chore(deps): three of the four manifest bumps; safetensors is blocked upstream - #71
Merged
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @ciresnave-bot, you've used your own review budget of 250,000 diff characters for the last 7 days.
You can request another review in 5 days and 11 hours by commenting @sourcery-ai review. Upgrade to get a review now.
Reviewer's GuideThis PR updates three dependency manifests and the lockfile, while intentionally deferring Sequence diagram for byte-compatible GGUF metadata hashingsequenceDiagram
participant Dumper as dump_gguf_meta
participant Sha2 as sha2::Sha256
participant Artifact as GGUF metadata dump
participant Oracle as Python hashlib
Dumper->>Sha2: update(body.as_bytes())
Dumper->>Sha2: finalize()
Sha2-->>Dumper: Array digest bytes
Dumper->>Dumper: write each byte as {b:02x}
Dumper->>Artifact: emit lowercase hexadecimal digest
Oracle-->>Dumper: matching hexdigest vectors
Dumper-->>Artifact: byte-identical output verified
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
… upstream Continues the freshness pass. The two range-permitted upgrades landed in the previous commit; these are the four that needed a manifest change. sha2 0.10 -> 0.11 (mlmf-conformance) sysinfo 0.38 -> 0.39 tokenizers 0.22 -> 0.23 safetensors 0.7 -> 0.8 ✗ BLOCKED, see below ##⚠️ safetensors 0.8 CANNOT BE TAKEN HERE, AND IT IS NOT OUR CALL Measured, not inferred: error[E0277]: the trait bound `&candlelight::Tensor: View` is not satisfied --> src/formats/safetensors_export.rs:81 note: there are multiple different versions of crate `safetensors` in the dependency graph cargo tree -i safetensors: safetensors v0.7.0 +-- candle-core v0.10.2 +-- candle-nn / candle-transformers +-- candlelight (git, rev d70a03f3) +-- mlmf `candlelight` implements `View` against safetensors 0.7. Bumping ours puts TWO versions in the graph, and a trait implemented against one is not the trait required by the other. THE BLOCKER IS candle-core's PIN, reached through candlelight -- upstream of this repository. So CireSnave's standing rule ("all dependencies on their most recent versions at all times") is UNSATISFIABLE for safetensors until candlelight moves. Recorded here rather than left as an unexplained lag: a rule that cannot be met needs its reason attached, or the next person re-derives this error from scratch. ## sha2 0.11 broke one call site, and the fix had to be byte-identical `finalize()` now returns `Array` instead of `GenericArray`, and `Array` does not implement `LowerHex` -- so `format!("{:x}", h.finalize())` is a compile error. One site: `dump_gguf_meta.rs:65`.⚠️ THAT DIGEST IS A CROSS-PROJECT CONTRACT with the lightbulb lane's dumper, so the replacement had to produce the SAME BYTES, not merely valid hex. Verified twice, at two levels: 1. against Python's hashlib on three vectors -- a different language and a different implementation: "" e3b0c442...b7852b855 "abc" ba7816bf...f20015ad "gguf-metadata-dump/v1" a4856063...dcc3a6a9 2. THE WHOLE ARTIFACT, old code vs new. A detached worktree at the previous commit (sha2 0.10) ran the dumper over the same 19-file corpus; `cmp` reports the two 10,099-byte dumps IDENTICAL, all 7 emitted digests included. (2) is the one that matters. (1) proves the encoder is correct; only (2) proves the ARTIFACT did not move. ##⚠️ AND I NEARLY SHIPPED A COMMENT CITING A TEST THAT DOES NOT EXIST My first draft of that comment said the round-trip was "pinned by `the_digest_is_lowercase_hex_of_the_utf8_body` below". THERE IS NO SUCH TEST, and there are no tests in that file at all. Worse, writing one there would not have helped: CI runs `cargo test -p mlmf-conformance`, which executes the lib unit tests, `tests/*` and doc-tests -- measured, and EXAMPLE TARGETS ARE NOT AMONG THEM. A `#[test]` in an example reads as coverage and runs never. The comment now states what is actually true: verified against an independent oracle and by artifact comparison, NOT by a test, with the reason a test cannot live there and what it would take to have one. VERIFIED: cargo clippy --workspace --all-targets --all-features exit 0 cargo fmt --all --check exit 0 cargo test -p mlmf --lib 106 passed cargo test -p mlmf --doc 29 passed cargo test -p mlmf-core exit 0 cargo test -p mlmf-conformance exit 0 cargo test -p mlmf-hf-layout exit 0 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MdVuiraXRfDHQ227cjBt51
ciresnave-bot
force-pushed
the
deps-manifest-bumps
branch
from
September 10, 2026 20:50
0ddd002 to
2f49bd2
Compare
ciresnave
pushed a commit
that referenced
this pull request
Sep 10, 2026
Closes the last dependency-freshness item in this workspace. candlelight rev d70a03f -> 3009b2d (ciresnave/candlelight#1, merged) safetensors 0.7 -> 0.8 ## Why this could not be done in #71 `candlelight` implemented `View` against safetensors 0.7. Bumping ours put TWO versions of safetensors in one graph, and a trait implemented against one is not the trait required by the other: error[E0277]: the trait bound `&candlelight::Tensor: View` is not satisfied note: there are multiple different versions of crate `safetensors` in the dependency graph candlelight now depends on candle 0.11.0, which is the first release requiring safetensors ^0.8.0. ## Verified cargo build --workspace --all-features exit 0 cargo clippy --workspace --all-targets --all-features exit 0 cargo fmt --all --check exit 0 cargo test -p mlmf --lib 106 passed cargo test -p mlmf --doc 29 passed cargo test -p mlmf-core exit 0 cargo test -p mlmf-safetensors exit 0 cargo test -p mlmf-conformance exit 0 safetensors 0.7 edges in the graph ZERO safetensors 0.8 edges 3⚠️ The `safetensors v0.4.0` row a substring match reports is OUR OWN `mlmf-safetensors` crate at the workspace version, not a third safetensors. Checked rather than assumed, because a version count is exactly the figure that gets quoted without its subject. ##⚠️ THIS PATH WAS PROVEN BEFORE candlelight#1 WAS OPENED While scoping the candlelight change I built mlmf against a local path patch of that branch, with safetensors already at 0.8: workspace build exit 0, 106 lib tests, no 0.7 edge. So this commit is the SAME measurement re-run against the published rev rather than a fresh hope -- the only variable that changed is whether the code came from a path or from a git rev. That is why the upstream PR was worth the round trip: the consumer-side check is the one that answers "does this unblock anything", and it was available before the upstream change existed. Claude-Session: https://claude.ai/code/session_01MdVuiraXRfDHQ227cjBt51 Co-authored-by: MLMF Agent <ciresnave+mlmf@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
base: deps-to-latest). Retarget tomainonce that lands.sha20.10 → 0.11 (mlmf-conformance)sysinfo0.38 → 0.39tokenizers0.22 → 0.23safetensors0.7 → 0.8Measured, not inferred:
candlelightimplementsViewagainst safetensors 0.7. Bumping ours putstwo versions in the graph, and a trait implemented against one is not the
trait required by the other. The blocker is
candle-core's pin, reached throughcandlelight— upstream of this repository.So the standing rule is unsatisfiable for safetensors until candlelight moves.
Recorded here rather than left as an unexplained lag: a rule that cannot be met
needs its reason attached, or the next person re-derives this error from scratch.
sha2 0.11 broke one call site, and the fix had to be byte-identical
finalize()returnsArrayinstead ofGenericArray, andArraydoes notimplement
LowerHex— soformat!("{:x}", h.finalize())is a compile error. Onesite:
dump_gguf_meta.rs:65.so the replacement had to produce the same bytes, not merely valid hex. Verified
at two levels:
1 — against Python's
hashlib, a different language and implementation:2 — the whole artifact, old code vs new. A detached worktree at the previous
commit (sha2 0.10) ran the dumper over the same 19-file corpus;
cmpreports thetwo 10,099-byte dumps IDENTICAL, all 7 emitted digests included.
(2) is the one that matters. (1) proves the encoder is correct; only (2) proves
the artifact did not move.
My first draft said the round-trip was "pinned by
the_digest_is_lowercase_hex_of_the_utf8_bodybelow". There is no such test,and no tests in that file at all.
And writing one there would not have helped: CI runs
cargo test -p mlmf-conformance, which executes the lib unit tests,tests/*and doc-tests —measured, and example targets are not among them. A
#[test]in an examplereads as coverage and runs never.
The comment now states what is true: verified by an independent oracle and by
artifact comparison, not by a test, with the reason a test cannot live there
and what it would take to have one.
Verification
🤖 Generated with Claude Code
https://claude.ai/code/session_01MdVuiraXRfDHQ227cjBt51
Summary by Sourcery
Refresh the available dependency versions and preserve conformance artifact compatibility while documenting the blocked safetensors upgrade.
Bug Fixes:
Enhancements:
Build:
Tests:
Chores: