chore(deps): bump the rust-dependencies group with 5 updates - #2294
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): bump the rust-dependencies group with 5 updates#2294dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the rust-dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [async-trait](https://github.com/dtolnay/async-trait) | `0.1.91` | `0.1.92` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.19` | `2.0.20` | | [napi](https://github.com/napi-rs/napi-rs) | `3.12.0` | `3.12.1` | | [napi-derive](https://github.com/napi-rs/napi-rs) | `3.6.2` | `3.6.3` | | [napi-build](https://github.com/napi-rs/napi-rs) | `2.4.0` | `2.4.1` | Updates `async-trait` from 0.1.91 to 0.1.92 - [Release notes](https://github.com/dtolnay/async-trait/releases) - [Commits](dtolnay/async-trait@0.1.91...0.1.92) Updates `thiserror` from 2.0.19 to 2.0.20 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@2.0.19...2.0.20) Updates `napi` from 3.12.0 to 3.12.1 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-v3.12.0...napi-v3.12.1) Updates `napi-derive` from 3.6.2 to 3.6.3 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-derive-v3.6.2...napi-derive-v3.6.3) Updates `napi-build` from 2.4.0 to 2.4.1 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-build-v2.4.0...napi-build-v2.4.1) --- updated-dependencies: - dependency-name: async-trait dependency-version: 0.1.92 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: thiserror dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi dependency-version: 3.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi-derive dependency-version: 3.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi-build dependency-version: 2.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 69f11ce | Commit Preview URL Branch Preview URL |
Aug 13 2026, 09:35 AM |
chaliy
added a commit
that referenced
this pull request
Aug 14, 2026
Supersedes #2294, adding the supply-chain exemption bumps that PR was missing. Bumps async-trait 0.1.91 -> 0.1.92, napi 3.12.0 -> 3.12.1, napi-build 2.4.0 -> 2.4.1, napi-derive 3.6.2 -> 3.6.3, napi-derive-backend 6.1.1 -> 6.1.2, and thiserror/thiserror-impl 2.0.19 -> 2.0.20. `supply-chain/config.toml` pins exemptions to exact versions, so a dependency bump without a matching exemption bump fails `cargo vet --locked`, which is why #2294's Audit job was red: Vetting Failed! thiserror:2.0.20 missing ["safe-to-deploy"] thiserror-impl:2.0.20 missing ["safe-to-deploy"] async-trait:0.1.92 missing ["safe-to-deploy"] napi:3.12.1 missing ["safe-to-deploy"] napi-build:2.4.1 missing ["safe-to-deploy"] napi-derive:3.6.3 missing ["safe-to-deploy"] napi-derive-backend:6.1.2 missing ["safe-to-deploy"] All seven exemptions now track the locked versions: Vetting Succeeded (27 fully audited, 6 partially audited, 590 exempted) `cargo audit` reports no vulnerabilities; only the two already-suppressed unmaintained warnings remain.
2 tasks
|
Superseded by #2299, which carries the same five dependency bumps plus the The Audit job here fails because With all seven updated: Generated by Claude Code |
chaliy
added a commit
that referenced
this pull request
Aug 14, 2026
## What changed Takes the `rust-dependencies` group bump from #2294 and adds the supply-chain exemption updates that PR was missing, so it can actually go green. Supersedes #2294. | Crate | From | To | |---|---|---| | `async-trait` | 0.1.91 | 0.1.92 | | `napi` | 3.12.0 | 3.12.1 | | `napi-build` | 2.4.0 | 2.4.1 | | `napi-derive` | 3.6.2 | 3.6.3 | | `napi-derive-backend` | 6.1.1 | 6.1.2 | | `thiserror` / `thiserror-impl` | 2.0.19 | 2.0.20 | No source changes — lockfile plus the matching `supply-chain/config.toml` exemptions. ## Why `supply-chain/config.toml` pins every exemption to an **exact** version, so any dependency bump that doesn't carry a matching exemption bump fails `cargo vet --locked`. Dependabot doesn't know about that file, so #2294's Audit job went red. Worth noting for anyone reading #2294's CI log: it looks like only `thiserror` is missing, because the surrounding log grep matches on the substring `error` — which `thiserror` happens to contain. Running `cargo vet` directly shows all seven. ## Before / After **Before** (on #2294's head): ``` $ cargo vet --locked Vetting Failed! 7 unvetted dependencies: async-trait:0.1.92 missing ["safe-to-deploy"] napi:3.12.1 missing ["safe-to-deploy"] napi-build:2.4.1 missing ["safe-to-deploy"] napi-derive:3.6.3 missing ["safe-to-deploy"] napi-derive-backend:6.1.2 missing ["safe-to-deploy"] thiserror:2.0.20 missing ["safe-to-deploy"] thiserror-impl:2.0.20 missing ["safe-to-deploy"] ``` **After**: ``` $ cargo vet --locked Vetting Succeeded (27 fully audited, 6 partially audited, 590 exempted) $ cargo build --workspace Finished `dev` profile [unoptimized + debuginfo] target(s) $ cargo audit warning: 2 allowed warnings found # the two already-suppressed unmaintained advisories # no vulnerabilities ``` ## Risk - **Low** - Patch-level bumps within existing semver ranges, no source changes. The exemptions were bumped to track the locked versions rather than widened or loosened, so supply-chain coverage is unchanged in kind. ## Checklist - [x] Tests added or updated — n/a, dependency-only; covered by the existing suite and the `cargo vet` / `cargo audit` gates - [x] Backward compatibility considered --- _Generated by [Claude Code](https://claude.ai/code/session_014KSUiRr2RqUa1wyuh7beXB)_
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/cargo/rust-dependencies-f917ef617e
branch
August 14, 2026 09:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the rust-dependencies group with 5 updates:
0.1.910.1.922.0.192.0.203.12.03.12.13.6.23.6.32.4.02.4.1Updates
async-traitfrom 0.1.91 to 0.1.92Release notes
Sourced from async-trait's releases.
Commits
82e7e9eRelease 0.1.929a35cb8Merge pull request #303 from dtolnay/mustuse875ceecResolve double_must_use clippy lint62993a5Raise minimum tested compiler to rust 1.88Updates
thiserrorfrom 2.0.19 to 2.0.20Release notes
Sourced from thiserror's releases.
Commits
b1d5db5Release 2.0.20c4c3ebdMerge pull request #454 from dtolnay/clippy2266152Suppress redundant_field_names clippy lint2901cfdRaise minimum tested compiler to rust 1.88aa9d91fUpdate ui tests for version 2.0.19Updates
napifrom 3.12.0 to 3.12.1Release notes
Sourced from napi's releases.
Commits
956e452chore: release (#3448)73048f5chore(release): publish61fae8afix(napi): stop unloading addons with live native code, preserve non-Error re...93e86cechore(release): publish2c90599fix(cli): support npm 12 pack output (#3449)360b1ecfix(wasi): avoid randomness during module registration (#3447)b648c40build(deps): bump nanoid from 3.3.16 to 3.3.18 (#3446)ffda4efchore(deps): update dependency js-yaml to v4.3.1 [security] (#3445)387b0dcfeat(cli): size WASI browser worker pools from navigator.hardwareConcurrency ...61e4346build(deps): bump fast-uri from 3.1.4 to 3.1.5 (#3440)Updates
napi-derivefrom 3.6.2 to 3.6.3Release notes
Sourced from napi-derive's releases.
Commits
956e452chore: release (#3448)73048f5chore(release): publish61fae8afix(napi): stop unloading addons with live native code, preserve non-Error re...93e86cechore(release): publish2c90599fix(cli): support npm 12 pack output (#3449)360b1ecfix(wasi): avoid randomness during module registration (#3447)b648c40build(deps): bump nanoid from 3.3.16 to 3.3.18 (#3446)ffda4efchore(deps): update dependency js-yaml to v4.3.1 [security] (#3445)387b0dcfeat(cli): size WASI browser worker pools from navigator.hardwareConcurrency ...61e4346build(deps): bump fast-uri from 3.1.4 to 3.1.5 (#3440)Updates
napi-buildfrom 2.4.0 to 2.4.1Release notes
Sourced from napi-build's releases.
Commits
956e452chore: release (#3448)73048f5chore(release): publish61fae8afix(napi): stop unloading addons with live native code, preserve non-Error re...93e86cechore(release): publish2c90599fix(cli): support npm 12 pack output (#3449)360b1ecfix(wasi): avoid randomness during module registration (#3447)b648c40build(deps): bump nanoid from 3.3.16 to 3.3.18 (#3446)ffda4efchore(deps): update dependency js-yaml to v4.3.1 [security] (#3445)387b0dcfeat(cli): size WASI browser worker pools from navigator.hardwareConcurrency ...61e4346build(deps): bump fast-uri from 3.1.4 to 3.1.5 (#3440)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions