chore(rs): bump IC dependencies and didc to latest#7812
Merged
Conversation
2 tasks
505fcff to
b3b5528
Compare
|
✅ No security or compliance issues detected. Reviewed everything up to 06954a4. Security Overview
Detected Code ChangesThe diff is too large to display a summary of code changes. |
ic-cdk 0.19 removed the decoding_quota query attribute. Re-impose the 10K cycle budget that previously guarded http_request against oversized attacker-controlled payloads, using a custom decode_with function that sets both decoding_quota and skipping_quota. Also drops a useless .into_iter() flagged by newer clippy.
After the ic-cdk 0.19 migration, the error type returned from
inter-canister calls changed from (RejectionCode, String) to
ic_cdk::call::Error. The old code formatted these with {err:?} which
produced clean output for the tuple, but the new Error enum's Debug
output is verbose (CallRejected { ... }). Switch to {err} so that
thiserror's Display impl (transparent on each variant) renders the
reject_message directly. Logs only — no candid surface affected.
Also drops the orphaned rs/backend/src/spawn.rs file. The 'mod spawn'
declaration was removed from main.rs during the ic-cdk-timers
migration but the file itself was left behind.
The braced match arm for the lifecycle error needs a trailing semicolon to match the other arms and satisfy clippy::semicolon_if_nothing_returned on Rust 1.94.1.
Avoid drift between the workspace pin and a hardcoded version in sns_aggregator's Cargo.toml on the next ic-cdk bump. Also adds TODOs for two pre-existing concerns surfaced during review that are out of scope for this branch: - update_cache could race under concurrent timer invocations; consider set_timer_interval_serial added in ic-cdk-timers 1.0.0. - backend http_request has no decoding quota; add a decode_with decoder matching the sns_aggregator pattern.
jasonz-dfinity
approved these changes
May 20, 2026
Address review nit: the const was sandwiched between two use statements. Moving it below the import block reads cleaner.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The IC cargo dependencies were pinned to
release-2025-08-14_03-27-base. Upgrading torelease-2026-04-02_04-48-basewas blocked because the new IC release requiresic-cdk-timers ^1.0.0, which conflicts with the old version^0.11.0pinned in the workspace. Additionally, didc was bumped from 0.4.0 to 0.5.4.Changes
release-2025-08-14_03-27-basetorelease-2026-04-02_04-48-base.ic-cdkfrom0.17.1to0.19.0,ic-cdk-timersfrom0.11.0to1.0.0, andic-management-canister-typesfrom0.4.1to0.5.0.set_timerandset_timer_intervalcall sites to the new future-based API inic-cdk-timers 1.0.0.timer.rsto store futures instead of plain closures.spawnmodule from the backend.ic_cdk::callto the newic_cdk::call::Call::unbounded_waitbuilder API inexchange_rate_canister.rs,governance.rs,upstream.rs, andlib.rs.ic_cdk::idtocanister_self,api::set_certified_datatocertified_data_set,api::stable::*toic_cdk::stable::*, andapi::call::CallResult/RejectionCodetoic_cdk::call::CallResult/RejectCode.CanisterId/CanisterIdRecordfrom the deprecatedapi::management_canister::mainmodule withcandid::Principalandic_cdk::management_canister::CanisterIdRecord.#![allow(deprecated)]to the auto-generatedic_sns_*.rsbindings and thedid2rs.headertemplate.decoding_quotaattribute from#[ic_cdk::query]insns_aggregator(removed in ic-cdk 0.19.0).DIDC_RELEASEto2025-12-18andDIDC_VERSIONtodidc 0.5.4inconfig.json.candid_parserdev-dependency from0.1.2to0.3.0.Tests
Todos