Updated:(deps): Bump html-to-markdown-rs from 3.4.1 to 3.5.0 in /src

[dependabot]

Bumps html-to-markdown-rs from 3.4.1 to 3.5.0.

Release notes

Sourced from html-to-markdown-rs's releases.

v3.5.0

See CHANGELOG.md for full release notes.

First non-rc release in the 3.5.0 cycle. Promoted from v3.5.0-rc.3 after the publish workflow reached fully green (run 26393110006).

Highlights

• bindings: regenerated with alef 0.19.6. Node optional-dep package names now scoped (@kreuzberg/html-to-markdown-node-<target>).
• ci(publish-hex): bump to kreuzberg-dev/actions@v1.6.9. cargo generate-lockfile before mix hex.publish so Hex no longer fails on the gitignored NIF lockfile.
• ci(publish): rename Go FFI tarballs to use -go- infix. Workaround for alef 0.19.6 packager collision with C FFI prefix; alef-side fix already on alef main.

v3.5.0-rc.3

See CHANGELOG.md for the full release notes.

Folds the rc.2 publish-fix fallout: alef 0.19.5 regen unblocks Kotlin Android compile; actions v1.6.6/v1.6.7 unblock Elixir Hex and Homebrew arm64 bottle; Dart pub.dev now publishes via workflow_dispatch so OIDC accepts the token.

v3.5.0-rc.2

[3.5.0-rc.2] - 2026-05-25

Changed

• ci(publish): replace inline Homebrew formula updater with kreuzberg-dev/actions/publish-homebrew-source-formulas@v1. The publish-homebrew-formula job previously ran a 184-line scripts/publish/update-homebrew-formula.sh Bash heredoc that wrote html-to-markdown.rb + libhtml-to-markdown.rb from scratch (h2m is a dual-formula tap; the shared single-formula publish-homebrew@v1 doesn't apply). The new shared action does the same job from per-formula .rb.tmpl templates + a scripts/publish/homebrew.json manifest, downloading release assets via gh release download and substituting their SHA256s into ${cli_*_sha} / ${ffi_*_sha} placeholders. The script is deleted; the formula generation rules now live in version-controlled Ruby templates rather than a bash heredoc. The job's gate now also passes on dry_run == 'true' (was is_tag == 'true' only) so dry-run pipelines exercise the bottle pipeline downstream — the new action substitutes a zero-SHA placeholder for missing assets on dry-run.

• ci(publish): pin actions/checkout@v5 on the homebrew-bottles matrix job. v6 hits an includeIf credential regression on the macos-15-intel runner that this matrix includes (same workaround liter-llm applies on its Homebrew matrix). Other jobs stay on @v6.

Fixed

• ci(publish): skip publish-hex and homebrew-bottles on dry-run. Both jobs need real GitHub Release assets (generate-elixir-checksums downloads NIF tarballs; brew install --build-bottle downloads CLI/FFI source tarballs), but upload-release-assets@v1 only logs on dry-run — the release doesn't exist. Both jobs failed every dry-run after surviving every other stage. Gated their if: on dry_run != 'true'; real-release runs continue to exercise them.

• ci(publish): replace inline Elixir Hex packaging with kreuzberg-dev/actions/build-elixir-hex@v1. The elixir-package job in .github/workflows/publish.yaml previously ran mix deps.get + mix hex.build inline with no path-dep rewrite and no Cargo.lock generation. Cargo.lock is gitignored, so on a fresh CI checkout mix hex.build failed at the files list check with Missing files: native/html_to_markdown_nif/Cargo.lock — the proximate blocker on v3.5.0-rc.2 dry-run after the Go FFI fix landed. The new shared action wraps rewrite-native-deps@v1 (default-on, dry-run-guarded) and falls back to cargo generate-lockfile on dry-run so the lockfile exists for mix hex.build even when the rewrite is skipped. Hex source-package builds now match the python-sdist / ruby-gem pattern (rewrite baked into the shared action; cannot be omitted).

• release: cut v3.5.0-rc.2. Aligned every workspace manifest (Cargo + npm + PyPI + Maven + Composer + Gemfile + Hex + pub.dev + Zig + R + Cocoa + NuGet + Cargo.lock) on 3.5.0-rc.2 via alef sync-versions --set 3.5.0-rc.2 and re-generated all bindings, READMEs, docs reference pages, e2e suites, and test_apps/ registry pins against alef 0.19.2.

• bindings: regenerated with alef 0.19.2. Picks up the cumulative v0.19.1 → v0.19.2 sweep: Swift codegen handles serde_rename_all = "lowercase" / "UPPERCASE" in unit enums and tagged Codable shapes (was silently emitting wrong casing); Swift now emits a custom Codable for serde-untagged data enums (the auto-derive previously used the wrong shape, surfacing as 19 runtime e2e failures); tagged-data enums route through JSONDecoder and Vec<Codable-enum> closure signatures are fixed. The trait-bridge codegen pipeline is rewired across all 14 language backends (rust/python/ts/node/wasm/ruby/php/go/c#/r/zig/elixir/dart/swift/java/kotlin-android) — super-trait lifecycle methods (name / version / initialize / shutdown) are driven by the IR instead of hardcoded literals, and canonical bridge-name helpers in Swift/Kotlin de-duplicate the prior near-misses. JNI no longer special-cases trait impl-name extraction; Kotlin Android accepts a bridge_class_name parameter so non-kreuzberg consumers (e.g. liter-llm) can opt out of the hardcoded KreuzbergBridge / kreuzberg:: references. Java's package_dir output_paths override now excludes setup/test/lint runs from .../src/main/java/ so they execute from packages/java/ as expected; JNI 0.22 compatibility was tightened (RuntimeMethodSignature parsing, borrow semantics, unsafe-block scoping, JString lifetime binding). Inherited from the v0.19.1 fix landed earlier today: magnus (Ruby) and rustler (Elixir) NodeContent::MetadataBlock reverse conversion now reconstructs Vec<(String, String)> from the sanitized Vec<Vec<String>> binding shape (the prior code didn't type-check and broke every Ruby build).

Fixed

• ci(publish): build the Go FFI matrix on dry-runs too. .github/workflows/publish.yaml job go-ffi-libraries gated only on release_go == 'true' and the registry existence check, so on workflow_dispatch dry-runs it skipped entirely. Its downstream sibling upload-go-release already gates on is_tag || dry_run but waits for go-ffi-libraries.result == 'success', so no Go assets were ever uploaded to the dry-run release, and the terminal verify-assets gate failed with ✗ pattern NOT matched: html-to-markdown-rs-go-*.tar.gz on every recent retry (the immediate blocker on v3.5.0-rc.1 publish). Added the (is_tag == 'true' || dry_run == 'true') clause to go-ffi-libraries's if:, mirroring the kotlin-android-natives pattern (precedent: commit e00a56e1 "ci(publish): build Kotlin Android natives on dry_run too").

• ci(e2e/ruby): drop the explicit python3 scripts/ci/ruby/vendor-core-crate.py step from both ruby build jobs in .github/workflows/ci-e2e.yaml (committed earlier today as f23e6d458); the dead script itself is removed in f440af4fa. The shared kreuzberg-dev/actions/build-ruby-gem@v1 action now invokes rewrite-native-deps@v1 internally and vendors the core crate into packages/ruby/vendor/html-to-markdown/ (no -rs suffix). Running the local script first wrote packages/ruby/vendor/Cargo.toml with members = ["html-to-markdown-rs"] and copied the crate into vendor/html-to-markdown-rs/; the subsequent action then created a sibling vendor/html-to-markdown/ outside that members list, and cargo refused to build it with error inheriting 'lints' from workspace root manifest's 'workspace.lints' / 'workspace.lints' was not defined. The action is now the single source of truth for ruby vendoring.

v3.5.0-rc.1

Release candidate v3.5.0-rc.1. See CHANGELOG.md for details.

Changelog

Sourced from html-to-markdown-rs's changelog.

[3.5.0] - 2026-05-25

Fixed

• bindings: regenerated with alef 0.19.6. Node optional-dep package names now carry the @kreuzberg/ scope (@kreuzberg/html-to-markdown-node-<target>) so requireOptionalDependency() resolves the published per-platform packages instead of an unscoped name that does not exist on npm. test_apps/ restructured by alef to the new layout (per-language runners under test_apps/<lang>/{ffi,htm_test,run_tests} for C; legacy in-tree test files removed). Additional alef-emitter, swift-bridge, FFI param handling, and ahash-scaffold fixes carried through from the 0.19.x line.

• ci(publish-hex): bump to kreuzberg-dev/actions@v1.6.9 — generate Cargo.lock before mix hex.publish. publish-hex@v1 runs a fresh actions/checkout, so the gitignored packages/elixir/native/html_to_markdown_nif/Cargo.lock is absent and mix hex.publish fails with Missing files: native/html_to_markdown_nif/Cargo.lock. v1.6.9 mirrors the build-elixir-hex fix and runs cargo generate-lockfile for every native/**/Cargo.toml before publishing. (v1 floating tag retagged.)

• ci(publish): rename Go FFI tarballs to use -go- infix instead of -ffi-. alef 0.19.6's Go packager (alef publish package --lang go) emitted {crate}-ffi-v{version}-{platform}.tar.gz, colliding with the C FFI packager's prefix. check-registry asset-prefix probes and verify-release-assets pattern lists could not distinguish Go from C FFI tarballs, so verify-release-assets failed on the missing html-to-markdown-rs-go-*.tar.gz pattern. Workaround: rename -ffi-v → -go-v immediately after alef publish package --lang go in the workflow. The alef-side fix is already on alef main; the workaround can be dropped once the local alef pin moves to a release that ships it.

• release: cut v3.5.0. Promoted from v3.5.0-rc.3 after the dry-run/republish cycle (publish run 26393110006) reached fully green (31 success / 0 failed / 56 skipped). Aligned every workspace manifest on 3.5.0 via alef sync-versions --set 3.5.0 + full alef generate regen.

[3.5.0-rc.3] - 2026-05-25

Fixed

• ci(actions/build-elixir-hex): generate Cargo.lock unconditionally after rewrite-native-deps. The fallback cargo generate-lockfile only ran on dry-run, but the lockfile is gitignored — real-release runs hit Missing files: native/html_to_markdown_nif/Cargo.lock at mix hex.build. Now runs in both modes. (kreuzberg-dev/actions v1.6.6, floating v1 retagged.)

• ci(publish): split Dart pub.dev publishing into a workflow_dispatch flow so OIDC trusted publishing succeeds. pub.dev's OIDC verifier rejects tokens minted by release events (Authentication failed!) and only accepts push / workflow_dispatch. The publish workflow now assembles the Dart package as an artifact under the release-triggered run, then dispatches a separate publish-pubdev.yaml workflow (workflow_dispatch) that downloads the artifact and runs dart-lang/publish-pub@v1. The dispatched job inherits a token GitHub's OIDC provider mints with event_name == workflow_dispatch, which pub.dev's audit accepts.

• ci(actions/homebrew-build-bottles): suppress brew config SIGPIPE under pipefail on arm64 Linux runners. The arm64 runner's /usr/bin/ldd writes more output than head -20 consumes; under set -o pipefail the broken-pipe propagated out of the early diagnostic block and aborted the script before any bottle work. Temporarily disables pipefail for the diagnostic stanza only — strict mode is restored before the build phase. (kreuzberg-dev/actions v1.6.7, floating v1 retagged.)

• bindings: regenerated with alef 0.19.5. Picks up the Kotlin Android trait-bridge codegen fixes that caused the v3.5.0-rc.2 :compileReleaseKotlin failure (Unresolved reference 'HtmlToMarkdownRsBridge'): bridge_obj filename is now used for trait-bridge codegen so the file matches the object name; trait-bridge emission is skipped when the bridge function is excluded via kotlin_android.exclude_functions. Also picks up the alef 0.19.5 cumulative sweep: WASM emitter JSON-deserializes structured sub-config fields; swift-bridge restores JSON deserialization step in pre-call AHashMap binding; alef-emitter removes stray > after .collect::<Vec<Vec<String>>>(); PHP/Ruby/Elixir/Swift/Dart bridges emit pre-call AHashMap binding + ahash = "0.8" scaffold dep for Cow<'static, str> key map params; WASM wraps sanitized Vec<Vec<String>> fields with serde_wasm_bindgen::to_value(); WASM deduplicates input DTO struct generation across functions sharing the same config type; FFI preserves AHashMap<Cow<'static, str>, _> param types across the wrapper boundary; setup-defaults-ruby appends --add-checksums to default bundle install; scaffold-ffi injects workspace version into every internal workspace dependency so cargo publish accepts the FFI crate.

• ci(e2e): pin erlef/setup-beam@v1.24.0 (was @v1.24 floating minor) to avoid silent action upgrades during the rc cycle.

• release: cut v3.5.0-rc.3. Aligned every workspace manifest on 3.5.0-rc.3 via alef sync-versions --set 3.5.0-rc.3 + full alef generate regen against alef 0.19.5.

[3.5.0-rc.2] - 2026-05-25

Changed

• ci(publish): replace inline Homebrew formula updater with kreuzberg-dev/actions/publish-homebrew-source-formulas@v1. The publish-homebrew-formula job previously ran a 184-line scripts/publish/update-homebrew-formula.sh Bash heredoc that wrote html-to-markdown.rb + libhtml-to-markdown.rb from scratch (h2m is a dual-formula tap; the shared single-formula publish-homebrew@v1 doesn't apply). The new shared action does the same job from per-formula .rb.tmpl templates + a scripts/publish/homebrew.json manifest, downloading release assets via gh release download and substituting their SHA256s into ${cli_*_sha} / ${ffi_*_sha} placeholders. The script is deleted; the formula generation rules now live in version-controlled Ruby templates rather than a bash heredoc. The job's gate now also passes on dry_run == 'true' (was is_tag == 'true' only) so dry-run pipelines exercise the bottle pipeline downstream — the new action substitutes a zero-SHA placeholder for missing assets on dry-run.

• ci(publish): pin actions/checkout@v5 on the homebrew-bottles matrix job. v6 hits an includeIf credential regression on the macos-15-intel runner that this matrix includes (same workaround liter-llm applies on its Homebrew matrix). Other jobs stay on @v6.

Fixed

• ci(publish): skip publish-hex and homebrew-bottles on dry-run. Both jobs need real GitHub Release assets (generate-elixir-checksums downloads NIF tarballs; brew install --build-bottle downloads CLI/FFI source tarballs), but upload-release-assets@v1 only logs on dry-run — the release doesn't exist. Both jobs failed every dry-run after surviving every other stage. Gated their if: on dry_run != 'true'; real-release runs continue to exercise them.

• ci(publish): replace inline Elixir Hex packaging with kreuzberg-dev/actions/build-elixir-hex@v1. The elixir-package job in .github/workflows/publish.yaml previously ran mix deps.get + mix hex.build inline with no path-dep rewrite and no Cargo.lock generation. Cargo.lock is gitignored, so on a fresh CI checkout mix hex.build failed at the files list check with Missing files: native/html_to_markdown_nif/Cargo.lock — the proximate blocker on v3.5.0-rc.2 dry-run after the Go FFI fix landed. The new shared action wraps rewrite-native-deps@v1 (default-on, dry-run-guarded) and falls back to cargo generate-lockfile on dry-run so the lockfile exists for mix hex.build even when the rewrite is skipped. Hex source-package builds now match the python-sdist / ruby-gem pattern (rewrite baked into the shared action; cannot be omitted).

• release: cut v3.5.0-rc.2. Aligned every workspace manifest (Cargo + npm + PyPI + Maven + Composer + Gemfile + Hex + pub.dev + Zig + R + Cocoa + NuGet + Cargo.lock) on 3.5.0-rc.2 via alef sync-versions --set 3.5.0-rc.2 and re-generated all bindings, READMEs, docs reference pages, e2e suites, and test_apps/ registry pins against alef 0.19.2.

• bindings: regenerated with alef 0.19.2. Picks up the cumulative v0.19.1 → v0.19.2 sweep: Swift codegen handles serde_rename_all = "lowercase" / "UPPERCASE" in unit enums and tagged Codable shapes (was silently emitting wrong casing); Swift now emits a custom Codable for serde-untagged data enums (the auto-derive previously used the wrong shape, surfacing as 19 runtime e2e failures); tagged-data enums route through JSONDecoder and Vec<Codable-enum> closure signatures are fixed. The trait-bridge codegen pipeline is rewired across all 14 language backends (rust/python/ts/node/wasm/ruby/php/go/c#/r/zig/elixir/dart/swift/java/kotlin-android) — super-trait lifecycle methods (name / version / initialize / shutdown) are driven by the IR instead of hardcoded literals, and canonical bridge-name helpers in Swift/Kotlin de-duplicate the prior near-misses. JNI no longer special-cases trait impl-name extraction; Kotlin Android accepts a bridge_class_name parameter so non-kreuzberg consumers (e.g. liter-llm) can opt out of the hardcoded KreuzbergBridge / kreuzberg:: references. Java's package_dir output_paths override now excludes setup/test/lint runs from .../src/main/java/ so they execute from packages/java/ as expected; JNI 0.22 compatibility was tightened (RuntimeMethodSignature parsing, borrow semantics, unsafe-block scoping, JString lifetime binding). Inherited from the v0.19.1 fix landed earlier today: magnus (Ruby) and rustler (Elixir) NodeContent::MetadataBlock reverse conversion now reconstructs Vec<(String, String)> from the sanitized Vec<Vec<String>> binding shape (the prior code didn't type-check and broke every Ruby build).

Fixed

• ci(publish): build the Go FFI matrix on dry-runs too. .github/workflows/publish.yaml job go-ffi-libraries gated only on release_go == 'true' and the registry existence check, so on workflow_dispatch dry-runs it skipped entirely. Its downstream sibling upload-go-release already gates on is_tag || dry_run but waits for go-ffi-libraries.result == 'success', so no Go assets were ever uploaded to the dry-run release, and the terminal verify-assets gate failed with ✗ pattern NOT matched: html-to-markdown-rs-go-*.tar.gz on every recent retry (the immediate blocker on v3.5.0-rc.1 publish). Added the (is_tag == 'true' || dry_run == 'true') clause to go-ffi-libraries's if:, mirroring the kotlin-android-natives pattern (precedent: commit e00a56e1 "ci(publish): build Kotlin Android natives on dry_run too").

... (truncated)

Commits

• 4d5618b chore: release prep for v3.5.0
• 4217923 ci(publish): rename Go FFI tarballs to use -go- prefix
• 033a6f7 chore: regenerate with alef 0.19.6
• a09e36b chore: release prep for v3.5.0-rc.3
• d74a5e4 fix(publish): use workflow_dispatch for pub.dev publishing to support OIDC
• 1465c35 docs: fold [Unreleased] CI fixes into [3.5.0-rc.2] release notes
• 159ae7c ci(publish): skip publish-hex and homebrew-bottles on dry-run
• 49a7a67 chore: regenerated with alef v0.19.4
• cdae280 ci(publish): migrate Homebrew formula update to publish-homebrew-source-formu...
• 888d2da ci(publish): use build-elixir-hex@v1 for Hex source packaging
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.