UPSTREAM PR #3302: Bump openssl from 0.10.73 to 0.10.78#136
Conversation
Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from 0.10.73 to 0.10.78. - [Release notes](https://github.com/rust-openssl/rust-openssl/releases) - [Commits](rust-openssl/rust-openssl@openssl-v0.10.73...openssl-v0.10.78) --- updated-dependencies: - dependency-name: openssl dependency-version: 0.10.78 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
OverviewA single OpenSSL security update (0.10.73 → 0.10.78) triggered widespread compiler optimization changes affecting 9,826 functions (27.6% of total). Core test execution hot paths remain unaffected. Main impact: compression subsystem shifted to sophisticated multi-threaded ZSTD operations, trading CPU time for 40-60% better compression ratios. Function Counts: 35,547 total | 9,826 modified | 10,617 new | 9,467 removed | 5,637 unchanged Power Consumption Changes:
Function AnalysisMajor Regressions (Compression Pipeline):
Decompression Pipeline:
Major Improvement:
Self-Update Operations:
Other analyzed functions (serialization, configuration parsing, UI cleanup, memory management) showed changes in non-critical paths with negligible real-world impact. Flame Graph ComparisonFunction: Base version: Target version: The target version shows dramatic expansion from shallow 2-level calls to 10-level deep stack with extensive ZSTD compression operations (dictionary matching, entropy encoding, parallel histogram counting) consuming 99.9% of execution time. Additional FindingsArchitectural Isolation Effective: Recording subsystem's separate thread with 128-event bounded channel successfully isolates compression regressions from test execution hot paths. The 1.2ms compression overhead per write doesn't block test spawning or output capture. No Source Code Changes: All performance variations stem from compiler optimization differences triggered by the dependency update, not nextest code modifications. This demonstrates how dependency updates can cause significant performance shifts through code generation changes. Test Execution Preserved: Critical paths ( 💬 Questions? Tag @loci-dev |
loci-dev
force-pushed
the
main
branch
5 times, most recently
from
b27abae to
6b3869e
Compare
1 participant
Note
Source pull request: nextest-rs/nextest#3302
Bumps openssl from 0.10.73 to 0.10.78.
Release notes
Sourced from openssl's releases.
... (truncated)
Commits
a6debf5Release openssl v0.10.78 and openssl-sys v0.9.114 (#2609)09b425eCheck derive output buffer length on OpenSSL 1.1.x (#2606)826c388Error for short out in MdCtxRef::digest_final() (#2608)1d10902Validate callback-returned lengths in PSK and cookie trampolines (#2607)5af6895Reject oversized length returns from password callback trampoline (#2605)718d07ffix inverted bounds assertion in AES key unwrap (#2604)53cc69dAdd support for LibreSSL 4.3.x (#2603)0b41e79Fix dangling stack pointer in custom extension add callback (#2599)cbdedf8Avoid panic for overlong OIDs (#2598)1fc51efopenssl 4 support (#2591)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.