chore(deps): bump rustls-webpki from 0.103.10 to 0.103.13 in /src-tauri#4
Merged
Merged
Conversation
Bumps [rustls-webpki](https://github.com/rustls/webpki) from 0.103.10 to 0.103.13. - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.10...v/0.103.13) --- updated-dependencies: - dependency-name: rustls-webpki dependency-version: 0.103.13 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
deleted the
dependabot/cargo/src-tauri/rustls-webpki-0.103.13
branch
t41372
added a commit
that referenced
this pull request
May 22, 2026
… i18n
Why
- Codex review flagged three Blocking/High issues against feat/v0.3-redesign-2:
(1) the ⌘K palette in shell.tsx sent `{ search, limit, offset }` to
query_history and tried to read `response.rows`, but the real
contract is `{ q, page, cursor, ... }` returning `items`. Result:
palette searches were silently empty on desktop, and the existing
tests had been mocking the wrong shape.
(2) Paper UI still leaked raw English copy (char/chars counter, "Remove
tag {tag}" aria, "Calendar" dialog label, "now"/"first" year-rail
footers, dashboard greetings). i18n is a shipping contract, not
polish.
(3) Theme was held twice — once by the shell as a private useState,
once by Settings → Appearance via applyPaperPreferences. Toggling
one didn't update the other, so the buttons drifted.
What
- shell.tsx: palette now calls `backend.queryHistory({ q, limit, sort })`
and maps `response.items` with the real HistoryEntry shape (id/url/
domain/title/visitedAt/visitTime). Removed the orphan PaletteRow
interface. shell.test.tsx mocks `backend.queryHistory` with valid
HistoryQueryResponse fixtures instead of the legacy rows shape.
- i18n: added 3-language entries for the paper detail panel's char
counter (singular + plural template), the remove-tag aria label, the
calendar dialog aria, the year-rail now/first footer captions, and
the dashboard morning/afternoon/evening greetings. The dashboard's
hand-rolled greeting map is gone — it now reads
`dashboard.greetingMorning/Afternoon/Evening` like every other copy
in that route. PaperDetailPanelCopy + PaperCalendarPopoverCopy +
PaperYearRailProps + paper-view.tsx copy interface all gained the
new keys; buildPaperDetailPanelCopy + buildPaperContactSheetCopy
thread them through. i18n parity 100% (2798 keys × 3 locales).
- paper-preferences.ts: applyPaperPreferences now dispatches a
`pathkeep.paperPreferencesChanged` CustomEvent (with the resolved
preferences in `detail.preferences`) after applying + persisting.
shell.tsx subscribes to that event so the topbar theme button stays
in sync with Settings → Appearance toggles; settings/appearance-
section.tsx subscribes too so flipping theme via the shell button
updates the radio without re-mount. shell.tsx's handleToggleTheme
now routes through applyPaperPreferences instead of mutating a
private useState — single source of truth, one persist call.
Context
- Codex findings #1, #5, #6. Findings #2 (paper pagination), #3
(og:image fetch trigger), #4 (coverage gate restoration) tracked
separately and remain pending in BACKLOG.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
t41372
added a commit
that referenced
this pull request
May 22, 2026
…age gate
Why
- Codex review flagged three more issues:
(2) Paper Explorer Browse exposed no pagination — the underlying
useExplorerUrlState had `goToHistoryPage` / `setHistoryPageSize`
handlers, but the paper UI dropped them. For a 1440 M-row archive
this caps the user at the first response page (≤200 rows).
(3) Card-mode og:image cache only loaded existing rows — there was no
production path that enqueued a fetch for cache-miss URLs, so a
fresh archive permanently rendered favicons.
(4) `check:coverage` ran `coverage:rust:quality` (a triage slice) not
the accepted full-scope `coverage:rust`. That's an unauthorised
gate weakening vs. docs/plan/program/quality-matrix.md.
What
- PaperContactSheet: new optional `pagination` prop renders a footer
with newer/older buttons (paper goes newest → oldest, so "next" is
the older direction), a "page X of Y · N rows" summary, and a
rows-per-page selector. Disabled buttons clamp at archive bounds.
Footer omitted entirely when route doesn't supply pagination (e.g.
the day-only insight surface).
- PaperExplorerView + Explorer route: thread the new pagination
descriptor through from useExplorerUrlState's existing
handleNextHistoryPage / handlePreviousHistoryPage / setHistoryPageSize
handlers. `visibleTimeResults` carries the authoritative page /
pageCount / total / hasNext / hasPrevious; the footer reads them.
- i18n: 5 new keys across all three locales — paginationOlder, Newer,
Summary, SummaryPending, PageSizeLabel. 2803 keys × 3 locales,
parity 100%.
- use-explorer-og-images.ts: after `loadHistoryOgImages` resolves,
the hook now diffs the response and enqueues
`triggerOgImageRefetch(batch)` for URLs that came back with a
non-`ok` status (missing or never-cached). Bounded at 20 URLs per
render so the worker pool can't be stampeded; `enqueuedFetchRef`
prevents re-enqueuing within the same cache epoch. The promise's
.catch swallows rate-limit / disabled-fetch rejections silently —
the Rust worker persists negative-cache rows on its own.
- og_images_fetch.rs: extracted `read_capped_bytes<R: Read>` from
`read_response_body` so the body-read fall-throughs (Io error,
TooLarge) can be unit-tested directly with synthetic Read impls,
closing line 336 of the production source. Three new cargo tests:
errors-mid-stream → Io, oversize → TooLarge, short stream → Ok.
- package.json: check:coverage now calls `coverage:rust` (full
scope), not the `:quality` triage slice. The Rust full gate still
has ~20 uncovered defensive lines (worker pool mutex poison,
sender disconnect, mid-stream Io in the live HTTP pipeline) — those
surface on `bun run check` so a release gate failure is honest.
Coverage delta
- JS: unchanged at 99.71 stmts / 98.89 branches / 99.77 funcs /
99.89 lines (existing threshold still 99/99/98/99 pending the
separate JS residual sweep).
- Rust full scope: 12 → 7 uncovered lines in og_images_fetch.rs.
archive_flows.rs worker pool internals (13 lines) still need an
integration harness — tracked in WORK-V03-RUST-COVERAGE-RESIDUAL.
Context
- Codex findings #2, #3, #4. Codex flagged the gate-weakening change
as a merge blocker — the check:coverage script is now restored to
full coverage. The remaining residual is documented in BACKLOG and
the gate fails until it closes, which matches the codex requirement
of "merge 前必須恢復".
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
t41372
added a commit
that referenced
this pull request
May 22, 2026
Why - Codex review on 2026-05-21 raised six findings against feat/v0.3-redesign-2. Five are now closed (palette contract, i18n raw copy, theme dual state, paper pagination, og:image fetch trigger); the gate-restoration finding stays blocked until the Rust line residual closes. Document the closeouts + the remaining residual shape so the next session can pick up cleanly. What - BACKLOG: new WORK-V03-CODEX-REVIEW-FOLLOWUP block with per-finding status, commit references, and the explicit "merge blocker" call-out on #4 (full coverage gate restoration). - WORK-V03-RUST-COVERAGE-RESIDUAL: updated with this session's progress (check:coverage restored to coverage:rust full, annotations 4 lines closed, og_images.rs row-mapper closure now exercised, og_images_fetch utf8 + absolutize + read_capped_bytes extractions). Residual list refreshed to the current line numbers: 7 in og_images_fetch + 13 in archive_flows worker pool internals. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps rustls-webpki from 0.103.10 to 0.103.13.
Release notes
Sourced from rustls-webpki's releases.
Commits
2879b2cPrepare 0.103.132c49773Improve tests for padding ofBitStringFlags4e3c0b3Correct validation of BIT STRING constraints39c91d2Actually fail closed for URI matching against excluded subtrees27131d4Bump version to 0.103.126ecb876Clean up stuttery enum variant names318b3e6Ignore wildcard labels when matching name constraints1219622Rewrite constraint matching to avoid permissive catch-all branch57bc62cBump version to 0.103.11d0fa01eAllow parsing trust anchors with unknown criticial extensionsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.