Repository navigation
chore(deps): bump the rust-dependencies group with 5 updates - #2431
Merged
Merged
Conversation
Bumps the rust-dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [clap](https://github.com/clap-rs/clap) | `4.6.6` | `4.6.7` | | [napi](https://github.com/napi-rs/napi-rs) | `3.12.4` | `3.12.6` | | [napi-derive](https://github.com/napi-rs/napi-rs) | `3.6.5` | `3.6.7` | | [napi-build](https://github.com/napi-rs/napi-rs) | `2.4.2` | `2.4.4` | | [syn](https://github.com/dtolnay/syn) | `3.0.5` | `3.0.6` | Updates `clap` from 4.6.6 to 4.6.7 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md) - [Commits](clap-rs/clap@clap_complete-v4.6.6...clap_complete-v4.6.7) Updates `napi` from 3.12.4 to 3.12.6 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-v3.12.4...napi-v3.12.6) Updates `napi-derive` from 3.6.5 to 3.6.7 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-derive-v3.6.5...napi-derive-v3.6.7) Updates `napi-build` from 2.4.2 to 2.4.4 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-build-v2.4.2...napi-build-v2.4.4) Updates `syn` from 3.0.5 to 3.0.6 - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](dtolnay/syn@3.0.5...3.0.6) --- updated-dependencies: - dependency-name: clap dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi dependency-version: 3.12.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi-derive dependency-version: 3.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi-build dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: syn dependency-version: 3.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 954a3e6 | Commit Preview URL Branch Preview URL |
Sep 21 2026, 11:29 PM |
chaliy
added a commit
that referenced
this pull request
Sep 29, 2026
The group bump left seven versions unvetted and the Audit job failing. Reviewed each delta against the published sources and recorded a delta audit, following the precedent set in #2431. napi 3.12.7 -> 3.13.0 is the only substantive one, and it tightens safety: External<T> now consults a native-payload registry before casting the tagged object, so what used to be an unchecked cast into a type-confusion is an InvalidArg error, and a failed napi_wrap no longer leaks obj_ptr/size_hint_ptr. The rest of its additions are the wasm-only two-phase env-cleanup exports. New unsafe stays inside the existing NAPI FFI idiom, and the only std::process uses are abort() guards against unwinding across the FFI boundary. The other six are small: rand 0.10.3 replaces panics with errors in WeightedIndex and Uniform; thiserror-impl tracks turbofish depth while scanning display attributes; tokio-test fixes a TOCTOU race in Mock::poll_write; napi-build only prints cargo directives; napi-derive and thiserror have no functional source change. None adds unsafe, fs, net, or ambient access. Before: "Vetting Failed! 7 unvetted dependencies". After: "Vetting Succeeded (26 fully audited, 67 partially audited, 523 exempted)". Claude-Session: https://claude.ai/code/session_01DyKfW3rVZUrUKzrCLpurco
chaliy
added a commit
that referenced
this pull request
Sep 29, 2026
The group bump left seven versions unvetted and the Audit job failing. Reviewed each delta against the published sources and recorded a delta audit, following the precedent set in #2431. napi 3.12.7 -> 3.13.0 is the only substantive one, and it tightens safety: External<T> now consults a native-payload registry before casting the tagged object, so what used to be an unchecked cast into a type-confusion is an InvalidArg error, and a failed napi_wrap no longer leaks obj_ptr/size_hint_ptr. The rest of its additions are the wasm-only two-phase env-cleanup exports. New unsafe stays inside the existing NAPI FFI idiom, and the only std::process uses are abort() guards against unwinding across the FFI boundary. The other six are small: rand 0.10.3 replaces panics with errors in WeightedIndex and Uniform; thiserror-impl tracks turbofish depth while scanning display attributes; tokio-test fixes a TOCTOU race in Mock::poll_write; napi-build only prints cargo directives; napi-derive and thiserror have no functional source change. None adds unsafe, fs, net, or ambient access. Before: "Vetting Failed! 7 unvetted dependencies". After: "Vetting Succeeded (26 fully audited, 67 partially audited, 523 exempted)". Claude-Session: https://claude.ai/code/session_01DyKfW3rVZUrUKzrCLpurco
chaliy
added a commit
that referenced
this pull request
Sep 29, 2026
The group bump left seven versions unvetted and the Audit job failing. Reviewed each delta against the published sources and recorded a delta audit, following the precedent set in #2431. napi 3.12.7 -> 3.13.0 is the only substantive one, and it tightens safety: External<T> now consults a native-payload registry before casting the tagged object, so what used to be an unchecked cast into a type-confusion is an InvalidArg error, and a failed napi_wrap no longer leaks obj_ptr/size_hint_ptr. The rest of its additions are the wasm-only two-phase env-cleanup exports. New unsafe stays inside the existing NAPI FFI idiom, and the only std::process uses are abort() guards against unwinding across the FFI boundary. The other six are small: rand 0.10.3 replaces panics with errors in WeightedIndex and Uniform; thiserror-impl tracks turbofish depth while scanning display attributes; tokio-test fixes a TOCTOU race in Mock::poll_write; napi-build only prints cargo directives; napi-derive and thiserror have no functional source change. None adds unsafe, fs, net, or ambient access. Before: "Vetting Failed! 7 unvetted dependencies". After: "Vetting Succeeded (26 fully audited, 67 partially audited, 523 exempted)". Claude-Session: https://claude.ai/code/session_01DyKfW3rVZUrUKzrCLpurco
chaliy
added a commit
that referenced
this pull request
Sep 29, 2026
The group bump left seven versions unvetted and the Audit job failing. Reviewed each delta against the published sources and recorded a delta audit, following the precedent set in #2431. napi 3.12.7 -> 3.13.0 is the only substantive one, and it tightens safety: External<T> now consults a native-payload registry before casting the tagged object, so what used to be an unchecked cast into a type-confusion is an InvalidArg error, and a failed napi_wrap no longer leaks obj_ptr/size_hint_ptr. The rest of its additions are the wasm-only two-phase env-cleanup exports. New unsafe stays inside the existing NAPI FFI idiom, and the only std::process uses are abort() guards against unwinding across the FFI boundary. The other six are small: rand 0.10.3 replaces panics with errors in WeightedIndex and Uniform; thiserror-impl tracks turbofish depth while scanning display attributes; tokio-test fixes a TOCTOU race in Mock::poll_write; napi-build only prints cargo directives; napi-derive and thiserror have no functional source change. None adds unsafe, fs, net, or ambient access. Before: "Vetting Failed! 7 unvetted dependencies". After: "Vetting Succeeded (26 fully audited, 67 partially audited, 523 exempted)". Claude-Session: https://claude.ai/code/session_01DyKfW3rVZUrUKzrCLpurco
chaliy
added a commit
that referenced
this pull request
Sep 29, 2026
The group bump left seven versions unvetted and the Audit job failing. Reviewed each delta against the published sources and recorded a delta audit, following the precedent set in #2431. napi 3.12.7 -> 3.13.0 is the only substantive one, and it tightens safety: External<T> now consults a native-payload registry before casting the tagged object, so what used to be an unchecked cast into a type-confusion is an InvalidArg error, and a failed napi_wrap no longer leaks obj_ptr/size_hint_ptr. The rest of its additions are the wasm-only two-phase env-cleanup exports. New unsafe stays inside the existing NAPI FFI idiom, and the only std::process uses are abort() guards against unwinding across the FFI boundary. The other six are small: rand 0.10.3 replaces panics with errors in WeightedIndex and Uniform; thiserror-impl tracks turbofish depth while scanning display attributes; tokio-test fixes a TOCTOU race in Mock::poll_write; napi-build only prints cargo directives; napi-derive and thiserror have no functional source change. None adds unsafe, fs, net, or ambient access. Before: "Vetting Failed! 7 unvetted dependencies". After: "Vetting Succeeded (26 fully audited, 67 partially audited, 523 exempted)". Claude-Session: https://claude.ai/code/session_01DyKfW3rVZUrUKzrCLpurco
chaliy
added a commit
that referenced
this pull request
Sep 29, 2026
The group bump left seven versions unvetted and the Audit job failing. Reviewed each delta against the published sources and recorded a delta audit, following the precedent set in #2431. napi 3.12.7 -> 3.13.0 is the only substantive one, and it tightens safety: External<T> now consults a native-payload registry before casting the tagged object, so what used to be an unchecked cast into a type-confusion is an InvalidArg error, and a failed napi_wrap no longer leaks obj_ptr/size_hint_ptr. The rest of its additions are the wasm-only two-phase env-cleanup exports. New unsafe stays inside the existing NAPI FFI idiom, and the only std::process uses are abort() guards against unwinding across the FFI boundary. The other six are small: rand 0.10.3 replaces panics with errors in WeightedIndex and Uniform; thiserror-impl tracks turbofish depth while scanning display attributes; tokio-test fixes a TOCTOU race in Mock::poll_write; napi-build only prints cargo directives; napi-derive and thiserror have no functional source change. None adds unsafe, fs, net, or ambient access. Before: "Vetting Failed! 7 unvetted dependencies". After: "Vetting Succeeded (26 fully audited, 67 partially audited, 523 exempted)". Claude-Session: https://claude.ai/code/session_01DyKfW3rVZUrUKzrCLpurco
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the rust-dependencies group with 5 updates:
4.6.64.6.73.12.43.12.63.6.53.6.72.4.22.4.43.0.53.0.6Updates
clapfrom 4.6.6 to 4.6.7Release notes
Sourced from clap's releases.
Changelog
Sourced from clap's changelog.
Commits
d3e59a9chore: Released997f87docs: Update changelogfb6058cMerge pull request #6409 from heaths/pwsh-support2310870test(complete): Add tests for completer_for_path5967c17refactor(complete): Move shell detection to Shells594602bfix(complete): Detect pwsh for PowerShell3a4f2d0Merge pull request #6427 from clap-rs/renovate/shlex-2.x67ebaedMerge pull request #6426 from clap-rs/renovate/actions-checkout-7.xc968b13chore(deps): Update Rust crate shlex to v28f247cbchore(deps): Update actions/checkout action to v7Updates
napifrom 3.12.4 to 3.12.6Release notes
Sourced from napi's releases.
Commits
e2f21c6chore: release (#3525)134045achore(release): publish1391704fix(cli): drain outstanding async work before disposing a WASI binding (#3528)c50beb0chore(release): publish98ed126fix(cli): give reconciliation identity-resolver tests realistic time budgets ...f9be941fix(cli): settle threaded WASI disposal after async work (#3526)43100bachore: release (#3508)bb7b75achore(release): publish89d7a0bchore(deps): update dependency oxfmt to ^0.68.0 (#3519)5554591fix(cli): rate-limit failed incarnation probes and let reconciliation tests i...Updates
napi-derivefrom 3.6.5 to 3.6.7Release notes
Sourced from napi-derive's releases.
Commits
e2f21c6chore: release (#3525)134045achore(release): publish1391704fix(cli): drain outstanding async work before disposing a WASI binding (#3528)c50beb0chore(release): publish98ed126fix(cli): give reconciliation identity-resolver tests realistic time budgets ...f9be941fix(cli): settle threaded WASI disposal after async work (#3526)43100bachore: release (#3508)bb7b75achore(release): publish89d7a0bchore(deps): update dependency oxfmt to ^0.68.0 (#3519)5554591fix(cli): rate-limit failed incarnation probes and let reconciliation tests i...Updates
napi-buildfrom 2.4.2 to 2.4.4Release notes
Sourced from napi-build's releases.
Commits
38162bbchore: release (#3529)ec3d8eafix(napi): guard AsyncTask completion against env teardown (#3536)96ed267chore(deps): update release-plz/action action to v0.5.139 (#3537)b2c9f3bchore(deps): update release-plz/action action to v0.5.138 (#3533)f31c887fix(cli): skip the reconciliation heal test on hosts whose identity probes fa...34b8781chore(release): publish5f5c289fix(cli): derive WASI.d.ctsfrom ESM sources when nothing blocks it (#3532)2733e5bchore(release): publish43ddfacfix(cli): retry a filesystem snapshot whose source only changed metadata and ...e2f21c6chore: release (#3525)Updates
synfrom 3.0.5 to 3.0.6Release notes
Sourced from syn's releases.
Commits
559cab5Release 3.0.69088cadMerge pull request #2082 from dtolnay/lifetimevar3eb43bbFix parsing interpolated lifetime at statement start7b2f6f9Add regression test for issue 2081d55bcd2Update test suite to nightly-2026-09-138e37bcaResolve non_kebab_case_bins warning4dfd88fUpdate test suite to nightly-2026-09-06Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions