Update cargo to v2.3.6 - #587
Conversation
Deploying mouseterm with
|
| Latest commit: |
6d03ca3
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://fa7958f1.mouseterm.pages.dev |
| Branch Preview URL: | https://renovate-cargo.mouseterm.pages.dev |
dormouse-bot
left a comment
dormouse-bot
left a comment
There was a problem hiding this comment.
Reviewing as a draft — flagging anything that looks worth a quick fix. Mark ready for a full review.
The lockfile change itself is a correct, mechanical re-resolution: tauri-plugin-shell 2.3.5→2.3.6 and tauri-plugin-updater 2.10.1→2.11.0, with core-foundation now disambiguated by version because system-configuration 0.7.0 pins 0.9.4 alongside the existing 0.10.1, and tempfile's getrandom edge deduped onto 0.4.3 (0.3.4 stays, tauri still uses it). No removals.
Build & Test is red on the disclosure gate, and it will stay red until website/src/data/dependencies-cargo.json is regenerated. Renovate can't run node website/scripts/generate-deps.js, so a Cargo.lock-only bump always leaves the snapshot behind — docs/specs/security-supply-chain.md -> "Disclosure" makes that a FAIL IF, and this is the fourth time it's needed a follow-up commit (86a3c75e, 4b42808a, e60906c5, 258ba681). I'm pushing the regeneration to this branch so the PR can go green; if Renovate rebases the branch it will need reapplying.
Worth knowing what the regenerated snapshot discloses: hyper-util 0.1.20 gained its system-proxy feature here, pulling in system-configuration + system-configuration-sys on macOS and windows-registry on Windows. That means the updater's HTTP client now reads the OS proxy configuration on those platforms — no spec asserts otherwise, so nothing to change, but it's a real behavior delta inside a "patch + minor" bump.
One thing I did not treat as a problem: the JS bindings stay at @tauri-apps/plugin-updater 2.10.1 / plugin-shell 2.3.5 because Renovate splits npm and cargo into separate PRs. Newer Rust plugin against older guest JS is the safe direction within a major — the Rust side implements the commands — so the drift resolves on its own at the next npm run.
…n bumps Renovate cannot run website/scripts/generate-deps.js, so a Cargo.lock-only bump leaves website/src/data/dependencies-cargo.json behind and the 'Dependency disclosure is current' gate in ci.yml goes red (docs/specs/security-supply-chain.md -> Disclosure). Records tauri-plugin-shell 2.3.6 and tauri-plugin-updater 2.11.0 as direct, and adds the transitive crates the new resolution pulls in: core-foundation 0.9.4, system-configuration 0.7.0, system-configuration-sys 0.6.0, and windows-registry 0.6.1 (hyper-util's system-proxy feature).
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
2 participants
This PR contains the following updates:
2.3.5→2.3.62.10.1→2.11.0Configuration
📅 Schedule: (in timezone America/Los_Angeles)
* * * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.