chore(deps): refresh every dependency the project can move, and close two blind spots - #508
Conversation
… two blind spots Consolidates the seven open Dependabot PRs and everything else that could move. Not a stylistic preference: THREE of these pins are COUPLED, and merging the Dependabot PRs one at a time desyncs them. CARGO -- 53 crates to the latest 1.96-compatible versions, covering all three of the grouped production PR (`toml` 1.1.4 -> 1.1.6, one further than proposed; `ureq` 3.4.0 -> 3.4.1; `cc` 1.4.4 -> 1.4.5). The coupled one is `wasm-bindgen` 0.2.127 -> 0.2.128. The CLI version pinned in `crates/rustynes-frontend/web/Trunk.toml` must equal the library in `Cargo.lock` EXACTLY; a mismatch fails `trunk build` and the Pages deploy while wasm clippy still passes, so no gate but that pin would catch it. Bumped here. ANDROID -- the five Gradle bumps, plus TWO PINS DEPENDABOT COULD NOT KNOW TO MOVE WITH THEM. `com.android.test` shares AGP's version coordinate (its own comment in `android/build.gradle.kts` says so) and `androidx.baselineprofile` tracks `benchmark-macro-junit4`. Dependabot raises each artifact separately, so merging its `com.android.application` 9.4.0 PR alone leaves `com.android.test` at 9.3.2 -- two halves of one AGP release train, out of step, in a job that is deliberately NOT a required check and therefore would not have stopped anyone. The recorded AGP BUILD SUCCESSFUL measurement stays stated at 9.3.2 rather than being reworded to 9.4.0. No Android toolchain exists on this machine, CI's Gradle bundle job is what re-establishes it, and a measurement nobody re-ran must not be re-attributed to a version nobody tested it on. GITHUB ACTIONS -- `taiki-e/install-action` 2.87.0 -> 2.87.11 (Dependabot proposed 2.87.5). Everything else was ALREADY current, checked rather than assumed: every other action is at its latest major, and both SHA pins already resolve to the current tag (`actions/checkout` -> v7.0.1, `dtolnay/rust-toolchain` -> v1), verified through the API. The three `pre-commit` hook pins are likewise already latest. DEPENDABOT WAS BLIND TO `crates/rustynes-cosim`, AND HAD BEEN ALL ALONG. That crate is excluded from the workspace on purpose -- cargo unifies features across a workspace build and it mandatorily enables two trace features that select a different per-dot loop -- so it carries its OWN `Cargo.lock`, which the `/` cargo entry cannot reach. Four crates had drifted there with nothing watching them. Added a `/crates/rustynes-cosim` directory entry and updated the lock. The exclusion is deliberate and stays; the blind spot it created does not. It is the same shape as every "the gate does not reach the code" finding in this repository, one layer out into the tooling. THE egui 0.36 / wgpu 30 HOLD IS RE-MEASURED, NOT RE-ASSERTED. The note in `Cargo.toml` said "0.36.1 is the newest on crates.io as of 2026-08". 0.36.2 shipped 2026-09-08 and still carries the blocker, established the cheap way: a three-line scratch crate depending on `egui-winit = "0.36.2"` with this project's exact feature set fails `cargo check --target wasm32-unknown-unknown` with the same E0407, and 0.36.2's `NativeFile` still implements `bytes()` with no cfg gate. The note now carries that reproduction, so the next attempt costs two minutes rather than a full migration -- and it records that the preserved migration branch is based on a pre-v2.3.2 tree, so it is a reference for the five API deltas rather than something to cherry-pick. NOT MOVED, and why: `getrandom` 0.2/0.3 -> 0.4 and `generic-array` 0.14.7 -> 0.14.9 are transitive and held by dependents' requirements, not by anything this repository states. The Rust toolchain stays at 1.96.0 -- `rust-toolchain. toml` carries an explicit warning that 1.97 turns the libretro image's injected `-C ar` from a warning into a hard error and fails all four Apple buildbot jobs together, and that is a change with its own blast radius rather than a dependency refresh. Gates, all run in a worktree so they did not contend with the accuracy sweep in the main tree: `cargo check --workspace`; `cargo clippy --workspace --all-targets`; the `retroachievements`, `scripting` and `scripting,hd-pack` frontend combos; BOTH wasm32 invocations (default and `wasm-canvas`); the `thumbv7em-none-eabihf` no_std build, which is the only thing that catches an `lz4_flex` feature regression; `RUSTDOCFLAGS="-D warnings" cargo doc`; `cargo test --workspace` at 25 suites and 0 failures; and `cargo deny check` -- advisories, bans, licenses and sources all ok. `pre-commit` over the changed files only, never `--all-files`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qfTKi2M3swo7qnwvYCkDj
|
Warning Review limit reachedNext included review available in 23 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (8)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe pull request refreshes Android, WebAssembly, and security-tool versions. It adds Dependabot monitoring for ChangesDependency and tooling refresh
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Merge Risk: ⚪ Minimal · up to The dependency pins are aligned at rc02, and no actionable merge-blocking issue remains. 🚥 Pre-merge checks | ✅ 9✅ Passed checks (9 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Antigravity review (Gemini via Ultra)This PR refreshes dependencies across Cargo, Gradle, and GitHub Actions, introduces Dependabot grouping for coupled Android artifacts, and fixes a blind spot by adding an excluded Cargo workspace member to Dependabot's watch list. Blocking issuesNone found. Suggestions
Nitpicks
Automated first-pass review by Earlier review rounds (newest first)Round reviewed at 2026-09-12 05:44 UTCAntigravity review (Gemini via Ultra)This PR consolidates dependency updates across Cargo, Android, and GitHub Actions, and configures Dependabot to track an previously unmonitored workspace crate. Blocking issues
Suggestions
Nitpicks
Automated first-pass review by |
…t was about Antigravity's review of this PR found that it bumps `androidx.glance:glance-material3` to 1.3.0-alpha02 and leaves `androidx.glance:glance-appwidget` at alpha01 on the line above. Confirmed and fixed: alpha02 exists for both (checked against Google Maven, not assumed), and they are one Jetpack library split across two artifacts. This is the PR's own subject happening to the PR. Its whole argument is that Dependabot raises one PR per artifact and coupled pins therefore desync -- and it caught AGP's two halves and the baselineprofile pair by hand while missing a third. Doing it by hand is what failed. So the fix is not just the version. `.github/dependabot.yml` now GROUPS the three coupled sets for the gradle ecosystem -- `com.android.*`, the benchmark/baselineprofile pair, and `androidx.glance:*` -- so each set arrives as one PR and the halves cannot be merged apart. A rule the tooling enforces beats a rule someone has to remember, which is this repository's own standing lesson and the reason the grouping is preferred over adding another comment. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qfTKi2M3swo7qnwvYCkDj
|
Triaged against the code. The blocking finding is correct, and it is this PR's own subject happening to this PR. Fixed in Blocking —
|
What this is
The seven open Dependabot PRs, consolidated, plus everything else the project could move — and two coverage gaps that consolidation exposed.
Consolidating is not a stylistic preference here: three of these pins are coupled, and merging the Dependabot PRs one at a time desyncs them.
Cargo — 53 crates
cargo updateto the latest 1.96-compatible versions. Covers all three crates of the grouped production PR:toml1.1.4 → 1.1.6 (one further than proposed),ureq3.4.0 → 3.4.1,cc1.4.4 → 1.4.5.The coupled one is
wasm-bindgen0.2.127 → 0.2.128. The CLI version pinned incrates/rustynes-frontend/web/Trunk.tomlmust equal the library inCargo.lockexactly; a mismatch failstrunk buildand the Pages deploy while wasm clippy still passes, so no gate but that pin catches it. Bumped in the same commit.Android — five bumps, plus two Dependabot could not know about
com.android.applicationcom.android.testandroidx.baselineprofilebenchmark-macro-junit4coil-composeuiautomatorglance-material3Merging #502 alone would have left
com.android.testat 9.3.2 — two halves of one AGP release train out of step, in a job that is deliberately not a required check and so would not have stopped anyone.AGP's recorded
BUILD SUCCESSFULmeasurement stays stated at 9.3.2, not reworded to 9.4.0: no Android toolchain exists on the machine that made the bump, CI's Gradle bundle job is what re-establishes it, and a measurement nobody re-ran must not be re-attributed to a version nobody tested it on.GitHub Actions
taiki-e/install-action2.87.0 → 2.87.11 (Dependabot proposed 2.87.5). Everything else was already current — checked, not assumed: every other action is at its latest major, and both SHA pins already resolve to the current tag (actions/checkout→ v7.0.1,dtolnay/rust-toolchain→ v1), verified through the API. The threepre-commithook pins are likewise already latest.Dependabot was blind to
crates/rustynes-cosimThat crate is excluded from the workspace on purpose, so it carries its own
Cargo.lock, which the/cargo entry cannot reach. Four crates had drifted there with nothing watching them. Added a/crates/rustynes-cosimdirectory entry and updated the lock. The exclusion is deliberate and stays; the blind spot it created does not — the same shape as every "the gate does not reach the code" finding here, one layer out into the tooling.The egui 0.36 / wgpu 30 hold is re-measured, not re-asserted
The note said "0.36.1 is the newest on crates.io as of 2026-08". 0.36.2 shipped 2026-09-08 and still carries the blocker. Established the cheap way — a three-line scratch crate depending on
egui-winit = "0.36.2"with this project's exact feature set failscargo check --target wasm32-unknown-unknownwith the sameE0407, and 0.36.2'sNativeFilestill implementsbytes()with no cfg gate.The note now carries that reproduction, so the next attempt costs two minutes instead of a full migration, and records that the preserved migration branch is based on a pre-v2.3.2 tree — a reference for the five API deltas, not something to cherry-pick.
Not moved, and why
getrandom0.2/0.3 → 0.4 andgeneric-array0.14.7 → 0.14.9 are transitive, held by dependents' requirements rather than by anything this repository states.rust-toolchain.tomlcarries an explicit warning that 1.97 turns the libretro image's injected-C arfrom a warning into a hard error and fails all four Apple buildbot jobs together. That is a change with its own blast radius, not a dependency refresh.Gates
Run in a git worktree so they did not contend with the accuracy sweep in the main tree:
cargo check --workspace·cargo clippy --workspace --all-targets· theretroachievements,scriptingandscripting,hd-packfrontend combos · both wasm32 invocations (default andwasm-canvas) · thethumbv7em-none-eabihfno_std build (the only thing that catches anlz4_flexfeature regression) ·RUSTDOCFLAGS="-D warnings" cargo doc·cargo test --workspace— 25 suites, 0 failures ·cargo deny check— advisories, bans, licenses, sources all ok.pre-commitover the changed files only, never--all-files.Supersedes #496, #498, #499, #500, #501, #502 and #504.
🤖 Generated with Claude Code
https://claude.ai/code/session_014qfTKi2M3swo7qnwvYCkDj
Summary by CodeRabbit
Chores
Documentation