chore(deps): bump reqwest-sse from 0.1.0 to 0.2.0 in /generators/cli/sdk - #17486
chore(deps): bump reqwest-sse from 0.1.0 to 0.2.0 in /generators/cli/sdk#17486dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [reqwest-sse](https://github.com/vvvinceocam/reqwest-sse) from 0.1.0 to 0.2.0. - [Commits](vvvinceocam/reqwest-sse@v0.1.0...v0.2.0) --- updated-dependencies: - dependency-name: reqwest-sse dependency-version: 0.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| # Added by the generated SDK crate for specs with server-sent events (see | ||
| # AbstractRustGeneratorContext, which declares these two behind an `sse` feature). | ||
| reqwest-sse = { version = "0.1", optional = true } | ||
| reqwest-sse = { version = "0.2", optional = true } |
There was a problem hiding this comment.
🔴 Locked dependency version no longer matches what the generated CLI code requires, breaking reproducible builds
The pinned server-sent-events library is moved to a new major line (reqwest-sse = "0.2" at generators/cli/sdk/Cargo.toml:110) even though the generated CLI code still asks for the previous line (0.1), so the shipped lock file no longer contains a version the generated output can use.
Impact: Generated CLIs that use streaming can no longer be built or audited in locked/offline mode, silently disabling the dependency-auditing guarantee this dependency exists to provide.
Version-closure mismatch between cli/sdk lock and the Rust SDK generator
This dependency is declared solely to pin the generated model/SDK crates' dependency closure into the shipped Cargo.lock (see the comments at generators/cli/sdk/Cargo.toml:88-109, which state "Versions must match what the model generator emits ... Any package they need that is absent from this lock makes the generated output fail cargo build --locked ... cargo audit").
The Rust SDK generator still emits reqwest-sse = { version: "0.1", optional: true } (generators/rust/base/src/context/AbstractRustGeneratorContext.ts:212) and reqwest = { version: "0.12", ... } (AbstractRustGeneratorContext.ts:114-115). In Cargo semver, the requirement "0.1" means >=0.1.0, <0.2.0, which 0.2.0 does not satisfy. The lock was regenerated to reqwest-sse 0.2.0 (generators/cli/sdk/Cargo.lock:1817-1818), so the generated crate's ^0.1 requirement can no longer be resolved from the shipped lock — defeating the lock-closure purpose.
Secondly, reqwest-sse 0.2.0 depends on reqwest 0.13.4 (generators/cli/sdk/Cargo.lock:1823), while the SSE template code calls response.events() through the EventSource trait on a reqwest 0.12 Response (generators/rust/base/src/asIs/sse_stream.rs:5, :155-158). The 0.2 trait is implemented against reqwest 0.13 types, so the generated SSE code would not compile against reqwest 0.12.
The bump should be coordinated: AbstractRustGeneratorContext.ts (and the reqwest version / sse_stream.rs usage) must be updated together with this pin, or the pin should stay at 0.1.
Prompt for agents
The reqwest-sse pin in generators/cli/sdk/Cargo.toml exists only to make the generated Rust SDK's dependency closure resolvable in the shipped Cargo.lock (see comments at lines 88-109). The Rust SDK generator still emits reqwest-sse = "0.1" (generators/rust/base/src/context/AbstractRustGeneratorContext.ts:212) and reqwest = "0.12" (same file, lines 114-121). Cargo's "0.1" requirement means >=0.1.0,<0.2.0, which 0.2.0 does not satisfy, so after this bump the lock no longer contains a reqwest-sse version the generated crate can resolve under --locked. Additionally reqwest-sse 0.2 depends on reqwest 0.13 (generators/cli/sdk/Cargo.lock:1823), while the SSE template code in generators/rust/base/src/asIs/sse_stream.rs uses response.events() on a reqwest 0.12 Response, so the generated code would not compile against 0.2. Either revert this pin to 0.1, or coordinate the upgrade: bump reqwest-sse to 0.2 (and reqwest to 0.13) in AbstractRustGeneratorContext.ts, adapt sse_stream.rs to the new reqwest-sse 0.2 API, and update all affected generated seed outputs and versions.yml.
Was this helpful? React with 👍 or 👎 to provide feedback.
Bumps reqwest-sse from 0.1.0 to 0.2.0.
Commits
8808d3dchore(release): 0.2.09f79afcdocs: update example and code sample4c10675feat: improve content-type validation6a8fe58refactor: explicit cloning of data67fdfb1ci: use cargo test instead of nextest3e2f65afeat: impl core::error::Error for error types4547acadoc: update READMEa8b3524refactor: use type alias to simplify signaturesb9be580feat: bump reqwest to 0.13a2efc01build: update toolchainDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)