From fb9bae3dd82733df8301b1b0761ba38193d1cbc8 Mon Sep 17 00:00:00 2001 From: DoubleGate Date: Mon, 3 Aug 2026 15:09:42 -0400 Subject: [PATCH] chore(deps): consolidate Dependabot #336-#338 into one PR (4 bumps) Roll the three currently-open Dependabot PRs into a single change so they land and close together instead of as three separate merges, matching this repo's standing "master Dependabot consolidation" practice. Cargo (production-dependencies group, #338): - wide 1.5.0 -> 1.6.0 (SIMD; used by the frontend software blitter) - clap_complete 4.6.7 -> 4.6.8 (CLI shell-completion generation) Cargo.lock is taken verbatim from Dependabot's #338 so the diff is exactly the four version+checksum lines and nothing else. A local `cargo update -p clap_complete --precise 4.6.8` additionally re-resolved four transitive `windows-sys` references off 0.61.2 (down to 0.52.0/0.48.0) -- a valid but non-minimal churn cargo does opportunistically against a newer registry index; Dependabot's own lockfile does NOT do this (clap 4.6.8 does not require it), and agy's review flagged the drift, so the minimal lockfile is used instead. `cargo metadata --locked` accepts it, so it is consistent with the manifest with zero re-resolution. GitHub Actions: - taiki-e/install-action v2 -> v2.85.5 (#337) -- both call sites in .github/workflows/security.yml (the cargo-audit and cargo-deny jobs, which install the prebuilt binaries rather than compiling them under the 1.96 pin). - gradle/actions/setup-gradle v6 -> v6.2.0 (#336) -- the Android foss+play bundle job in .github/workflows/android.yml. Both move from a floating `@vN` major tag to the exact patch Dependabot pins; Dependabot's github-actions ecosystem then tracks them forward. (agy suggested SHA-pinning; declined -- the repo deliberately keeps `@vN` tags for every action except the compiler-installing dtolnay/rust-toolchain, a documented maintenance-policy choice.) Verification: - Cargo.lock diff == Dependabot #338 (wide + clap_complete only, no windows-sys or other transitive churn); `cargo metadata --locked` clean. - `cargo check --workspace` compiles the full graph on the new lockfile. - `cargo build -p rustynes-core --target thumbv7em-none-eabihf --no-default-features` -- the standalone no_std build a full workspace build masks (the lz4_flex-0.14 lesson) -- stays green. - Both edited workflows parse as valid YAML. Supersedes #336, #337, #338 (closed in favour of this consolidated PR). Co-Authored-By: Claude Opus 4.8 --- .github/workflows/android.yml | 2 +- .github/workflows/security.yml | 4 ++-- Cargo.lock | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index ff490e9c..9c4e286e 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -122,7 +122,7 @@ jobs: java-version: '17' - name: Resolve NDK run: echo "ANDROID_NDK_HOME=$ANDROID_NDK_LATEST_HOME" >> "$GITHUB_ENV" - - uses: gradle/actions/setup-gradle@v6 + - uses: gradle/actions/setup-gradle@v6.2.0 with: # v6 extracted the default ("enhanced") Gradle User Home cache into the # closed-source `gradle-actions-caching` library (separate Terms of Use). diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 6ddf4cad..e010186d 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -60,7 +60,7 @@ jobs: # cargo-audit release needs >= 1.88 to COMPILE. The prebuilt binary RUNS # fine under any toolchain — it only parses Cargo.lock, it never compiles # the project — so the toolchain pin is irrelevant to it. - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@v2.85.5 with: tool: cargo-audit - run: cargo audit @@ -75,7 +75,7 @@ jobs: # Prebuilt binary for the same reason as the audit job: the latest # cargo-deny needs rustc >= 1.88 to build from source, while the repo is # pinned to 1.96. Policy lives in `deny.toml`. - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@v2.85.5 with: tool: cargo-deny - run: cargo deny check diff --git a/Cargo.lock b/Cargo.lock index 3c9a0dfb..922924d4 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -706,9 +706,9 @@ dependencies = [ [[package]] name = "clap_complete" -version = "4.6.7" +version = "4.6.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "db8b397918185f0161ff3d6fcaa9e4bfc09b8367caf6e1d4a2848e5477ed027b" +checksum = "b1f84a88507dbd05c695f2cb5e8558e747179134005e9893882dec964190ed89" dependencies = [ "clap", ] @@ -6238,9 +6238,9 @@ dependencies = [ [[package]] name = "wide" -version = "1.5.0" +version = "1.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dfdfe6a32973f2d1b268b8895845a8a96cac2f0191e72c27cc929036060dbf89" +checksum = "be99e8317aa9f08e7d16e13033ca43faab59ab582b1d0feab7b385424c42f8b1" dependencies = [ "bytemuck", "safe_arch",