Skip to content

fix: remove unused surf fallback from schema store - #1920

Merged
ya7010 merged 2 commits into
mainfrom
ya7010/fix-code-scanning-alerts
May 28, 2026
Merged

fix: remove unused surf fallback from schema store#1920
ya7010 merged 2 commits into
mainfrom
ya7010/fix-code-scanning-alerts

Conversation

@ya7010

@ya7010 ya7010 commented May 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • remove the unused surf fallback client from tombi-schema-store
  • drop the obsolete surf2 feature and workspace dependency
  • refresh Cargo.lock to remove the unmaintained transitive dependency chain flagged by code scanning

Background

surf was not part of the active runtime path in this repository anymore. Current consumers of tombi-schema-store use the native (reqwest) or wasm (gloo-net) paths, while the surf2 fallback had become a leftover compatibility path.

The immediate trigger for this change was GitHub code scanning: keeping surf in the dependency graph pulled in an unmaintained chain including async-std, stdweb, instant, cpuid-bool, aesni, and aes-soft. Since that stack was no longer needed for actual supported feature combinations, the safer and lower-maintenance fix was to remove the dead fallback rather than keep carrying and justifying stale vulnerable dependencies in Cargo.lock.

This PR therefore records the intent explicitly: the goal is not only to make the alert disappear, but to align the manifest and lockfile with the HTTP client paths that tombi still supports in practice.

Why Remove Instead Of Upgrade

The key point is that this was not a normal dependency bump situation.

At the time of this PR, surf itself is marked unmaintained by RustSec, and the advisory does not provide a patched release line. In other words, there is no known "upgrade to version X" remediation path inside the surf crate line itself. Keeping surf would therefore mean knowingly retaining an unmaintained dependency tree and documenting exceptions around it.

That trade-off only makes sense if the repository still has a real supported feature path that depends on surf. After checking the workspace, that was not the case here:

  • the supported native path is reqwest
  • the supported wasm path is gloo-net
  • no in-repo consumer was enabling surf2
  • the surf implementation had effectively become a dormant compatibility fallback

Because of that, upgrading was not available, and ignoring the alert would have meant preserving a dead path plus its stale transitive dependency chain in the main lockfile.

Decision Boundary

This change should be read as a maintenance decision, not as a statement that surf is universally forbidden.

The reason for removal is specifically the combination of these facts:

  • surf has no patched maintained release path for the advisory in question
  • the repository's supported execution paths no longer require it
  • leaving it in place would keep unmaintained transitive dependencies in the default audited dependency graph

If a future experimental flow truly needs surf, it should come back as an explicitly scoped experimental path with a clear owner and documented risk acceptance, rather than remaining as an unowned fallback in the default workspace dependency graph.

Testing

  • cargo fmt --all
  • cargo clippy --workspace --all-targets --locked -- -D warnings
  • cargo nextest run --workspace --locked --no-fail-fast
  • cargo test --workspace --doc --locked

Copilot AI review requested due to automatic review settings May 27, 2026 14:19
@ya7010 ya7010 added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 27, 2026
Copilot AI reviewed May 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR removes the unused surf-based HTTP client fallback from tombi-schema-store, drops the obsolete surf2 feature/workspace dependency, and refreshes Cargo.lock to eliminate an unmaintained transitive dependency chain.

Changes:

  • Delete the surf-based HTTP client implementation and remove related feature gates.
  • Remove surf from tombi-schema-store and workspace dependencies/features.
  • Update Cargo.lock to reflect the dependency graph after removing surf.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
crates/tombi-schema-store/src/http_client/surf_client.rs Removes the surf-based HTTP client implementation.
crates/tombi-schema-store/src/http_client.rs Drops surf2 selection logic and updates the “no client enabled” stub cfg.
crates/tombi-schema-store/Cargo.toml Removes the optional surf dependency and the surf2 feature.
Cargo.toml Removes the workspace dependency on surf.
Cargo.lock Removes surf and related transitive dependencies from the lockfile.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread crates/tombi-schema-store/src/http_client.rs
@ya7010
ya7010 merged commit c813b37 into main May 28, 2026
21 checks passed
@ya7010
ya7010 deleted the ya7010/fix-code-scanning-alerts branch May 28, 2026 01:06
@BrewTestBot BrewTestBot mentioned this pull request May 29, 2026
Merged
This was referenced Jul 16, 2026
Closed
Closed
Merged
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Jul 16, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade tombi (#84)
607af36 
Automated mise tool upgrades from local config.

Updated tools:
- `tombi`

Command: `mise upgrade --bump --local tombi`

<details>
<summary>Version changelog (tombi)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `tombi` | `1.0.0` → `1.2.0` | `1.0.0` → `1.2.0` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>tombi: `1.0.0` → `1.2.0` (tombi-toml/tombi)</summary>

### v1.1.0

<!-- Release notes generated using configuration in .github/release.yml at v1.1.0 -->

## What's Changed

Starting with this version, we will synchronize [setup-tombi](https://github.com/tombi-toml/setup-tombi) with version control.

### 🛠️ Other Changes
* test: consolidate tombi-lsp ad hoc cases by @ya7010 in tombi-toml/tombi#1914
* ci: sync setup-tombi release automation by @ya7010 in tombi-toml/tombi#1915

**Full Changelog**: tombi-toml/tombi@v1.0.0...v1.1.0

### v1.1.1

<!-- Release notes generated using configuration in .github/release.yml at v1.1.1 -->

## What's Changed
### 🐛 Bug Fixes
* Align multiline delimiter comments with trailing comment width by @ya7010 in tombi-toml/tombi#1924
### 👒 Dependencies
* fix: address Dependabot security alerts by @ya7010 in tombi-toml/tombi#1919
* fix: remove unused surf fallback from schema store by @ya7010 in tombi-toml/tombi#1920
### 🛠️ Other Changes
* fix: statically link Windows MSVC CRT by @ya7010 in tombi-toml/tombi#1917
* fix: resolve Dependabot security alerts by @ya7010 in tombi-toml/tombi#1918

**Full Changelog**: tombi-toml/tombi@v1.1.0...v1.1.1

### v1.1.2

<!-- Release notes generated using configuration in .github/release.yml at v1.1.2 -->

## What's Changed
### 🚀 New Features
* feat(installer): add archive checksum verification by @ya7010 in tombi-toml/tombi#1931
* fix(cargo-hover): show feature dependency metadata in hover by @ya7010 in tombi-toml/tombi#1932
### 👒 Dependencies
* build(deps): bump tar from 0.4.45 to 0.4.46 in the cargo group across 1 directory by @dependabot[bot] in tombi-toml/tombi#1928
### 🛠️ Other Changes
* ci: follow setup-tombi consolidated release workflow by @ya7010 in tombi-toml/tombi#1925
* docs(schema): describe partially dynamic pyproject metadata by @ya7010 in tombi-toml/tombi#1929

**Full Changelog**: tombi-toml/tombi@v1.1.1...v1.1.2

### v1.1.3

<!-- Release notes generated using configuration in .github/release.yml at v1.1.3 -->

## What's Changed
### 🚀 New Features
* fix(pyproject): keep declarations out of references by @ya7010 in tombi-toml/tombi#1937
### 🛠️ Other Changes
* docs(install): remove sha256 prefix from checksum example by @ya7010 in tombi-toml/tombi#1933
* fix(ci): quote install workflow step name by @ya7010 in tombi-toml/tombi#1934
* ci: pin GitHub Actions and tighten defaults by @ya7010 in tombi-toml/tombi#1935
* ci: pin npm release tooling versions by @ya7010 in tombi-toml/tombi#1936
* ci: use trusted publishing for PyPI release by @ya7010 in tombi-toml/tombi#1938
* fix(ci): pass snapcraft matrix platform to build by @ya7010 in tombi-toml/tombi#1939
* fix(ci): allow snapcraft cross-build platforms on amd64 by @ya7010 in tombi-toml/tombi#1940

**Full Changelog**: tombi-toml/tombi@v1.1.2...v1.1.3

### v1.1.4

<!-- Release notes generated using configuration in .github/release.yml at v1.1.4 -->

## What's Changed
### 🐛 Bug Fixes
* fix(lsp): avoid stale diagnostics after changes by @ya7010 in tombi-toml/tombi#1954
### 👒 Dependencies
* build(deps-dev): bump esbuild from 0.28.0 to 0.28.1 in the npm_and_yarn group across 1 directory by @dependabot[bot] in tombi-toml/tombi#1945
* build(deps-dev): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in tombi-toml/tombi#1952
### 🛠️ Other Changes
* fix(ci): include LICENSE in python sdist by @ya7010 in tombi-toml/tombi#1942
* docs: explain selective auto-sort re-enable by @ya7010 in tombi-toml/tombi#1943
* Use GitHub App token for dependent release dispatches by @ya7010 in tombi-toml/tombi#1951

**Full Changelog**: tombi-toml/tombi@v1.1.3...v1.1.4

### v1.1.5

<!-- Release notes generated using configuration in .github/release.yml at v1.1.5 -->

## What's Changed
### 🐛 Bug Fixes
* fix(lsp): merge allOf table key completions by @ya7010 in tombi-toml/tombi#1959
* fix(vscode): color TOML dates as constants by @ya7010 in tombi-toml/tombi#1960
### 🛠️ Other Changes
* fix(lsp): complete literal keys in tables by @ya7010 in tombi-toml/tombi#1958

**Full Changelog**: tombi-toml/tombi@v1.1.4...v1.1.5

### v1.1.6

<!-- Release notes generated using configuration in .github/release.yml at v1.1.6 -->

## What's Changed
### 🚀 New Features
* feat: include target in CLI version output by @ya7010 in tombi-toml/tombi#1974
### 🐛 Bug Fixes
* fix: remove npm install script from tombi package by @ya7010 in tombi-toml/tombi#1969
### 🛠️ Other Changes
* Fix Windows release CRT linkage by @ya7010 in tombi-toml/tombi#1961
* ci: use shared release environment by @ya7010 in tombi-toml/tombi#1962
* Deprecate legacy document-link feature toggles by @ya7010 in tombi-toml/tombi#1965
* docs: add v2 release todo by @ya7010 in tombi-toml/tombi#1966
* chore: bump biome $schema to match pinned CLI 2.3.8 by @EduardF1 in tombi-toml/tombi#1967
* Align release build settings by @ya7010 in tombi-toml/tombi#1972
* fix: update vulnerable npm dependencies by @ya7010 in tombi-toml/tombi#1973

## New Contributors
* @EduardF1 made their first contribution in tombi-toml/tombi#1967

**Full Changelog**: tombi-toml/tombi@v1.1.5...v1.1.6

### v1.1.7

<!-- Release notes generated using configuration in .github/release.yml at v1.1.7 -->

## What's Changed
### 🦅 New Features
* Apply quote style to string keys by @ya7010 in tombi-toml/tombi#1980
* Support JSON schema `deprecationMessage` by @ya7010 in tombi-toml/tombi#1986
### 🐝 Bug Fixes
* Fix nested anyOf hover enum selection by @ya7010 in tombi-toml/tombi#1979
### 🛠️ Other Changes
* Update issue template emoji by @ya7010 in tombi-toml/tombi#1975
* Fix anyOf hover enum leakage by @ya7010 in tombi-toml/tombi#1976
* ci: validate winget manifest before submission by @ya7010 in tombi-toml/tombi#1977
* Improve formatting edit debug log by @ya7010 in tombi-toml/tombi#1978
* ci: harden winget manifest invocation check by @ya7010 in tombi-toml/tombi#1981
* ci: validate winget manifest leaf directory by @ya7010 in tombi-toml/tombi#1982
* ci: ignore winget manifest validation warnings by @ya7010 in tombi-toml/tombi#1983
* Fix root `$ref` schema completion by @kjanat in tombi-toml/tombi#1984

**Full Changelog**: tombi-toml/tombi@v1.1.6...v1.1.7

### v1.2.0

<!-- Release notes generated using configuration in .github/release.yml at v1.2.0 -->

## What's Changed
### 🚨 Breaking Changes
* Send CLI diagnostics to stderr by @ya7010 in tombi-toml/tombi#1991
### 🦅 New Features
* Add release asset attestations by @ya7010 in tombi-toml/tombi#1993
### 🐝 Bug Fixes
* fix(lsp): clear diagnostics after document close if workspace-diagnostics is disabled by @ya7010 in tombi-toml/tombi#1998
### 🛠️ Other Changes
* ci: align release note category emoji by @ya7010 in tombi-toml/tombi#1990
* docs: document TOMBI_NO_COLOR by @ya7010 in tombi-toml/tombi#1997
* fix(lsp): avoid cloning document URIs by @ya7010 in tombi-toml/tombi#1999

**Full Changelog**: tombi-toml/tombi@v1.1.7...v1.2.0

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ya7010