psa-systems/bunyip
Watch
9
0
Fork
You've already forked bunyip
 0
Code Issues Pull requests Projects Releases 18 Packages Wiki Activity Actions

chore(deps): collapse the dunite pins onto one merged rev (DEV-495) #452

Merged
longjacksonle merged 1 commit from chore/DEV-495-repin-dunite-merged-revs into main 2026-08-04 14:15:22 +02:00
Conversation 0 Commits 1 Files changed 4 +18 -32
longjacksonle commented 2026-08-04 02:26:20 +02:00
Owner
Copy link

Every consumer PR under the DEV-495 epic pinned its dunite dep to the branch rev that introduced the crate, with a comment promising to re-pin once the dunite PR merged. They all have, so this collapses the lot onto dunite main cc10e83.

crate was now
dunite-core c5730bc cc10e83
dunite-download c5730bc cc10e83
dunite-oci c5730bc cc10e83
dunite-oidc c5730bc cc10e83
dunite-stripe-core 0734f2a cc10e83
dunite-feedback 3c9d3f8 cc10e83
dunite-stripe 41dbbeb cc10e83
dunite-user-core 82cfbe0 cc10e83

Cargo now resolves one git checkout instead of five, and the next bump is one edit instead of eight.

Not a pure no-op

dunite-core/download/oci/oidc move off c5730bc, which picks up dunite #26: alg=EdDSA published on every JWK. bunyip serves provider.keys.jwks verbatim at /.well-known/jwks.json, so each key in that document gains "alg": "EdDSA". This is additive and RFC 7517-correct: strict RP key selectors that filter candidates by alg start matching, and anything that ignored the field is unaffected. No other shared crate changed between the old pins and main.

Testing

cargo clippy --workspace --all-targets -- -D warnings clean, cargo test --workspace --lib 414 passed / 0 failed. Cargo.lock confirms all eight crates resolve to the single cc10e83 source.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CGnY8JKXCgH2jiUSqH6g4x

Every consumer PR under the DEV-495 epic pinned its dunite dep to the branch rev that introduced the crate, with a comment promising to re-pin once the dunite PR merged. They all have, so this collapses the lot onto dunite main `cc10e83`. | crate | was | now | |---|---|---| | dunite-core | c5730bc | cc10e83 | | dunite-download | c5730bc | cc10e83 | | dunite-oci | c5730bc | cc10e83 | | dunite-oidc | c5730bc | cc10e83 | | dunite-stripe-core | 0734f2a | cc10e83 | | dunite-feedback | 3c9d3f8 | cc10e83 | | dunite-stripe | 41dbbeb | cc10e83 | | dunite-user-core | 82cfbe0 | cc10e83 | Cargo now resolves one git checkout instead of five, and the next bump is one edit instead of eight. ## Not a pure no-op dunite-core/download/oci/oidc move off c5730bc, which picks up dunite #26: `alg=EdDSA` published on every JWK. bunyip serves `provider.keys.jwks` verbatim at `/.well-known/jwks.json`, so each key in that document gains `"alg": "EdDSA"`. This is additive and RFC 7517-correct: strict RP key selectors that filter candidates by `alg` start matching, and anything that ignored the field is unaffected. No other shared crate changed between the old pins and main. ## Testing `cargo clippy --workspace --all-targets -- -D warnings` clean, `cargo test --workspace --lib` 414 passed / 0 failed. `Cargo.lock` confirms all eight crates resolve to the single `cc10e83` source. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CGnY8JKXCgH2jiUSqH6g4x
chore(deps): collapse the dunite pins onto one merged rev (DEV-495)
All checks were successful
E2E PR gate / Install + reachability (no deployment secrets) (pull_request) Successful in 23s
Details
Check / fmt + clippy + build + tests (pull_request) Successful in 13m29s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
fc3a2e75f5 
The five shared crates were each pinned to the branch rev that introduced them (dunite-core/download/oci/oidc at c5730bc, stripe-core at 0734f2a, feedback at 3c9d3f8, stripe at 41dbbeb, user-core at 82cfbe0), which is what the consumer PRs promised to clean up once the dunite PRs landed. All eight now point at dunite main cc10e83, so cargo resolves a single checkout instead of five and a future bump is one edit rather than eight.

Not a pure no-op: dunite-core/download/oci/oidc move from c5730bc to main, which picks up dunite PR #26 (alg=EdDSA on every published JWK). bunyip serves `provider.keys.jwks` verbatim at `/.well-known/jwks.json`, so each key in that document now carries `"alg": "EdDSA"`. Additive and RFC 7517-correct: strict RP key selectors that filter candidates by `alg` start matching, and nothing that ignored the field changes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CGnY8JKXCgH2jiUSqH6g4x
longjacksonle deleted branch chore/DEV-495-repin-dunite-merged-revs 2026-08-04 14:15:22 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/bunyip!452
No description provided.