Refresh Rust dependencies and replace abandoned crates

Cargo.toml

@@ -30,7 +30,7 @@ rust-version = "1.97"
 version = "0.0.0"
 
 [workspace.dependencies]
-base64 = "0.22.1"
+base64 = "0.23.1"
 hmac = "0.13.0"
 hf-hub = "=1.0.0"
 remora-domain = { path = "crates/remora-domain" }

crates/remora-admission/Cargo.toml

@@ -7,7 +7,7 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-getrandom = "0.3.4"
+getrandom = "0.4.3"
 remora-contracts = { path = "../remora-contracts" }
 remora-credentials = { path = "../remora-credentials" }
 remora-domain.workspace = true

crates/remora-api/Cargo.toml

@@ -8,10 +8,10 @@ version.workspace = true
 
 [dependencies]
 actix-ws = "=0.4.0"
-actix-web = { version = "=4.14.0", features = ["rustls-0_23"] }
+actix-web = { version = "=4.14.1", features = ["rustls-0_23"] }
 actix-tls = "=3.5.0"
-futures-util = "=0.3.32"
-getrandom = "0.3.4"
+futures-util = "=0.3.34"
+getrandom = "0.4.3"
 remora-admission = { path = "../remora-admission" }
 remora-attempt = { path = "../remora-attempt" }
 remora-contracts = { path = "../remora-contracts" }
@@ -25,8 +25,8 @@ remora-result = { path = "../remora-result" }
 remora-runtime = { path = "../remora-runtime" }
 remora-schema.workspace = true
 remora-target = { path = "../remora-target" }
-rustls = "=0.23.42"
-rustls-pemfile = "=2.2.0"
+rustls = "=0.23.43"
+rustls-pki-types = "=1.15.1"
 serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true
@@ -37,9 +37,9 @@ tokio.workspace = true
 tracing.workspace = true
 
 [dev-dependencies]
-base64 = "=0.22.1"
-jsonwebtoken = "=9.3.1"
-rcgen = "=0.14.8"
+base64 = "=0.23.1"
+jsonwebtoken = { version = "=11.0.0", features = ["aws_lc_rs"] }
+rcgen = "=0.14.9"
 remora-coordination = { path = "../remora-coordination" }
 reqwest = { version = "=0.13.4", default-features = false, features = ["form", "json", "rustls"] }
 tokio-tungstenite = "=0.30.0"

crates/remora-api/src/application.rs

@@ -1,6 +1,5 @@
 use std::{
-    fs,
-    io::{self, BufReader},
+    fs, io,
     net::{SocketAddr, TcpListener},
     path::{Path, PathBuf},
     sync::Arc,
@@ -28,6 +27,7 @@ use rustls::{
     pki_types::{CertificateDer, PrivateKeyDer},
     server::WebPkiClientVerifier,
 };
+use rustls_pki_types::pem::PemObject;
 use sqlx::PgPool;
 use tokio::task::JoinHandle;
 
@@ -611,7 +611,7 @@ fn server_tls(config: &WorkerTlsConfig) -> Result<ServerConfig, RuntimeError> {
 
 fn certificates(path: &Path) -> Result<Vec<CertificateDer<'static>>, RuntimeError> {
     let file = fs::File::open(path).map_err(|error| path_error(path, error))?;
-    let certificates = rustls_pemfile::certs(&mut BufReader::new(file))
+    let certificates = CertificateDer::pem_reader_iter(file)
         .collect::<Result<Vec<_>, _>>()
         .map_err(runtime_error)?;
     if certificates.is_empty() {
@@ -625,7 +625,9 @@ fn certificates(path: &Path) -> Result<Vec<CertificateDer<'static>>, RuntimeErro
 
 fn private_key(path: &Path) -> Result<PrivateKeyDer<'static>, RuntimeError> {
     let file = fs::File::open(path).map_err(|error| path_error(path, error))?;
-    rustls_pemfile::private_key(&mut BufReader::new(file))
+    PrivateKeyDer::pem_reader_iter(file)
+        .next()
+        .transpose()
         .map_err(runtime_error)?
         .ok_or_else(|| RuntimeError::message(format!("{} contains no private key", path.display())))
 }

crates/remora-attempt/Cargo.toml

@@ -7,7 +7,7 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-getrandom = "0.3.4"
+getrandom = "0.4.3"
 remora-coordination = { path = "../remora-coordination" }
 remora-domain.workspace = true
 remora-durable.workspace = true

crates/remora-contracts/Cargo.toml

@@ -7,8 +7,8 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-fancy-regex = "0.16.2"
-jsonschema = { version = "0.47.0", default-features = false }
+fancy-regex = "0.19.0"
+jsonschema = { version = "0.49.9", default-features = false }
 remora-domain.workspace = true
 serde.workspace = true
 serde_json.workspace = true

crates/remora-coordination/Cargo.toml

@@ -7,7 +7,7 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-redis = { version = "0.32.7", default-features = false, features = [
+redis = { version = "1.6.0", default-features = false, features = [
     "aio",
     "connection-manager",
     "script",

crates/remora-coordination/src/store.rs

@@ -1,7 +1,7 @@
 use std::time::Duration;
 
 use redis::aio::{ConnectionManager, ConnectionManagerConfig};
-use redis::{AsyncCommands, Client, FromRedisValue, RedisResult, Value};
+use redis::{AsyncCommands, Client, FromRedisValue, Value};
 
 use crate::error::CoordinationError;
 use crate::keys::KeySpace;
@@ -52,9 +52,9 @@ impl CoordinationStore {
             CoordinationError::config(format!("invalid coordination URL: {error}"))
         })?;
         let connection_config = ConnectionManagerConfig::new()
-            .set_connection_timeout(Duration::from_secs(3))
-            .set_response_timeout(Duration::from_secs(5))
-            .set_max_delay(1_000);
+            .set_connection_timeout(Some(Duration::from_secs(3)))
+            .set_response_timeout(Some(Duration::from_secs(5)))
+            .set_max_delay(Duration::from_millis(1_000));
         let conn = ConnectionManager::new_with_config(client, connection_config).await?;
         Ok(Self {
             conn,
@@ -497,8 +497,7 @@ fn value_to_strings(value: &Value) -> Result<Vec<String>, CoordinationError> {
                     Value::Int(n) => out.push(n.to_string()),
                     other => {
                         // Fall back to Redis display for unexpected tags.
-                        let as_string: RedisResult<String> =
-                            FromRedisValue::from_redis_value(other);
+                        let as_string = String::from_redis_value_ref(other);
                         out.push(as_string.unwrap_or_else(|_| format!("{other:?}")));
                     }
                 }

crates/remora-credentials/Cargo.toml

@@ -7,12 +7,12 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-getrandom = "0.3.4"
+getrandom = "0.4.3"
 remora-domain.workspace = true
 remora-durable.workspace = true
-reqwest = { version = "0.12.28", default-features = false, features = [
+reqwest = { version = "0.13.4", default-features = false, features = [
     "json",
-    "rustls-tls-webpki-roots",
+    "rustls",
 ] }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true

crates/remora-deletion/Cargo.toml

@@ -7,8 +7,8 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-futures-util = "0.3.32"
-getrandom = "0.3.4"
+futures-util = "0.3.34"
+getrandom = "0.4.3"
 remora-domain.workspace = true
 remora-durable.workspace = true
 remora-identity = { path = "../remora-identity" }

crates/remora-hf-source/Cargo.toml

@@ -9,12 +9,12 @@ version.workspace = true
 [dependencies]
 bytes = "1.12.1"
 hf-hub.workspace = true
-http = "1.4.0"
+http = "1.5.0"
 httpdate = "1.0.3"
 remora-domain.workspace = true
 remora-outbound = { path = "../remora-outbound" }
 remora-stream = { path = "../remora-stream" }
-reqwest = { version = "0.12.28", default-features = false }
+reqwest = { version = "0.13.4", default-features = false }
 serde.workspace = true
 serde_json.workspace = true
 serde_json_canonicalizer.workspace = true
@@ -26,5 +26,5 @@ tempfile = "3.27.0"
 url = "2.5.8"
 
 [dev-dependencies]
-ipnet = "2.12.0"
+ipnet = "2.12.1"
 tokio = { workspace = true, features = ["io-util", "net"] }

crates/remora-http-source/Cargo.toml

@@ -8,16 +8,16 @@ version.workspace = true
 
 [dependencies]
 bytes = "1.12.1"
-http = "1.4.0"
+http = "1.5.0"
 httpdate = "1.0.3"
 remora-domain.workspace = true
 remora-outbound = { path = "../remora-outbound" }
 remora-stream = { path = "../remora-stream" }
-reqwest = { version = "0.12.28", default-features = false }
+reqwest = { version = "0.13.4", default-features = false }
 thiserror.workspace = true
 tokio.workspace = true
 
 [dev-dependencies]
-ipnet = "2.12.0"
+ipnet = "2.12.1"
 sha2.workspace = true
 tokio = { workspace = true, features = ["io-util", "net"] }

crates/remora-http-source/tests/http_source.rs

@@ -424,7 +424,7 @@ async fn changed_redirect_target_invalidates_resume_identity() {
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn response_start_timeout_is_retryable() {
     let (port, _, server) = serve(1, |_, _| {
-        std::thread::sleep(Duration::from_millis(50));
+        std::thread::sleep(Duration::from_millis(500));
         strong(b"body", "\"v1\"")
     })
     .await;
@@ -433,7 +433,7 @@ async fn response_start_timeout_is_retryable() {
         .allow_non_global("127.0.0.0/8".parse::<IpNet>().expect("network"))
         .build();
     let timing = RetryTiming {
-        response_start_timeout: Duration::from_millis(5),
+        response_start_timeout: Duration::from_millis(100),
         ..RetryTiming::default_bounds()
     };
     assert_eq!(

crates/remora-identity/Cargo.toml

@@ -8,12 +8,12 @@ version.workspace = true
 
 [dependencies]
 base64.workspace = true
-jsonwebtoken = { version = "9.3.1", default-features = false, features = ["use_pem"] }
+jsonwebtoken = { version = "11.0.0", default-features = false, features = ["aws_lc_rs", "use_pem"] }
 remora-domain.workspace = true
 remora-durable.workspace = true
-reqwest = { version = "0.12.28", default-features = false, features = [
+reqwest = { version = "0.13.4", default-features = false, features = [
     "json",
-    "rustls-tls-webpki-roots",
+    "rustls",
 ] }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
@@ -24,8 +24,6 @@ time.workspace = true
 tokio.workspace = true
 
 [dev-dependencies]
-pkcs8 = { version = "0.10.2", features = ["pem"] }
-rand = "0.8.5"
+rcgen = { version = "0.14.9", default-features = false, features = ["aws_lc_rs", "pem"] }
 remora-schema.workspace = true
-rsa = { version = "0.9.8", default-features = false, features = ["std", "pem"] }
 tokio = { workspace = true, features = ["macros", "rt-multi-thread", "sync", "time"] }

crates/remora-identity/tests/token_validation.rs

@@ -2,13 +2,12 @@ use std::collections::HashMap;
 use std::sync::LazyLock;
 
 use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header, encode};
+use rcgen::{KeyPair, PKCS_RSA_SHA256, RsaKeySize};
 use remora_domain::{BucketName, StorageScope, TargetPrefix, TargetStoreId};
 use remora_identity::{
     OidcConfig, OidcIdentityProvider, ZITADEL_PROJECT_ROLES_CLAIM, encode_admin_role,
     encode_storage_role,
 };
-use rsa::RsaPrivateKey;
-use rsa::pkcs8::{EncodePrivateKey, EncodePublicKey, LineEnding};
 use serde_json::json;
 
 struct EphemeralRsa {
@@ -17,15 +16,10 @@ struct EphemeralRsa {
 }
 
 static EPHEMERAL_RSA: LazyLock<EphemeralRsa> = LazyLock::new(|| {
-    let mut rng = rand::thread_rng();
-    let private = RsaPrivateKey::new(&mut rng, 2048).expect("generate ephemeral RSA key");
-    let private_pem = private
-        .to_pkcs8_pem(LineEnding::LF)
-        .expect("encode private pem");
-    let public_pem = private
-        .to_public_key()
-        .to_public_key_pem(LineEnding::LF)
-        .expect("encode public pem");
+    let key_pair = KeyPair::generate_rsa_for(&PKCS_RSA_SHA256, RsaKeySize::_2048)
+        .expect("generate ephemeral RSA key");
+    let private_pem = key_pair.serialize_pem();
+    let public_pem = key_pair.public_key_pem();
     EphemeralRsa {
         encoding: EncodingKey::from_rsa_pem(private_pem.as_bytes()).expect("encoding key"),
         decoding: DecodingKey::from_rsa_pem(public_pem.as_bytes()).expect("decoding key"),

crates/remora-object-source/Cargo.toml

@@ -8,8 +8,8 @@ version.workspace = true
 
 [dependencies]
 bytes = "1.12.1"
-futures-util = "0.3.32"
-opendal = { version = "0.58.0", default-features = false, features = [
+futures-util = "0.3.34"
+opendal = { version = "0.58.1", default-features = false, features = [
     "executors-tokio",
     "http-transport-reqwest",
     "http-transport-reqwest-rustls",

crates/remora-outbound/Cargo.toml

@@ -7,17 +7,17 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-http = "1.4.0"
-ipnet = "2.12.0"
-reqwest = { version = "0.12.28", default-features = false, features = [
-    "rustls-tls-webpki-roots",
+http = "1.5.0"
+ipnet = "2.12.1"
+reqwest = { version = "0.13.4", default-features = false, features = [
+    "rustls",
 ] }
 thiserror.workspace = true
 tokio.workspace = true
 url = "2.5.8"
 
 [dev-dependencies]
-rcgen = { version = "0.14.8", default-features = false, features = ["ring"] }
-rustls = { version = "0.23.42", default-features = false, features = ["ring", "std", "tls12"] }
+rcgen = { version = "0.14.9", default-features = false, features = ["ring"] }
+rustls = { version = "0.23.43", default-features = false, features = ["ring", "std", "tls12"] }
 tokio = { workspace = true, features = ["macros", "net", "rt-multi-thread", "sync", "time"] }
 tokio-rustls = { version = "0.26.4", default-features = false, features = ["ring", "tls12"] }

crates/remora-result/Cargo.toml

@@ -8,7 +8,7 @@ version.workspace = true
 
 [dependencies]
 bytes = "1.11.1"
-futures-util = "0.3.32"
+futures-util = "0.3.34"
 remora-domain.workspace = true
 remora-durable.workspace = true
 remora-stream = { path = "../remora-stream" }

crates/remora-runtime/Cargo.toml

@@ -7,8 +7,8 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-actix-web = "=4.14.0"
-getrandom = "0.3.4"
+actix-web = "=4.14.1"
+getrandom = "0.4.3"
 remora-coordination = { path = "../remora-coordination" }
 serde.workspace = true
 sqlx.workspace = true