Skip to content

chore(deps): refresh every dependency the project can move, and close two blind spots - #508

Merged
doublegate merged 2 commits into
mainfrom
chore/dependency-refresh
Sep 12, 2026
Merged

doublegate merged 2 commits into
mainfrom
chore/dependency-refresh

Conversation

@doublegate

@doublegate doublegate commented Sep 12, 2026

Copy link
Copy Markdown
Owner

What this is

The seven open Dependabot PRs, consolidated, plus everything else the project could move — and two coverage gaps that consolidation exposed.

Consolidating is not a stylistic preference here: three of these pins are coupled, and merging the Dependabot PRs one at a time desyncs them.

Cargo — 53 crates

cargo update to the latest 1.96-compatible versions. Covers all three crates of the grouped production PR: toml 1.1.4 → 1.1.6 (one further than proposed), ureq 3.4.0 → 3.4.1, cc 1.4.4 → 1.4.5.

The coupled one is wasm-bindgen 0.2.127 → 0.2.128. The CLI version pinned in crates/rustynes-frontend/web/Trunk.toml must equal the library in Cargo.lock exactly; a mismatch fails trunk build and the Pages deploy while wasm clippy still passes, so no gate but that pin catches it. Bumped in the same commit.

Android — five bumps, plus two Dependabot could not know about

pin from to who proposed it
com.android.application 9.3.2 9.4.0 Dependabot #502
com.android.test 9.3.2 9.4.0 nobody — shares AGP's coordinate
androidx.baselineprofile 1.5.0-rc01 1.5.0-rc02 nobody — tracks the row below
benchmark-macro-junit4 1.5.0-rc01 1.5.0-rc02 Dependabot #498
coil-compose 3.6.0 3.6.1 Dependabot #501
uiautomator 2.3.0 2.4.0 Dependabot #500
glance-material3 1.3.0-alpha01 1.3.0-alpha02 Dependabot #499

Merging #502 alone would have left com.android.test at 9.3.2 — two halves of one AGP release train out of step, in a job that is deliberately not a required check and so would not have stopped anyone.

AGP's recorded BUILD SUCCESSFUL measurement stays stated at 9.3.2, not reworded to 9.4.0: no Android toolchain exists on the machine that made the bump, CI's Gradle bundle job is what re-establishes it, and a measurement nobody re-ran must not be re-attributed to a version nobody tested it on.

GitHub Actions

taiki-e/install-action 2.87.0 → 2.87.11 (Dependabot proposed 2.87.5). Everything else was already current — checked, not assumed: every other action is at its latest major, and both SHA pins already resolve to the current tag (actions/checkout → v7.0.1, dtolnay/rust-toolchain → v1), verified through the API. The three pre-commit hook pins are likewise already latest.

Dependabot was blind to crates/rustynes-cosim

That crate is excluded from the workspace on purpose, so it carries its own Cargo.lock, which the / cargo entry cannot reach. Four crates had drifted there with nothing watching them. Added a /crates/rustynes-cosim directory entry and updated the lock. The exclusion is deliberate and stays; the blind spot it created does not — the same shape as every "the gate does not reach the code" finding here, one layer out into the tooling.

The egui 0.36 / wgpu 30 hold is re-measured, not re-asserted

The note said "0.36.1 is the newest on crates.io as of 2026-08". 0.36.2 shipped 2026-09-08 and still carries the blocker. Established the cheap way — a three-line scratch crate depending on egui-winit = "0.36.2" with this project's exact feature set fails cargo check --target wasm32-unknown-unknown with the same E0407, and 0.36.2's NativeFile still implements bytes() with no cfg gate.

The note now carries that reproduction, so the next attempt costs two minutes instead of a full migration, and records that the preserved migration branch is based on a pre-v2.3.2 tree — a reference for the five API deltas, not something to cherry-pick.

Not moved, and why

  • getrandom 0.2/0.3 → 0.4 and generic-array 0.14.7 → 0.14.9 are transitive, held by dependents' requirements rather than by anything this repository states.
  • The Rust toolchain stays at 1.96.0. rust-toolchain.toml carries an explicit warning that 1.97 turns the libretro image's injected -C ar from a warning into a hard error and fails all four Apple buildbot jobs together. That is a change with its own blast radius, not a dependency refresh.

Gates

Run in a git worktree so they did not contend with the accuracy sweep in the main tree:

cargo check --workspace · cargo clippy --workspace --all-targets · the retroachievements, scripting and scripting,hd-pack frontend combos · both wasm32 invocations (default and wasm-canvas) · the thumbv7em-none-eabihf no_std build (the only thing that catches an lz4_flex feature regression) · RUSTDOCFLAGS="-D warnings" cargo doc · cargo test --workspace — 25 suites, 0 failures · cargo deny check — advisories, bans, licenses, sources all ok.

pre-commit over the changed files only, never --all-files.

Supersedes #496, #498, #499, #500, #501, #502 and #504.

🤖 Generated with Claude Code

https://claude.ai/code/session_014qfTKi2M3swo7qnwvYCkDj

Summary by CodeRabbit

  • Chores

    • Updated Android build tooling and libraries, including Coil, Glance, UI Automator, and benchmark components.
    • Updated web build tooling and security scanning actions.
    • Added automated dependency monitoring for an additional Rust workspace component.
  • Documentation

    • Updated dependency and compatibility records, including confirmation that the current egui and wgpu versions remain on hold due to a WebAssembly build issue.

… two blind spots

Consolidates the seven open Dependabot PRs and everything else that could move.
Not a stylistic preference: THREE of these pins are COUPLED, and merging the
Dependabot PRs one at a time desyncs them.

CARGO -- 53 crates to the latest 1.96-compatible versions, covering all three
of the grouped production PR (`toml` 1.1.4 -> 1.1.6, one further than proposed;
`ureq` 3.4.0 -> 3.4.1; `cc` 1.4.4 -> 1.4.5).

The coupled one is `wasm-bindgen` 0.2.127 -> 0.2.128. The CLI version pinned in
`crates/rustynes-frontend/web/Trunk.toml` must equal the library in
`Cargo.lock` EXACTLY; a mismatch fails `trunk build` and the Pages deploy while
wasm clippy still passes, so no gate but that pin would catch it. Bumped here.

ANDROID -- the five Gradle bumps, plus TWO PINS DEPENDABOT COULD NOT KNOW TO
MOVE WITH THEM. `com.android.test` shares AGP's version coordinate (its own
comment in `android/build.gradle.kts` says so) and `androidx.baselineprofile`
tracks `benchmark-macro-junit4`. Dependabot raises each artifact separately, so
merging its `com.android.application` 9.4.0 PR alone leaves `com.android.test`
at 9.3.2 -- two halves of one AGP release train, out of step, in a job that is
deliberately NOT a required check and therefore would not have stopped anyone.

The recorded AGP BUILD SUCCESSFUL measurement stays stated at 9.3.2 rather than
being reworded to 9.4.0. No Android toolchain exists on this machine, CI's
Gradle bundle job is what re-establishes it, and a measurement nobody re-ran
must not be re-attributed to a version nobody tested it on.

GITHUB ACTIONS -- `taiki-e/install-action` 2.87.0 -> 2.87.11 (Dependabot
proposed 2.87.5). Everything else was ALREADY current, checked rather than
assumed: every other action is at its latest major, and both SHA pins already
resolve to the current tag (`actions/checkout` -> v7.0.1,
`dtolnay/rust-toolchain` -> v1), verified through the API. The three
`pre-commit` hook pins are likewise already latest.

DEPENDABOT WAS BLIND TO `crates/rustynes-cosim`, AND HAD BEEN ALL ALONG. That
crate is excluded from the workspace on purpose -- cargo unifies features
across a workspace build and it mandatorily enables two trace features that
select a different per-dot loop -- so it carries its OWN `Cargo.lock`, which
the `/` cargo entry cannot reach. Four crates had drifted there with nothing
watching them. Added a `/crates/rustynes-cosim` directory entry and updated the
lock. The exclusion is deliberate and stays; the blind spot it created does
not. It is the same shape as every "the gate does not reach the code" finding
in this repository, one layer out into the tooling.

THE egui 0.36 / wgpu 30 HOLD IS RE-MEASURED, NOT RE-ASSERTED. The note in
`Cargo.toml` said "0.36.1 is the newest on crates.io as of 2026-08". 0.36.2
shipped 2026-09-08 and still carries the blocker, established the cheap way: a
three-line scratch crate depending on `egui-winit = "0.36.2"` with this
project's exact feature set fails `cargo check --target
wasm32-unknown-unknown` with the same E0407, and 0.36.2's `NativeFile` still
implements `bytes()` with no cfg gate. The note now carries that reproduction,
so the next attempt costs two minutes rather than a full migration -- and it
records that the preserved migration branch is based on a pre-v2.3.2 tree, so
it is a reference for the five API deltas rather than something to cherry-pick.

NOT MOVED, and why: `getrandom` 0.2/0.3 -> 0.4 and `generic-array` 0.14.7 ->
0.14.9 are transitive and held by dependents' requirements, not by anything
this repository states. The Rust toolchain stays at 1.96.0 -- `rust-toolchain.
toml` carries an explicit warning that 1.97 turns the libretro image's injected
`-C ar` from a warning into a hard error and fails all four Apple buildbot jobs
together, and that is a change with its own blast radius rather than a
dependency refresh.

Gates, all run in a worktree so they did not contend with the accuracy sweep in
the main tree: `cargo check --workspace`; `cargo clippy --workspace
--all-targets`; the `retroachievements`, `scripting` and `scripting,hd-pack`
frontend combos; BOTH wasm32 invocations (default and `wasm-canvas`); the
`thumbv7em-none-eabihf` no_std build, which is the only thing that catches an
`lz4_flex` feature regression; `RUSTDOCFLAGS="-D warnings" cargo doc`;
`cargo test --workspace` at 25 suites and 0 failures; and `cargo deny check` --
advisories, bans, licenses and sources all ok. `pre-commit` over the changed
files only, never `--all-files`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014qfTKi2M3swo7qnwvYCkDj
Copilot AI lite review requested due to automatic review settings September 12, 2026 05:13
@coderabbitai

coderabbitai Bot commented Sep 12, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

Warning

Review limit reached

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f4937c15-902a-4029-aafd-6ae998f5ab81

📥 Commits

Reviewing files that changed from the base of the PR and between 0754f50 and 0d73708.

📒 Files selected for processing (3)
  • .github/dependabot.yml
  • CHANGELOG.md
  • android/app/build.gradle.kts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 2f05d861-b630-4565-b408-82f4623fdec9

📥 Commits

Reviewing files that changed from the base of the PR and between b9a8057 and 0754f50.

⛔ Files ignored due to path filters (2)
  • Cargo.lock is excluded by !**/*.lock, !Cargo.lock
  • crates/rustynes-cosim/Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (8)
  • .github/dependabot.yml
  • .github/workflows/security.yml
  • CHANGELOG.md
  • Cargo.toml
  • android/app/build.gradle.kts
  • android/baselineprofile/build.gradle.kts
  • android/build.gradle.kts
  • crates/rustynes-frontend/web/Trunk.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The pull request refreshes Android, WebAssembly, and security-tool versions. It adds Dependabot monitoring for crates/rustynes-cosim and updates documentation for the dependency refresh and egui compatibility hold.

Changes

Dependency and tooling refresh

Layer / File(s) Summary
Runtime and build version updates
.github/workflows/security.yml, android/..., crates/rustynes-frontend/web/Trunk.toml
Android plugins and libraries, wasm_bindgen, and taiki-e/install-action use updated versions.
Dependabot monitoring configuration
.github/dependabot.yml
Dependabot now monitors crates/rustynes-cosim weekly with update limits, labels, and commit-message settings.
Refresh documentation and compatibility record
CHANGELOG.md, Cargo.toml
The changelog records the refresh and egui 0.36.2 result. The Cargo comment records the continued egui 0.35 hold and migration reference.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 0754f

The dependency pins are aligned at rc02, and no actionable merge-blocking issue remains.

🚥 Pre-merge checks | ✅ 9
✅ Passed checks (9 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main dependency refresh and the added coverage for two dependency-management blind spots described in the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Docs-As-Spec Sync ✅ Passed PASS — The authoritative PR diff contains no changes under crates/rustynes-cpu, crates/rustynes-ppu, crates/rustynes-apu, or crates/rustynes-mappers. Cargo.toml changes only an egui hold comment. Carg…
Changelog Entry For User-Visible Changes ✅ Passed PASS. The authoritative diff contains only dependency manifests and lockfiles, Android/Trunk version pins, Dependabot and CI configuration, and explanatory comments. It contains no product source or u…
No Unwrap/Expect/Panic On Untrusted Input ✅ Passed PASS. The authoritative PR diff changes no .rs files and adds no .unwrap(), .expect(), or panic!() calls. The Rust-related changes are Cargo.lock metadata, Cargo.toml comments, and a Depen…
Safety Comment On New Unsafe Blocks ✅ Passed PASS. The authoritative pull-request diff changes 10 files and no .rs files. The added-line scan found no unsafe token, unsafe { block, or unsafe fn. The changes are dependency lockfiles, Carg…
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/dependency-refresh

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@doublegate

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Sep 12, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@socket-security

socket-security Bot commented Sep 12, 2026

Copy link
Copy Markdown

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@github-actions

github-actions Bot commented Sep 12, 2026

Copy link
Copy Markdown

Antigravity review (Gemini via Ultra)

This PR refreshes dependencies across Cargo, Gradle, and GitHub Actions, introduces Dependabot grouping for coupled Android artifacts, and fixes a blind spot by adding an excluded Cargo workspace member to Dependabot's watch list.

Blocking issues

None found.

Suggestions

  • .github/dependabot.yml (line 106): The pattern "com.android.*" is overly broad and may unintentionally capture other Android tooling or libraries. Prefer explicitly listing "com.android.application" and "com.android.test" if they are the only coupled artifacts you intend to group.
  • CHANGELOG.md (lines 31-69): The changelog entry reads like a PR description, documenting internal tooling behaviors, Dependabot quirks, and CI architecture rather than user-facing changes. Consider moving the extensive rationale to the commit message and keeping the changelog concise.
  • crates/rustynes-frontend/web/Trunk.toml: Since Dependabot does not natively monitor Trunk.toml, future wasm-bindgen bumps will continue to break CI until manually synced. Consider adding a step to your CI pipeline that automatically asserts the CLI version in Trunk.toml matches Cargo.lock, failing fast with a clear error message.

Nitpicks

  • .github/dependabot.yml (line 110): The androidx.baselineprofile* wildcard could be tightened to androidx.baselineprofile:* or the exact plugin ID to prevent accidental matches on unrelated artifacts in the future.

Automated first-pass review by agy on a self-hosted runner -- not a human review.

Earlier review rounds (newest first)
Round reviewed at 2026-09-12 05:44 UTC

Antigravity review (Gemini via Ultra)

This PR consolidates dependency updates across Cargo, Android, and GitHub Actions, and configures Dependabot to track an previously unmonitored workspace crate.

Blocking issues

  • Correctness: In android/app/build.gradle.kts, androidx.glance:glance-material3 is bumped to 1.3.0-alpha02, but androidx.glance:glance-appwidget on the preceding line is left at 1.3.0-alpha01. These are tightly coupled Jetpack libraries and must be bumped in lockstep to prevent ABI mismatches or runtime crashes.

Suggestions

  • .github/dependabot.yml: Since this PR actively cleans up Dependabot's tendency to desync coupled libraries (like AGP and com.android.test), consider adding a groups configuration block for both the cargo and gradle ecosystems. This allows Dependabot to bundle related updates automatically and avoid these blind spots.
  • .github/workflows/security.yml: The changelog explicitly mentions verifying SHA pins for actions as a security measure, but taiki-e/install-action (lines 78 and 94) uses a mutable version tag (@v2.87.11). Consider pinning this to a specific commit SHA for consistency with the rest of your CI boundary.

Nitpicks

  • None.

Automated first-pass review by agy on a self-hosted runner -- not a human review.

…t was about

Antigravity's review of this PR found that it bumps
`androidx.glance:glance-material3` to 1.3.0-alpha02 and leaves
`androidx.glance:glance-appwidget` at alpha01 on the line above. Confirmed and
fixed: alpha02 exists for both (checked against Google Maven, not assumed), and
they are one Jetpack library split across two artifacts.

This is the PR's own subject happening to the PR. Its whole argument is that
Dependabot raises one PR per artifact and coupled pins therefore desync -- and
it caught AGP's two halves and the baselineprofile pair by hand while missing a
third. Doing it by hand is what failed.

So the fix is not just the version. `.github/dependabot.yml` now GROUPS the
three coupled sets for the gradle ecosystem -- `com.android.*`, the
benchmark/baselineprofile pair, and `androidx.glance:*` -- so each set arrives
as one PR and the halves cannot be merged apart. A rule the tooling enforces
beats a rule someone has to remember, which is this repository's own standing
lesson and the reason the grouping is preferred over adding another comment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014qfTKi2M3swo7qnwvYCkDj
@doublegate

Copy link
Copy Markdown
Owner Author

Triaged against the code. The blocking finding is correct, and it is this PR's own subject happening to this PR. Fixed in 0d737087.

Blocking — androidx.glance desync: CONFIRMED

glance-appwidget was left at 1.3.0-alpha01 on the line above glance-material3:1.3.0-alpha02. Verified rather than assumed — 1.3.0-alpha02 exists for both artifacts on Google Maven — and bumped.

Worth naming plainly: this PR's entire argument is that Dependabot raises one PR per artifact and coupled pins therefore desync. It caught AGP's two halves and the benchmark/baselineprofile pair by hand, and missed a third the same way. Doing it by hand is precisely what failed.

Suggestion — groups in dependabot.yml: ADOPTED, and it is the real fix

Taken for exactly the reason above, so the correction is enforced rather than remembered. The gradle ecosystem now groups the three coupled sets:

  • com.android.*com.android.application and com.android.test share a version coordinate;
  • androidx.benchmark:* + androidx.baselineprofile* — the plugin tracks the library;
  • androidx.glance:* — the pair this review found.

Each set now arrives as one PR and the halves cannot be merged apart.

Not added for cargo: that ecosystem already has a production-dependencies group (which is how #504 arrived as one PR for three crates), and the one coupling that bites there — wasm-bindgen and the CLI pin in web/Trunk.toml — is not two cargo artifacts, so no grouping can express it. That one is held by libretro_info_audit-style prose plus the comment in Trunk.toml; a gate asserting the two match would be the real answer and is a bigger change than this PR.

Suggestion — SHA-pin taiki-e/install-action: DECLINED, with the reason

Not a drive-by change. AGENTS.md records the decision: dtolnay/rust-toolchain is SHA-pinned specifically because it feeds 12 of 19 checkouts and installs the compiler, "the hardest place to notice a compromise". The other ~12 actions "remain on @vN tags by choice: those are not expected to move, and blanket SHA-pinning is a maintenance-policy decision, not a drive-by fix."

Your point has real force for this particular action — it installs binaries into the CI environment, so it is closer to rust-toolchain than to actions/checkout — and it is already pinned to an exact patch tag rather than a floating major, which is a middle position. But widening the SHA-pin policy is the maintainer's call and belongs in its own change with its own reasoning, not inside a dependency refresh. Flagged rather than silently dropped.

Note on the checked claims

The PR body says both existing SHA pins were verified against the API rather than assumed; that stands — actions/checkout resolves to v7.0.1 and dtolnay/rust-toolchain to v1, both already current.

@doublegate
doublegate merged commit c3e5734 into main Sep 12, 2026
32 checks passed
@doublegate
doublegate deleted the chore/dependency-refresh branch September 12, 2026 06:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants