build(deps): update linkerd/dev from v43 to v44

.devcontainer/Dockerfile

@@ -4,6 +4,8 @@ FROM ghcr.io/linkerd/dev:${DEV_VERSION}
 RUN scurl https://run.linkerd.io/install-edge | sh && \
     mkdir -p "$HOME/bin" && ln -s "$HOME/.linkerd2/bin/linkerd" "$HOME/bin/linkerd"
 
+ENV RUSTFLAGS="--cfg tokio_unstable"
+
 # XXX(ver) This doesn't currently work, because it puts
 # /usr/local/cargo/registry into a weird state with regard to permissions.
 #RUN rustup toolchain install --profile=minimal nightly

.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
 	"build": {
 		"dockerfile": "Dockerfile",
 		"args": {
-			"DEV_VERSION": "v43",
+			"DEV_VERSION": "v44",
 			"http_proxy": "${localEnv:http_proxy}",
 			"https_proxy": "${localEnv:https_proxy}"
 		}

.github/workflows/beta.yml

@@ -23,7 +23,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v43-rust
+    container: ghcr.io/linkerd/dev:v44-rust
     timeout-minutes: 20
     continue-on-error: true
     steps:

.github/workflows/coverage.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: docker://ghcr.io/linkerd/dev:v43-rust
+      image: docker://ghcr.io/linkerd/dev:v44-rust
       options: --security-opt seccomp=unconfined # 🤷
     env:
       CXX: "/usr/bin/clang++-14"

.github/workflows/fuzzers.yml

@@ -27,7 +27,7 @@ jobs:
   list-changed:
     timeout-minutes: 3
     runs-on: ubuntu-latest
-    container: docker://rust:1.76.0
+    container: docker://rust:1.83.0
     steps:
       - run: apt update && apt install -y jo
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -48,7 +48,7 @@ jobs:
     needs: [list-changed]
     timeout-minutes: 40
     runs-on: ubuntu-latest
-    container: docker://rust:1.76.0
+    container: docker://rust:1.83.0
     strategy:
       matrix:
         dir: ${{ fromJson(needs.list-changed.outputs.dirs) }}

.github/workflows/nightly.yml

@@ -23,7 +23,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v43-rust
+    container: ghcr.io/linkerd/dev:v44-rust
     timeout-minutes: 20
     continue-on-error: true
     steps:

.github/workflows/pr.yml

@@ -76,7 +76,7 @@ jobs:
     if: needs.meta.outputs.actions_changed == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v43
+      - uses: linkerd/dev/actions/setup-tools@v44
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: just action-lint
       - run: just action-dev-check
@@ -85,7 +85,7 @@ jobs:
     needs: meta
     if: needs.meta.outputs.cargo_changed == 'true' || needs.meta.outputs.rust_changed == 'true'
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v43-rust
+    container: ghcr.io/linkerd/dev:v44-rust
     permissions:
       contents: read
     timeout-minutes: 20
@@ -111,7 +111,7 @@ jobs:
     if: needs.meta.outputs.cargo_changed == 'true'
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v43-rust
+    container: ghcr.io/linkerd/dev:v44-rust
     strategy:
       matrix:
         crate: ${{ fromJson(needs.meta.outputs.cargo_crates) }}
@@ -130,7 +130,7 @@ jobs:
     env:
       WAIT_TIMEOUT: 2m
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v43
+      - uses: linkerd/dev/actions/setup-tools@v44
       - name: scurl https://run.linkerd.io/install-edge | sh
         run: |
           scurl https://run.linkerd.io/install-edge | sh

.github/workflows/release.yml

@@ -133,7 +133,7 @@ jobs:
     continue-on-error: ${{ needs.meta.outputs.publish != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 40
-    container: docker://ghcr.io/linkerd/dev:v43-rust-musl
+    container: docker://ghcr.io/linkerd/dev:v44-rust-musl
     env:
       LINKERD2_PROXY_VENDOR: ${{ github.repository_owner }}
       LINKERD2_PROXY_VERSION: ${{ needs.meta.outputs.version }}

.github/workflows/shellcheck.yml

@@ -15,6 +15,6 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v43
+      - uses: linkerd/dev/actions/setup-tools@v44
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: just sh-lint

.github/workflows/toolchain.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   devcontainer:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v43-rust
+    container: ghcr.io/linkerd/dev:v44-rust
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -37,7 +37,7 @@ jobs:
   workflows:
     runs-on: ubuntu-latest
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v43
+      - uses: linkerd/dev/actions/setup-tools@v44
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - shell: bash
         run: |

Cargo.lock

@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "addr2line"

Dockerfile

@@ -3,7 +3,7 @@
 # This is intended **DEVELOPMENT ONLY**, i.e. so that proxy developers can
 # easily test the proxy in the context of the larger `linkerd2` project.
 
-ARG RUST_IMAGE=ghcr.io/linkerd/dev:v43-rust
+ARG RUST_IMAGE=ghcr.io/linkerd/dev:v44-rust
 
 # Use an arbitrary ~recent edge release image to get the proxy
 # identity-initializing and linkerd-await wrappers.

deny.toml

@@ -1,3 +1,4 @@
+[graph]
 targets = [
     { triple = "x86_64-unknown-linux-gnu" },
     { triple = "aarch64-unknown-linux-gnu" },
@@ -7,10 +8,6 @@ targets = [
 [advisories]
 db-path = "~/.cargo/advisory-db"
 db-urls = ["https://github.com/rustsec/advisory-db"]
-vulnerability = "deny"
-unmaintained = "warn"
-yanked = "deny"
-notice = "warn"
 ignore = []
 
 [licenses]
@@ -21,12 +18,7 @@ allow = [
     "ISC",
     "MIT",
     "Unicode-3.0",
-    "Unicode-DFS-2016",
 ]
-deny = []
-copyleft = "deny"
-allow-osi-fsf-free = "neither"
-default = "deny"
 # Ignore local workspace license values for unpublished crates.
 private = { ignore = true }
 confidence-threshold = 0.8
@@ -60,18 +52,10 @@ deny = [
     { name = "webpki" },
 ]
 skip = [
-    # The proc-macro ecosystem is in the middle of a migration from `syn` v1 to
-    # `syn` v2. Allow both versions to coexist peacefully for now.
-    #
-    # Since `syn` is used by proc-macros (executed at compile time), duplicate
-    # versions won't have an impact on the final binary size.
-    { name = "syn" },
-    # `tonic` v0.6 depends on `bitflags` v1.x, while `boring-sys` depends on
-    # `bitflags` v2.x. Allow both versions to coexist peacefully for now.
-    { name = "bitflags", version = "1" },
     # `linkerd-trace-context`, `rustls-pemfile` and `tonic` depend on `base64`
     # v0.13.1 while `rcgen` depends on v0.21.5
     { name = "base64" },
+    { name = "bitflags", version = "1" },
     # https://github.com/hawkw/matchers/pull/4
     { name = "regex-automata", version = "0.1" },
     { name = "regex-syntax", version = "0.6" },
@@ -82,17 +66,9 @@ skip = [
     { name = "hashbrown", version = "0.12" },
 ]
 skip-tree = [
-    # right now we have a mix of versions of this crate in the ecosystem
-    # procfs uses 0.36.14, tempfile uses 0.37.4
-    { name = "rustix" },
-    # Hyper v0.14 depends on an older socket2 version.
-    { name = "socket2" },
 ]
 
 [sources]
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-
-[sources.allow-org]
-github = ["linkerd"]

linkerd/addr/Cargo.toml

@@ -11,3 +11,6 @@ http = "0.2"
 ipnet = "2.10"
 linkerd-dns-name = { path = "../dns/name" }
 thiserror = "1"
+
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(fuzzing)'] }

linkerd/app/core/src/metrics.rs

@@ -423,7 +423,7 @@ impl FmtLabels for Direction {
     }
 }
 
-impl<'a> FmtLabels for Authority<'a> {
+impl FmtLabels for Authority<'_> {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         write!(f, "authority=\"{}\"", self.0)
     }

linkerd/app/core/src/transport/labels.rs

@@ -120,7 +120,7 @@ impl<'t> From<&'t tls::ConditionalServerTls> for TlsAccept<'t> {
     }
 }
 
-impl<'t> FmtLabels for TlsAccept<'t> {
+impl FmtLabels for TlsAccept<'_> {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self.0 {
             Conditional::None(tls::NoServerTls::Disabled) => {
@@ -148,7 +148,7 @@ impl<'t> From<&'t tls::ConditionalClientTls> for TlsConnect<'t> {
     }
 }
 
-impl<'t> FmtLabels for TlsConnect<'t> {
+impl FmtLabels for TlsConnect<'_> {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self.0 {
             Conditional::None(tls::NoClientTls::Disabled) => {

linkerd/app/inbound/Cargo.toml

@@ -66,3 +66,6 @@ linkerd-proxy-server-policy = { path = "../../proxy/server-policy", features = [
 linkerd-tracing = { path = "../../tracing", features = ["ansi"] }
 tokio = { version = "1", features = ["full", "macros"] }
 tokio-test = "0.4"
+
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(fuzzing)'] }

linkerd/app/integration/src/lib.rs

@@ -73,7 +73,7 @@ pub type Error = Box<dyn std::error::Error + Send + Sync + 'static>;
 macro_rules! assert_eventually {
     ($cond:expr, retries: $retries:expr, $($arg:tt)+) => {
         {
-            use std::{env, u64};
+            use std::{env};
             use std::str::FromStr;
             use tokio::time::{Instant, Duration};
             use tracing::Instrument as _;

linkerd/app/integration/src/metrics.rs

@@ -192,8 +192,8 @@ impl MetricMatch {
     }
 
     pub async fn assert_in(&self, client: &crate::client::Client) {
+        use std::env;
         use std::str::FromStr;
-        use std::{env, u64};
         use tokio::time::{Duration, Instant};
         use tracing::Instrument as _;
         const MAX_RETRIES: usize = 5;

linkerd/app/outbound/Cargo.toml

@@ -15,6 +15,8 @@ allow-loopback = []
 test-subscriber = []
 test-util = ["linkerd-app-test", "linkerd-meshtls-rustls/test-util"]
 
+prometheus-client-rust-242 = [] # TODO
+
 [dependencies]
 ahash = "0.8"
 bytes = "1"
@@ -67,3 +69,6 @@ linkerd-meshtls-rustls = { path = "../../meshtls/rustls", features = [
 ] }
 linkerd-stack = { path = "../../stack", features = ["test-util"] }
 linkerd-tracing = { path = "../../tracing", features = ["ansi"] }
+
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(fuzzing)'] }

linkerd/app/outbound/src/http/logical/policy/route/retry.rs

@@ -15,10 +15,6 @@ use linkerd_http_retry::{self as retry, peek_trailers::PeekTrailersBody};
 use linkerd_proxy_client_policy as policy;
 use tokio::time;
 
-// A request extension that marks that a request is a retry.
-#[derive(Copy, Clone, Debug)]
-pub struct IsRetry(());
-
 pub type NewHttpRetry<F, N> =
     retry::NewHttpRetry<RetryPolicy, RouteLabels, F, RouteLabelExtract, N>;
 

linkerd/app/src/env/types.rs

@@ -113,9 +113,8 @@ pub(super) fn parse_port_range_set(s: &str) -> Result<RangeInclusiveSet<u16>, Pa
             let low = parse_number::<u16>(low)?;
             if let Some(high) = parts.next() {
                 let high = high.trim();
-                let high = parse_number::<u16>(high).map_err(|e| {
+                let high = parse_number::<u16>(high).inspect_err(|_| {
                     error!("Not a valid port range: {part}");
-                    e
                 })?;
                 if high < low {
                     error!("Not a valid port range: {part}; {high} is greater than {low}");

linkerd/app/test/src/resolver.rs

@@ -136,9 +136,8 @@ impl<T: Param<ConcreteAddr>, E> tower::Service<T> for Dst<E> {
             .endpoints
             .lock()
             .remove(&addr)
-            .map(|x| {
+            .inspect(|_| {
                 tracing::trace!("found endpoint for target");
-                x
             })
             .unwrap_or_else(|| {
                 tracing::debug!(?addr, "no endpoint configured for");
@@ -188,9 +187,8 @@ impl Profiles {
             .endpoints
             .lock()
             .remove(&addr)
-            .map(|x| {
+            .inspect(|_| {
                 tracing::trace!("found endpoint for addr");
-                x
             })
             .unwrap_or_else(|| {
                 tracing::debug!(?addr, "no endpoint configured for");

linkerd/app/test/src/resolver/client_policy.rs

@@ -121,9 +121,8 @@ impl ClientPolicies {
             .endpoints
             .lock()
             .remove(&addr)
-            .map(|x| {
+            .inspect(|_| {
                 tracing::trace!("found policy for addr");
-                x
             })
             .ok_or_else(|| {
                 tracing::debug!(?addr, "no policy configured for");

linkerd/conditional/src/lib.rs

@@ -86,7 +86,7 @@ impl<C, R> Conditional<C, R> {
     }
 }
 
-impl<'a, C, R> Conditional<&'a C, R>
+impl<C, R> Conditional<&C, R>
 where
     C: Clone,
 {

linkerd/dns/Cargo.toml

@@ -14,3 +14,6 @@ thiserror = "1"
 tracing = "0.1"
 hickory-resolver = "0.24.1"
 tokio = { version = "1", features = ["rt", "sync", "time"] }
+
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(fuzzing)'] }

linkerd/dns/name/src/name.rs

@@ -41,7 +41,7 @@ pub struct Name(Arc<str>);
 /// allowed.
 ///
 /// [RFC 5280 Section 7.2]: https://tools.ietf.org/html/rfc5280#section-7.2
-#[derive(Clone, Copy, Debug, Eq, Hash)]
+#[derive(Clone, Copy, Debug, Eq)]
 pub struct NameRef<'a>(&'a str);
 
 #[derive(Copy, Clone, Debug, Eq, PartialEq, Error)]

linkerd/http/access-log/src/lib.rs

@@ -202,8 +202,8 @@ where
             .map(|x| span.record("response_bytes", x));
 
         span.record("status", response.status().as_u16());
-        span.record("total_ns", &field::display(total_ns));
-        span.record("processing_ns", &field::display(processing_ns));
+        span.record("total_ns", field::display(total_ns));
+        span.record("processing_ns", field::display(processing_ns));
 
         Poll::Ready(Ok(response))
     }

linkerd/http/metrics/src/lib.rs

@@ -93,7 +93,7 @@ where
     }
 }
 
-impl<'p, N: fmt::Display> fmt::Display for Prefixed<'p, N> {
+impl<N: fmt::Display> fmt::Display for Prefixed<'_, N> {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         if self.prefix.is_empty() {
             return self.name.fmt(f);