Skip to content

chore(deps)(deps): bump the production-dependencies group with 2 updates - #338

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/production-dependencies-cd40943762
Closed

chore(deps)(deps): bump the production-dependencies group with 2 updates#338
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/production-dependencies-cd40943762

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 2 updates: wide and clap_complete.

Updates wide from 1.5.0 to 1.6.0

Changelog

Sourced from wide's changelog.

1.6.0

  • Potential Change: i64xN functions to_bitmask, any, all and none no longer guarantee that the sign-bit is used to decide whether an element is considered "true" or "false". This is being counted as a "bug" in the docs for previously being too specific.
  • Added cast functions cast_unsigned, cast_signed, to_bits, from_bits.
  • Added u8x32/i8x32 swizzle and swizzle_relaxed: a full-width 32-entry byte table lookup (vpermb on AVX-512-VBMI, vqtbl2 on NEON, emulated on AVX2/SSSE3).
  • Fixed i8x32/u8x32 swizzle_half on AVX2: out-of-range indices now correctly zero their output lane (previously leaked self[..][0]).
  • Made to_array, as_array and as_mut_array available in const contexts.
  • Added four unbounded-shift functions for integers.
  • Renamed float function pow_{simd-type-name} to powf_simd and deprecated powf.
  • Added conversions between wide types and native intrinsics SIMD types.
  • Added reduce_mul for integers.
  • Added integer functions reduce_mul and mul_keep_low_high.
  • Added overflowing arithmetic for integers.
  • Added float function round_ties_even.
  • Fixed bugs in the fallback paths of any, all, none and fast_clamp.
  • Added support for shifting SIMD vectors by values of isize and usize and SIMD vectors of "opposite-signedness".
  • Deprecated blend and replaced it with select and bitselect.
  • Fixed bug in powf.
  • Fixed clamp and added guarantees for fast_clamp.
  • Added small optimizations to saturating_add/sub.
  • Fixed shift operators overflow behavior.
  • Fixed round which previously behaved like round_ties_even.
  • Fixed UpperExp formatting for floats.
  • Renamed integer function mul_widen to widening_mul and added it for remaining types.
  • Added integer function mul_keep_high for remaining types.
  • Added missing #[must_use] annotations
  • Updated documenattion.
Commits

Updates clap_complete from 4.6.7 to 4.6.8

Commits
  • d93a00d chore: Release
  • 4709d1a docs(complete): Update changelog
  • 2246e8b Merge pull request #6455 from epage/possible
  • 2550f32 feat(complete): Expose possible value completers
  • 9048857 refactor(complete): Pull out possible values candidate conversion
  • 0607d66 refactor(complete): Remove unused allocation
  • 943de73 refactor(complete): Move related functions next to each other
  • 81b86a9 refactor(complete): Generalize value candidate handling
  • ae09202 refactor(complete): Remove extra allocation
  • 466b2be chore: Release
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-dependencies group with 2 updates: [wide](https://github.com/Lokathor/wide) and [clap_complete](https://github.com/clap-rs/clap).


Updates `wide` from 1.5.0 to 1.6.0
- [Changelog](https://github.com/Lokathor/wide/blob/main/changelog.md)
- [Commits](Lokathor/wide@v1.5.0...v1.6.0)

Updates `clap_complete` from 4.6.7 to 4.6.8
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.7...clap_complete-v4.6.8)

---
updated-dependencies:
- dependency-name: wide
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: clap_complete
  dependency-version: 4.6.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates rust Rust / cargo dependencies labels Aug 3, 2026
@dependabot
dependabot Bot requested a review from doublegate as a code owner August 3, 2026 10:11
@dependabot dependabot Bot added dependencies Dependency updates rust Rust / cargo dependencies labels Aug 3, 2026
@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock, !Cargo.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c7db323d-91ba-4e84-8c0b-f11bed8397de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

Antigravity review (Gemini via Ultra)

This PR updates Cargo.lock to bump clap_complete from 4.6.7 to 4.6.8 and wide from 1.5.0 to 1.6.0.

Blocking issues

None found.

Suggestions

  • Ensure the full test suite and any relevant SIMD/numerical benchmarks are executed to verify that upgrading wide across a minor version boundary (1.5.0 to 1.6.0) causes no performance regressions or subtle behavior changes.

Nitpicks

  • Fix the duplicate scope prefix in the PR title (chore(deps)(deps)).

Automated first-pass review by agy on a self-hosted runner -- not a human review.

@doublegate

Copy link
Copy Markdown
Owner

Superseded by #340, which consolidates this bump together with the other two open Dependabot PRs (#336 gradle/actions, #337 taiki-e/install-action, #338 wide + clap_complete) into a single reviewed-and-verified change. Closing in favour of that consolidated PR.

@doublegate doublegate closed this Aug 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/cargo/production-dependencies-cd40943762 branch August 3, 2026 19:10
doublegate added a commit that referenced this pull request Aug 3, 2026
Roll the three currently-open Dependabot PRs into a single change so they
land and close together instead of as three separate merges, matching this
repo's standing "master Dependabot consolidation" practice.

Cargo (production-dependencies group, #338):
  - wide          1.5.0 -> 1.6.0  (SIMD; used by the frontend software blitter)
  - clap_complete 4.6.7 -> 4.6.8  (CLI shell-completion generation)
  Cargo.lock is taken verbatim from Dependabot's #338 so the diff is exactly
  the four version+checksum lines and nothing else. A local
  `cargo update -p clap_complete --precise 4.6.8` additionally re-resolved
  four transitive `windows-sys` references off 0.61.2 (down to 0.52.0/0.48.0)
  -- a valid but non-minimal churn cargo does opportunistically against a
  newer registry index; Dependabot's own lockfile does NOT do this (clap
  4.6.8 does not require it), and agy's review flagged the drift, so the
  minimal lockfile is used instead. `cargo metadata --locked` accepts it, so
  it is consistent with the manifest with zero re-resolution.

GitHub Actions:
  - taiki-e/install-action  v2 -> v2.85.5  (#337) -- both call sites in
    .github/workflows/security.yml (the cargo-audit and cargo-deny jobs,
    which install the prebuilt binaries rather than compiling them under
    the 1.96 pin).
  - gradle/actions/setup-gradle  v6 -> v6.2.0  (#336) -- the Android
    foss+play bundle job in .github/workflows/android.yml.
  Both move from a floating `@vN` major tag to the exact patch Dependabot
  pins; Dependabot's github-actions ecosystem then tracks them forward.
  (agy suggested SHA-pinning; declined -- the repo deliberately keeps `@vN`
  tags for every action except the compiler-installing
  dtolnay/rust-toolchain, a documented maintenance-policy choice.)

Verification:
  - Cargo.lock diff == Dependabot #338 (wide + clap_complete only, no
    windows-sys or other transitive churn); `cargo metadata --locked` clean.
  - `cargo check --workspace` compiles the full graph on the new lockfile.
  - `cargo build -p rustynes-core --target thumbv7em-none-eabihf
    --no-default-features` -- the standalone no_std build a full workspace
    build masks (the lz4_flex-0.14 lesson) -- stays green.
  - Both edited workflows parse as valid YAML.

Supersedes #336, #337, #338 (closed in favour of this consolidated PR).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
doublegate added a commit that referenced this pull request Aug 3, 2026
…340)

Roll the three currently-open Dependabot PRs into a single change so they
land and close together instead of as three separate merges, matching this
repo's standing "master Dependabot consolidation" practice.

Cargo (production-dependencies group, #338):
  - wide          1.5.0 -> 1.6.0  (SIMD; used by the frontend software blitter)
  - clap_complete 4.6.7 -> 4.6.8  (CLI shell-completion generation)
  Cargo.lock is taken verbatim from Dependabot's #338 so the diff is exactly
  the four version+checksum lines and nothing else. A local
  `cargo update -p clap_complete --precise 4.6.8` additionally re-resolved
  four transitive `windows-sys` references off 0.61.2 (down to 0.52.0/0.48.0)
  -- a valid but non-minimal churn cargo does opportunistically against a
  newer registry index; Dependabot's own lockfile does NOT do this (clap
  4.6.8 does not require it), and agy's review flagged the drift, so the
  minimal lockfile is used instead. `cargo metadata --locked` accepts it, so
  it is consistent with the manifest with zero re-resolution.

GitHub Actions:
  - taiki-e/install-action  v2 -> v2.85.5  (#337) -- both call sites in
    .github/workflows/security.yml (the cargo-audit and cargo-deny jobs,
    which install the prebuilt binaries rather than compiling them under
    the 1.96 pin).
  - gradle/actions/setup-gradle  v6 -> v6.2.0  (#336) -- the Android
    foss+play bundle job in .github/workflows/android.yml.
  Both move from a floating `@vN` major tag to the exact patch Dependabot
  pins; Dependabot's github-actions ecosystem then tracks them forward.
  (agy suggested SHA-pinning; declined -- the repo deliberately keeps `@vN`
  tags for every action except the compiler-installing
  dtolnay/rust-toolchain, a documented maintenance-policy choice.)

Verification:
  - Cargo.lock diff == Dependabot #338 (wide + clap_complete only, no
    windows-sys or other transitive churn); `cargo metadata --locked` clean.
  - `cargo check --workspace` compiles the full graph on the new lockfile.
  - `cargo build -p rustynes-core --target thumbv7em-none-eabihf
    --no-default-features` -- the standalone no_std build a full workspace
    build masks (the lz4_flex-0.14 lesson) -- stays green.
  - Both edited workflows parse as valid YAML.

Supersedes #336, #337, #338 (closed in favour of this consolidated PR).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates rust Rust / cargo dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant