deps(rust): bump the rust-minor-patch group across 1 directory with 9 updates - #280
Closed
dependabot[bot] wants to merge 2 commits into
Closed
dependabot[bot] wants to merge 2 commits into
dependabot[bot] wants to merge 2 commits into
Conversation
… updates Bumps the rust-minor-patch group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [async-trait](https://github.com/dtolnay/async-trait) | `0.1.91` | `0.1.92` | | [crc32fast](https://github.com/srijs/rust-crc32fast) | `1.5.0` | `1.5.1` | | [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.9` | `1.1.10` | | [futures](https://github.com/rust-lang/futures-rs) | `0.3.33` | `0.3.34` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.19` | `2.0.20` | | [toml](https://github.com/toml-rs/toml) | `1.1.4+spec-1.1.0` | `1.1.5+spec-1.1.0` | | [tower-http](https://github.com/tower-rs/tower-http) | `0.7.0` | `0.7.1` | | [uuid](https://github.com/uuid-rs/uuid) | `1.24.0` | `1.26.0` | Updates `async-trait` from 0.1.91 to 0.1.92 - [Release notes](https://github.com/dtolnay/async-trait/releases) - [Commits](dtolnay/async-trait@0.1.91...0.1.92) Updates `crc32fast` from 1.5.0 to 1.5.1 - [Commits](srijs/rust-crc32fast@v1.5.0...v1.5.1) Updates `flate2` from 1.1.9 to 1.1.10 - [Release notes](https://github.com/rust-lang/flate2-rs/releases) - [Commits](rust-lang/flate2-rs@1.1.9...1.1.10) Updates `futures` from 0.3.33 to 0.3.34 - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md) - [Commits](rust-lang/futures-rs@0.3.33...0.3.34) Updates `thiserror` from 2.0.19 to 2.0.20 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@2.0.19...2.0.20) Updates `toml` from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0 - [Commits](toml-rs/toml@toml-v1.1.4...toml-v1.1.5) Updates `tower-http` from 0.7.0 to 0.7.1 - [Release notes](https://github.com/tower-rs/tower-http/releases) - [Commits](tower-rs/tower-http@tower-http-0.7.0...tower-http-0.7.1) Updates `uuid` from 1.24.0 to 1.26.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.24.0...v1.26.0) Updates `futures-util` from 0.3.33 to 0.3.34 - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md) - [Commits](rust-lang/futures-rs@0.3.33...0.3.34) --- updated-dependencies: - dependency-name: async-trait dependency-version: 0.1.92 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: crc32fast dependency-version: 1.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: flate2 dependency-version: 1.1.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: futures dependency-version: 0.3.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: thiserror dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: toml dependency-version: 1.1.5+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: tower-http dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: uuid dependency-version: 1.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-minor-patch - dependency-name: futures-util dependency-version: 0.3.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
iai-callgrind —
|
iai-callgrind —
|
iai-callgrind —
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![mergestorm-vortex[bot]](https://avatars.githubusercontent.com/in/3924858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review progress ██████████ 1/1 files
Comment — found 1 issue(s) at 84df078.
Actionable comment posted: 1
🤖 Prompt for AI agents
Verify each finding against current code. Fix only still-valid concrete bugs, skip the
rest with a brief reason, keep changes minimal, and validate. Skip Decision required,
policy forks, and "consider X" alternatives. Do not add new features, refactors, or
architecture beyond the fix; prefer the smallest diff.
Findings to address:
1. In `@Cargo.lock` (line 7092, Important):
`+ "getrandom 0.3.4"` (tempfile 3.27.0 block)
The `tempfile` entry keeps the same version and checksum (`32497e9a...`) before and after this PR, but its `getrandom` edge changes `0.4.2` → `0.3.4`. A crate's declared requirement cannot change when its version/checksum does not, and every other copy of this exact package in the repo resolves it the other way: `tooling/recall-bench/Cargo.lock:3759`, `apps/prime-mcp/Cargo.lock:4465`, `apps/auth/Cargo.lock:2482`, `crates/better-auth-allsource/Cargo.lock:1721` all show `tempfile 3.27.0 -> getrandom 0.4.2` (0.3.4 will not satisfy a `^0.4` requirement).
Effect: the committed lock no longer satisfies the manifest constraints, so the resolver wants to re-pin getrandom for tempfile. CI builds with `--locked` (`Makefile:170-176`, `apps/core/Makefile:91-97`), which fails with "the lock file needs to be updated but --locked was passed" on `make quality-rust` / root `allsource` builds even though no source changed. Please re-run `cargo update -p tempfile` (or a plain `cargo generate-lockfile`) and commit the result instead of hand-regenerating, and confirm `cargo build --locked` passes for the root workspace.
| dependencies = [ | ||
| "fastrand", | ||
| "getrandom 0.4.2", | ||
| "getrandom 0.3.4", |
There was a problem hiding this comment.
tempfile 3.27.0 dependency edge downgraded to getrandom 0.3.4
+ "getrandom 0.3.4" (tempfile 3.27.0 block)
The tempfile entry keeps the same version and checksum (32497e9a...) before and after this PR, but its getrandom edge changes 0.4.2 → 0.3.4. A crate's declared requirement cannot change when its version/checksum does not, and every other copy of this exact package in the repo resolves it the other way: tooling/recall-bench/Cargo.lock:3759, apps/prime-mcp/Cargo.lock:4465, apps/auth/Cargo.lock:2482, crates/better-auth-allsource/Cargo.lock:1721 all show tempfile 3.27.0 -> getrandom 0.4.2 (0.3.4 will not satisfy a ^0.4 requirement).
Effect: the committed lock no longer satisfies the manifest constraints, so the resolver wants to re-pin getrandom for tempfile. CI builds with --locked (Makefile:170-176, apps/core/Makefile:91-97), which fails with "the lock file needs to be updated but --locked was passed" on make quality-rust / root allsource builds even though no source changed. Please re-run cargo update -p tempfile (or a plain cargo generate-lockfile) and commit the result instead of hand-regenerating, and confirm cargo build --locked passes for the root workspace.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid concrete bugs, skip the
rest with a brief reason, keep changes minimal, and validate. Skip Decision required,
policy forks, and "consider X" alternatives. Do not add new features, refactors, or
architecture beyond the fix; prefer the smallest diff.
In `@Cargo.lock` (line 7092, Important):
`+ "getrandom 0.3.4"` (tempfile 3.27.0 block)
The `tempfile` entry keeps the same version and checksum (`32497e9a...`) before and after this PR, but its `getrandom` edge changes `0.4.2` → `0.3.4`. A crate's declared requirement cannot change when its version/checksum does not, and every other copy of this exact package in the repo resolves it the other way: `tooling/recall-bench/Cargo.lock:3759`, `apps/prime-mcp/Cargo.lock:4465`, `apps/auth/Cargo.lock:2482`, `crates/better-auth-allsource/Cargo.lock:1721` all show `tempfile 3.27.0 -> getrandom 0.4.2` (0.3.4 will not satisfy a `^0.4` requirement).
Effect: the committed lock no longer satisfies the manifest constraints, so the resolver wants to re-pin getrandom for tempfile. CI builds with `--locked` (`Makefile:170-176`, `apps/core/Makefile:91-97`), which fails with "the lock file needs to be updated but --locked was passed" on `make quality-rust` / root `allsource` builds even though no source changed. Please re-run `cargo update -p tempfile` (or a plain `cargo generate-lockfile`) and commit the result instead of hand-regenerating, and confirm `cargo build --locked` passes for the root workspace.
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/cargo/rust-minor-patch-da60a9d1f7
branch
September 14, 2026 18:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the rust-minor-patch group with 8 updates in the / directory:
0.1.910.1.921.5.01.5.11.1.91.1.100.3.330.3.342.0.192.0.201.1.4+spec-1.1.01.1.5+spec-1.1.00.7.00.7.11.24.01.26.0Updates
async-traitfrom 0.1.91 to 0.1.92Release notes
Sourced from async-trait's releases.
Commits
82e7e9eRelease 0.1.929a35cb8Merge pull request #303 from dtolnay/mustuse875ceecResolve double_must_use clippy lint62993a5Raise minimum tested compiler to rust 1.88Updates
crc32fastfrom 1.5.0 to 1.5.1Commits
a150f65release 1.5.1f066e8dperf(simd): widen x86 folds, add ARM 3-way, and speed up small inputs (#56)d5c123dconsolidate dword load in baseline implementation (#55)50e2046downgrade msrv ci run to just cargo buildUpdates
flate2from 1.1.9 to 1.1.10Release notes
Sourced from flate2's releases.
Commits
ed93d4fMerge pull request #558 from rust-lang/lib-doc-updatefb5228dMerge pull request #559 from bushrat011899/no_std6ed3ba3Add executableno_stdexamplefaed8a0Expand CI to testno_stdcompatibility and correctness2ba8e7eAdd unstableno_stdsupport behindflate2_unstable_nightly_alloc_io3fe1126Centralize usage ofstdforerrorandio98e313aAddGzHeader::mtime_as_duration0642965Switch tocoreimplicit prelude and only usestdwhere required454a63cRemove left-overdbg!statement2a490b7Addruntime_detectionfeatureUpdates
futuresfrom 0.3.33 to 0.3.34Release notes
Sourced from futures's releases.
Changelog
Sourced from futures's changelog.
Commits
705e6b5Release 0.3.34616dac7compat: Inline RawWaker clone function4176369Inline remaining RawWaker clone functionsf17a895Fix cloned FuturesUnordered waker identity51d62admacro: bumpsynto v3 (#3028)9e26177ci: Reduce timeout-minutesb2d0983tsan: Enable Adaptive Delayf733d0eMiri: Ignore compat testse5def2fRename default branch to mainUpdates
thiserrorfrom 2.0.19 to 2.0.20Release notes
Sourced from thiserror's releases.
Commits
b1d5db5Release 2.0.20c4c3ebdMerge pull request #454 from dtolnay/clippy2266152Suppress redundant_field_names clippy lint2901cfdRaise minimum tested compiler to rust 1.88aa9d91fUpdate ui tests for version 2.0.19Updates
tomlfrom 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0Commits
e93ed4echore: Released23436ddocs: Update changelog151afcdfix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat (#1211)26a4050fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat232f136chore(deps): Update Prek to v0.5.1 (#1209)9ee4b4echore(deps): Update crate-ci/typos digest to 4d9c206 (#1208)525f352chore(deps): Update crate-ci/committed digest to 800a04e (#1207)46043edchore(deps): Update crate-ci/typos digest to 4d9c206c00e894chore(deps): Update crate-ci/committed digest to 800a04e1ae0158chore(deps): Update Prek to v0.5.0 (#1205)Updates
tower-httpfrom 0.7.0 to 0.7.1Release notes
Sourced from tower-http's releases.
... (truncated)
Commits
c941451chore(release): prepare 0.7.1 (#729)9697702chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (#730)e2582e2Allow ignoring multi-range requests (#727)888f7fefeat(services): configure directory redirects (#728)5ad7654chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (#726)d154adbfix: reject multipart ranges before validation (#661)d9e5c8aci: Update to cargo-check-external-types 0.5.0 (#724)90c072bPropagate ServeDir::try_call I/O errors (#718)860922efix(decompression): don't end the body on an empty data frame (#722)8532252docs(example)/custom future with multiple bodies (#711)Updates
uuidfrom 1.24.0 to 1.26.0Release notes
Sourced from uuid's releases.
Commits
cdc96a8Merge pull request #905 from uuid-rs/cargo/v1.26.034e4f49don't test macros under mirid9e7242update nightly used for miriec16819prepare for 1.26.0 release162cd20Merge pull request #904 from ChrisJr404/v7-additional-precision-bits97eceffAdd ContextV7::with_additional_precision_bits for microsecond clocks302e0bfMerge pull request #903 from uuid-rs/cargo/1.25.0b7ccde8prepare for 1.25.0 releasec62dffbMerge pull request #902 from ChrisJr404/serde-bytes-module8c198b2Add a serde::bytes module that encodes as a byte stringUpdates
futures-utilfrom 0.3.33 to 0.3.34Release notes
Sourced from futures-util's releases.
Changelog
Sourced from futures-util's changelog.
Commits
705e6b5Release 0.3.34616dac7compat: Inline RawWaker clone function4176369Inline remaining RawWaker clone functionsf17a895Fix cloned FuturesUnordered waker identity51d62admacro: bumpsynto v3 (#3028)9e26177ci: Reduce timeout-minutesb2d0983tsan: Enable Adaptive Delayf733d0eMiri: Ignore compat testse5def2fRename default branch to mainDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions