Upgrade `der` to 0.8 by ShaharNaveh · Pull Request #7695 · RustPython/RustPython

ShaharNaveh · 2026-04-27T08:16:06Z

Also moved der to the workspace dependencies as discussed at #7687 (comment)

Summary by CodeRabbit

Chores
- Updated dependency configuration to utilize workspace-managed specifications for improved consistency across the project.

coderabbitai · 2026-04-27T08:16:24Z

📝 Walkthrough

Walkthrough

The pull request upgrades the der crate from version 0.7 to 0.8 across the workspace. The root Cargo.toml introduces der 0.8 as a workspace dependency with specific features, and crates/stdlib/Cargo.toml shifts from a direct dependency reference to workspace-managed resolution.

Changes

Cohort / File(s)	Summary
Dependency Configuration `Cargo.toml`	Introduces `der` crate 0.8 as a workspace-managed dependency with `alloc`, `oid`, `pem`, and `zeroize` features enabled.
Workspace Dependency Reference `crates/stdlib/Cargo.toml`	Updates `der` dependency from explicit version `0.7` to workspace-managed (`workspace = true`), maintaining optional status.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 The der crate hops from seven to eight,
A version bump that feels just great!
Workspace paths now unified and clean,
The finest dependency change we've seen! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Upgrade `der` to 0.8' clearly and specifically describes the main change in the pull request - upgrading the der dependency version.
Linked Issues check	✅ Passed	The PR successfully implements the primary objective of issue `#7693`: upgrading der from 0.7.10 to 0.8.0 and moves it to workspace dependencies as discussed in PR `#7687`.
Out of Scope Changes check	✅ Passed	All changes are directly related to the linked issue objective - upgrading der to 0.8 and configuring it as a workspace dependency. No extraneous modifications detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

Cargo.toml (1)
173-173: Optional: confirm zeroize was intentionally added.

The previous direct dep used ["alloc", "oid"]; the new workspace dep adds pem and zeroize. pem is mentioned in the commit message ("Add pem feature") and is needed by the SSL code. zeroize isn't called out in the PR description — confirm it's intentional (e.g. needed by a downstream consumer or wanted for defense-in-depth on key material). If not, it can be dropped to keep the feature surface minimal.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@Cargo.toml` at line 173, The change added "pem" and "zeroize" to the der
dependency features; verify whether "zeroize" was intentionally included—check
for any use of zeroize traits or downstream crates expecting der with zeroize
(or if we want defense-in-depth for key material); if it's not required, remove
"zeroize" from the feature list and keep the features as ["alloc","oid","pem"]
to minimize surface area, otherwise document the rationale for retaining
"zeroize" near the Cargo.toml entry.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Cargo.toml`:
- Line 173: The workspace now pins der = { version = "0.8", features = [...] }
while crates/stdlib still depends on pkcs8 = "0.10" and x509-cert = "0.2.5"
which require der ^0.7; fix by reconciling these dependency versions: either
roll back the workspace der to 0.7 to match pkcs8/x509-cert, or upgrade pkcs8
and x509-cert to versions compatible with der 0.8 (e.g., pkcs8 = "0.11.0-rc" and
x509-cert = "0.3.0-rc"), then rebuild and verify the project compiles with
--features ssl-rustls to ensure no dual der versions remain.

---

Nitpick comments:
In `@Cargo.toml`:
- Line 173: The change added "pem" and "zeroize" to the der dependency features;
verify whether "zeroize" was intentionally included—check for any use of zeroize
traits or downstream crates expecting der with zeroize (or if we want
defense-in-depth for key material); if it's not required, remove "zeroize" from
the feature list and keep the features as ["alloc","oid","pem"] to minimize
surface area, otherwise document the rationale for retaining "zeroize" near the
Cargo.toml entry.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 7f073a6f-b15f-4155-968d-e01652ad3496

📥 Commits

Reviewing files that changed from the base of the PR and between 02c454b and 646b526.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

Cargo.toml
crates/stdlib/Cargo.toml

coderabbitai · 2026-04-27T08:23:47Z

 # ruff_text_size = { git = "https://github.com/astral-sh/ruff.git", rev = "c2a8815842f9dc5d24ec19385eae0f1a7188b0d9" }
 # ruff_source_file = { git = "https://github.com/astral-sh/ruff.git", rev = "c2a8815842f9dc5d24ec19385eae0f1a7188b0d9" }

+der = { version = "0.8", features = ["alloc", "oid", "pem", "zeroize"] }


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Enumerate every `der::` usage and the modules that mix der with pkcs8 / x509-cert / x509-parser, # to assess whether the duplicate der 0.7 / 0.8 in the dep graph causes type-incompatibility issues. echo "=== Direct uses of the `der` crate ===" rg -nP --type=rust -C2 '\b(use\s+der(::|;)|\bder::)' || true echo echo "=== Files that import both der and pkcs8 / x509-cert / x509-parser ===" fd -e rs -x sh -c ' f="$1" if rg -q "^\s*use\s+der(::|;)|\bder::" "$f" \ && rg -q "^\s*use\s+(pkcs8|x509_cert|x509_parser)(::|;)|\b(pkcs8|x509_cert|x509_parser)::" "$f"; then echo "MIXED: $f" fi ' _ {} echo echo "=== der versions actually resolved ===" rg -nP '^name = "der"|^version = "0\.(7|8)' Cargo.lock | sed -n '1,200p' echo echo "=== pkcs8 / x509-cert / x509-parser versions resolved (which der do they pull?) ===" rg -nP -A6 '^\[\[package\]\]\s*\nname = "(pkcs8|x509-cert|x509-parser|oid-registry)"' Cargo.lock || true

Repository: RustPython/RustPython

Length of output: 1785

🌐 Web query:

What is the minimum version of pkcs8 and x509-cert that supports der 0.8?

💡 Result:

The minimum versions of the RustCrypto pkcs8 and x509-cert crates that support der 0.8 are their respective 0.11.0-rc and 0.3.0-rc pre-release versions. For pkcs8: versions prior to 0.11.0 (e.g., 0.10.2) depend on der ^0.7, while 0.11.0-rc.8 and later specify der ^0.8.0-rc.9 in their dependencies, indicating compatibility with der 0.8.0. For x509-cert: versions prior to 0.3.0 (e.g., 0.2.5) depend on der ^0.7.6, while 0.3.0-rc.0 and later (latest 0.3.0-rc.4) specify der ^0.8.0-rc.3, confirming support for der 0.8.0. These crates are part of the RustCrypto/formats monorepo, where der 0.8.0 was released on 2026-02-13, and dependent crates were updated in parallel via pre-releases to match.

Citations:

1: https://crates.io/crates/der/0.8.0

2: https://docs.rs/pkcs8/latest/pkcs8/

3: https://lib.rs/crates/pkcs8

4: https://crates.io/crates/x509-cert

5: https://crates.io/crates/pkcs8

6: https://crates.io/crates/x509-cert/0.3.0-rc.0

7: https://crates.io/crates/pkcs8/0.11.0-rc.8

8: https://github.com/RustCrypto/formats/tree/master

🏁 Script executed:

# Check if we can access files directly or list the repository structure find . -name "Cargo.toml" -type f 2>/dev/null | head -20

Repository: RustPython/RustPython

Length of output: 625

🏁 Script executed:

# Search for der and pkcs8/x509-cert version specifications in Cargo files find . -name "Cargo.toml" -type f 2>/dev/null | xargs grep -l "der\|pkcs8\|x509-cert" 2>/dev/null | head -10

Repository: RustPython/RustPython

Length of output: 291

🌐 Web query:

pkcs8 0.10.2 der dependency version

💡 Result:

The pkcs8 crate version 0.10.2 depends on the der crate with version requirement ^0.7 (i.e., >=0.7.0, <0.8.0). It also specifies 1 extra feature for der.

Citations:

1: https://crates.io/crates/pkcs8/0.10.2/dependencies

2: https://crates.io/crates/pkcs8/0.10.2

3: https://crates.io/crates/pkcs8

🌐 Web query:

x509-cert 0.2.5 der dependency version

💡 Result:

The x509-cert crate version 0.2.5 depends on the der crate at version ^0.7.6 (specifically version = "0.7.6" with features = ["alloc", "derive", "flagset", "oid"]). This is confirmed directly from the official Cargo.toml source code for x509-cert 0.2.5.

Citations:

1: https://docs.rs/crate/x509-cert/latest/source/Cargo.toml

2: https://crates.io/crates/x509-cert/0.2.5

3: https://deps.rs/crate/x509-cert/0.2.5

🏁 Script executed:

# Read Cargo.toml around line 173 to see the der version sed -n '165,180p' ./Cargo.toml

Repository: RustPython/RustPython

Length of output: 1202

🏁 Script executed:

# Read crates/stdlib/Cargo.toml to check pkcs8 and x509-cert versions cat ./crates/stdlib/Cargo.toml | grep -A2 -B2 "pkcs8\|x509-cert"

Repository: RustPython/RustPython

Length of output: 1077

🏁 Script executed:

# Check if der is used and what features are gated by ssl-rustls grep -n "ssl-rustls" ./Cargo.toml

Repository: RustPython/RustPython

Length of output: 206

🏁 Script executed:

# Search for der usage patterns in the codebase to understand the scope rg -l "use der|der::" --type rust | head -20

Repository: RustPython/RustPython

Length of output: 619

🌐 Web query:

pkcs8 0.11.0 stable release der 0.8

💡 Result:

The pkcs8 Rust crate from RustCrypto does not have a stable 0.11.0 release as of 2026-04-27. The latest version is the pre-release 0.11.0-rc.11, released on 2026-02-11. The previous stable version is 0.10.2. This 0.11.0 release candidate depends on der ^0.8.0-rc.12 (as shown in Cargo.toml for rc.11), aligning with the query's mention of der 0.8. No stable 0.11.0 or exact der 0.8 (stable) match was found; der 0.8 appears in pre-releases.

Citations:

1: https://crates.io/crates/pkcs8/0.11.0-rc.11

2: https://docs.rs/pkcs8/0.11.0-rc.11/aarch64-apple-darwin/pkcs8/index.html

3: https://crates.io/crates/pkcs8/0.11.0-rc.8

4: https://lib.rs/crates/pkcs8

5: https://crates.io/crates/pkcs8

6: https://docs.rs/pkcs8/latest/pkcs8/

🌐 Web query:

x509-cert 0.3.0 stable release der 0.8

💡 Result:

The RustCrypto x509-cert crate does not have a stable 0.3.0 release as of 2026-04-27. The latest version is 0.3.0-rc.4 (released 2026-01-25). Pre-releases like 0.3.0-pre.0 exist from 2024-10-08, and a v0.3 release train was tracked in GitHub issue #1289 (closed Oct 2024). This version depends on der ^0.8.0-rc.3 (and later RCs use der ^0.8.0-rc.10), aligning with der 0.8 development. The prior stable v0.2.5 uses der ^0.7.6. No full stable 0.3.0 is published on crates.io.

Citations:

1: x509-cert: v0.3 release train RustCrypto/formats#1289

2: https://crates.io/crates/x509-cert/0.3.0-rc.0

3: https://lib.rs/crates/x509-cert

4: https://crates.io/crates/der/0.8.0-rc.9

5: https://crates.io/crates/x509-cert

6: https://docs.rs/crate/x509-cert/0.3.0-rc.3

7: https://docs.rs/crate/x509-cert/latest/source/Cargo.toml

🏁 Script executed:

# Check if ssl-rustls feature is tested or used in CI rg -l "ssl-rustls" --type=yaml --type=toml | head -10

Repository: RustPython/RustPython

Length of output: 101

🏁 Script executed:

# Check if there are any type conflicts or mixing of der 0.7 and 0.8 in the stdlib crate grep -n "use der" crates/stdlib/src/*.rs 2>/dev/null | head -20

Repository: RustPython/RustPython

Length of output: 47

Version incompatibility: der 0.8 is incompatible with pkcs8 0.10 and x509-cert 0.2.5 currently pinned in crates/stdlib/Cargo.toml.

The workspace now specifies der = "0.8" while crates/stdlib/Cargo.toml still depends on pkcs8 = "0.10" and x509-cert = "0.2.5", which both require der ^0.7. This creates a dual-version dependency graph with both der 0.7 and der 0.8 present. Since both packages are only pulled in via the ssl-rustls feature, the risk is contained to that feature flag—as long as no der-typed values (e.g., AnyRef, ObjectIdentifier) cross the version boundary between the two, compilation will succeed. However, any such crossing will produce cryptic type mismatch errors.

Verify this builds with --features ssl-rustls before merging. If build succeeds, consider upgrading pkcs8 and x509-cert to versions compatible with der 0.8. Currently, only pre-release versions support this (e.g., pkcs8 = "0.11.0-rc" and x509-cert = "0.3.0-rc"); stable releases matching der 0.8 have not yet been published.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@Cargo.toml` at line 173, The workspace now pins der = { version = "0.8", features = [...] } while crates/stdlib still depends on pkcs8 = "0.10" and x509-cert = "0.2.5" which require der ^0.7; fix by reconciling these dependency versions: either roll back the workspace der to 0.7 to match pkcs8/x509-cert, or upgrade pkcs8 and x509-cert to versions compatible with der 0.8 (e.g., pkcs8 = "0.11.0-rc" and x509-cert = "0.3.0-rc"), then rebuild and verify the project compiles with --features ssl-rustls to ensure no dual der versions remain.

ShaharNaveh added 2 commits April 27, 2026 11:09

Update der to 0.8, move to workspace dependencies

0f95f2f

Add pem feature

646b526

coderabbitai Bot reviewed Apr 27, 2026

View reviewed changes

youknowone merged commit 5648a33 into RustPython:main Apr 27, 2026
20 checks passed

Navigation Menu

Uh oh!

Upgrade `der` to 0.8 - #7695

Upgrade `der` to 0.8#7695
youknowone merged 2 commits into
RustPython:mainfrom
ShaharNaveh:der-upgr

ShaharNaveh commented Apr 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 27, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Apr 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ShaharNaveh commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ShaharNaveh commented Apr 27, 2026 •

edited

Loading

coderabbitai Bot commented Apr 27, 2026 •

edited

Loading