Skip to content

chore(sdk): bump version to 0.3.1 - #28

Merged
jonasz-lasut merged 2 commits into
mainfrom
chore/release-0.3.1
Oct 8, 2026
Merged

jonasz-lasut merged 2 commits into
mainfrom
chore/release-0.3.1

Conversation

@jonasz-lasut

@jonasz-lasut jonasz-lasut commented Oct 8, 2026 •

Copy link
Copy Markdown
Collaborator

Bumps function-sdk-rust to 0.3.1 to release what landed since v0.3.0:

  • rustls 0.23.45 for RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc. fix: bump rustls and move the example image to Debian 13 #27 fixed it in this repo's Cargo.lock only, which projects depending on the SDK ignore, so this PR also declares rustls = { version = "0.23.45", default-features = false } in sdk/Cargo.toml. With 0.3.1 they cannot resolve an affected rustls; default-features = false keeps the feature set tonic's tls-aws-lc already enables.
  • Renovate lockfile updates: tokio 1.53.2, thiserror 2.0.21, clap 4.6.7, prometheus-client 0.25.1 and tokio-test 0.4.6.
  • The crate's repository field and the README link point to crossplane/function-sdk-rust instead of the old fork, which fixes the repository link on crates.io.
  • The vendored run_function.proto marker names crossplane/crossplane v2.4.2 (comment-only change).

Checked locally: clippy -D warnings and tests pass, and cargo publish -p function-sdk-rust --dry-run succeeds. In a scratch crate depending on the SDK, cargo update -p rustls --precise 0.23.43 succeeds against 0.3.0 and fails against this branch with "failed to select a version for the requirement rustls = "^0.23.45"".

After merge, run the Publish workflow with version v0.3.1: it compares the input against v plus the sdk/Cargo.toml version.

Signed-off-by: Jonasz Małecki <jonasz@upbound.io>
The rustls fix from #27 only changed this repo's Cargo.lock, which
projects depending on the SDK ignore. Declare rustls directly with a
0.23.45 floor so they cannot resolve a version affected by
RUSTSEC-2026-0285. default-features = false keeps the feature set that
tonic's tls-aws-lc already enables.

Signed-off-by: Jonasz Małecki <jonasz@upbound.io>
@jonasz-lasut
jonasz-lasut marked this pull request as ready for review October 8, 2026 06:32
@jonasz-lasut
jonasz-lasut merged commit a64ce1c into main Oct 8, 2026
5 checks passed
@jonasz-lasut
jonasz-lasut deleted the chore/release-0.3.1 branch October 11, 2026 15:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant