Repository navigation
fix(deps): move futures-util to 0.3.34, dropping pin-utils - #273
Merged
Merged
Conversation
RUSTSEC-2026-0441 (2026-10-01) marks pin-utils unmaintained; its repository was archived. futures-util 0.3.31 depends on it, and 0.3.32 and later no longer do. `cargo update -p futures-util` moves futures-core, futures-macro, futures-task and futures-util to 0.3.34 and removes pin-utils. Only Cargo.lock changes. futures-util 0.3.34 declares rust-version 1.71, below this crate's 1.90. `cargo audit` now reports only the four upstream-blocked warnings (W1 and W2 in the standards upstream dependency watch). `cargo clippy --all-features --all-targets -D warnings` and `cargo test --all-features` pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
hyperpolymath
added a commit
to metadatastician/standards
that referenced
this pull request
Nov 9, 2026
) RUSTSEC-2026-0441 marks `pin-utils` unmaintained; its upstream repository was archived on 2026-10-01. Two archived example lockfiles still carry it: - `9-archive/rhodium-standard-repositories/examples/ai-ml-project` - `9-archive/rhodium-standard-repositories/examples/enterprise-service` In both, it arrives by two routes: `futures-util` 0.3.31 and `hyper` 1.8.1. `futures-util` 0.3.32+ and `hyper` 1.9.0+ no longer depend on it; I checked each release's dependency list on crates.io. `cargo update -p futures-util -p hyper` moves them to 0.3.34 and 1.12.0 and removes `pin-utils`. Only the two `Cargo.lock` files change; no `Cargo.toml` in the archive is edited. ## MSRV note `enterprise-service` declares `rust-version = "1.70"`, and `futures-util` 0.3.34 declares 1.71. Before this change the lockfile already needed Rust 1.88 (`time` 0.3.47), so the declared value was already stale. This bump does not raise the effective requirement. Every `futures-util` release without `pin-utils` needs 1.71, so there is no lower-MSRV route. ## Verification - `cargo check --lib --bins --tests` passes in both examples. - `enterprise-service`'s 6 tests pass. - Neither lockfile contains `pin-utils` afterwards. - `enterprise-service`'s `api_benchmarks` bench does not compile, identically before and after this change: `criterion`'s `to_async` needs its `async_tokio` feature. That failure is pre-existing and this PR leaves it alone. Related: hyperpolymath/panic-attack#273 fixes the same advisory in panic-attack. --- _Generated by [Claude Code](https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RUSTSEC-2026-0441 marks
pin-utilsunmaintained; its upstream repository was archived on 2026-10-01. Onmain,cargo auditreports it throughfutures-util0.3.31.futures-util0.3.32 and later no longer depend onpin-utils. This runscargo update -p futures-util, which:futures-core,futures-macro,futures-taskandfutures-utilfrom 0.3.31 to 0.3.34;pin-utilsfrom the lockfile.Only
Cargo.lockchanges.Path in
futures-utilreaches the build two ways:eframe→egui-winit→accesskit_winit→accesskit_unix;js-sys.Verification
cargo auditexits 0. Its warnings drop from 5 to 4. The remaining four are the upstream-blocked unmaintained advisories, W1 and W2 indocs/UPSTREAM-DEPENDENCY-WATCH.adocin hyperpolymath/standards.cargo clippy --all-features --all-targets -- -D warningspasses.cargo test --all-featurespasses, including the 531-test main suite.futures-util0.3.34 declaresrust-version1.71, below this crate's 1.90.Generated by Claude Code