Update lukemathwalker/cargo-chef Docker tag to latest-rust-1.98.0-alpine - #4756
Conversation
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| # syntax=docker/dockerfile:1.26@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 | ||
|
|
||
| FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder | ||
| FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS builder |
There was a problem hiding this comment.
This bump breaks the build — docker-build is failing on this PR because of it.
/go/pkg/mod/github.com/cockroachdb/swiss@v0.0.0-20251224182025-b0f6560f979b/map.go:286:7: undefined: hashFn
/go/pkg/mod/github.com/cockroachdb/swiss@v0.0.0-20251224182025-b0f6560f979b/map.go:337:14: undefined: getRuntimeHasher
/go/pkg/mod/github.com/cockroachdb/swiss@v0.0.0-20251224182025-b0f6560f979b/map.go:338:22: undefined: fastrand64
...
/go/pkg/mod/github.com/cockroachdb/swiss@v0.0.0-20251224182025-b0f6560f979b/options.go:30:14: undefined: hashFn
(failing job — fails on both linux/amd64 and linux/arm64.)
Root cause. github.com/cockroachdb/swiss reaches into runtime internals via go:linkname, so it gates that code on an explicit Go version range. In the version pinned at flow/go.mod:153, the build tag on runtime_go1.20.go covers go1.20 up to but excluding go1.27. Under Go 1.27 the whole file drops out of the build, which is why hashFn / getRuntimeHasher / fastrand64 come out undefined. It is an indirect dependency, pulled in by github.com/cockroachdb/pebble/v2 v2.1.6 (flow/go.mod:36).
Fix. Upstream widened the constraint to exclude only go1.28, in the commit "Enable go 1.27 support" (2026-08-20). Bumping the indirect dep alongside this image bump should unblock it:
go -C flow get github.com/cockroachdb/swiss@v0.0.0-20260820225851-333444432258
go -C flow mod tidy
(or wait for a pebble/v2 release that requires the fixed swiss). Either way this cannot merge as-is — automerge is enabled on this PR, so it is worth making sure it stays red until the dep is updated.
Other Go 1.27 release-note items worth a look once the build is green
1. CI still compiles and tests on Go 1.26.6. The version is hardcoded in .github/workflows/golang-lint.yml:27, .github/workflows/tilt-flow.yml:235, and .github/workflows/cleanup.yml:17. The e2e suite runs go test on the host under setup-go, while the shipped binary is built inside this image — so after this bump the toolchain that produces the release artifact is never the one under test. That gap used to be a patch release (1.26.6 vs 1.26.7); now it spans a minor carrying a significant stdlib change. Recommend bumping those three to 1.27.x in the same PR.
2. encoding/json is now backed by the v2 implementation. The v1 API keeps v1 semantics — duplicate keys and invalid UTF-8 are still tolerated, the stricter defaults apply only to the new encoding/json/v2 package — so this should be transparent. But it is a wholesale implementation swap underneath roughly 35 files and 69 call sites in the record and normalization path (flow/model/record_items.go, flow/model/pg_items.go, flow/model/qvalue/equals.go, the ClickHouse / Elasticsearch / BigQuery writers). The release notes do call out that error message text may differ. I grepped and found no code matching on JSON error strings, so I do not expect a break — it is mainly why point 1 matters, since e2e on 1.26.6 will not exercise any of it. Escape hatch if something does surface: GOEXPERIMENT=nojsonv2 at build time.
3. Removed TLS GODEBUGs: tlsrsakex, tls3des, tls10server. These are permanently gone in 1.27, not merely defaulted off. Nothing in this repo sets them, but PeerDB connects to arbitrary customer source databases, and any deployment setting one of these on the container to reach a legacy TLS endpoint will silently lose the ability to re-enable those suites. Possibly worth a release note.
Neutral for us: the asynctimerchan removal (already off for go >= 1.23 modules), the macOS 13 minimum (no macOS Go runners), the ppc64 ELFv2 switch. flow/go.mod stays at go 1.26.0 with no toolchain directive, so the language version is unchanged and no 1.27-only syntax can sneak in. The Alpine base is unchanged too — both 1.26-alpine and 1.27-alpine alias alpine3.24, matching the alpine:3.24 runtime stage, so CGO/geos dynamic linking is unaffected.
| # syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 | ||
|
|
||
| FROM lukemathwalker/cargo-chef:latest-rust-1.97.1-alpine@sha256:ff60ee1358ec287344f421dc6055e66d98de47b58cba4176bc82b86a090251fd AS chef | ||
| FROM lukemathwalker/cargo-chef:latest-rust-1.98.0-alpine@sha256:917b051d1fc8e234a3aad123378b5263c95fa5d8739439ee25aa789c2db97a90 AS chef |
There was a problem hiding this comment.
The Rust bump itself looks fine, but flagging that it is currently unverified: the nexus stages were still compiling when the Go stage failed the build, so buildkit cancelled them (#133 CANCELED / #135 CANCELED in the job log). Nothing here has been through a green build yet. rust-lint.yml runs cargo clippy on the runner default rustup stable rather than this image, so it does not cover this pin either.
From the 1.97.1 to 1.98.0 compatibility notes, the items that could bite a large dep tree (tokio, pgwire / aws-lc-rs, ssh2, refinery, sqlparser) are all compile-time, so they would fail loudly rather than silently:
ambiguous_glob_importspromoted from lint to hard error in some cases- where-bounds of the form
Type = TypeandType == Typeare no longer syntactically allowed repr(transparent)is stricter about which fields count as having trivial layouttransmute()size checking corrected when somereprattributes are involved- fully elided lifetime bounds on trait object types may resolve differently, or be rejected, in niche cases
Two runtime-visible ones, both niche: derived PartialOrd is now optimized in a way that can misbehave alongside inconsistent hand-written Ord impls, and Debug formatting escapes more characters in strings and chars. Worth a glance at any Debug-formatted output that reaches the wire in the query router, though I did not find a concrete site.
No action needed beyond re-checking once the Go build is fixed and these stages actually run to completion.
❌ Test FailureAnalysis: Real build breakage, not a flaky test: PR #4756 bumps the builder base image to golang:1.27-alpine, and the indirect dependency github.com/cockroachdb/swiss fails to compile on Go 1.27 (undefined hashFn/getRuntimeHasher/fastrand64 runtime linkname shims), so the peer-flow image build fails identically in all four matrix jobs before any test executes. |
c6a11c1 to
799c6ef
Compare
| # syntax=docker/dockerfile:1.26@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 | ||
|
|
||
| FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder | ||
| FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS builder |
There was a problem hiding this comment.
Digest verified: sha256:4c9fe601…6c46dbc really is golang:1.27-alpine, which currently resolves to the alpine3.24 variant. That matches the alpine:3.24 runtime stage further down this file, so the CGO_ENABLED=1 build (musl + geos) stays ABI-aligned with the final image.
Note — toolchain drift: this ships a Go 1.27-built binary that lint/vet never sees.
This is the only place the Go toolchain moves to 1.27. Everything else in the repo still says 1.26:
.github/workflows/golang-lint.yml:27—go-version: 1.26.6.github/workflows/tilt-flow.yml:235—go-version: 1.26.6.github/workflows/cleanup.yml:17—go-version: 1.26.6flow/go.mod:3andflow/pkg/go.mod:3—go 1.26.0
The go.mod directives are fine to leave alone (Go is forward-compatible, and keeping them at 1.26.0 is what pins the language and GODEBUG defaults). The setup-go pins are the gap: once this merges, golangci-lint and the host-side e2e test binary compile under 1.26.6 while the released images compile under 1.27, so anything 1.27-specific is invisible to lint and vet. Mitigating factor: Tiltfile:30-49 builds flow-api/flow-worker/flow-snapshot-worker from this Dockerfile, so the tilt-flow e2e suite does exercise the 1.27-compiled services — it is lint/vet coverage that lags, not runtime coverage.
Renovate historically bumps setup-go in the separate github-actions dependencies PR (e.g. #4684), so this drift should close on its own — worth confirming that follow-up actually lands rather than sitting at 1.26.6.
Go 1.27 release-note scan for regressions relevant to PeerDB (no blockers found)
encoding/jsonis now backed by the v2 implementation. The scariest-sounding item for an ETL product, but it checks out: the v1 API keeps v1 semantics — invalid UTF-8 in strings is still replaced with U+FFFD rather than erroring, and duplicate object names are still permitted. The stricter v2 defaults apply only when importingencoding/json/v2directly. Only the error message text changes, and nothing underflow/asserts onjson:/invalid character/cannot unmarshalstrings, so this is a no-op here. Worth checking because Postgresjsonpreserves duplicate keys and non-UTF-8 MySQL columns are a known concern (cf. cd593d9) — a real v2 switch would have been a live regression.- Permanently removed GODEBUGs:
asynctimerchan,tlsrsakex,tls3des,tls10server,tlsunsafeekm,x509keypairleaf,gotypesalias. Nothing in the repo setsGODEBUG, andasynctimerchanwas already off by default forgo >= 1.23modules. Operationally relevant though: an operator pointing PeerDB at a legacy TLS endpoint can no longer re-enable RSA key exchange or 3DES viaGODEBUG=tlsrsakex=1/tls3des=1— that escape hatch is gone for good, not merely defaulted off. net/http: HTTP/1Response.Bodynow auto-drains unread content onClose(bounded), and the HTTP/2 server honours RFC 9218 client priorities by default. Only a latency consideration for the HTTP-heavy destinations (ClickHouse, S3, Elasticsearch, BigQuery) if a body is closed early; the release notes scope the downside to misconfiguredTransports.compress/flateoutput may differ from 1.26. No directcompress/flate,compress/gziporklauspost/compressimport underflow/, and no test asserts on compressed bytes.crypto/x509SystemCertPoolnow honoursSSL_CERT_FILE/SSL_CERT_DIR— Windows/Darwin only, so the AWS RDS bundle added at line 35 plusupdate-ca-certificateson Linux is unaffected.- Size-specialized malloc, goroutine-leak profiling GA, generic methods — perf and additive.
- macOS 13 minimum,
bzrremoval, linux/ppc64 ELFv2 — N/A for these linux amd64/arm64 alpine images. dlv@latest(line 30,DEBUG_BUILD=1targets): Delve 1.27.x added Go 1.27 support including generic methods, so theflow-*-debugstages will not hit an "unsupported version of Go" wall.
No PII or secret exposure introduced by this change.
| # syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 | ||
|
|
||
| FROM lukemathwalker/cargo-chef:latest-rust-1.97.1-alpine@sha256:ff60ee1358ec287344f421dc6055e66d98de47b58cba4176bc82b86a090251fd AS chef | ||
| FROM lukemathwalker/cargo-chef:latest-rust-1.98.0-alpine@sha256:917b051d1fc8e234a3aad123378b5263c95fa5d8739439ee25aa789c2db97a90 AS chef |
There was a problem hiding this comment.
Digest verified: sha256:917b051d…2db97a90 really is lukemathwalker/cargo-chef:latest-rust-1.98.0-alpine (same digest as 0.1.78-rust-1.98.0-alpine), amd64 + arm64.
Rust 1.97.1 → 1.98.0 reviewed — no regressions expected for nexus. Release notes scan (1.98.0, released 2026-08-20):
- New
invalid_runtime_symbol_definitions(deny-by-default),suspicious_runtime_symbol_definitionsandc_void_returns(warn-by-default) lints. These are the only changes in this release that could break thecargo buildon line 39 or thecargo clippy -- -D warningsgate in.github/workflows/rust-lint.yml. Grepped the wholenexus/workspace for#[no_mangle],#[export_name],extern "C"andc_void— zero hits, so nothing here can trip them. - Algebraic float methods (
-ffast-math-style reordering) are opt-in new APIs, not a change to existing float semantics. NumBuffer/format_into,str::substr_range,[T]::subslice_range,strip_circumfix,Send/SyncforCommandArgs, radix parsing onNonZero— purely additive.- Relaxed
&mutlifetime shortening under unsize coercion, and thumbv7/thumbv8 promotion to Tier 2 — no impact on this workspace or its targets.
Also worth noting the toolchain here has no counterpart to keep in sync: nexus/ has no rust-toolchain.toml, and rust-lint.yml uses the runner default stable — so unlike the Go bump in the sibling file, this image version is the only pin.
No PII or secret exposure introduced by this change.
799c6ef to
9ac9982
Compare
| # syntax=docker/dockerfile:1.26@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 | ||
|
|
||
| FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder | ||
| FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS builder |
There was a problem hiding this comment.
Go 1.27 now builds the shipped binaries, but nothing in CI tests at 1.27.
This bump is unaccompanied — every Go toolchain reference in the repo stays at 1.26:
flow/go.mod:3→go 1.26.0(same inflow/pkg/go.mod:3).github/workflows/golang-lint.yml:27→go-version: '1.26.6'.github/workflows/tilt-flow.yml:235→go-version: '1.26.6'.github/workflows/cleanup.yml:17→go-version: '1.26.6'
Per the comment at .github/workflows/tilt-flow.yml:284, the e2e suite runs go test on the host, so flow_test exercises 1.26.6-compiled code. The passing docker-build check only proves 1.27 compiles the tree via docker buildx bake; no test ever runs a 1.27-built binary. With automerge enabled, that lands unvalidated.
The go 1.26.0 directive does keep GODEBUG-gated behavior at 1.26 defaults, which covers most of the release. But two Go 1.27 changes are not GODEBUG-gated and land in the shipped image regardless of the go directive:
encoding/jsonis now backed by theencoding/json/v2implementation. Marshal/unmarshal behavior is documented as preserved, but it is a full rewrite, and the release notes ship aGOEXPERIMENT=nojsonv2opt-out specifically for "users who encounter compatibility problems". 35 files underflow/importencoding/json, including core replication paths —flow/model/record_items.go,flow/model/pg_items.go,flow/model/qvalue/equals.go, and the per-sourceqvalue_convert.gofiles for Postgres/MySQL/BigQuery/CockroachDB.compress/flate's encoder changed, socompress/gzip,compress/zlib, andarchive/zipoutput bytes may differ from 1.26.
Suggest bumping go-version in the three workflows (and optionally the go directive) to 1.27.x in this same PR, so lint and e2e cover the toolchain that actually ships.
|
Dependency bump review Read the upstream release notes for both bumped ranges.
One finding, posted inline on Reviewed and not a concern here: macOS 13 minimum (Linux-only images), removal of
Clean. Rust 1.98.0's compatibility notes do contain hard-error changes that could break a build — additional ambiguous-import cases and Digest pins Both verified against Docker Hub:
No new stdout/stderr/log output, so nothing to review for PII or secret exposure. |
9ac9982 to
3a71f95
Compare
| # syntax=docker/dockerfile:1.26@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 | ||
|
|
||
| FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder | ||
| FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS builder |
There was a problem hiding this comment.
Go 1.26 → 1.27 — release-notes review
Digest verified: sha256:4c9fe601… is the current golang:1.27-alpine manifest (pushed 2026-08-19), and it resolves to 1.27-alpine3.24 — the same Alpine base that 1.26-alpine pointed at, so the geos-dev (builder) / geos (alpine:3.24 runtime) CGO linkage is unchanged. flow/go.mod is at go 1.26.0 with no toolchain directive, so the newer toolchain builds it fine.
Two things from the Go 1.27 release notes worth knowing before this auto-merges:
-
encoding/jsonis now backed by the v2 implementation by default. From the notes: "Theencoding/jsonpackage is now backed by the v2 implementation. Marshaling and unmarshaling behavior is preserved, but the exact text of error messages may differ." The only escape hatch isGOEXPERIMENT=nojsonv2at build time — there is no runtime GODEBUG, and it is not gated by thego 1.26.0directive, so this image gets v2 unconditionally. Mitigating factor: the Postgresjson/jsonbhot path uses jsoniter (createExtendedJSONUnmarshaler,flow/connectors/postgres/cdc.go:161), not stdlib, so arbitrary customer JSON is unaffected; stdlibencoding/jsonis confined to PeerDB-controlled structs (configs, catalog, destination payloads), and I found no test asserting on JSON error strings. Low risk, but it is the largest behavior surface in this bump. -
Several
crypto/tlsGODEBUG escape hatches are removed permanently, includingtlsrsakex,tls3desandtls10server. These were already default-off, but until 1.27 an operator could re-enable RSA key exchange / 3DES viaGODEBUGto reach an old TLS-terminating source database. From 1.27 there is no workaround. Nothing in this repo setsGODEBUG, so this only affects users who set it on the container.
Checked, no action needed: the compress/flate encoder output changed, but the Deflate Avro codec (flow/connectors/s3/qrep.go:87) still emits valid OCF, and TestWriteRecordsToDeflateAvroFileHappyPath only asserts non-empty. The function-literal naming change does not affect Temporal, since every registration in flow/workflows/register.go uses named functions.
One actionable item: this PR moves the shipped images to Go 1.27 but leaves every CI Go pin at 1.26.6 — .github/workflows/golang-lint.yml:27, cleanup.yml:17, tilt-flow.yml:235. Because go test runs on the host (see the comment at tilt-flow.yml:284), the entire Go test suite and the golangci-lint type-check/vet pass keep executing on 1.26, while the containers under test run 1.27-built binaries. Consider bumping those pins in the same change so lint and tests exercise the toolchain that actually ships.
| # syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 | ||
|
|
||
| FROM lukemathwalker/cargo-chef:latest-rust-1.97.1-alpine@sha256:ff60ee1358ec287344f421dc6055e66d98de47b58cba4176bc82b86a090251fd AS chef | ||
| FROM lukemathwalker/cargo-chef:latest-rust-1.98.0-alpine@sha256:917b051d1fc8e234a3aad123378b5263c95fa5d8739439ee25aa789c2db97a90 AS chef |
There was a problem hiding this comment.
Rust 1.97.1 → 1.98.0 — release-notes review, no regressions found
Digest verified: sha256:917b051d… matches lukemathwalker/cargo-chef:latest-rust-1.98.0-alpine (pushed 2026-08-21).
Rust 1.98.0 is additive — stabilizations (str::substr_range, [T]::subslice_range, core::fmt::NumBuffer plus format_into, the algebraic float ops, Atomic::from_mut, String::from_utf16le, strip_circumfix, NonZero::from_str_radix) plus a ManuallyDrop/Box documentation guarantee. No compatibility-breaking changes are called out in the announcement.
Nothing in nexus/ is exposed to the usual minor-bump breakage: no rust-toolchain.toml, no rust-version MSRV, no #![feature(...)], and no #![deny(warnings)] or [lints] table — so a new or tightened lint cannot fail the build. Crates are already on edition 2024 (parser is still 2021).
Pre-existing, not introduced here: ci.yml pins no Rust toolchain, so cargo check / cargo test run on whatever rustc the GitHub runner ships, independent of this pinned 1.98.0 builder image.
3a71f95 to
ddb7c9c
Compare
renovate
Bot
changed the title
Dependency bump review — cargo-chef
|
| Compat note | Applies here? |
|---|---|
repr(transparent) layout rules more restrictive |
No — zero repr(transparent) in the workspace |
New c_void_returns lint (warn) |
No — no c_void usage |
New invalid_runtime_symbol_definitions lint (deny) |
No — build succeeds, see below |
| Ambiguous glob imports now error more consistently | No — only 2 glob imports, unambiguous |
derive(PartialOrd) fast path can break inconsistent Ord/PartialOrd impls |
No — all sites in parser/src/ast_peerdb.rs derive both together, so they're consistent by construction |
Elided lifetime bounds on trait objects may resolve differently; Type = Type where-bounds removed; structural-equality pattern matching |
No — no such constructs; build confirms |
Empirical check: the docker-build job on this PR resolved the new digest on both linux/amd64 and linux/arm64 and ran cargo chef cook + cargo build --release --bin peerdb-server to completion on both — so the workspace compiles under 1.98.0 with the static-OpenSSL musl setup intact. That covers the deny-by-default lint and the language changes above.
Note (pre-existing, not introduced here): rust-lint.yml runs cargo clippy -- -D warnings on the runner's own rustup toolchain and only triggers on nexus/**, so it is decoupled from this pinned image and did not re-run for this bump. Not a blocker for this PR.
🤖 Generated with Claude Code
ddb7c9c to
97db98f
Compare
Renovate dependency review — reviewed, looks clean ✅Reviewed per Verification
Upstream release notes — Rust 1.98.0 regression risk Notable compatibility notes that could in principle break a build. None of them apply to
Also worth noting: because the tag tracks the latest cargo-chef, this incidentally moves cargo-chef ~0.1.77 → 0.1.78 (toml v1.1 support, OCI annotations) — no recipe-format change that affects the Bottom line: low risk. All the 1.98 breaking changes are compile-time failures rather than silent behavior changes, so the pending |
97db98f to
e8317d2
Compare
Dependency bump review — clean ✅Reviewed per What actually changes: only the builder base image in Upstream regression check (Rust 1.98.0, released 2026-08-20) — walked the release compatibility notes and checked each against
Nothing in 1.98.0 looks capable of causing a behavioral regression in nexus. The rest of the release is additive (stabilized APIs, new tier-2/3 targets, new warn-level lints). Build validation: Coverage gap worth knowing (not a blocker): Secrets/PII (REVIEW.md item 1): no logging, stdout/stderr, or output changes in this diff. No findings — safe to merge. |
1 participant
This PR contains the following updates:
latest-rust-1.97.1-alpine→latest-rust-1.98.0-alpineWarning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.