update bnf to 0.6

[CrockAgile]

Summary

• Upgrade bnf to 0.6 and remove the rand version pin that was required until bnf 0.6 (see #7897).
• Use coverage-guided grammar generation in the connector_selection_parse fuzz target: switch to bnf's CoverageGuided strategy and run multiple generations per fuzz input so we exercise more grammar productions per seed.

Motivation

• bnf 0.6 re-exports rand and uses rand 0.9, so the fuzz crate no longer needs a pinned rand dependency.
• The connector_selection_parse target previously used a single grammar generation per input; CoverageGuided only helps when the same strategy is reused across generations. Running several generations per input (same seed, same strategy) lets the strategy prefer previously unused productions, improving grammar coverage for the JSON selection parser fuzz run.

Changes

• fuzz/Cargo.toml: bump bnf from 0.5.0 to 0.6, remove rand = "=0.8.5" and the comment about bnf PR fix(deps): update rust crate anyhow to 1.0.48 #175.
• fuzz/fuzz_targets/connector_selection_parse.rs: use bnf::CoverageGuided and bnf::rand (no direct rand dep); generate up to 8 selections per fuzz input via generate_seeded_with_strategy and parse each; keep Corpus::Reject when no generation succeeds (e.g. non-terminating expansion).

---

---

Checklist

Complete the checklist (and note appropriate exceptions) before the PR is marked ready-for-review.

• PR description explains the motivation for the change and relevant context for reviewing
• PR description links appropriate GitHub/Jira tickets (creating when necessary)
• Changeset is included for user-facing changes
• Changes are compatible¹
• Documentation² completed
• Performance impact assessed and acceptable
• Metrics and logs are added³ and documented
• Tests added and passing⁴
  • Unit tests
  • Integration tests
  • Manual tests, as necessary

Exceptions

• Changeset: Not included; changes are limited to the fuzz crate and do not affect router behavior or user-facing APIs.
• Documentation: N/A; no configuration or user-facing behavior changed.
• Metrics and logs: N/A; no new observability added.
• Tests: No new unit or integration tests. Verified with cargo check -p router-fuzz and by running the connector_selection_parse fuzz target.

Notes

Footnotes

1. It may be appropriate to bring upcoming changes to the attention of other (impacted) groups. Please endeavour to do this before seeking PR approval. The mechanism for doing this will vary considerably, so use your judgement as to how and when to do this. ↩

2. Configuration is an important part of many changes. Where applicable please try to document configuration examples. ↩

3. A lot of (if not most) features benefit from built-in observability and debug-level logs. Please read this guidance on metrics best-practices. ↩

4. Tick whichever testing boxes are applicable. If you are adding Manual Tests, please document the manual testing (extensively) in the Exceptions. ↩

[apollo-cla]

@CrockAgile: Thank you for submitting a pull request! Before we can merge it, you'll need to sign the Apollo Contributor License Agreement here: https://contribute.apollographql.com/

[CrockAgile]

@apollo-cla never got the email, so guess I'll just wait 😴

update: it went to spam because the amazon SES isn't setup to use certificates, but I got it!

[aaronArinder]

@CrockAgile: thanks for this! to help me understand it, could you motivate the change for me? I'm not 100% sure I follow what's at stake or whether this fixes/improves something for folks

[CrockAgile]

@aaronArinder yeah sure! first motivation is just to update BNF to the latest version (I'm a maintainer, so selfishly working to keep more users on the recent version)

other motivation is that BNF is being used in this code based for fuzz testing. the existing random generation in 0.5 was not really designed with fuzzing in mind tho, and did not prioritize exploring new paths to increase coverage

BNF 0.6 has multiple strategies now, one of which being CoverageGuided, for exactly this kind of fuzzing use case

[CrockAgile]

also addresses this leftover TODO due to rand version differences in bnf 0.5, which have been addressed in bnf 0.6

[CrockAgile]

@aaronArinder anything I can do to explain this better? just let me know

[aaronArinder]

@CrockAgile: it's more of a priority thing, just waiting until I have more time to look at it. There's an internal advocate for this change, too, so I might rely on them to help out too

[goto-bus-stop]

LGTM, thanks for doing this! & extra for the improvement to the fuzzer :)

[goto-bus-stop]

@mergify copy dev

[mergify]

copy dev

✅ Pull request copies have been created

Details

• #8935 update bnf to 0.6 (copy #8864) has been created for branch dev

[goto-bus-stop]

Our test suite can't run fully from a fork, so the PR will be merged thru #8935. Thanks again!