chore: refresh dependencies and linters - #398
Closed
create-pr-workflow-auth[bot] wants to merge 1 commit into
Closed
chore: refresh dependencies and linters#398create-pr-workflow-auth[bot] wants to merge 1 commit into
create-pr-workflow-auth[bot] wants to merge 1 commit into
Conversation
Deploying ryl-docs with
|
| Latest commit: |
c0578d9
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://e089c0fa.ryl-docs.pages.dev |
| Branch Preview URL: | https://bot-update-deps-and-linters.ryl-docs.pages.dev |
This was referenced Aug 16, 2026
owenlamont
added a commit
that referenced
this pull request
Aug 16, 2026
* fix(deps): bump pymdown-extensions to 11.0.1 for two advisories `uv audit` fails on main: pymdown-extensions 10.21.3 arrives via zensical (docs) and carries GHSA-gm37-52c6-37mw (high, exponential-backtracking ReDoS in the caret, tilde, betterem and magiclink inline processors) and GHSA-9xwg-3r6f-jcx2 (path traversal in the b64 extension). Both are fixed by 11.0.1. * fix(ci): grant the refresh bot token workflows write access The `Bump pinned wingetcreate version` step edits `.github/workflows/release.yml`, but the App token was minted with only contents+pull-requests write. GitHub rejects an App push touching `.github/workflows/`, so the refresh workflow has failed to push since 2026-07-26 (three consecutive weekly runs) and #398 has been frozen at its 2026-07-19 state. The App installation also needs the Workflows repository permission granted.
owenlamont
added a commit
that referenced
this pull request
Aug 16, 2026
* fix(deps): bump pymdown-extensions to 11.0.1 for two advisories `uv audit` fails on main: pymdown-extensions 10.21.3 arrives via zensical (docs) and carries GHSA-gm37-52c6-37mw (high, exponential-backtracking ReDoS in the caret, tilde, betterem and magiclink inline processors) and GHSA-9xwg-3r6f-jcx2 (path traversal in the b64 extension). Both are fixed by 11.0.1. * fix(ci): grant the refresh bot token workflows write access The `Bump pinned wingetcreate version` step edits `.github/workflows/release.yml`, but the App token was minted with only contents+pull-requests write. GitHub rejects an App push touching `.github/workflows/`, so the refresh workflow has failed to push since 2026-07-26 (three consecutive weekly runs) and #398 has been frozen at its 2026-07-19 state. The App installation also needs the Workflows repository permission granted. * feat: migrate to granit-parser 1.1.0 Supersedes the Dependabot bump in #409, which proposed 0.0.7 — five releases behind by now, and a version whose only relevant change (the `Event::DocumentStart` arity) is a subset of this one. Mechanical API updates: - `Event::DocumentStart` carries the `%YAML` version alongside the explicit flag. - `Event::Nothing` is gone; those no-op arms become the wildcard that `Event` now requires as a `#[non_exhaustive]` enum. - `Tag` fields are private, so `handle`/`suffix` go through their accessors. - `Scanner` is a fallible, fused iterator. Call sites take `.map_while(Result::ok)`, preserving the old stop-at-first-lexical-error behaviour, and read `Token` through `into_parts()` now its fields are private. `scanner_error` collapses into a single `find_map(Result::err)`. Three behaviour changes needed real fixes rather than a signature update: `collect_comments` recovered past parse errors by continuing to pull events, but the parser is now fused and yields `None` for good after its first error, so no comment after one was ever reported (caught by `checks_comments_after_undeclared_anchor_alias`). It now scans instead of parses: an undefined alias is a parse error, not a lexical one, so the scanner tokenizes straight past it. Consumers only ever test for `Right`, so the scanner reporting an own-line comment as `Free` where the parser said `Above` changes nothing. `document-end` classified its marker from the text the `DocumentEnd` span covered, but granit now spans only the explicit `...` and reports an implicit end as a zero-width point — sometimes on the marker, sometimes on the break before it. Every implicit end therefore looked unmarked and multi-document inputs lost a violation. The zero-width case now reads the source forward, which is also what recovers the marker's own line. Checked against real yamllint across twelve inputs (two/three documents, explicit end, `--- foo`, empty documents, blank lines, comments, CRLF, no trailing newline): all twelve agree. The spanned branch collapses to `ExplicitEnd`, retiring `classify_document_end_marker_bytes`, `trim_ascii` and `byte_slice`. `empty-values` reported a tagged empty value at EOF (`a: !!str`) at column 2, which was the clamp pulling back granit's old out-of-bounds position rather than a chosen column. granit now positions the implicit scalar in bounds, giving column 9, which matches the untagged `a:` convention of pointing where the value would go. yamllint reports nothing here at all, so there is no compatibility target either way. Net -72 lines. Coverage clean, both clippy gates pass, 1749 tests pass.
owenlamont
added a commit
that referenced
this pull request
Aug 16, 2026
Replaces the stalled #398 refresh, which has been frozen at its 2026-07-19 state since the bot lost push access. - Rust 1.96.0 -> 1.97.1 (`rust-toolchain.toml`, `clippy.toml` msrv, AGENTS.md) - `cargo update` - `prek autoupdate --cooldown-days 7`: rumdl 0.2.52, ruff 0.16.2, typos 1.49.0, zizmor 1.29.0 - Allow the `syn` duplicate: `cargo update` moved the build graph to syn 3.x, but synstructure 0.13 still pins syn 2.x and reaches the graph only through the `jsonschema` dev-dependency, so `clippy::multiple_crate_versions` fires on a duplicate no dependency bump of ours can resolve. - ruff 0.16's RUF105/RUF106 rewrote one suppression comment. Rust 1.97 adds nothing this codebase can use: the stabilised APIs are integer bit-manipulation helpers, and `char::is_control`'s new const-ness is unusable at our call sites, which all sit in non-const predicates. Clippy under `msrv = "1.97.1"` reports no modernisation opportunities.
owenlamont
added a commit
that referenced
this pull request
Aug 16, 2026
Replaces the stalled #398 refresh, which has been frozen at its 2026-07-19 state since the bot lost push access. - Rust 1.96.0 -> 1.97.1 (`rust-toolchain.toml`, `clippy.toml` msrv, AGENTS.md) - `cargo update` - `prek autoupdate --cooldown-days 7`: rumdl 0.2.52, ruff 0.16.2, typos 1.49.0, zizmor 1.29.0 - Allow the `syn` duplicate: `cargo update` moved the build graph to syn 3.x, but synstructure 0.13 still pins syn 2.x and reaches the graph only through the `jsonschema` dev-dependency, so `clippy::multiple_crate_versions` fires on a duplicate no dependency bump of ours can resolve. - ruff 0.16's RUF105/RUF106 rewrote one suppression comment. Rust 1.97 adds nothing this codebase can use: the stabilised APIs are integer bit-manipulation helpers, and `char::is_control`'s new const-ness is unusable at our call sites, which all sit in non-const predicates. Clippy under `msrv = "1.97.1"` reports no modernisation opportunities.
Owner
|
Superseded by #412, which does the same This branch had been frozen at its 2026-07-19 state because the refresh workflow lost push access (fixed in #411), and its |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated dependency and linter refresh:
cargo updateprek autoupdate --cooldown-days 7wingetcreateversion against the latestwinget-createreleaseIf the
wingetcreatepin changed, verify the version and SHA256 againsthttps://github.com/microsoft/winget-create/releases/latest before merging.