viirya commented on PR #6: URL: https://github.com/apache/spark-connect-gateway/pull/6#issuecomment-5688066282
Closing this in favour of a separate, manual upgrade — the jump to `jsonwebtoken` 10 needs a deliberate decision that a version bump alone cannot make. **1. The base predates the code import, so the diff removes workspace members.** Alongside the version bump, it deletes `crates/proxy` and `crates/gateway` from `[workspace].members` — neither had landed when this branch was cut. Merging would drop both from the workspace. **2. `jsonwebtoken` 10 needs an explicit crypto provider, and the failure is at runtime, not compile time.** The 14 test failures reported here are a symptom rather than the problem. The crate now has a pluggable crypto backend and panics when it cannot pick one: ``` Could not automatically determine the process-level CryptoProvider from jsonwebtoken crate features. Call CryptoProvider::install_default() before this point to select a provider manually, or make sure exactly one of the 'rust_crypto' and 'aws_lc_rs' features is enabled. ``` Worth being explicit about the consequence: because `jsonwebtoken = "10"` still *compiles* cleanly, this would not be caught by a build. The gateway would start normally and panic on the first JWT it verified. That is why this wants a considered choice rather than a bump. Choosing the backend is a decision about the auth path's crypto implementation (`rust_crypto`, pure Rust and consistent with this repo's existing `reqwest = rustls-tls` / `opentelemetry-otlp = tls-ring` choices, versus `aws_lc_rs`, which brings a C dependency but is the FIPS-oriented route), so it should be made deliberately rather than inherited from a default. For the record, one further trap for whoever picks this up: `use_pem` is a *default* feature, so `default-features = false` with only a crypto provider fails to compile — `EncodingKey::from_rsa_pem` lives behind `use_pem`. The combination I verified locally is `features = ["use_pem", "rust_crypto"]`, which gives 204 passing tests with clippy and fmt clean. A follow-up PR will handle this properly. Thanks, dependabot. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
