Upgrade Axum and Cargo Dependencies

The agent reads Cargo.toml and Cargo.lock to see how far behind the project is and what moves together. In launchbadge/realworld-axum-sqlx the manifest asks for axum 0.3.4, sqlx 0.5 with runtime-tokio-native-tls, postgres, uuid and time, tokio 1.14, tower 0.4 and tower-http 0.2 with trace, clap at 3.0.0-beta.5, time 0.2, uuid 0.8, argon2 0.3, jwt 0.15 with hmac 0.11 and sha2 0.9, rand 0.8, itertools 0.10, thiserror 1, anyhow, async-trait, dotenv, env_logger 0.9 and log. The lock has not moved since the code was written: sqlx resolves to 0.5.9, time to 0.2.27, uuid to 0.8.2. There are no tests under tests/ and no .sqlx offline data, and the handlers use sqlx::query! and query_as! throughout, so even cargo build needs a DATABASE_URL pointing at a Postgres with the four files in migrations/ applied.

Then it reads what a build proves here. .github/workflows/rust.yml starts a postgres service, installs sqlx-cli, runs sqlx db setup, then cargo build --verbose and cargo test --verbose, and finally starts the server with cargo run and runs the RealWorld Postman collection from a pinned fork against port 8080. .env.sample names the two settings config.rs reads through clap, DATABASE_URL and HMAC_KEY, plus RUST_LOG. The agent does the same in its sandbox: starts Postgres, writes .env, runs sqlx db setup so the macros can check every query at compile time, and keeps the Postman run as the integration check since there is no unit suite to lean on.

The groups are decided by where the code breaks. Axum and Tower move together, and the port is in src/http/mod.rs and src/http/extractor.rs: AddExtensionLayer becomes Extension as a layer, axum::Server::bind becomes a TcpListener with axum::serve, the #[async_trait] impl FromRequest for AuthUser and MaybeAuthUser become FromRequestParts without the macro, and route paths such as /api/articles/:slug in src/http/articles/mod.rs take the newer brace syntax. SQLx moves on its own, with the runtime feature split into runtime-tokio and tls-native-tls, and Timestamptz in src/http/types.rs rechecked as a sqlx::Type over OffsetDateTime. The time major changes types.rs, where Format::Rfc3339 and lazy_format give way to the well-known format description, and extractor.rs, which builds a two-week Duration. clap from the beta to a release changes the attributes on Config in src/config.rs and needs the derive and env features. hmac, sha2 and jwt move together because extractor.rs signs and verifies with all three and NewMac was renamed. argon2, uuid, rand, itertools, thiserror and env_logger are each a small group, and dotenv is swapped for its maintained fork only if the prompt allows a crate change.

After each group the agent runs cargo build, cargo clippy, cargo test and the Postman collection against a running server, all against the same Postgres. A group that passes is a commit with the port in it; a group that fails, for example a jwt release that changes how claims deserialize, is reverted with the compiler output kept. The pull request lists each bump with old and new versions, the source files each port touched, the skips with their reason, and the four check results.

What comes back is a pull request on a new branch that changes Cargo.toml and Cargo.lock in one commit per group that passed, each commit carrying the port that group needed: src/http/mod.rs and src/http/extractor.rs for Axum, src/http/types.rs for time and SQLx, src/config.rs for clap, and the route strings in src/http/articles/mod.rs and its siblings. Migrations are untouched.

The description is one line per bump with old and new versions, the files each port touched, a list of upgrades left out with the compiler error or failing Postman request that excluded them, and the result lines of cargo build, cargo clippy, cargo test and the collection run. The trajectory keeps the full output for every group, including the reverted ones, and the server log from each collection run.

Before merging, a reviewer reads the extractor.rs port closely, since it is the token verification path, checks that the Timestamptz serialization still produces RFC 3339 strings, and confirms the Postman run exercised login and article creation, because there is no unit test covering either.

Create an automation in the Project with this prompt and a schedule trigger (cron 0 9 * * 1 in your timezone). After the first run catches the project up, each week's run opens one pull request with that week's bumps, or none when nothing moved. Because each group is its own commit, dropping a bump before merge is a revert of one commit.

To have the link reach your server, start the weekly run from your own scheduler instead, with POST /o/{org}/sessions and an API key that has a webhook URL: Rush then POSTs run.completed with the session_url when the turn ends, and a handler on your side can post the pull request link where the API's maintainers read. A run that ends with no safe group opens no pull request and says why in its result.

An Axum API that has not moved in a few releases cannot be upgraded by a bot: every bump is also a port, the query macros need a live database to compile, and the only integration check is a Postman collection against a running server. On Rush the agent has Postgres, sqlx-cli and the server in its own sandbox, does one group at a time, keeps the groups that pass and the compiler output for the ones that do not, so the pull request that reaches you is already green.

The record shows every build, every clippy run and every collection run, which is the evidence a reviewer needs when the code that changed is the authentication extractor. The same request runs against every Axum service you maintain at once.

There are no tests. What stops a bad port?

Why does cargo build need Postgres?

Will it change the route syntax?

Does it replace the dotenv crate?

Can it do only part of the catch-up?