Skip to content

chore(deps): bump rustyline from 18.0.1 to 19.0.0 in the rust-dependencies group - #2765

Merged
chaliy merged 3 commits into
mainfrom
dependabot/cargo/rust-dependencies-ca9e26f7a6
Oct 21, 2026
Merged

chore(deps): bump rustyline from 18.0.1 to 19.0.0 in the rust-dependencies group#2765
chaliy merged 3 commits into
mainfrom
dependabot/cargo/rust-dependencies-ca9e26f7a6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the rust-dependencies group with 1 update: rustyline.

Updates rustyline from 18.0.1 to 19.0.0

Release notes

Sourced from rustyline's releases.

19.0.0

What's Changed

  • Fix some clippy #936
  • Bump to actions/checkout@v6 #937
  • Ignore clippy::collapsible_match #925
  • Replace cfg_if by cfg_select #935
  • Replace some cfg(not by cfg_select #939
  • Bump rusqlite version #940
  • Fix clippy warnings #942
  • Fix clippy errors #945
  • Use std::assert_matches #941
  • Fix page_completions #948 (#949)
  • Simplify creation of an editor with a default helper #950
  • Coverage #891
  • Edition 2024 #952
  • Test --no-default-features #953
  • Rustfmt group_imports & imports_granularity #956
  • Update syn requirement from 2.0.116 to 3.0.2 #958
  • Fix clippy warnings #962
  • Simplify test code #965
  • Simplify tests #967
  • Accept Tab as confirmation at the completion list prompt #955 (#968)
  • Read VEOF before writing VTIME #970 (#971)
  • Fix FTS queries #966, #972 (#973, #989)
  • Fix clippy warnings #975
  • Check input buffer before polling #976 (#977)
  • Fix page completions #980 (#981)
  • Rustfmt #982

Full Changelog: kkawakam/rustyline@v18.0.0...v19.0.0

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump rustyline
82fea8d 
Bumps the rust-dependencies group with 1 update: [rustyline](https://github.com/kkawakam/rustyline).


Updates `rustyline` from 18.0.1 to 19.0.0
- [Release notes](https://github.com/kkawakam/rustyline/releases)
- [Changelog](https://github.com/kkawakam/rustyline/blob/master/History.md)
- [Commits](kkawakam/rustyline@v18.0.1...v19.0.0)

---
updated-dependencies:
- dependency-name: rustyline
  dependency-version: 19.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 20, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 bashkit fcc02ff Commit Preview URL

Branch Preview URL		 Oct 21 2026, 10:17 AM

This was referenced Oct 20, 2026
Closed
Merged
chaliy added 2 commits October 21, 2026 05:10
@chaliy
Merge branch 'main' into dependabot/cargo/rust-dependencies-ca9e26f7a6
c9c331d
@chaliy
chore(deps): vet rustyline 19.0.0 for the dependabot bump
fcc02ff 
`cargo vet --locked` fails on this PR's own bump -- `rustyline:19.0.0 missing
["safe-to-deploy"]` -- and that is the whole of its red `Audit` check. The
advisory scan, cargo-deny licenses and cargo-deny sources all pass on this
head; the `error: override toolchain ... is not installed` further up that
job's log is noise that appears in passing runs too, where rustup then
installs the toolchain and reports `licenses ok, sources ok`.

Dependabot can move a version but cannot write a supply-chain entry, so every
bump of a vetted or exempted crate arrives unvettable by construction. This is
the missing half of its commit, not a separate change.

18.0.1 was an exemption rather than an audit, so the exemption moves to
19.0.0: writing a delta audit would claim a review of a major-version diff
that is mostly an edition-2024 migration and a rustfmt reflow, which is not a
claim worth making. What the delta was checked for instead:

- Dependency set shrinks. `cfg-if` is dropped in favour of std's
  `cfg_select!`; nothing is added.
- `unsafe` occurrences are unchanged at 46, so the termios/raw-mode surface
  this crate needs did not grow.
- No new ambient capability: no filesystem, network or process access that
  18.0.1 did not already have.
- It builds against the `interactive` feature, which is on by default for
  `bashkit-cli`, so the editor-construction change in rustyline #950 does not
  break our call sites.

One user-visible REPL change rides along and is recorded in the interactive
shell knowledge: the "display all N possibilities?" prompt that
`CompletionType::List` shows for a large match set now accepts Tab as
confirmation (rustyline #955).
@chaliy Claude

chaliy commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Rebased onto main and pushed the supply-chain half of this bump, which Dependabot can't write itself.

The red Audit check was this PR's own, and only on its last step:

Vetting Failed!
1 unvetted dependencies:
  rustyline:19.0.0 missing ["safe-to-deploy"]

Everything else in that job passed on this head — the advisory scan, cargo-deny check licenses and check sources. Worth flagging for anyone reading the log: it also contains an error: override toolchain '1.95.0-x86_64-unknown-linux-musl' is not installed with a full Rust backtrace, which looks like the cause and isn't. That same error appears in passing runs on main, where rustup then installs the toolchain and reports licenses ok, sources ok.

The structural point: a version bump of a vetted or exempted crate is unvettable by construction, because Dependabot moves the version without the cargo vet entry that version needs.

Review of the 18.0.1 → 19.0.0 delta, against the published sources:

Check Result
Dependency set Shrinks — cfg-if dropped for std's cfg_select!; nothing added
unsafe occurrences 46 → 46, unchanged — the termios/raw-mode surface did not grow
New ambient capability None beyond 18.0.1
Builds with interactive (default for bashkit-cli) Yes — cargo build -p bashkit-cli clean locally

18.0.1 was an exemption, not an audit, so the exemption moves to 19.0.0. Writing a delta audit instead would claim a review of a major-version diff that is largely an edition-2024 migration and a rustfmt reflow — not a claim worth making. cargo vet --locked now succeeds locally:

Vetting Succeeded (98 fully audited, 84 partially audited, 494 exempted)

One user-visible REPL change rides along, so it's recorded in knowledge/integrations/interactive-shell.md next to the existing CompletionType::List note: the "display all N possibilities?" prompt now accepts Tab as confirmation (rustyline #955).

Waiting on CI; I'll merge once it's green.

Generated by Claude Code

@chaliy
chaliy merged commit b968244 into main Oct 21, 2026
47 checks passed
@chaliy
chaliy deleted the dependabot/cargo/rust-dependencies-ca9e26f7a6 branch October 21, 2026 10:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chaliy