chore(deps): batch the outstanding dependabot bumps + group future ones - #640
Merged
Conversation
Each manifest and dependency was opening its own PR. Use `directories` to span the two cargo manifests and the five pip ones from a single update config, and a catch-all group per ecosystem, so a week's bumps arrive as four PRs instead of one per dependency per directory. Ecosystems stay separate: cargo and github-actions bumps exercise different CI legs, and the pre-commit gate runs the full workspace suite — mixing them makes a red run harder to attribute. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Rolls up the seven open dependabot PRs (#632–#638): base64 0.22.1 -> 0.23.1 (workspace + /fuzz) actions/checkout 7.0.0 -> 7.0.1 astral-sh/setup-uv 8.2.0 -> 10.0.1 docker/setup-buildx-action 4.1.0 -> 4.3.0 taiki-e/install-action 2.82.3 -> 2.86.2 vmactions/freebsd-vm 1.4.8 -> 1.5.3 base64 is a semver-major bump, but the only call sites name the `general_purpose::STANDARD` engine explicitly (musefs-format/src/ogg/b64.rs and friends) rather than relying on a default, so the encoding is unchanged and no code moved. Workspace builds clean, clippy is quiet, and the full suite passes; `cargo +nightly fuzz build` covers the out-of-workspace fuzz crate, whose lockfile is bumped in step. Also drops a stale `# v4` pin comment beside the checkout SHA in docs.yml, which had been wrong since the v7 bump. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (14)
Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. 📝 WalkthroughWalkthroughThe pull request consolidates Dependabot updates, refreshes pinned GitHub Actions revisions across workflows, and updates ChangesDependency maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This dependency and CI configuration update has no actionable merge-blocking risk remaining and is merge-ready after normal checks and review. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolls the seven open dependabot PRs into one, and changes the dependabot
config so future weeks arrive grouped instead of one PR per dependency per
directory.
Bumps
base64(workspace +/fuzz)actions/checkoutastral-sh/setup-uvdocker/setup-buildx-actiontaiki-e/install-actionvmactions/freebsd-vmbase64is the only semver-major of the set. Every call site names thegeneral_purpose::STANDARDengine explicitly (musefs-format/src/ogg/b64.rsand friends) rather than leaning on a default, so the encoding is unchanged
and no code had to move — relevant because Ogg art rides on
METADATA_BLOCK_PICTUREbase64, where a silent encoder change would be acorrectness bug rather than a build break.
The
/fuzzlockfile is bumped in step, since that crate is outside theworkspace and the pre-commit gate does not cover it.
Also drops a stale
# v4pin comment beside the checkout SHA indocs.ymlthat had been wrong since the v7 bump.
Grouping
.github/dependabot.ymlnow usesdirectoriesto span the two cargomanifests and the five pip ones from a single update config, plus a
catch-all group per ecosystem. That caps a normal week at four PRs.
Ecosystems stay separate on purpose: cargo and github-actions bumps
exercise different CI legs, and the pre-commit gate runs the full workspace
suite, so mixing them makes a red run harder to attribute. The known
tradeoff is that one unmergeable dependency now blocks its whole group —
the fix, if it bites, is splitting the offender into its own named group.
Verification
All local, on the merged branch:
cargo build --all-targets— cleancargo clippy --all-targets -- -D warnings— quietcargo test— 1281 passed, 0 failedcargo test --workspace -- --ignored— the full e2e tier green, includingthe FUSE mount tests (
end_to_end_read_through_mount, the Ogg page/audiovalidators,
randomized_reads_match_oracle_all_formats,mmap_whole_file_matches_pread, the SIGTERM/unmount pair) andall_supported_formats_decode_to_same_pcm_sha_as_source, the ffmpeg PCMcheck that would catch a base64/art regression corrupting audio
scripts/contract-roundtrip.sh— 2 passed (Python-written tags and artsurvive Rust synthesis)
MUSEFS_INTEROP_DIR=... pytest tests/interop— 4 passed, mutagen readingback synthesized tags, binary frames, and M4A multi-cover art
cargo +nightly fuzz build— buildsyamllintover all tracked YAML — cleanThe interop and contract suites ran against a venv built from
tests/interop/requirements.txt(mutagen 1.48.0), since mutagen is not inthe system Python here.
Closes #632
Closes #633
Closes #634
Closes #635
Closes #636
Closes #637
Closes #638
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Maintenance