PR #572 - preloopdev/preloop

Weekly batch for the major-breaking group. Replaces the single-dependency Renovate PRs listed under "Supersedes". Batch config: #568. Source changes are limited to call-site ports for the new majors (see "Code changes"); the bumps themselves are in the manifests and lockfile.

Ubuntu 26.04 split

The Ubuntu 26.04-only image and release-host changes were extracted into parked PR #595. That PR is intentionally open and unmerged for later evaluation. This PR keeps the supported Ubuntu 24.04 Dockerfile, release hosts, and golden behavior from #594.

Dependency updates (current -> new)

Workspace manifest (Cargo.toml, [workspace.dependencies]):

axum 0.7 -> 0.8
axum-server 0.7 -> 0.8
base64 0.22 -> 0.23
cap-std 3.4 -> 4.0
cron 0.12 -> 0.17
opentelemetry, opentelemetry_sdk, opentelemetry-otlp, opentelemetry-http, opentelemetry-appender-tracing, opentelemetry-semantic-conventions 0.32 -> 0.33
rand 0.8 -> 0.10
rusqlite 0.37 -> 0.40
similar 2.5 -> 3.0
thiserror 1.0 -> 2.0
tokio-tungstenite 0.23 -> 0.30
toml 0.8 -> 1.0 (see Notes)
tower-http 0.5 -> 0.7
tracing-opentelemetry 0.33 -> 0.34
utoipa 5 -> 6
zip 2 -> 8

Crate manifests:

nix 0.27 -> 0.31 (crates/preloop-orchestrator, crates/preloop-runner)
tree-sitter 0.25 -> 0.27 (crates/runner-watch)
rsa 0.9 (workspace): version unchanged; getrandom feature enabled (see Notes)

Images and runners:

ci/runner.Dockerfile and .github/workflows/release.yml / release-runner.yml remain on supported Ubuntu 24.04; the former 26.04-only delta is parked in #595.

GitHub Actions (SHA-pinned, comment matches the tag; SHAs resolved with gh api):

actions/checkout v5.1.0 -> v7.0.1 (15 workflows, 32 uses)
actions/upload-artifact v4.6.2 -> v7.0.1 (10 workflows, 17 uses)
actions/cache v4 -> v6 (ci.yml)
astral-sh/setup-uv v9.0.0 -> v10.2.0 (zizmor.yml)

Supersedes

#527, #529, #530, #533, #536, #539, #541, #543, #544, #551, #554, #555, #557, #558, #561, #562, #563, #564, #565, #566

Not closed by this batch: #542 (toml 0.9, see Notes), #549 (axum; also edits benchmarks/preloop-perf), #556 (checkout v7; also edits fixtures/upstream-workflows), #567 (ubuntu; also edits benchmarks/real-world Dockerfiles).

Code changes

Call-site ports only, with no intended behavior change:

axum 0.8: route captures :param and *rest are now {param} and {*rest} in production and test routers, including /{orchestration_id}//idtoken/.... rerun_run takes Result<Json<_>, JsonRejection>, so a malformed or non-JSON body still falls back to the default rerun, as it did under 0.7.
rand 0.10: thread_rng() becomes rand::rng(); RngCore and gen* become Rng and RngExt::random*.
rsa: RSA keygen and signing use rsa::rand_core::OsRng (see Notes for the feature).
nix 0.31: killpg takes nix's Signal. command-group still signals through its own nix 0.27, so both signal types stay in process.rs.
tokio-tungstenite 0.30 and axum ws: Utf8Bytes conversions, which share Bytes and do not copy.
clippy 1.99: chunks_exact becomes as_chunks in preloop-runner-server/src/live_log_segments.rs; fetch_update becomes try_update in preloop-orchestrator.
Tests: snapshot_publishes_without_staging_in_the_process_temp_dir no longer sets TMPDIR. The mutation raced with concurrent tests and caused ENOENT flakes.
benchmarks/preloop-perf: axum 0.8 pin. benchmarks/control-load: rand 0.10 renames. Both compile-only, approved by the repo owner. No other benchmarks/ file changed.

Notes

toml: the plan lists both 0.8 -> 0.9 (#542) and 0.8 -> 1.0 (#564) for the same [workspace.dependencies] line. Only one can apply, so 1.0 is applied (resolves to 1.1.8) and #542 stays open.
Frozen paths: fixtures/upstream-workflows/** is untouched. benchmarks/** has only the compile-only edits listed under Code changes.
rsa getrandom: the workspace enables rsa's getrandom feature so rsa::rand_core::OsRng (rand_core 0.6) is available after the rand port. No version change.
Metrics label format: HTTP route labels now use axum's matched-path syntax, for example /api/v1/runs/{run_id} instead of /api/v1/runs/:run_id. Label cardinality is unchanged. Dashboards or alerts that match the :param form need updating.
#549: this PR's axum 0.8 bump, including the benchmarks/preloop-perf pin, supersedes #549's content. The Ubuntu 26.04 runner-image/workflow delta is parked separately in #595; #567's benchmarks/real-world Dockerfile edits are not included, so #567 stays open for that part. Neither PR is closed by this one.
Supply chain: current main's cargo-vet policy (including the #572 batch exemptions from #593) is retained; cargo vet --locked passes on the rebased tree.
Overlaps with deps/batch-non-breaking (checkout lines, Cargo.lock) and deps/batch-crypto (Cargo.toml adjacent lines, Cargo.lock). Expect rebase conflicts after each earlier merge.

Verification

Rebased head 0463902e1 onto current main 4e9377365:

cargo fmt --all -- --check: pass
cargo check --workspace --all-targets --locked: pass
cargo clippy --workspace --all-targets --locked -- -D warnings: pass
cargo vet --locked: pass (17 fully audited, 2 partially audited, 472 exempted)
Full workspace tests were not rerun after this rebase; the prior #572 run reported 2814 passed and one pre-existing github::tests::expired_webhook_lease_rejects_all_mutations disk-I/O race under parallel load.
Not run: just conform and just dogfood; they need official-runner captures and a live runner, so the runner-facing gate remains open.

Summary by cubic

Batches this week's major-version dependency updates into a single PR, replacing 20 separate Renovate PRs. Call sites across the workspace are ported to the new APIs with no intended behavior changes.

Dependency updates

Workspace manifest: axum/axum-server 0.7→0.8, base64 0.22→0.23, cap-std 3.4→4.0, cron 0.12→0.17, rand 0.8→0.10, rusqlite 0.37→0.40, similar 2.5→3.0, thiserror 1.0→2.0, toml 0.8→1.0, tokio-tungstenite 0.23→0.30, tower-http 0.5→0.7, tracing-opentelemetry 0.33→0.34, utoipa 5→6, zip 2→8, and the six opentelemetry crates 0.32→0.33.
Crate manifests: nix 0.27→0.31 in the runner and orchestrator, tree-sitter 0.25→0.27 in runner-watch.
Runners and images move to Ubuntu 26.04; actions/checkout v5→v7, actions/upload-artifact v4→v7, actions/cache v4→v6, and astral-sh/setup-uv v9→v10 move to the SHA-pinned commits matching those tags.
toml 1.0 wins over the also-listed 0.8→0.9 bump for the same workspace line, so #542 stays open; frozen paths benchmarks/** and fixtures/upstream-workflows/** are untouched, leaving #549 and #556 open.
Release jobs need the ubuntu-26.04 runner label provisioned before merge; overlaps with the non-breaking and crypto batches mean rebase conflicts after each earlier merge. The workspace build against the locked lockfile is still being verified.

Porting call sites

axum 0.8 drops :param/*wildcard routes; production and test routes use {param}/{*rest}. rerun_run takes Result<Json<_>, JsonRejection> to keep the old default-rerun fallback on malformed bodies, and metric route labels follow MatchedPath's {param} form.
rand 0.10 renames thread_rng→rng and gen/gen_range→random/random_range; RSA call sites use rsa::rand_core::OsRng.
WebSocket text messages convert Utf8Bytes between tokio-tungstenite 0.30 and axum without copying; nix 0.31 killpg uses nix's Signal alongside command-group's nix 0.27 type.
The snapshot staging test stops mutating TMPDIR, fixing an ENOENT flake from racing tempdir creation.
Clippy 1.99 fixes: fetch_update→try_update in the orchestrator and chunks_exact→as_chunks in live_log_segments.

Summary by CodeRabbit

Bug Fixes
- Rerun requests with missing, malformed, or non-JSON bodies now use the default “rerun all” behavior.
Chores
- Updated CI, verification, and release workflows, including moving release builds to Ubuntu 26.04.
- Updated request routing and communication handling for compatibility with current platform behavior.
- Refreshed dependencies and test and benchmark tooling while preserving existing workflows and behavior.