Bump the dependencies group with 8 updates #280
Conversation
Bumps the dependencies group with 8 updates: | Package | From | To | | --- | --- | --- | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.98` | `1.0.99` | | [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.15` | `0.7.16` | | [security-framework](https://github.com/kornelski/rust-security-framework) | `3.2.0` | `3.3.0` | | [sysinfo](https://github.com/GuillaumeGomez/sysinfo) | `0.36.1` | `0.37.0` | | [tempfile](https://github.com/Stebalien/tempfile) | `3.20.0` | `3.21.0` | | [regex](https://github.com/rust-lang/regex) | `1.11.1` | `1.11.2` | | [tree-sitter-javascript](https://github.com/tree-sitter/tree-sitter-javascript) | `0.23.1` | `0.25.0` | | [libc](https://github.com/rust-lang/libc) | `0.2.174` | `0.2.175` | Updates `anyhow` from 1.0.98 to 1.0.99 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](dtolnay/anyhow@1.0.98...1.0.99) Updates `tokio-util` from 0.7.15 to 0.7.16 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-util-0.7.15...tokio-util-0.7.16) Updates `security-framework` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/kornelski/rust-security-framework/releases) - [Commits](kornelski/rust-security-framework@v3.2.0...v3.3.0) Updates `sysinfo` from 0.36.1 to 0.37.0 - [Changelog](https://github.com/GuillaumeGomez/sysinfo/blob/master/CHANGELOG.md) - [Commits](GuillaumeGomez/sysinfo@v0.36.1...v0.37.0) Updates `tempfile` from 3.20.0 to 3.21.0 - [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md) - [Commits](Stebalien/tempfile@v3.20.0...v3.21.0) Updates `regex` from 1.11.1 to 1.11.2 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](rust-lang/regex@1.11.1...1.11.2) Updates `tree-sitter-javascript` from 0.23.1 to 0.25.0 - [Release notes](https://github.com/tree-sitter/tree-sitter-javascript/releases) - [Commits](tree-sitter/tree-sitter-javascript@v0.23.1...v0.25.0) Updates `libc` from 0.2.174 to 0.2.175 - [Release notes](https://github.com/rust-lang/libc/releases) - [Changelog](https://github.com/rust-lang/libc/blob/0.2.175/CHANGELOG.md) - [Commits](rust-lang/libc@0.2.174...0.2.175) --- updated-dependencies: - dependency-name: anyhow dependency-version: 1.0.99 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: tokio-util dependency-version: 0.7.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: security-framework dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: sysinfo dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: tempfile dependency-version: 3.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: regex dependency-version: 1.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: tree-sitter-javascript dependency-version: 0.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: libc dependency-version: 0.2.175 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
|
Can dependabot not be configured to make these bumps lockfile-only? Bumping the minimum version in Cargo.toml for no reason really isn't necessary. |
|
I don't hold super strong opinions here, but I generally dislike the idea of declaring support for a version that we don't actively test against. |
Well, that depends on what "declaring support for" means ... the way it's set up now is that the project always forces a dependency on the ~ latest version even if that's not technically necessary. This can cause unnecessary MSRV bumps, or a lot of duplicate dependencies in the dependency tree - which can sometimes cause compiled artifacts to be significantly larger than necessary. (It's probably not practical to enforce having only one version of every dependency in the dependency tree (cargo-deny can be set up to do that - with an allowlist for exceptions) though, since that often leads to not being able to bump dependencies for relatively long periods of time.) Mostly though I kind of have a negative opinion about dependabot bumping "real" dependencies (as opposed to only bumping the lockfile, when possible) because it is really annoing to deal with when doing distribution packaging (mostly affects Fedora and debian). Bumping project dependencies for no good reason often creates a lot of work for those downstream consumers. As an aside, it appears that the mitmproxy package in debian is stuck at version 8.1.1 (the last one before Rust components were added), which isn't great ... |
|
The problem is that cargo does not seem to have a way to test with the oldest allowed dependency versions. This means that we won't notice in CI if we break old versions (despite still declaring support). I don't want to declare support for an older version we can't actively test against. I agree that Dependabot's default strategy is annoying for distributions, but it's such a widely used pattern that I think this needs to be solved with better distribution tooling. Except for downstream distributions, there are really very few reasons to declare support for older versions. Duplicate dependencies can be an example, but empirically that's never been a big issue for us. |
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
|
@dependabot recreate |
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
It actually does (but it's still unstable): But I'm OK with keeping the current "strategy" for mitmproxy_rs. |
|
Oh, super cool! Thanks, TIL. This is really useful for libs. :)
…On Tue, 9 Sept 2025, 17:29 Fabio Valentini, ***@***.***> wrote:
*decathorpe* left a comment (mitmproxy/mitmproxy_rs#280)
<#280 (comment)>
cargo does not seem to have a way to test with the oldest allowed
dependency versions
It actually does (but it's still unstable): -Zminimal-versions or
-Zdirect-minimal-versions
https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#direct-minimal-versions
But I'm OK with keeping the current "strategy" for mitmproxy_rs.
—
Reply to this email directly, view it on GitHub
<#280 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAHY2PTZ7BSTSH7LS23LTFT3R3W5TAVCNFSM6AAAAACFN7MAGKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTENZRGIZTQNRXHE>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
Bumps the dependencies group with 8 updates:
1.0.981.0.990.7.150.7.163.2.03.3.00.36.10.37.03.20.03.21.01.11.11.11.20.23.10.25.00.2.1740.2.175Updates
anyhowfrom 1.0.98 to 1.0.99Release notes
Sourced from anyhow's releases.
Commits
f2b963aRelease 1.0.992c64c15Merge pull request #420 from dtolnay/enotempty8cf66f7Allow build-script cleanup failure with NFSv3 output directory to be non-fatalf5e145cRevert "Pin nightly toolchain used for miri job"1d7ef1dUpdate ui test suite to nightly-2025-06-306929572Update ui test suite to nightly-2025-06-1837224e3Ignore mismatched_lifetime_syntaxes lint11f0e81Pin nightly toolchain used for miri jobd04c999Raise required compiler for backtrace feature to rust 1.82219d163Update test suite to nightly-2025-05-01Updates
tokio-utilfrom 0.7.15 to 0.7.16Commits
cf6b50achore: prepare tokio-util v0.7.16 (#7507)416e36btask: stabiliseJoinMap(#7075)9741c90sync: document cancel safety onSetOnce::wait(#7506)4e3f17bcodec: also apply capacity to read buffer inFramed::with_capacity(#7500)86cbf81Merge 'tokio-1.47.1' into 'master'be8ee45chore: prepare Tokio v1.47.1 (#7504)d9b1916Merge 'tokio-1.43.2' into 'tokio-1.47.x' (#7503)db8edc6chore: prepare Tokio v1.43.2 (#7502)e47565bblocking: clarify that spawn_blocking is aborted if not yet started (#7501)4730984readme: add 1.47 as LTS release (#7497)Updates
security-frameworkfrom 3.2.0 to 3.3.0Commits
bb4f7b4Bumpf65ccc6Allow adding a client-constructed access control object to an item.2ecca58Password options cleanupUpdates
sysinfofrom 0.36.1 to 0.37.0Changelog
Sourced from sysinfo's changelog.
Commits
317d873Merge pull request #1569 from GuillaumeGomez/update-version65797c1Update crate version to0.37.0634f800Update CHANGELOG for0.37.0version1862c57Merge pull request #1568 from GuillaumeGomez/internal-improvement5d189e6RenamePathHandler::joinintoPathHandler::replace_and_jointo make it ea...833b3baImprove process refresh on Linux (#1566)af60d22Merge pull request #1567 from GuillaumeGomez/msrv5fa1b50Fix new clippy lints8ac5855Update minimum supported rust version to 1.8814f55d3Merge pull request #1561 from guillaumecl/idUpdates
tempfilefrom 3.20.0 to 3.21.0Changelog
Sourced from tempfile's changelog.
Commits
48bff5ftest(tempdir): configure tempdir on wasi704a1d2test(tempdir): cleanup tempdir tests and run more tests on wasia0dc80dAdd Android CI target (#367)4ad1ae6chore(release): release 3.21.03849eddbuild(deps): bump actions/checkout from 4 to 5 (#368)0657fdfbuild(deps): update windows-sys requirement <0.61 (#360)69b95c7ci: fix was tests in CI (#361)Updates
regexfrom 1.11.1 to 1.11.2Changelog
Sourced from regex's changelog.
Commits
d0aa5861.11.2a3bf4adregex-cli-0.2.225a15e2rure-0.2.345c3da7regex-lite-0.1.7873ed80regex-automata-0.4.10ea834f8regex-syntax-0.8.686836fbchangelog: 1.11.263a26c1cargo: ensure that 'perf' doesn't enable 'std' implicitly (#1150)dd96592doc: clarify CRLF mode effect931dae0cargo: pointrepositorymetadata to clonable URLsUpdates
tree-sitter-javascriptfrom 0.23.1 to 0.25.0Release notes
Sourced from tree-sitter-javascript's releases.
Commits
44c892e0.25.05f100b0docs: clarify targeted ECMAScript version2409583chore: generate39798e2feat: addawaitto reserved identifiersc220d3efeat: add reserved words7ef8551fix: allowofas identifiers in for loopsebdb4f1feat: addusingdeclaration166a565ci: use macos-latestbe1e969build: update bindingsb131ccbci: bump actions/checkout from 4 to 5Updates
libcfrom 0.2.174 to 0.2.175Release notes
Sourced from libc's releases.
... (truncated)
Changelog
Sourced from libc's changelog.
... (truncated)
Commits
84e26e6Update the lockfile4d04aeechore: release libc 0.2.17594a7f32cleanup: Format a file that was missed1725273Rename the ctest file frommaintocteste9b021bfreebsd adding further TCP stack related constants.9606a29freebsd15: Add ki_uerrmsg to struct kinfo_proc2816bc2libc-test: include sys/ktls.h on freebsdadfe283libc-test: Account for xktls_session_onedir::gen (freebsd)4cc1bf4freebsd: Document avoidance of reserved namegen7cdcaa6freebsd: Fix type of struct xktls_session_onedir, field ifnetMost Recent Ignore Conditions Applied to This Pull Request
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions