From 68c854dc1cf4e4363f4dd1a88dece5c283f8ed1e Mon Sep 17 00:00:00 2001 From: vitali87 Date: Sun, 25 Oct 2026 03:15:22 +0400 Subject: [PATCH 1/3] test(graph-rs): add the fuzz package manifest --- rust/cgr_graph_rs/fuzz/Cargo.lock | 183 ++++++++++++++++++++++++++++++ rust/cgr_graph_rs/fuzz/Cargo.toml | 60 ++++++++++ 2 files changed, 243 insertions(+) create mode 100644 rust/cgr_graph_rs/fuzz/Cargo.lock create mode 100644 rust/cgr_graph_rs/fuzz/Cargo.toml diff --git a/rust/cgr_graph_rs/fuzz/Cargo.lock b/rust/cgr_graph_rs/fuzz/Cargo.lock new file mode 100644 index 0000000000..1df32514f6 --- /dev/null +++ b/rust/cgr_graph_rs/fuzz/Cargo.lock @@ -0,0 +1,183 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 4 + +[[package]] +name = "arbitrary" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed" + +[[package]] +name = "bitflags" +version = "2.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06" + +[[package]] +name = "cc" +version = "1.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6651c9ed80effdc7db0ff72512157f901af5e3549e341e24b1dd4887d836d838" +dependencies = [ + "find-msvc-tools", + "jobserver", + "libc", + "shlex", +] + +[[package]] +name = "cfg-if" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600" + +[[package]] +name = "cgr_graph_rs" +version = "0.1.0" +dependencies = [ + "rusqlite", +] + +[[package]] +name = "cgr_graph_rs-fuzz" +version = "0.0.0" +dependencies = [ + "cgr_graph_rs", + "libfuzzer-sys", + "rusqlite", +] + +[[package]] +name = "fallible-iterator" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649" + +[[package]] +name = "fallible-streaming-iterator" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a" + +[[package]] +name = "find-msvc-tools" +version = "0.1.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484" + +[[package]] +name = "foldhash" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" + +[[package]] +name = "getrandom" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" +dependencies = [ + "cfg-if", + "libc", + "r-efi", +] + +[[package]] +name = "hashbrown" +version = "0.15.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" +dependencies = [ + "foldhash", +] + +[[package]] +name = "hashlink" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1" +dependencies = [ + "hashbrown", +] + +[[package]] +name = "jobserver" +version = "0.1.35" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3" +dependencies = [ + "getrandom", + "libc", +] + +[[package]] +name = "libc" +version = "0.2.190" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78" + +[[package]] +name = "libfuzzer-sys" +version = "0.4.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2" +dependencies = [ + "arbitrary", + "cc", +] + +[[package]] +name = "libsqlite3-sys" +version = "0.35.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f" +dependencies = [ + "cc", + "pkg-config", + "vcpkg", +] + +[[package]] +name = "pkg-config" +version = "0.3.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548" + +[[package]] +name = "r-efi" +version = "6.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" + +[[package]] +name = "rusqlite" +version = "0.37.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f" +dependencies = [ + "bitflags", + "fallible-iterator", + "fallible-streaming-iterator", + "hashlink", + "libsqlite3-sys", + "smallvec", +] + +[[package]] +name = "shlex" +version = "2.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba" + +[[package]] +name = "smallvec" +version = "1.16.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b" + +[[package]] +name = "vcpkg" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" diff --git a/rust/cgr_graph_rs/fuzz/Cargo.toml b/rust/cgr_graph_rs/fuzz/Cargo.toml new file mode 100644 index 0000000000..bccfe28404 --- /dev/null +++ b/rust/cgr_graph_rs/fuzz/Cargo.toml @@ -0,0 +1,60 @@ +# SPDX-License-Identifier: MIT +# +# cargo-fuzz targets for cgr_graph_rs. Run one with +# `cargo +nightly fuzz run ` from rust/cgr_graph_rs; each target's +# header says what it checks. The package is a workspace of its own, so the +# crate's own build and tests never compile it. + +[package] +name = "cgr_graph_rs-fuzz" +version = "0.0.0" +edition = "2021" +license = "MIT" +publish = false + +[package.metadata] +cargo-fuzz = true + +[lib] +name = "cgr_graph_rs_fuzz" +path = "src/lib.rs" + +[dependencies] +cgr_graph_rs = { path = ".." } +libfuzzer-sys = "0.4" +# The crate's own pin, for the in-memory database the SQLite target builds. +rusqlite = { version = "0.37", features = ["bundled"] } + +[workspace] +members = ["."] + +[profile.release] +debug = 1 + +[[bin]] +name = "cypher_parse" +path = "fuzz_targets/cypher_parse.rs" +test = false +doc = false +bench = false + +[[bin]] +name = "json_string" +path = "fuzz_targets/json_string.rs" +test = false +doc = false +bench = false + +[[bin]] +name = "graph_algorithms" +path = "fuzz_targets/graph_algorithms.rs" +test = false +doc = false +bench = false + +[[bin]] +name = "sqlite_graph" +path = "fuzz_targets/sqlite_graph.rs" +test = false +doc = false +bench = false From 90743ad377e3783c58a3eebd366fe665eeb27363 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 06:03:22 +0000 Subject: [PATCH 2/3] ci(fuzz): build and run the graph-rs cargo-fuzz targets in ClusterFuzzLite --- .clusterfuzzlite/Dockerfile | 16 ++++++++++++++ .clusterfuzzlite/build.sh | 35 +++++++++++++++++++++++++++++- .github/SECURITY.md | 2 +- .github/workflows/cflite_batch.yml | 12 +++++----- .github/workflows/cflite_pr.yml | 15 ++++++++----- AGENTS.md | 4 +++- CONTRIBUTING.md | 18 +++++++++++++++ 7 files changed, 88 insertions(+), 14 deletions(-) diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile index d0a5162f5a..333a303409 100644 --- a/.clusterfuzzlite/Dockerfile +++ b/.clusterfuzzlite/Dockerfile @@ -67,6 +67,22 @@ RUN curl -fsSLO "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x rm rustup-init && \ cargo --version +# The graph-rs fuzz targets (rust/cgr_graph_rs/fuzz) are cargo-fuzz targets, +# built by the `language: rust` job. OSS-Fuzz's compile hands Rust builds +# -Zsanitizer through RUSTFLAGS, which only a nightly accepts, so they get the +# nightly and the cargo-fuzz release base-builder-rust pins, the pair OSS-Fuzz +# builds against this image's clang. The nightly must be new enough for the +# crate's dependencies, as RUST_TOOLCHAIN above must. A rust build also copies +# the DEFAULT toolchain's std sources (for coverage reports) and stops if they +# are missing, so the stable toolchain carries rust-src. +ARG CARGO_FUZZ_VERSION=0.13.2 +ENV RUST_FUZZ_TOOLCHAIN=nightly-2025-09-05 +RUN rustup toolchain install "${RUST_FUZZ_TOOLCHAIN}" --profile minimal && \ + rustup component add rust-src --toolchain "${RUST_TOOLCHAIN}" && \ + cargo install cargo-fuzz --locked --version "${CARGO_FUZZ_VERSION}" && \ + rm -rf /rust/registry && \ + cargo fuzz --version + # Make that interpreter the default `python3` so compile_python_fuzzer and # build.sh use it without either knowing where it came from. RUN ln -sf "$(uv python find 3.12)" /usr/local/bin/python3 && \ diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh index 426bc3a8b0..066926cbe3 100755 --- a/.clusterfuzzlite/build.sh +++ b/.clusterfuzzlite/build.sh @@ -1,5 +1,38 @@ #!/bin/bash -eu -# Builds one fuzz target per harness in fuzz/. +# Builds one fuzz target per harness in fuzz/, or, for the `language: rust` +# job, one per cargo-fuzz target in rust/cgr_graph_rs/fuzz. +# +# Each job builds only its own language's targets. ClusterFuzzLite's bad-build +# check holds every target in $OUT to the job's language: under `python` it +# checks the frozen `.pkg` a native Rust binary does not have, and +# under `rust` it wants a sanitizer runtime linked into the binary, which a +# Python wrapper script gets through LD_PRELOAD instead. +if [ "$FUZZING_LANGUAGE" = "rust" ]; then + cd "$SRC/code-graph-rag/rust/cgr_graph_rs" + # The linker base-builder-rust sets: libFuzzer comes in as OSS-Fuzz's + # prebuilt libFuzzingEngine.a, built against libc++. + export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=clang + # RUSTUP_TOOLCHAIN rather than `cargo +toolchain`, so `fuzz build` stays the + # first argument OSS-Fuzz's cargo wrapper sees: it rewrites that command for + # a coverage build. Debug assertions on, as OSS-Fuzz builds Rust targets, so + # an integer overflow is a crash. + export RUSTUP_TOOLCHAIN="$RUST_FUZZ_TOOLCHAIN" + cargo fuzz build -O --debug-assertions + for target in $(cargo fuzz list); do + cp "fuzz/target/x86_64-unknown-linux-gnu/release/$target" "$OUT/" + # As for the Python targets below: fail here, naming the target, rather + # than in the bad-build check after the whole job. + echo "Smoke-testing $target" + if ! "$OUT/$target" -runs=1 > /tmp/smoke.log 2>&1; then + echo "ERROR: $target failed to run a single input:" >&2 + tail -25 /tmp/smoke.log >&2 + exit 1 + fi + done + exit 0 +fi + +# The rest is the Python build. # # The harnesses import the package under test, so the project and its parsing # extras must be installed into the image's interpreter before diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 37cdbfa163..2a6e2a549d 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -51,7 +51,7 @@ This policy applies to the `code-graph-rag` Python package and its official repo - **Code scanning**: The CodeQL workflow (`.github/workflows/codeql.yml`) analyses the Actions, C/C++, C#, JavaScript/TypeScript and Python code in this repository on every pull request targeting `main`, pull requests from forks included, on every push to `main` and weekly, and reports findings to the Security tab. The `main` ruleset requires CodeQL results on every pull request and blocks the merge while CodeQL reports any new alert on it - **Static analysis gate**: The SonarCloud workflow analyses pushes to `main` and pull requests targeting `main` from a branch of this repository, Dependabot's excepted, and on those pull requests the `All Checks Pass` status check fails while SonarCloud reports any open issue, vulnerabilities included - **Python security linting**: Bandit runs as a pre-commit hook, and the `Lint & Format` CI job runs the same hook on every pull request, so a high-severity finding fails `All Checks Pass`. The same job's `ruff check` enforces Ruff's flake8-bandit (`S`) rules outside tests, and `pyproject.toml` records why each rule left off is off -- **Fuzzing**: [ClusterFuzzLite](https://google.github.io/clusterfuzzlite/) runs the harnesses in `fuzz/` against every pull request targeting `main`, and daily for longer against `main` +- **Fuzzing**: [ClusterFuzzLite](https://google.github.io/clusterfuzzlite/) runs the harnesses in `fuzz/` and the Rust extension's cargo-fuzz targets in `rust/cgr_graph_rs/fuzz/` against every pull request targeting `main`, and daily for longer against `main` - **Vulnerability scanning**: The [OSV-Scanner](https://google.github.io/osv-scanner/) workflow checks dependencies against the OSV database on pull requests targeting `main`, on pushes to `main` and weekly, and reports findings to the Security tab - **Supply chain scorecard**: The [OpenSSF Scorecard](https://github.com/ossf/scorecard) workflow audits the repository's supply chain posture and reports findings to the Security tab - **Private vulnerability reporting**: Enabled, so vulnerabilities can be reported privately through the Security tab as described above diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index 1897abf116..58a1a120f0 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -20,20 +20,22 @@ concurrency: jobs: batch-fuzzing: - name: Batch fuzz (${{ matrix.sanitizer }}) + name: Batch fuzz (${{ matrix.language }}, ${{ matrix.sanitizer }}) runs-on: ubuntu-latest strategy: fail-fast: false matrix: + # One job per language: see .clusterfuzzlite/build.sh. + language: [python, rust] sanitizer: [address] steps: - - name: Build fuzzers (${{ matrix.sanitizer }}) + - name: Build fuzzers (${{ matrix.language }}, ${{ matrix.sanitizer }}) uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: sanitizer: ${{ matrix.sanitizer }} - language: python + language: ${{ matrix.language }} - - name: Run fuzzers (${{ matrix.sanitizer }}) + - name: Run fuzzers (${{ matrix.language }}, ${{ matrix.sanitizer }}) uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} @@ -46,4 +48,4 @@ jobs: # 30s default). A PyInstaller-frozen Python target is slow to start, # so dropping this risks real crashes being written off as # unreproducible. - language: python + language: ${{ matrix.language }} diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index de90a08672..9a189020e4 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -1,7 +1,9 @@ # ClusterFuzzLite on pull requests. # # Runs each harness in fuzz/ for a short budget against the PR's head, seeded -# from the corpus in fuzz/corpus/. A crash fails the job with the reproducing +# from the corpus in fuzz/corpus/, and each cargo-fuzz target in +# rust/cgr_graph_rs/fuzz in a job of its own (see .clusterfuzzlite/build.sh for +# why a job builds one language). A crash fails the job with the reproducing # input attached as an artifact. # # See https://google.github.io/clusterfuzzlite/ @@ -21,23 +23,24 @@ concurrency: jobs: fuzzing: - name: Fuzz (${{ matrix.sanitizer }}) + name: Fuzz (${{ matrix.language }}, ${{ matrix.sanitizer }}) runs-on: ubuntu-latest permissions: security-events: write strategy: fail-fast: false matrix: + language: [python, rust] sanitizer: [address] steps: - - name: Build fuzzers (${{ matrix.sanitizer }}) + - name: Build fuzzers (${{ matrix.language }}, ${{ matrix.sanitizer }}) uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: sanitizer: ${{ matrix.sanitizer }} - language: python + language: ${{ matrix.language }} github-token: ${{ secrets.GITHUB_TOKEN }} - - name: Run fuzzers (${{ matrix.sanitizer }}) + - name: Run fuzzers (${{ matrix.language }}, ${{ matrix.sanitizer }}) uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} @@ -50,5 +53,5 @@ jobs: # 30s default). A PyInstaller-frozen Python target is slow to start, # so dropping this risks real crashes being written off as # unreproducible. - language: python + language: ${{ matrix.language }} output-sarif: true diff --git a/AGENTS.md b/AGENTS.md index 1434961606..1939435dab 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -41,7 +41,9 @@ To move them: `cgr-graph-rs` floor in `pyproject.toml`), as CI requires for any change to the library. If the new crate needs a newer Rust than `RUST_TOOLCHAIN` in `.clusterfuzzlite/Dockerfile`, raise that too: the - fuzz build compiles the crate with it and fails otherwise. + fuzz build compiles the crate with it and fails otherwise. The same goes + for `RUST_FUZZ_TOOLCHAIN`, the nightly the crate's cargo-fuzz targets are + built with. 5. Run `codebase_rag/tests/test_native_trees.py` and `cargo test --manifest-path rust/cgr_graph_rs/Cargo.toml`. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 184719dfb9..d018bd040e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -250,6 +250,24 @@ When fuzzing finds a crash: add a regression test under `codebase_rag/tests/` that fails without the fix, commit the reproducer into the harness' corpus directory, and only then fix the bug. +The Rust extension has cargo-fuzz targets of its own, in +`rust/cgr_graph_rs/fuzz/fuzz_targets/`, and both workflows run them in a +separate `rust` job with the same budgets. Each target's header says what it +drives and checks: + +| Target | What it drives | +| --- | --- | +| `cypher_parse` | the Cypher lexer and parser on any query text | +| `json_string` | `json_text::push_string`, against Python's `json.dumps` | +| `graph_algorithms` | the graph procedures and `run` on a graph and arguments the input chooses | +| `sqlite_graph` | the bulk writer, the variable-length walk and `Graph::load`, against a model of the graph | + +To run one locally, with a nightly toolchain and `cargo install cargo-fuzz`: + +```bash +cd rust/cgr_graph_rs && cargo +nightly fuzz run cypher_parse -- -max_total_time=60 +``` + ## Coding Standards ### Tooling From c0dfe9c3d76647d263fe5aaa3bffd476f2f69c2a Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 08:06:50 +0000 Subject: [PATCH 3/3] test(graph-rs): lock the fuzz package to cgr_graph_rs 0.1.2 and its new dependencies --- rust/cgr_graph_rs/fuzz/Cargo.lock | 293 +++++++++++++++++++++++++++++- 1 file changed, 290 insertions(+), 3 deletions(-) diff --git a/rust/cgr_graph_rs/fuzz/Cargo.lock b/rust/cgr_graph_rs/fuzz/Cargo.lock index 1df32514f6..1094e8ad3d 100644 --- a/rust/cgr_graph_rs/fuzz/Cargo.lock +++ b/rust/cgr_graph_rs/fuzz/Cargo.lock @@ -2,6 +2,15 @@ # It is not intended for manual editing. version = 4 +[[package]] +name = "aho-corasick" +version = "1.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba" +dependencies = [ + "memchr", +] + [[package]] name = "arbitrary" version = "1.5.0" @@ -14,6 +23,24 @@ version = "2.13.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06" +[[package]] +name = "blake2" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f" +dependencies = [ + "digest", +] + +[[package]] +name = "block-buffer" +version = "0.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa" +dependencies = [ + "hybrid-array", +] + [[package]] name = "cc" version = "1.8.0" @@ -34,9 +61,12 @@ checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600" [[package]] name = "cgr_graph_rs" -version = "0.1.0" +version = "0.1.2" dependencies = [ + "blake2", "rusqlite", + "sha2", + "tree-sitter", ] [[package]] @@ -48,6 +78,63 @@ dependencies = [ "rusqlite", ] +[[package]] +name = "cmov" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" + +[[package]] +name = "const-oid" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" + +[[package]] +name = "cpufeatures" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566" +dependencies = [ + "libc", +] + +[[package]] +name = "crypto-common" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" +dependencies = [ + "hybrid-array", +] + +[[package]] +name = "ctutils" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fe3e9d21d39e6f39ff46e03d5b621424f88ee23d8a1672c6bfc9ccc7f2da4f6a" +dependencies = [ + "cmov", +] + +[[package]] +name = "digest" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" +dependencies = [ + "block-buffer", + "const-oid", + "crypto-common", + "ctutils", +] + +[[package]] +name = "equivalent" +version = "1.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826" + [[package]] name = "fallible-iterator" version = "0.3.0" @@ -72,6 +159,12 @@ version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" +[[package]] +name = "foldhash" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb" + [[package]] name = "getrandom" version = "0.4.3" @@ -89,18 +182,49 @@ version = "0.15.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" dependencies = [ - "foldhash", + "foldhash 0.1.5", ] +[[package]] +name = "hashbrown" +version = "0.17.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a" + [[package]] name = "hashlink" version = "0.10.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1" dependencies = [ - "hashbrown", + "hashbrown 0.15.5", +] + +[[package]] +name = "hybrid-array" +version = "0.4.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17" +dependencies = [ + "typenum", ] +[[package]] +name = "indexmap" +version = "2.14.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855" +dependencies = [ + "equivalent", + "hashbrown 0.17.1", +] + +[[package]] +name = "itoa" +version = "1.0.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" + [[package]] name = "jobserver" version = "0.1.35" @@ -138,18 +262,71 @@ dependencies = [ "vcpkg", ] +[[package]] +name = "memchr" +version = "2.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98" + [[package]] name = "pkg-config" version = "0.3.34" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548" +[[package]] +name = "proc-macro2" +version = "1.0.107" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "quote" +version = "1.0.47" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001" +dependencies = [ + "proc-macro2", +] + [[package]] name = "r-efi" version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" +[[package]] +name = "regex" +version = "1.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d" +dependencies = [ + "aho-corasick", + "memchr", + "regex-automata", + "regex-syntax", +] + +[[package]] +name = "regex-automata" +version = "0.4.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2" +dependencies = [ + "aho-corasick", + "memchr", + "regex-syntax", +] + +[[package]] +name = "regex-syntax" +version = "0.8.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4" + [[package]] name = "rusqlite" version = "0.37.0" @@ -164,6 +341,61 @@ dependencies = [ "smallvec", ] +[[package]] +name = "serde" +version = "1.0.229" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba" +dependencies = [ + "serde_core", +] + +[[package]] +name = "serde_core" +version = "1.0.229" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48" +dependencies = [ + "serde_derive", +] + +[[package]] +name = "serde_derive" +version = "1.0.229" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "serde_json" +version = "1.0.154" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6" +dependencies = [ + "foldhash 0.2.0", + "indexmap", + "itoa", + "memchr", + "serde", + "serde_core", + "zmij", +] + +[[package]] +name = "sha2" +version = "0.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19" +dependencies = [ + "cfg-if", + "cpufeatures", + "digest", +] + [[package]] name = "shlex" version = "2.0.1" @@ -176,8 +408,63 @@ version = "1.16.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b" +[[package]] +name = "streaming-iterator" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b2231b7c3057d5e4ad0156fb3dc807d900806020c5ffa3ee6ff2c8c76fb8520" + +[[package]] +name = "syn" +version = "3.0.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "tree-sitter" +version = "0.26.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "887bd495d0582c5e3e0d8ece2233666169fa56a9644d172fc22ad179ab2d0538" +dependencies = [ + "cc", + "regex", + "regex-syntax", + "serde_json", + "streaming-iterator", + "tree-sitter-language", +] + +[[package]] +name = "tree-sitter-language" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d0af592be68c579aa78a16846bd19422978c3c52e438523d45ff5d1bff1f9d4a" + +[[package]] +name = "typenum" +version = "1.20.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" + +[[package]] +name = "unicode-ident" +version = "1.0.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563" + [[package]] name = "vcpkg" version = "0.2.15" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" + +[[package]] +name = "zmij" +version = "1.0.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"