From a0cacca0a476558e1f88925634bf5d9ab64d27d2 Mon Sep 17 00:00:00 2001 From: captjt Date: Thu, 29 Oct 2026 09:19:25 -0400 Subject: [PATCH 1/2] integrity-lineage-models: move to utoipa 6 utoipa goes from 3.5.0 to 6.0.0. Guardian's Integrity Service embeds these models in its OpenAPI document, and it can only reach a zip without CVE-2026-115905 through utoipa-swagger-ui 10, which needs utoipa 6. The two hex-encoded hash fields keep `type: string, format: binary`: utoipa 6 would otherwise describe a `[u8; N]` as an array of integers, which isn't what serde writes. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 10 +++++++++ Cargo.lock | 22 ++++++++++++++----- integrity-lineage-models/Cargo.toml | 2 +- .../src/models/statements/common.rs | 2 ++ 4 files changed, 29 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0765597..0691118 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,16 @@ not always match the Git tags; section versions follow the tags. ## [Unreleased] +### Changed + +- `integrity-lineage-models`: `utoipa` from 3.5.0 to 6.0.0. **Breaking:** the models' + `ToSchema` implementations are now utoipa 6's, so an OpenAPI document that embeds + them has to be built with utoipa 6. Serialization and the Rust API are unchanged. + The schemas describe the same JSON, now in OpenAPI 3.1 form: a nullable field's + `type` includes `"null"`, references carry their doc comments, and maps declare + string keys. The internally tagged `anchor::Location` enum no longer has a + `discriminator`; each variant still requires its `type` value. + ## [0.0.20] - 2026-10-28 ### Changed diff --git a/Cargo.lock b/Cargo.lock index e9f9812..94dac5c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8253,6 +8253,17 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "syn" +version = "3.0.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + [[package]] name = "sync_wrapper" version = "1.0.2" @@ -8777,9 +8788,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" [[package]] name = "utoipa" -version = "3.5.0" +version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d82b1bc5417102a73e8464c686eef947bdfb99fcdfc0a4f228e81afa9526470a" +checksum = "8765fe27aeff71012a3f90fa474cf1df863a7d0dd81ed25de4e63fff2544994f" dependencies = [ "indexmap 2.14.2", "serde", @@ -8789,15 +8800,14 @@ dependencies = [ [[package]] name = "utoipa-gen" -version = "3.5.0" +version = "6.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "05d96dcd6fc96f3df9b3280ef480770af1b7c5d14bc55192baa9b067976d920c" +checksum = "d935f1c83fdf8b88f09bbe050d0cea78ea4afee6d7b0317403228c1200b2c8ab" dependencies = [ - "proc-macro-error", "proc-macro2", "quote", "regex", - "syn 2.0.114", + "syn 3.0.9", ] [[package]] diff --git a/integrity-lineage-models/Cargo.toml b/integrity-lineage-models/Cargo.toml index d3a422d..28ed043 100644 --- a/integrity-lineage-models/Cargo.toml +++ b/integrity-lineage-models/Cargo.toml @@ -22,7 +22,7 @@ serde = { version = "1.0", features = ["derive"] } serde_jcs = "0.2.0" serde_json = "1.0" ssi = { version = "0.16", default-features = false, features = ["w3c", "ed25519", "secp256k1", "secp256r1"] } -utoipa = { version = "3", features = ["axum_extras", "openapi_extensions"] } +utoipa = { version = "6", features = ["axum_extras", "openapi_extensions"] } [target.'cfg(target_arch = "wasm32")'.dependencies] blake3 = "1.5" diff --git a/integrity-lineage-models/src/models/statements/common.rs b/integrity-lineage-models/src/models/statements/common.rs index d161f0c..4bbf1f4 100644 --- a/integrity-lineage-models/src/models/statements/common.rs +++ b/integrity-lineage-models/src/models/statements/common.rs @@ -15,6 +15,7 @@ pub struct UrnCidWithSha256 { #[serde(rename = "@id")] pub cid: String, /// SHA-256 hash of the content + #[schema(value_type = String, format = Binary)] #[serde( serialize_with = "serialize_u8_arr_as_hex", deserialize_with = "deserialize_u8_arr_32_from_hex" @@ -30,6 +31,7 @@ pub struct UrnCidWithSha384 { #[serde(rename = "@id")] pub cid: String, /// SHA-384 hash of the content + #[schema(value_type = String, format = Binary)] #[serde( serialize_with = "serialize_u8_arr_as_hex", deserialize_with = "deserialize_u8_arr_48_from_hex" From 610f5069967cd51aa1e2f4a1a6736cbb1faff60d Mon Sep 17 00:00:00 2001 From: captjt Date: Thu, 29 Oct 2026 09:20:09 -0400 Subject: [PATCH 2/2] CHANGELOG: link #57 Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0691118..bb78f46 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,7 @@ not always match the Git tags; section versions follow the tags. `type` includes `"null"`, references carry their doc comments, and maps declare string keys. The internally tagged `anchor::Location` enum no longer has a `discriminator`; each variant still requires its `type` value. + ([#57](https://github.com/eqtylab/integrity/pull/57)) ## [0.0.20] - 2026-10-28