Repository navigation
chore(deps): bump egui stack 0.34.3 -> 0.35.0 + in-constraint dep refresh - #215
Merged
Merged
Conversation
…resh Consolidates the three open egui Dependabot PRs (#211 egui-wgpu, #212 egui, #213 egui-winit) into one coordinated bump, since egui/egui-wgpu/egui-winit ship in lockstep and cannot be merged independently, plus a SemVer-compatible refresh of the rest of the transitive graph. egui 0.34.3 -> 0.35.0 (the "Inspection, egui_mcp, classes, improved IME" release) - Verified via crates.io that egui 0.35 stays within the project's *existing* render/windowing tier before touching anything: * egui-wgpu 0.35.0 requires wgpu ^29.0 (locked: 29.0.3) -> no change * egui-winit 0.35.0 requires winit ^0.30.13 (locked: 0.30.13) -> no change * egui 0.35.0 requires accesskit ^0.24.1 (locked: 0.24.1) -> no change So there is NO wgpu / winit / accesskit / naga movement; this is a pure in-tier bump and the shipped / native / no_std / wasm builds stay behavior-equivalent. - Migrated the one API break introduced by 0.35: egui::Panel::show_inside was deprecated and renamed to Panel::show(ui, ..) (same &mut Ui-nesting signature). Updated the three call sites -- the shell menu bar and status bar (ui_shell.rs) and the documentation side panel (debugger/doc_panel.rs) -- and refreshed the three surrounding architecture comments (ui_shell.rs + debugger/mod.rs) that named the old method, keeping the docs in sync with the code per the docs-as-spec rule. - The transitive font stack epaint 0.35 pulls in (fearless_simd, read-fonts, skrifa, vello_*) moved with it; ecolor/emath/epaint/epaint_default_fonts all advanced 0.34.3 -> 0.35.0 in lockstep. In-constraint transitive refresh (cargo update; SemVer-compatible only) - Picked up ~20 patch/minor bumps that violate no manifest requirement: anyhow 1.0.103, bstr 1.12.3, camino 1.2.4, clap_complete 4.6.7, console 0.16.4, js-sys / web-sys 0.3.103, rustls-pki-types 1.15.0, time 0.3.53, uuid 1.23.4, wasm-bindgen 0.2.126 (+ the -futures/-macro/-shared satellites), zlib-rs 0.6.5, and others. - wasm-bindgen 0.2.125 -> 0.2.126 required mirroring the pin in crates/rustynes-frontend/web/Trunk.toml: the wasm-bindgen library and the trunk-invoked wasm-bindgen CLI are released in lockstep and version-check each other, so a mismatch would fail `trunk build` (and the GitHub Pages deploy) at the wasm-bindgen step even though wasm clippy still passes. Deliberately EXCLUDED (out-of-tier / breaking; each needs its own change) - wgpu 30 / naga 30 -- would break the egui-wgpu 0.35 render tier (pins wgpu ^29). - getrandom 0.4 -- breaking wasm backend API; its `js` feature is obsolete. - uniffi 0.32 -- the mobile UniFFI bridge; needs a Kotlin/Swift regen plus an on-device verification pass, not a desktop drop-in. Verification (all green locally) - cargo fmt --all --check: clean. - cargo clippy --workspace --all-targets -- -D warnings: clean. - cargo clippy -p rustynes-frontend --features full -- -D warnings: clean. - wasm32 clippy (wasm-winit default + wasm-canvas): clean. - RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps: clean. - cargo test -p rustynes-frontend: 431 passed, 0 failed. - AccuracyCoin 139/139 unaffected -- the deterministic #![no_std] chip stack is untouched and byte-identical; egui lives only in the host frontend. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR consolidates the egui stack upgrade to 0.35.0 (egui/egui-wgpu/egui-winit) and performs an in-constraint cargo update refresh of the dependency graph, updating the few frontend call sites affected by the Panel::show_inside → Panel::show(ui, ..) rename and keeping the wasm build tooling pin (Trunk’s wasm-bindgen CLI) aligned with the resolved library version.
Changes:
- Bump egui stack from 0.34.x to 0.35.0 and migrate the affected
Panel::show_insidecall sites toPanel::show(ui, ..). - Refresh transitive dependencies via
cargo update, updatingCargo.lockaccordingly. - Update the pinned
wasm_bindgenCLI version incrates/rustynes-frontend/web/Trunk.tomlto match the resolvedwasm-bindgencrate version.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| crates/rustynes-frontend/web/Trunk.toml | Updates pinned wasm_bindgen CLI version to match the newly resolved wasm-bindgen library version. |
| crates/rustynes-frontend/src/ui_shell.rs | Migrates top/bottom panel rendering from show_inside to show(ui, ..) for egui 0.35. |
| crates/rustynes-frontend/src/debugger/mod.rs | Updates egui 0.35 panel API references in the debugger overlay flow/comments around run_ui. |
| crates/rustynes-frontend/src/debugger/doc_panel.rs | Migrates the documentation side panel from show_inside to show(ui, ..). |
| CHANGELOG.md | Documents the egui stack bump and the transitive dependency refresh for the Unreleased section. |
| Cargo.toml | Bumps workspace frontend dependency constraints for egui/egui-wgpu/egui-winit to 0.35. |
| Cargo.lock | Records the updated resolved dependency graph (egui stack + in-constraint transitive updates). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the egui GUI stack dependencies (egui, egui-wgpu, and egui-winit) from version 0.34 to 0.35, alongside refreshing various transitive dependencies in Cargo.lock. It migrates the deprecated show_inside API calls to the new show method on egui::Panel across the debugger and UI shell, updates related documentation comments, and bumps the pinned wasm-bindgen version in Trunk.toml to align with the lockfile. There are no review comments, so I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
…itive via winit)
The "Cargo Deny Check" CI gate went red on the advisories pass with
RUSTSEC-2026-0192 — `ttf-parser` flagged unmaintained. This is an informational
"unmaintained" advisory, NOT an exploitable vulnerability, on a purely
transitive dependency the workspace cannot influence from its manifest:
winit 0.30.13 -> sctk-adwaita -> ab_glyph -> owned_ttf_parser -> ttf-parser 0.25.1
ttf-parser 0.25.1 is already the latest release; the only way off it is for
winit's Wayland client-side-decoration stack to drop ab_glyph, which is outside
our control until a future winit bump. Crucially this is NOT introduced by the
egui 0.34->0.35 bump in this PR: `main` carries the identical `ttf-parser
0.25.1`, and cargo-deny fetches the live RUSTSEC database at check time, so the
freshly-published advisory fails equally on `main` — this PR is simply the first
to re-run the security workflow (which is path-filtered to Cargo.toml/lock
changes) after the advisory landed.
Per deny.toml's own stated policy ("a real transitive advisory with no safe
upgrade"), added RUSTSEC-2026-0192 to the `[advisories].ignore` list with a
comprehensive comment recording the dependency chain, why it is safe (unmaintained
!= vulnerable), and the revisit condition (a winit bump that drops the
ab_glyph/ttf-parser chain). `bans`/`licenses`/`sources` were already green and are
unaffected; no real vulnerability is being suppressed.
Verified locally: `cargo deny check` -> "advisories ok, bans ok, licenses ok,
sources ok".
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Owner
Author
|
Bot review adjudication
No inline threads were raised, so there are none to resolve. The one CI failure (Cargo Deny Check → |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the three open egui Dependabot PRs (#211 egui-wgpu, #212 egui, #213 egui-winit) into one coordinated bump — the trio ships in lockstep and cannot merge independently — plus a SemVer-compatible refresh of the rest of the transitive graph. Supersedes #211/#212/#213.
egui 0.34.3 → 0.35.0
Verified via crates.io that 0.35 stays within the project's existing render/windowing tier before changing anything:
wgpu ^29.0winit ^0.30.13accesskit ^0.24.1So no wgpu / winit / accesskit / naga movement — a pure in-tier bump; shipped/native/
no_std/wasm builds stay behavior-equivalent.egui::Panel::show_inside→ renamedPanel::show(ui, ..)(same&mut Uisignature). Updated 3 call sites (shell menu bar + status bar inui_shell.rs, doc side panel indebugger/doc_panel.rs) + 3 surrounding architecture comments.In-constraint transitive refresh (
cargo update)~20 SemVer-compatible patch/minor bumps (anyhow 1.0.103, clap_complete 4.6.7, time 0.3.53, uuid 1.23.4, js-sys/web-sys 0.3.103, wasm-bindgen 0.2.126, …). The wasm-bindgen 0.2.126 bump is mirrored in the pinned
web/Trunk.tomlCLI version (they version-check in lockstep — a mismatch fails the Pages deploy).Deliberately excluded (out-of-tier / breaking, each needs its own change):
wgpu 30/naga 30(breaks the egui-wgpu 0.35 tier),getrandom 0.4(breaking wasm API),uniffi 0.32(mobile bridge — needs Kotlin/Swift regen + on-device pass).Verification (all green locally)
cargo fmt --all --check: cleancargo clippy --workspace --all-targets -- -D warnings: cleancargo clippy -p rustynes-frontend --features full: cleanRUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps: cleancargo test -p rustynes-frontend: 431 passed, 0 failed#![no_std]chip stack is untouched and byte-identical; egui lives only in the host frontend.Closes #211, closes #212, closes #213.
🤖 Generated with Claude Code