chore(deps): bump workspace; migrate sqlx 0.9 + keyring 4 (#3324)

Author: hubcio

Cargo.lock

@@ -74,7 +74,9 @@ ahash = { version = "0.8.12", features = ["serde"] }
 aligned-vec = "0.6.4"
 anyhow = "1.0.102"
 apache-avro = "0.21.0"
+apple-native-keyring-store = { version = "1.0.0", features = ["keychain"] }
 argon2 = "0.5.3"
+# Pinned to 57 because iceberg 0.9.1 still requires arrow/parquet 57.
 arrow = "57.3.1"
 arrow-array = "57.3.1"
 arrow-json = "57.3.1"
@@ -128,7 +130,7 @@ configs_derive = { path = "core/configs_derive", version = "0.1.0" }
 consensus = { path = "core/consensus" }
 console-subscriber = "0.5.0"
 crossbeam = "0.8.4"
-crossfire = "3.1.13"
+crossfire = "3.1.16"
 csv = "1.4.0"
 ctor = "1.0.6"
 ctrlc = { version = "3.5", features = ["termination"] }
@@ -137,6 +139,7 @@ cyper = { version = "0.8.3", features = ["rustls"], default-features = false }
 cyper-axum = { version = "0.8.0" }
 darling = "0.23"
 dashmap = "6.2.1"
+dbus-secret-service-keyring-store = { version = "1.0.0", features = ["crypto-rust", "vendored"] }
 deltalake = { version = "0.32.3", features = ["azure", "gcs", "s3"] }
 derive-new = "0.7.0"
 derive_builder = "0.20.2"
@@ -153,7 +156,7 @@ err_trail = { version = "0.11.0", features = ["tracing"] }
 error_set = "0.9.1"
 figlet-rs = "1.0.0"
 figment = { version = "0.10.19", features = ["toml", "env"] }
-file-operation = "0.8.20"
+file-operation = "0.8.21"
 flatbuffers = "25.12.19"
 flume = "0.12.0"
 fs2 = "0.4.3"
@@ -184,12 +187,12 @@ integration = { path = "core/integration" }
 journal = { path = "core/journal" }
 js-sys = "0.3"
 jsonwebtoken = { version = "10.4.0", features = ["rust_crypto"] }
-keyring = { version = "3.6.3", features = ["sync-secret-service", "vendored"] }
+keyring-core = "1.0.0"
 lazy_static = "1.5.0"
 left-right = "0.11"
 lending-iterator = "0.1.7"
 libc = "0.2.186"
-log = "0.4.29"
+log = "0.4.30"
 lz4_flex = "0.13.1"
 message_bus = { path = "core/message_bus" }
 metadata = { path = "core/metadata" }
@@ -214,7 +217,7 @@ opentelemetry-otlp = { version = "0.32.0", features = [
     "reqwest-client",
 ] }
 opentelemetry-semantic-conventions = "0.32.0"
-opentelemetry_sdk = { version = "0.32.0", features = [
+opentelemetry_sdk = { version = "0.32.1", features = [
     "logs",
     "trace",
     "experimental_async_runtime",
@@ -241,7 +244,7 @@ rand_xoshiro = "0.8.1"
 rayon = "1.12.0"
 rcgen = "0.14.8"
 regex = "1.12.3"
-reqwest = { version = "0.13.3", default-features = false, features = ["json", "rustls"] }
+reqwest = { version = "0.13.4", default-features = false, features = ["json", "rustls"] }
 reqwest-middleware = { version = "0.5.2", features = ["json", "query"] }
 reqwest-retry = "0.9.1"
 reqwest-tracing = "0.7.1"
@@ -259,7 +262,7 @@ sd-notify = "0.5"
 secrecy = { version = "0.10", features = ["serde"] }
 send_wrapper = "0.6.0"
 serde = { version = "1.0.228", features = ["derive", "rc"] }
-serde_json = "1.0.149"
+serde_json = "1.0.150"
 serde_with = { version = "3.20.0", features = ["base64", "macros"] }
 serde_yaml_ng = "0.10.0"
 serial_test = "3.4.0"
@@ -271,8 +274,9 @@ simd-json = { version = "0.17.0", features = ["serde_impl"] }
 slab = "0.4.12"
 smallvec = "1.15"
 socket2 = "0.6.3"
-sqlx = { version = "0.8.6", features = [
-    "runtime-tokio-rustls",
+sqlx = { version = "0.9.0", features = [
+    "runtime-tokio",
+    "tls-rustls",
     "postgres",
     "chrono",
     "uuid",
@@ -322,6 +326,7 @@ web-sys = { version = "0.3", features = [
     "ResizeObserverEntry",
 ] }
 webpki-roots = "1.0.7"
+windows-native-keyring-store = "1.1.0"
 yew = { version = "0.23", features = ["csr"] }
 yew-router = "0.20"
 zip = { version = "8.6.0", default-features = false, features = ["deflate"] }

Cargo.toml

@@ -41,7 +41,12 @@ path = "src/main.rs"
 
 [features]
 default = ["login-session"]
-login-session = ["dep:keyring"]
+login-session = [
+    "dep:keyring-core",
+    "dep:dbus-secret-service-keyring-store",
+    "dep:apple-native-keyring-store",
+    "dep:windows-native-keyring-store",
+]
 
 [dependencies]
 anyhow = { workspace = true }
@@ -56,7 +61,7 @@ figlet-rs = { workspace = true }
 iggy = { workspace = true }
 iggy_binary_protocol = { workspace = true }
 iggy_common = { workspace = true }
-keyring = { workspace = true, optional = true }
+keyring-core = { workspace = true, optional = true }
 passterm = { workspace = true }
 secrecy = { workspace = true }
 serde = { workspace = true }
@@ -68,6 +73,15 @@ tracing = { workspace = true }
 tracing-appender = { workspace = true }
 tracing-subscriber = { workspace = true, default-features = false }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+dbus-secret-service-keyring-store = { workspace = true, optional = true }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+apple-native-keyring-store = { workspace = true, optional = true }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-native-keyring-store = { workspace = true, optional = true }
+
 [dev-dependencies]
 tempfile = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt"] }

core/cli/Cargo.toml

@@ -22,7 +22,7 @@ use async_trait::async_trait;
 use iggy_common::Client;
 use iggy_common::PersonalAccessTokenExpiry;
 use iggy_common::create_personal_access_token::CreatePersonalAccessToken;
-use keyring::Entry;
+use keyring_core::Entry;
 use tracing::{Level, event};
 
 pub struct CreatePersonalAccessTokenCmd {

core/cli/src/commands/binary_personal_access_tokens/create_personal_access_token.rs

@@ -21,7 +21,7 @@ use anyhow::Context;
 use async_trait::async_trait;
 use iggy_common::Client;
 use iggy_common::delete_personal_access_token::DeletePersonalAccessToken;
-use keyring::Entry;
+use keyring_core::Entry;
 use tracing::{Level, event};
 
 pub struct DeletePersonalAccessTokenCmd {

core/cli/src/commands/binary_personal_access_tokens/delete_personal_access_tokens.rs

@@ -16,11 +16,47 @@
  * under the License.
  */
 
-use keyring::{Entry, Result};
+#[cfg(any(target_os = "linux", target_os = "macos", target_os = "windows"))]
+use std::sync::Mutex;
+
+#[cfg(target_os = "macos")]
+use apple_native_keyring_store::keychain::Store;
+#[cfg(target_os = "linux")]
+use dbus_secret_service_keyring_store::store::Store;
+use keyring_core::{Entry, error::Result};
+use tracing::warn;
+#[cfg(target_os = "windows")]
+use windows_native_keyring_store::store::Store;
+
+use crate::commands::cli_command::PRINT_TARGET;
 
 const SESSION_TOKEN_NAME: &str = "iggy-cli-session";
 const SESSION_KEYRING_SERVICE_NAME: &str = "iggy-cli-session";
 
+/// `keyring-core` 1.x has no implicit default backend. Register one on the
+/// first `Entry::new` so unrelated CLI subcommands never touch the OS keyring.
+///
+/// The mutex serializes concurrent callers so two threads cannot both observe
+/// an empty default store and race to install one. `get_default_store()` acts
+/// as the idempotency check, so a transient `Store::new()` failure stays
+/// retryable on the next call.
+#[cfg(any(target_os = "linux", target_os = "macos", target_os = "windows"))]
+pub fn ensure_default_store() -> Result<()> {
+    static INIT_LOCK: Mutex<()> = Mutex::new(());
+    let _guard = INIT_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+    if keyring_core::get_default_store().is_some() {
+        return Ok(());
+    }
+    let store = Store::new()?;
+    keyring_core::set_default_store(store);
+    Ok(())
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
+pub fn ensure_default_store() -> Result<()> {
+    Ok(())
+}
+
 pub struct ServerSession {
     server_address: String,
 }
@@ -43,6 +79,10 @@ impl ServerSession {
     }
 
     pub fn is_active(&self) -> bool {
+        if let Err(e) = ensure_default_store() {
+            warn!(target: PRINT_TARGET, "keyring backend unavailable, treating session as inactive: {e}");
+            return false;
+        }
         if let Ok(entry) = Entry::new(&self.get_service_name(), &self.get_token_name()) {
             return entry.get_password().is_ok();
         }
@@ -51,12 +91,17 @@ impl ServerSession {
     }
 
     pub fn store(&self, token: &str) -> Result<()> {
+        ensure_default_store()?;
         let entry = Entry::new(&self.get_service_name(), &self.get_token_name())?;
         entry.set_password(token)?;
         Ok(())
     }
 
     pub fn get_token(&self) -> Option<String> {
+        if let Err(e) = ensure_default_store() {
+            warn!(target: PRINT_TARGET, "keyring backend unavailable, cannot read session token: {e}");
+            return None;
+        }
         if let Ok(entry) = Entry::new(&self.get_service_name(), &self.get_token_name())
             && let Ok(token) = entry.get_password()
         {
@@ -67,6 +112,7 @@ impl ServerSession {
     }
 
     pub fn delete(&self) -> Result<()> {
+        ensure_default_store()?;
         let entry = Entry::new(&self.get_service_name(), &self.get_token_name())?;
         entry.delete_credential()
     }

core/cli/src/commands/binary_system/session.rs

@@ -21,15 +21,15 @@ use crate::error::{CmdToolError, IggyCmdError};
 use anyhow::{Context, bail};
 use iggy::clients::client::IggyClient;
 use iggy::prelude::{Args, IggyError, PersonalAccessTokenClient, UserClient};
-use iggy_cli::commands::binary_system::session::ServerSession;
+use iggy_cli::commands::binary_system::session::{ServerSession, ensure_default_store};
 use passterm::{Stream, isatty, prompt_password_tty};
 use secrecy::{ExposeSecret, SecretString};
 use std::env::var;
 
 #[cfg(feature = "login-session")]
 mod credentials_login_session {
     pub(crate) use iggy_cli::commands::cli_command::PRINT_TARGET;
-    pub(crate) use keyring::Entry;
+    pub(crate) use keyring_core::Entry;
     pub(crate) use tracing::{Level, event};
 }
 
@@ -91,6 +91,7 @@ impl<'a> IggyCredentials<'a> {
                     let server_address = format!("iggy:{server_address}");
                     event!(target: PRINT_TARGET, Level::DEBUG,"Checking token presence under service: {} and name: {}",
                     server_address, token_name);
+                    ensure_default_store()?;
                     let entry = Entry::new(&server_address, token_name)?;
                     let token = entry.get_password()?;
 

core/cli/src/credentials.rs

@@ -97,6 +97,7 @@ use tracing::{Level, event};
 #[cfg(feature = "login-session")]
 mod main_login_session {
     pub(crate) use crate::args::session::SessionAction;
+    pub(crate) use iggy_cli::commands::binary_system::session::ensure_default_store;
     pub(crate) use iggy_cli::commands::binary_system::session_status::SessionStatusCmd;
     pub(crate) use iggy_cli::commands::binary_system::{login::LoginCmd, logout::LogoutCmd};
     pub(crate) use iggy_cli::commands::utils::login_session_expiry::LoginSessionExpiry;
@@ -377,6 +378,14 @@ async fn main() -> Result<(), IggyCmdError> {
     let mut logging = Logging::new();
     logging.init(args.cli.quiet, &args.cli.debug);
 
+    // keyring-core 1.x has no implicit default backend. Register one up front
+    // so any subcommand that touches `Entry::new` (login, PAT store/delete,
+    // token-name lookup) sees the backend regardless of code-path ordering.
+    #[cfg(feature = "login-session")]
+    if let Err(e) = ensure_default_store() {
+        tracing::warn!(target: PRINT_TARGET, "keyring backend unavailable: {e}");
+    }
+
     let command = args.command.clone().unwrap();
 
     let mut context_manager = ContextManager::default();

core/cli/src/main.rs

@@ -216,7 +216,7 @@ impl PostgresSink {
         sql.push_str(&format!(", payload {payload_type}"));
         sql.push_str(", created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW())");
 
-        sqlx::query(&sql)
+        sqlx::query(sqlx::AssertSqlSafe(sql))
             .execute(pool)
             .await
             .map_err(|e| Error::InitError(format!("Failed to create table '{table_name}': {e}")))?;
@@ -368,7 +368,7 @@ impl PostgresSink {
         include_origin_timestamp: bool,
         payload_format: PayloadFormat,
     ) -> Result<(), (sqlx::Error, bool)> {
-        let mut query_builder = sqlx::query(query);
+        let mut query_builder = sqlx::query(sqlx::AssertSqlSafe(query));
 
         for message in messages {
             let payload_bytes = message.payload.clone().try_into_vec().map_err(|e| {