changed substantially — 0.30 switched Kotlin to JNA direct mapping and RustBuffer len/capacity moved to u64, and 0.31 changed method checksum computation. A .so built with 0.31 used together with this committed 0.24 .kt will fail the runtime checksum / ABI checks. build-libs.sh regenerates the file at build time, but the committed copy is now inconsistent — please regenerate it with 0.31.2 and re-commit so the repo stays coherent and the new bindings are actually exercised.
2. This bump is not covered by CI. kotlin-attestation-bindings is not built or tested by any workflow: lint-and-test.yml's path filter doesn't include kotlin-attestation-bindings/** and it runs cargo make ci from inside attestation-doc-validation (building only that package); the deploy workflows only build node/python/wasm. The green checks on this PR (linux/windows/macos = python, build = wasm) never touch the kotlin crate. Recommend building the kotlin bindings + regenerating locally (e.g. via build-libs.sh) to validate before merging.
3. MSRV bump. uniffi 0.31 raises the minimum supported Rust to 1.87. This is fine for current stable toolchains, but worth noting for anyone building these bindings.
No blocking issues in the diff itself — leaving this as a comment so a human can regenerate the Kotlin bindings and verify a local build.
| [dependencies] | ||
| attestation-doc-validation = "0.9.0" | ||
| uniffi = { version = "0.24.1" } | ||
| uniffi = { version = "0.31.2" } |
There was a problem hiding this comment.
This jumps uniffi across several releases with breaking changes (0.25/0.29/0.30/0.31). The crate's Rust APIs still exist in 0.31.2 so it should compile, but two things need attention: uniffi 0.31 requires Rust >= 1.87 (MSRV bump), and the committed src/uniffi/bindings/bindings.kt was generated with 0.24 and is ABI/checksum-incompatible with a 0.31-built library — it should be regenerated and re-committed. Since no CI job builds this crate, please verify a local build + regeneration before merging.
|
Superseded by #191. |
Bumps uniffi from 0.24.3 to 0.31.2.
Changelog
Sourced from uniffi's changelog.
... (truncated)
Commits
05b45b1chore: Release7a0eb62chore: Released4d26c6Adding changelog entries for 0.31.29b81f26Fix compile error message to point out missingCARGO_MANIFEST_DIRf29bc2dFix Kotlin JNA unsigned small integer direct returns9a11123Fix Kotlin async external RustBuffer returns04f196aswift: nonisolated(unsafe) on callback vtablePtrcef4501Swift: preserve leading U+FEFF byte order mark in FfiConverterStringb4153d4fix: sort uniffi_traits to ensure deterministic code generationec08cf9Changelog update for 0.31.1You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)