chore(deps)(deps): bump the production-dependencies group with 2 updates - #338
chore(deps)(deps): bump the production-dependencies group with 2 updates#338dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the production-dependencies group with 2 updates: [wide](https://github.com/Lokathor/wide) and [clap_complete](https://github.com/clap-rs/clap). Updates `wide` from 1.5.0 to 1.6.0 - [Changelog](https://github.com/Lokathor/wide/blob/main/changelog.md) - [Commits](Lokathor/wide@v1.5.0...v1.6.0) Updates `clap_complete` from 4.6.7 to 4.6.8 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](clap-rs/clap@clap_complete-v4.6.7...clap_complete-v4.6.8) --- updated-dependencies: - dependency-name: wide dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: clap_complete dependency-version: 4.6.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Antigravity review (Gemini via Ultra)This PR updates Blocking issuesNone found. Suggestions
Nitpicks
Automated first-pass review by |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
Roll the three currently-open Dependabot PRs into a single change so they land and close together instead of as three separate merges, matching this repo's standing "master Dependabot consolidation" practice. Cargo (production-dependencies group, #338): - wide 1.5.0 -> 1.6.0 (SIMD; used by the frontend software blitter) - clap_complete 4.6.7 -> 4.6.8 (CLI shell-completion generation) Cargo.lock is taken verbatim from Dependabot's #338 so the diff is exactly the four version+checksum lines and nothing else. A local `cargo update -p clap_complete --precise 4.6.8` additionally re-resolved four transitive `windows-sys` references off 0.61.2 (down to 0.52.0/0.48.0) -- a valid but non-minimal churn cargo does opportunistically against a newer registry index; Dependabot's own lockfile does NOT do this (clap 4.6.8 does not require it), and agy's review flagged the drift, so the minimal lockfile is used instead. `cargo metadata --locked` accepts it, so it is consistent with the manifest with zero re-resolution. GitHub Actions: - taiki-e/install-action v2 -> v2.85.5 (#337) -- both call sites in .github/workflows/security.yml (the cargo-audit and cargo-deny jobs, which install the prebuilt binaries rather than compiling them under the 1.96 pin). - gradle/actions/setup-gradle v6 -> v6.2.0 (#336) -- the Android foss+play bundle job in .github/workflows/android.yml. Both move from a floating `@vN` major tag to the exact patch Dependabot pins; Dependabot's github-actions ecosystem then tracks them forward. (agy suggested SHA-pinning; declined -- the repo deliberately keeps `@vN` tags for every action except the compiler-installing dtolnay/rust-toolchain, a documented maintenance-policy choice.) Verification: - Cargo.lock diff == Dependabot #338 (wide + clap_complete only, no windows-sys or other transitive churn); `cargo metadata --locked` clean. - `cargo check --workspace` compiles the full graph on the new lockfile. - `cargo build -p rustynes-core --target thumbv7em-none-eabihf --no-default-features` -- the standalone no_std build a full workspace build masks (the lz4_flex-0.14 lesson) -- stays green. - Both edited workflows parse as valid YAML. Supersedes #336, #337, #338 (closed in favour of this consolidated PR). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…340) Roll the three currently-open Dependabot PRs into a single change so they land and close together instead of as three separate merges, matching this repo's standing "master Dependabot consolidation" practice. Cargo (production-dependencies group, #338): - wide 1.5.0 -> 1.6.0 (SIMD; used by the frontend software blitter) - clap_complete 4.6.7 -> 4.6.8 (CLI shell-completion generation) Cargo.lock is taken verbatim from Dependabot's #338 so the diff is exactly the four version+checksum lines and nothing else. A local `cargo update -p clap_complete --precise 4.6.8` additionally re-resolved four transitive `windows-sys` references off 0.61.2 (down to 0.52.0/0.48.0) -- a valid but non-minimal churn cargo does opportunistically against a newer registry index; Dependabot's own lockfile does NOT do this (clap 4.6.8 does not require it), and agy's review flagged the drift, so the minimal lockfile is used instead. `cargo metadata --locked` accepts it, so it is consistent with the manifest with zero re-resolution. GitHub Actions: - taiki-e/install-action v2 -> v2.85.5 (#337) -- both call sites in .github/workflows/security.yml (the cargo-audit and cargo-deny jobs, which install the prebuilt binaries rather than compiling them under the 1.96 pin). - gradle/actions/setup-gradle v6 -> v6.2.0 (#336) -- the Android foss+play bundle job in .github/workflows/android.yml. Both move from a floating `@vN` major tag to the exact patch Dependabot pins; Dependabot's github-actions ecosystem then tracks them forward. (agy suggested SHA-pinning; declined -- the repo deliberately keeps `@vN` tags for every action except the compiler-installing dtolnay/rust-toolchain, a documented maintenance-policy choice.) Verification: - Cargo.lock diff == Dependabot #338 (wide + clap_complete only, no windows-sys or other transitive churn); `cargo metadata --locked` clean. - `cargo check --workspace` compiles the full graph on the new lockfile. - `cargo build -p rustynes-core --target thumbv7em-none-eabihf --no-default-features` -- the standalone no_std build a full workspace build masks (the lz4_flex-0.14 lesson) -- stays green. - Both edited workflows parse as valid YAML. Supersedes #336, #337, #338 (closed in favour of this consolidated PR). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Bumps the production-dependencies group with 2 updates: wide and clap_complete.
Updates
widefrom 1.5.0 to 1.6.0Changelog
Sourced from wide's changelog.
Commits
3900d88chore: Release wide version 1.6.0e45d333chaning the log67bd74bUpdate LICENSE-ZLIB.txt7f3a28cUpdate LICENSE-ZLIB.txt32cd7e9Rename LICENSE-ZLIB.md to LICENSE-ZLIB.txt0b5902fRename LICENSE-APACHE to LICENSE-APACHE.txtad63445Rename LICENSE-MIT to LICENSE-MIT.txtbaa4749Add LICENSE-APACHE and LICENSE-MIT (refs Lokathor/wide#301) (#302)c60323ddocs: Add documentation for everything (#286)9f84ed1Add the functions (#299)Updates
clap_completefrom 4.6.7 to 4.6.8Commits
d93a00dchore: Release4709d1adocs(complete): Update changelog2246e8bMerge pull request #6455 from epage/possible2550f32feat(complete): Expose possible value completers9048857refactor(complete): Pull out possible values candidate conversion0607d66refactor(complete): Remove unused allocation943de73refactor(complete): Move related functions next to each other81b86a9refactor(complete): Generalize value candidate handlingae09202refactor(complete): Remove extra allocation466b2bechore: ReleaseDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions