Skip to content

chore(deps): update dtolnay/rust-toolchain requirement to 2fe4ca74464c5902a4f6e302d0a619b4ea911ccc - #99

Closed
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/dtolnay/rust-toolchain-2fe4ca74464c5902a4f6e302d0a619b4ea911ccc
Closed

chore(deps): update dtolnay/rust-toolchain requirement to 2fe4ca74464c5902a4f6e302d0a619b4ea911ccc#99
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/dtolnay/rust-toolchain-2fe4ca74464c5902a4f6e302d0a619b4ea911ccc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on dtolnay/rust-toolchain to permit the latest version.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 23, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 23, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/dtolnay/rust-toolchain-2fe4ca74464c5902a4f6e302d0a619b4ea911ccc branch 2 times, most recently from 92850d3 to ae2702b Compare July 23, 2026 09:13
…c5902a4f6e302d0a619b4ea911ccc

Updates the requirements on [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) to permit the latest version.
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](https://github.com/dtolnay/rust-toolchain/commits/2fe4ca74464c5902a4f6e302d0a619b4ea911ccc)

---
updated-dependencies:
- dependency-name: dtolnay/rust-toolchain
  dependency-version: 2fe4ca74464c5902a4f6e302d0a619b4ea911ccc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/dtolnay/rust-toolchain-2fe4ca74464c5902a4f6e302d0a619b4ea911ccc branch from ae2702b to 4fa98db Compare July 23, 2026 09:19
…hain-2fe4ca74464c5902a4f6e302d0a619b4ea911ccc
…hain-2fe4ca74464c5902a4f6e302d0a619b4ea911ccc
@tonibergholm

Copy link
Copy Markdown
Member

Closing: the new SHA 2fe4ca74 is the head of dtolnay/rust-toolchain's 1.96.1 branch, not the nightly tag — this action encodes the toolchain in the pinned ref, so merging would silently swap the fuzz workflow's nightly toolchain for stable 1.96.1 while the # nightly comment stayed. (The fuzz check only passed because RUSTUP_TOOLCHAIN: nightly makes rustup auto-install nightly, bypassing the pin.) Toolchain pins here are bumped intentionally; a follow-up PR extends the dependabot ignore to all update-types for this action.

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/github_actions/dtolnay/rust-toolchain-2fe4ca74464c5902a4f6e302d0a619b4ea911ccc branch July 23, 2026 09:39
tonibergholm added a commit that referenced this pull request Jul 23, 2026
The action encodes the toolchain in the pinned ref, so any automated
ref update can silently change which toolchain a workflow installs —
PR #99 would have swapped the fuzz workflow's nightly pin for the
1.96.1 branch head. The previous semver-major-only ignore didn't catch
that because branch-tracking ref updates aren't semver. Toolchain pins
stay a deliberate, manual bump.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants