Skip to content

fix: drop polonius-the-crab, inline unsafe reborrow - #404

Closed
catinspace-au wants to merge 4 commits into
ClickHouse:mainfrom
hyperi-io:hyperi/remediation-polonius
Closed

fix: drop polonius-the-crab, inline unsafe reborrow#404
catinspace-au wants to merge 4 commits into
ClickHouse:mainfrom
hyperi-io:hyperi/remediation-polonius

Conversation

@catinspace-au

Copy link
Copy Markdown
Contributor

polonius-the-crab has so many abandonment issues it needs therapy --
two RustSec advisories across its transitive deps, the whole tree
stagnant for 12+ months. Four crates for a macro that expands to
one line of unsafe.

Inlined the raw-pointer reborrow with a full safety proof and
documentation of every alternative we tried (and why none compiled
without unsafe). Removes 4 crates, clears 2 advisories.

- fxhash (RUSTSEC-2025-0057, unmaintained) -> rustc-hash 2.x
- linked-hash-map (no releases since 2020) -> indexmap (already a dep)
- cargo update for semver-compatible bumps
Comment thread src/cursors/row.rs Outdated
@CLAassistant

CLAassistant commented Apr 29, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@catinspace-au
catinspace-au force-pushed the hyperi/remediation-polonius branch from 1f3013e to c4c6138 Compare April 29, 2026 00:13
…436)

- Drop polonius-the-crab and 3 transitive deps (paste, higher-kinded-types,
  macro_rules_attribute) — clears RUSTSEC-2024-0436 (paste unmaintained)
- Inline the raw-pointer reborrow that polonius wrapped behind a macro
- Fix rustfmt.toml edition 2021 -> 2024 to match Cargo.toml
4 mock-based tests (no ClickHouse needed) + 3 integration tests
covering the unsafe reborrow paths in poll_next and Next::poll:
- single row, multi-row, empty result, fetch_all/fetch_one (mock)
- large result spanning chunks, borrowed rows, small block size (integration)
Strip informal phrasings ("we hate", "needs therapy", "buy it a beer")
and replace em-dashes with ASCII punctuation to match project style.
Technical content unchanged.
@catinspace-au

Copy link
Copy Markdown
Contributor Author

Closing this in favour of a fresh upstreaming approach.

We're consolidating our upstream-targeted work onto a new hyperi-port/* branch chain off current main (0.15.0+). The 0.14 → 0.15 changes (#380, #390, #391, #397, #403) made these original PRs hard to rebase as a unit, and several of them packed too much into a single review. The new chain breaks the work into bite-sized PRs (target <500 LoC, hard limit 1500), each landing as a single squashed commit.

The polonius removal lands first as #422 (already rebased on main, single commit). The remainder of the chain — TCP transport, columnar/Native-format primitive, Inserter RFC #421 implementation, batching, multi-host, etc. — will arrive as separate PRs over the coming weeks. Some pieces (UnifiedClient ergonomic wrapper, DynamicInsert from serde_json::Value) won't be re-proposed upstream and will live in our consumer crate instead.

Sorry for the noise, people.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants