diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8bbf76bb..815cbd39 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -45,6 +45,12 @@ updates: update-types: ["version-update:semver-major"] - dependency-name: "js-yaml" update-types: ["version-update:semver-major"] + # typescript 7.x is blocked on a build-system migration, not a version bump: the CJS half of + # the dual build (packages/{bundler-utils,webpack-loader,rspack-loader}/tsconfig.cjs.json) + # uses moduleResolution=node10, which TS 7 removed (TS5108). Tracked in #364; remove this + # entry when it lands. `ignore` filters VERSION updates only — SECURITY updates still arrive. + - dependency-name: "typescript" + update-types: ["version-update:semver-major"] - package-ecosystem: github-actions directory: "/" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4adb36ab..5f1a9f86 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,13 +22,13 @@ jobs: name: Rust — fmt, clippy, test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable with: components: rustfmt, clippy # mds-python (pyo3, abi3-py311) is compiled by `clippy --all-targets` and # `test --workspace`; a 3.11+ interpreter makes the pyo3 build deterministic. - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.11" - uses: Swatinem/rust-cache@v2 @@ -48,7 +48,7 @@ jobs: name: MSRV (Rust 1.88) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 # rust-version = 1.88 is declared workspace-wide; verify the published # crates still compile on it. napi/wasm bindings are checked on stable # in their own jobs since their toolchain needs can differ. @@ -56,7 +56,7 @@ jobs: # mds-python is added to the MSRV gate: its pyo3/abi3 build must compile on # the workspace floor (Rust 1.88 ≥ pyo3 0.28 MSRV 1.83). setup-python gives # the pyo3 build script a 3.11+ interpreter. - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.11" - uses: Swatinem/rust-cache@v2 @@ -66,7 +66,7 @@ jobs: name: WASM — build & test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 # Pinned to 1.96.0 (released 2026-05-28, >30-day soak per project convention). # RATIONALE: unpinned `stable` lets compiler drift silently change the wasm-opt # output size independently of any source change, making the 850 KB guard measure @@ -167,7 +167,7 @@ jobs: os: [ubuntu-latest, macos-latest, windows-latest] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 # DELIBERATE: @stable is intentionally not pinned to a SHA here. This is the # only job that builds the native addon (ubuntu/macOS/Windows) against the # stable compiler — providing the sole CI coverage of the compiler that actually @@ -175,7 +175,7 @@ jobs: # would silently remove coverage of the released compiler channel. - uses: dtolnay/rust-toolchain@stable - uses: Swatinem/rust-cache@v2 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -209,7 +209,7 @@ jobs: # no pre-installed maturin needed. MDS_PYTHON_BIN is set to the exact # executable that owns the installed module so findPythonForMarkdownScript() # picks it up cross-platform (bin/ on Unix, Scripts/ on Windows). - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.11" - name: Install Python binding (CF-SM2 parity surface) @@ -234,10 +234,10 @@ jobs: python-version: ["3.11", "3.13"] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@v2 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} - name: Install test tooling @@ -275,7 +275,7 @@ jobs: name: examples/ gitignore coverage runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@v2 - name: Build mds CLI @@ -327,10 +327,10 @@ jobs: name: Python — wheel install smoke runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@v2 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.11" - name: Install build tooling @@ -369,8 +369,8 @@ jobs: name: Source hygiene runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 22 - name: Scan tracked source for hazardous codepoints @@ -405,7 +405,7 @@ jobs: name: Watch startup race (probe) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@v2 # Scoped to -p mds-cli --test cli_watch: `startup-race-probe` injects a sleep diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 157867d0..e118743a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -36,10 +36,10 @@ jobs: actions: read # CI workflow runs + their jobs, for the CI-history step id-token: write # OIDC for PyPI trusted publisher probe (F5, security-08) steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.ref }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: { node-version: 22, registry-url: "https://registry.npmjs.org" } - name: "Verify publish credentials before irreversible steps (security-08)" env: @@ -300,10 +300,10 @@ jobs: build: napi build --platform --release --target x86_64-pc-windows-msvc --no-js runs-on: ${{ matrix.settings.host }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.ref }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: { node-version: 22, cache: npm } - uses: dtolnay/rust-toolchain@stable with: @@ -369,10 +369,10 @@ jobs: if: ${{ !cancelled() && needs.build-napi.result == 'success' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.ref }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: { node-version: 22, cache: npm } - run: npm ci - name: Download all .node artifacts @@ -461,7 +461,7 @@ jobs: sdist: true runs-on: ${{ matrix.host }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.ref }} # Rust toolchain needed for macOS/Windows wheel builds. Linux legs run @@ -481,7 +481,7 @@ jobs: # --- build wheel --- - name: Build wheel if: ${{ !matrix.sdist }} - uses: PyO3/maturin-action@3e2bdf6ba6453a61e649744019b8a2d906c7eb38 # v1.51.0 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: command: build args: --release --locked --compatibility pypi -m crates/mds-python/Cargo.toml --out dist @@ -491,7 +491,7 @@ jobs: # --- build sdist --- - name: Build sdist if: ${{ matrix.sdist }} - uses: PyO3/maturin-action@3e2bdf6ba6453a61e649744019b8a2d906c7eb38 # v1.51.0 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: command: sdist args: -m crates/mds-python/Cargo.toml --out dist @@ -672,7 +672,7 @@ jobs: if: ${{ !cancelled() && needs.version-gate.result == 'success' && needs.stage-and-verify-napi.result == 'success' && needs.build-python.result == 'success' && startsWith(github.ref, 'refs/tags/v') }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.ref }} - uses: dtolnay/rust-toolchain@stable @@ -755,10 +755,10 @@ jobs: NPM_CONFIG_ACCESS: "public" NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.ref }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -934,7 +934,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.ref }} - name: Create release diff --git a/CHANGELOG.md b/CHANGELOG.md index ff984b37..3186996d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Cargo dependency sweep: napi 3.9.0 → 3.12.2, napi-derive 3.5.6 → 3.6.3, napi-build 2.3.2 → 2.4.1 (napi-sys 3.3.0, napi-derive-backend 6.1.2), pyo3 0.29.0 → 0.29.2, clap 4.6.1 → 4.6.6, similar 3.1.1 → 3.2.0, wasm-bindgen 0.2.121 → 0.2.126 (js-sys 0.3.103, wasm-bindgen-futures 0.4.76, wasm-bindgen-test 0.3.76), serde 1.0.228 → 1.0.229, serde_json 1.0.150 → 1.0.151, thiserror 2.0.18 → 2.0.20, libc 0.2.186 → 0.2.189. Supersedes Dependabot #354 #360 #359 #358 #280 #251 #249 #246 #243. - npm dependency sweep: relaxed the three phantom floor pins to caret ranges — fast-uri 3.1.5 → ^3.1.6 (oldest release patching GHSA-5jgf-p345-68v8, GHSA-fph4-wmhf-6fwf, GHSA-f65p-4m7j-42xc, GHSA-jqff-g426-hqxp), nanoid 3.3.18 → ^3.3.18, js-yaml 4.3.1 → ^4.3.1 (#336); @napi-rs/cli ^3.0.0 → ^3.8.6 (lock 3.7.0 → 3.8.6); vite lock 8.1.5 → 8.2.2; Dependabot `ignore` rules for semver-major bumps of the three phantom pins. Supersedes Dependabot #315 #332 #346 #362 #355 #357 #279. +- GitHub Actions sweep: actions/checkout v6 → v7 (16 call sites: 9 ci.yml + 7 release.yml), actions/setup-node v6 → v7 (6 sites), actions/setup-python v5 → v7 (5 sites, ci.yml only; action runtime node20 → node24), PyO3/maturin-action pin normalized from the v1.51.0 annotated-tag object (`3e2bdf6`) to the commit it points to (`e83996d1`), same version (PF-040); Dependabot `ignore` for typescript semver-major version updates pending the TS 7 migration (#364). Supersedes Dependabot #111, #189, #241, #356; replaces #169. ## [0.4.2] — 2026-09-03