chore(deps): update tree-sitter-language-pack requirement from <1.15,>=1.14.3 to >=1.14.3,<1.16

[dependabot]

Updates the requirements on tree-sitter-language-pack to permit the latest version.

Release notes

Sourced from tree-sitter-language-pack's releases.

v1.15.8

Fixed

• The plain-Java artifact reaches Maven Central again. It was the only registry still stuck at 1.14.3: every 1.15.x publish skipped Publish Maven package, because the E2E gate — Java it sits behind failed first on 8 assertions of the shape expected: <null> but was: <[]>.

  The cause was a disagreement inside each generated Java record. A component backed by a Rust Vec carrying #[serde(default, skip_serializing_if = "Vec::is_empty")] was emitted as @Nullable, and the canonical constructor stored whatever it was handed — null included — while the Jackson builder defaulted the same component to List.of(). A record built through the builder, or round-tripped through JSON, therefore never compared equal to the same record built through the constructor. Regenerating against alef 0.67.2 drops @Nullable on those components and adds a compact constructor normalizing null to an empty collection, so both construction paths agree. Affected records: DataNode, DocstringInfo, ImportInfo, ProcessResult, StructureItem.

• The hand-written Java unit tests asserted the old, wrong contract. They required such a component to arrive as null; the Rust fields behind them are plain Vec, never Option<Vec>, so empty is the truthful representation. They now assert assertEquals(List.of(), ...), which fails on null as well as on a non-empty list — the assertions were tightened, not relaxed to accept either shape. mvn test in packages/java reports 150 tests, 0 failures, 0 errors.

Added

• Prerelease mode for the registry-mode test apps. task test-apps:prerelease:run (and :verify, :status, :clean) stages a throwaway copy of each test_apps/ app under .prerelease/ and redirects its dependency resolution at the in-repo package source, so the suite is runnable between a version bump and the publish — the window in which the pinned version exists on no registry and alef test-apps run cannot resolve anything. Covers rust, go, python, ruby, dart, elixir and swift; status names the remaining targets and why each needs a built artifact rather than a source path.

• scripts/check_test_app_pins.py — a gate that fails when a test app is pinned to a release other than the one being built. It re-derives all 18 pins across every test_apps/ app plus the alef.toml registry pins from Cargo.toml, deliberately independent of alef, so a change in what alef sync-versions is willing to write surfaces as a failure instead of as silent drift. A pattern that matches nothing is an error, not a pass — that was the Dart failure mode. --fix repins everything; --release X checks against the version being published and also catches a Cargo.toml that disagrees with the tag.

  Wired in three places: task version:sync repins after alef sync-versions, the Check version sync CI step gates every push, and the publish workflow's validate-versions job gates the release itself against the tag. Also exposed as task test-apps:check-pins / :fix-pins.

• scripts/sync_zig_zon_hashes.py — regenerates and verifies the test_apps/zig/build.zig.zon package hashes from the tarballs their URLs name. A Zig package hash is a content digest, so it cannot be derived from a version string the way every other test-app pin can; the only reproducible source is zig fetch <url>, which prints the exact hash Zig will demand. --fix

... (truncated)

Changelog

Sourced from tree-sitter-language-pack's changelog.

[1.15.8] - 2026-08-23

Fixed

• The plain-Java artifact reaches Maven Central again. It was the only registry still stuck at 1.14.3: every 1.15.x publish skipped Publish Maven package, because the E2E gate — Java it sits behind failed first on 8 assertions of the shape expected: <null> but was: <[]>.

  The cause was a disagreement inside each generated Java record. A component backed by a Rust Vec carrying #[serde(default, skip_serializing_if = "Vec::is_empty")] was emitted as @Nullable, and the canonical constructor stored whatever it was handed — null included — while the Jackson builder defaulted the same component to List.of(). A record built through the builder, or round-tripped through JSON, therefore never compared equal to the same record built through the constructor. Regenerating against alef 0.67.2 drops @Nullable on those components and adds a compact constructor normalizing null to an empty collection, so both construction paths agree. Affected records: DataNode, DocstringInfo, ImportInfo, ProcessResult, StructureItem.

• The hand-written Java unit tests asserted the old, wrong contract. They required such a component to arrive as null; the Rust fields behind them are plain Vec, never Option<Vec>, so empty is the truthful representation. They now assert assertEquals(List.of(), ...), which fails on null as well as on a non-empty list — the assertions were tightened, not relaxed to accept either shape. mvn test in packages/java reports 150 tests, 0 failures, 0 errors.

Added

• Prerelease mode for the registry-mode test apps. task test-apps:prerelease:run (and :verify, :status, :clean) stages a throwaway copy of each test_apps/ app under .prerelease/ and redirects its dependency resolution at the in-repo package source, so the suite is runnable between a version bump and the publish — the window in which the pinned version exists on no registry and alef test-apps run cannot resolve anything. Covers rust, go, python, ruby, dart, elixir and swift; status names the remaining targets and why each needs a built artifact rather than a source path.

• scripts/check_test_app_pins.py — a gate that fails when a test app is pinned to a release other than the one being built. It re-derives all 18 pins across every test_apps/ app plus the alef.toml registry pins from Cargo.toml, deliberately independent of alef, so a change in what alef sync-versions is willing to write surfaces as a failure instead of as silent drift. A pattern that matches nothing is an error, not a pass — that was the Dart failure mode. --fix repins everything; --release X checks against the version being published and also catches a Cargo.toml that disagrees with the tag.

  Wired in three places: task version:sync repins after alef sync-versions, the Check version sync CI step gates every push, and the publish workflow's validate-versions job gates the release itself against the tag. Also exposed as task test-apps:check-pins / :fix-pins.

• scripts/sync_zig_zon_hashes.py — regenerates and verifies the test_apps/zig/build.zig.zon package hashes from the tarballs their URLs name. A Zig package hash is a content digest, so it cannot be derived from a version string the way every other test-app pin can; the only

... (truncated)

Commits

• 86fa5a8 chore(swift): update Package.swift with checksum for v1.15.8
• 7f3d1e6 docs(changelog): roll [Unreleased] into 1.15.8
• d9d1647 chore(release): bump version to 1.15.8
• 0f55a1e fix(java): assert the non-null empty-collection contract
• e85d7ee chore: regenerate bindings with alef 0.67.2
• eededd2 chore(deps): repin alef to 0.67.2
• 4da61e7 feat(ci): refresh zig test-app package hashes after publish
• 4d0b2b3 chore(deps): refresh Cargo.lock to latest compatible versions
• 19508d1 fix(ci): trigger CI Zig on the files its hash check reads
• 308fcb1 fix(test-apps): regenerate zig package hashes stale since 1.14.3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)