Bump deps + CI actions (consolidate Dependabot #161/163/164) - #167
Merged
Conversation
Consolidate three open Dependabot PRs into one gated PR so the release-hygiene steps they bypass (retch version bump, NOTES/man regen) are performed. No runtime behavior change. - Rust deps (#164, cargo-dependencies group, all patch-level, lockfile-only since the Cargo.toml specs are caret ranges): clap 4.6.1->4.6.4 (pulls syn v3 via clap_builder/clap_derive), serde 1.0.228->1.0.229, toml 1.1.2->1.1.3, clap_complete_nushell 4.6.0->4.6.1, anyhow 1.0.103->1.0.104, libc 0.2.186->0.2.189, sysinfo 0.39.5->0.39.6, serde_json 1.0.150->1.0.151. - actions/checkout 7.0.0->7.0.1 (#163) across benchmark/claude/ claude-code-review/packaging/rust/security (both SHA-pinned and @v7 uses). - softprops/action-gh-release 3.0.1->3.0.2 (#161) in the rust.yml release job. retch-cli -> 0.6.3; retch-sysinfo unchanged (0.1.46, no source change). Workspace fmt/clippy/test all green. Assisted-By: Claude Opus 4.8
This was referenced Jul 24, 2026
l1a
added a commit
that referenced
this pull request
Jul 25, 2026
The one genuinely-new bump from Dependabot #166 (the other 8 crates in that group already landed in #167/v0.6.3). A semver-breaking 0.x bump, held out of the v0.6.3 consolidation pending an API check. No runtime behavior change. base64 is used only under the optional `graphics` feature (src/logo.rs, two general_purpose::STANDARD.encode() sites for the Kitty/iTerm2 inline-image protocol). The Engine encode API is unchanged in 0.23: build + clippy -D warnings are clean *with --features graphics* (the default gate does not compile base64), and tests pass with and without the feature. `cargo bench` is unchanged (base64 is not on any benchmarked path). Widened the Cargo.toml spec "0.22" -> "0.23" since the caret range wouldn't admit 0.23. retch-cli -> 0.6.4; retch-sysinfo unchanged (0.1.46). Assisted-By: Claude Opus 4.8
This was referenced Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the three open Dependabot PRs (#161, #163, #164) into a single gated PR
so the release-hygiene steps Dependabot bypasses —
retchversion bump,NOTES.md, man-pageregen — are actually performed. No runtime behavior change.
Rust dependencies (#164 —
cargo-dependenciesgroup)All patch-level and lockfile-only (the
Cargo.tomlspecs are caret ranges, so nomanifest edit was needed — applied with
cargo update -p …):(clap 4.6.4 pulls
synv3 viaclap_builder/clap_derive— transitive.)GitHub Actions
actions/checkout7.0.0 → 7.0.1 (ci(deps): bump actions/checkout from 7.0.0 to 7.0.1 #163) — both the SHA-pinned uses(packaging/rust/security) and the
@v7→@v7.0.1tag uses(benchmark/claude/claude-code-review). Applied via
gh pr diff 163 | git applytoreproduce Dependabot's exact SHA/tag changes.
softprops/action-gh-release3.0.1 → 3.0.2 (ci(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 #161) — rust.yml release job.Versioning
retch-cli→ 0.6.3;retch-sysinfounchanged (0.1.46— no source change, only itstransitive lockfile deps moved).
Test plan
cargo test --workspace— all green (40/15/92).cargo fmt --checkandcargo clippy --workspace -- -D warnings— clean.just manregenerated (retch 0.6.3footer, single-bold, no drift).Follow-up
Once merged, close #161/#163/#164 as superseded with a note that they were rolled into
this PR (so Dependabot doesn't keep re-proposing them).
Checklist notes
just-recipe change.🤖 Generated with Claude Code