mirror of
https://github.com/huggingface/xet-core.git
synced 2026-06-04 13:30:29 +08:00
5868f64ab9
CI for hf-hub is running cargo audit and found many issues through
hf-xet transitive deps. this PR attempts to solve some of them (not
necessarily all of them).
Main changes:
- dropped derivative and reqwest-retry
- replaced bincode with postcard, only used in testing
- upgrade xet-core rand usage
- added audit CI step and ignoring some issues that we can't easily fix.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Medium risk because it removes `reqwest-retry`/`derivative` and
replaces part of the retry classification logic with an in-house
equivalent, which could subtly change HTTP retry behavior; the remaining
changes are dependency/version bumps and test-only serialization swaps.
>
> **Overview**
> Adds a new CI `cargo audit` job and introduces `.cargo/audit.toml` to
ignore a small set of **dev-only** RustSec advisories with documented
rationale.
>
> Reduces audit surface by dropping `derivative` (manual `Debug` impl
for `AuthConfig`) and removing `reqwest-retry`, replacing its
status-code classification with a local `Retryable` enum +
`default_on_request_success` helper in `RetryWrapper`.
>
> Updates workspace deps (notably `rand` to `0.10` and `rand_distr` to
`0.6`) and adjusts call sites to the newer `rand` APIs (`RngExt`
imports, minor test/bench tweaks). Test-only binary serialization
switches from `bincode` to `postcard` (and updates affected tests), with
corresponding lockfile updates across crates.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
26377f4a1c. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
105 lines
2.9 KiB
TOML
105 lines
2.9 KiB
TOML
[package]
|
|
name = "xet-client"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
homepage.workspace = true
|
|
repository.workspace = true
|
|
description = "Client library for communicating with Hugging Face Xet storage servers. Use through the hf-xet crate."
|
|
readme = "README.md"
|
|
keywords = ["huggingface"]
|
|
categories = ["artificial-intelligence", "network-programming"]
|
|
|
|
[lib]
|
|
name = "xet_client"
|
|
path = "src/lib.rs"
|
|
|
|
[dependencies]
|
|
xet-runtime = { version = "1.5.1", path = "../xet_runtime" }
|
|
xet-core-structures = { version = "1.5.1", path = "../xet_core_structures" }
|
|
|
|
anyhow = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
base64 = { workspace = true }
|
|
bytes = { workspace = true }
|
|
clap = { workspace = true }
|
|
crc32fast = { workspace = true }
|
|
futures = { workspace = true }
|
|
http = { workspace = true }
|
|
lazy_static = { workspace = true }
|
|
more-asserts = { workspace = true }
|
|
rand = { workspace = true }
|
|
reqwest = { workspace = true }
|
|
reqwest-middleware = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
serde_repr = { workspace = true }
|
|
statrs = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio-retry = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
url = { workspace = true }
|
|
urlencoding = { workspace = true }
|
|
|
|
[target.'cfg(target_family = "wasm")'.dependencies]
|
|
tokio = { workspace = true, features = [
|
|
"sync",
|
|
"macros",
|
|
"io-util",
|
|
"rt",
|
|
"time",
|
|
] }
|
|
web-time = { workspace = true }
|
|
|
|
[target.'cfg(not(target_family = "wasm"))'.dependencies]
|
|
axum = { workspace = true, optional = true }
|
|
humantime = { workspace = true, optional = true }
|
|
futures-util = { workspace = true, optional = true }
|
|
redb = { workspace = true }
|
|
human-bandwidth = { workspace = true, optional = true }
|
|
hyper = { workspace = true }
|
|
tokio = { workspace = true }
|
|
tower-http = { version = "0.6", features = ["cors"], optional = true }
|
|
|
|
[features]
|
|
strict = []
|
|
smoke-test = []
|
|
default = ["rustls-tls"]
|
|
elevated_information_level = []
|
|
fd-track = ["xet-runtime/fd-track"]
|
|
rustls-tls = ["reqwest/rustls"]
|
|
native-tls = ["reqwest/native-tls"]
|
|
native-tls-vendored = ["reqwest/native-tls-vendored"]
|
|
analysis = []
|
|
simulation = [
|
|
"dep:axum",
|
|
"dep:humantime",
|
|
"dep:futures-util",
|
|
"dep:human-bandwidth",
|
|
"dep:tower-http",
|
|
"xet-core-structures/simulation",
|
|
]
|
|
|
|
[[bin]]
|
|
name = "local_cas_server"
|
|
path = "src/cas_client/simulation/local_server/main.rs"
|
|
required-features = ["simulation"]
|
|
|
|
[[bin]]
|
|
name = "cache_analysis"
|
|
path = "src/chunk_cache/bin/analysis.rs"
|
|
required-features = ["analysis"]
|
|
|
|
[dev-dependencies]
|
|
approx = { workspace = true }
|
|
ctor = { workspace = true }
|
|
mockall = { workspace = true }
|
|
httpmock = { workspace = true }
|
|
rand_distr = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tokio = { workspace = true, features = ["rt-multi-thread"] }
|
|
tracing-test = { workspace = true }
|
|
wiremock = { workspace = true }
|