Skip to content

build(deps): bump toml from 0.8.23 to 1.1.2+spec-1.1.0#1

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/toml-1.1.2spec-1.1.0
Open

build(deps): bump toml from 0.8.23 to 1.1.2+spec-1.1.0#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/toml-1.1.2spec-1.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps toml from 0.8.23 to 1.1.2+spec-1.1.0.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 3, 2026
@dependabot dependabot Bot force-pushed the dependabot/cargo/toml-1.1.2spec-1.1.0 branch 3 times, most recently from 70c6ae7 to ca35584 Compare May 4, 2026 10:09
TAJD added a commit that referenced this pull request May 5, 2026
@TAJD @claude
feat(cd-7e4,cd-81a.7): wire Node-side plugin host into cofferdam check
0c129c0 
cofferdam check now loads plugins declared in cofferdam.toml's
`plugins = [...]` array, runs them via a Node subprocess, and merges
the resulting findings into the engine's output. Closes the
keystone gap that gated the BrandCasing e2e fixture and unblocks the
NoHttpClient + TenantIsolation siblings.

Architecture:
  - ProjectConfig grows a `plugins: Vec<PathBuf>` field, populated
    from the top-level `plugins = [...]` array in cofferdam.toml. Paths
    resolve relative to the config file's directory.
  - cofferdam-cli embeds a self-contained `plugin-host.mjs` runner via
    include_str!, materialises it to the OS temp dir on first call,
    and spawns `node` with the script + a JSON manifest piped over
    stdin. The manifest carries (path, text, lineViews) per file plus
    the resolved plugin paths and per-check option overrides.
  - Per-file LineViews are built Rust-side via cofferdam-ts::build_lines
    so the host script doesn't have to reproduce the comment/string
    classification logic in pure JS.
  - The host imports each plugin's default export, runs `check.run`
    against every file, and emits {reports, errors} as JSON on stdout.
    Plugin scope filtering (cd-81a.5 extensions) is honoured.
  - Reports come back with checkId/category; the CLI prefixes bare
    plugin IDs with their declared category (`Warning.BrandCasing`)
    so the formatter's category derivation works.
  - Suppression directives (`// cofferdam-ignore: BrandCasing`) apply
    to plugin findings too — the CLI re-runs the engine's suppression
    parser against plugin issues, matching both the prefixed and bare
    forms of the check ID.

Failure modes (all soft — built-in findings still ship):
  - Node not installed or spawn fails → Warning.PluginRuntimeUnavailable.
  - Plugin module fails to load → Warning.PluginLoadFailed.
  - Plugin's run() throws on a file → Warning.PluginCrashed.
  - Host exits non-zero or emits malformed JSON → Warning.PluginHostFailed.

Brand-casing fixture changes (cd-7e4 acceptance):
  - examples-plugins/brand-casing/cofferdam.toml — config pointing at
    the local plugin via `plugins = ["./"]` plus the allowedAliases
    override.
  - Plugin's run() loop fixed: the `isComment` short-circuit was
    skipping lines with both a string literal AND a trailing `// note`
    (which is every fixture line by design). Now gates on
    string/jsx presence first. Adds a quote-counting helper that skips
    identifier-position matches (e.g. `import { Rovikore }`).
  - expected.json regenerated: 2 findings (FLAG #1 line 13 string
    literal, FLAG #2 line 17 template literal). Spans round-trip to
    the literal `Rovikore` bytes.

Tooling:
  - scripts/regen-plugin-fixtures.mjs + scripts/check-plugin-fixtures.mjs
    auto-detect a per-fixture cofferdam.toml and pass --config; the
    engine's walk-up discovery starts from CWD and would otherwise
    miss configs nested in fixture directories.
  - .github/workflows/plugin-sdk-e2e.yml runs the full e2e:
    cargo build → SDK build → bundle into plugin's node_modules →
    plugin tsc → cofferdam check → JSON diff → span round-trip →
    negative-fixture tsc.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@dependabot dependabot Bot force-pushed the dependabot/cargo/toml-1.1.2spec-1.1.0 branch from ca35584 to b079469 Compare May 5, 2026 19:45
@dependabot dependabot Bot changed the title chore(deps): bump toml from 0.8.23 to 1.1.2+spec-1.1.0 build(deps): bump toml from 0.8.23 to 1.1.2+spec-1.1.0 May 21, 2026
@dependabot dependabot Bot force-pushed the dependabot/cargo/toml-1.1.2spec-1.1.0 branch 3 times, most recently from 6bf898f to d0ed804 Compare May 21, 2026 20:29
@dependabot
build(deps): bump toml from 0.8.23 to 1.1.2+spec-1.1.0
51ce085 
Bumps [toml](https://github.com/toml-rs/toml) from 0.8.23 to 1.1.2+spec-1.1.0.
- [Commits](toml-rs/toml@toml-v0.8.23...toml-v1.1.2)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 1.1.2+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/cargo/toml-1.1.2spec-1.1.0 branch from d0ed804 to 51ce085 Compare May 22, 2026 11:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants