chore(deps): bump the cargo group with 5 updates #59
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Bumps the cargo group with 5 updates: | Package | From | To | | --- | --- | --- | | [winnow](https://github.com/winnow-rs/winnow) | `0.7.6` | `0.7.7` | | [jiff](https://github.com/BurntSushi/jiff) | `0.2.9` | `0.2.10` | | [pulldown-cmark](https://github.com/raphlinus/pulldown-cmark) | `0.9.6` | `0.13.0` | | [cc](https://github.com/rust-lang/cc-rs) | `1.2.19` | `1.2.20` | | [jiff-static](https://github.com/BurntSushi/jiff) | `0.2.9` | `0.2.10` | Updates `winnow` from 0.7.6 to 0.7.7 - [Changelog](https://github.com/winnow-rs/winnow/blob/main/CHANGELOG.md) - [Commits](winnow-rs/winnow@v0.7.6...v0.7.7) Updates `jiff` from 0.2.9 to 0.2.10 - [Release notes](https://github.com/BurntSushi/jiff/releases) - [Changelog](https://github.com/BurntSushi/jiff/blob/master/CHANGELOG.md) - [Commits](BurntSushi/jiff@jiff-static-0.2.9...jiff-static-0.2.10) Updates `pulldown-cmark` from 0.9.6 to 0.13.0 - [Release notes](https://github.com/raphlinus/pulldown-cmark/releases) - [Commits](pulldown-cmark/pulldown-cmark@v0.9.6...v0.13.0) Updates `cc` from 1.2.19 to 1.2.20 - [Release notes](https://github.com/rust-lang/cc-rs/releases) - [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md) - [Commits](rust-lang/cc-rs@cc-v1.2.19...cc-v1.2.20) Updates `jiff-static` from 0.2.9 to 0.2.10 - [Release notes](https://github.com/BurntSushi/jiff/releases) - [Changelog](https://github.com/BurntSushi/jiff/blob/master/CHANGELOG.md) - [Commits](BurntSushi/jiff@jiff-static-0.2.9...jiff-static-0.2.10) --- updated-dependencies: - dependency-name: winnow dependency-version: 0.7.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: jiff dependency-version: 0.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: pulldown-cmark dependency-version: 0.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: cc dependency-version: 1.2.20 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo - dependency-name: jiff-static dependency-version: 0.2.10 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
EliahKagan
requested changes
Apr 25, 2025
Member
There was a problem hiding this comment.
This is created due to #58. That made Dependabot configuration changes unrelated to pulldown-cmark. We cannot yet readily upgrade pulldown-cmark for the reasons discussed in #54. I may make further changes to dependabot.yml, including to have it ignore non-patch updates to pulldown-cmark for now.
I don't think the updates here are very urgent. None are security updates, and none seem to be related to security other than the pulldown-cmark update that cannot be applied yet (and which has very low security impact for this project). Unlike in gitoxide, dependencies listed in Cargo.lock dependencies have been updated here recently, since a commit that included the effects of cargo update was manually added to #54.
Due to all these factors in combination, I think it should be fine to wait a while to merge this--and probably instead end up merging a successor to it. (However, if this is to be merged, then pulldown-cmark could be re-downgraded in it, as was done in #54.)
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
EliahKagan
added a commit
to EliahKagan/cargo-smart-release
that referenced
this pull request
Apr 25, 2025
This is for Dependabot version updates. It doesn't affect Dependabot security updates, nor does it affect any ways of upgrading that don't use Dependabot. See: - https://github.blog/changelog/2021-05-21-dependabot-version-updates-can-now-ignore-major-minor-patch-releases/ - https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore-- The reason is that `pulldown-cmark` will require changes to adapt to higher versions, and for some of those changes we don't yet know what is needed. See the full discussion in GitoxideLabs#54 and comment in GitoxideLabs#59.
EliahKagan
added a commit
to EliahKagan/cargo-smart-release
that referenced
this pull request
Apr 27, 2025
This is for Dependabot version updates. It doesn't affect Dependabot security updates, nor does it affect any ways of upgrading that don't use Dependabot. See: - https://github.blog/changelog/2021-05-21-dependabot-version-updates-can-now-ignore-major-minor-patch-releases/ - https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore-- The reason is that `pulldown-cmark` will require changes to adapt to higher versions, and for some of those changes we don't yet know what is needed. See the full discussion in GitoxideLabs#54 and comment in GitoxideLabs#59.
EliahKagan
added a commit
to EliahKagan/cargo-smart-release
that referenced
this pull request
Nov 2, 2025
This is an attempt to work around the problem seen in GitoxideLabs#85 and discussed in comments there, where even though we prohibit version updates to `pulldown-cmark` already (see `dependendabot.yml`, GitoxideLabs#54, and GitoxideLabs#59), Dependabot has recently begun to attempt them anyway. This may not prevent Dependabot from attempting to update the crate to a version it's not supposed to, but it should cause any such attempts to be done in their own PRs, separate from the main grouped PR where other updates are done.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bumps the cargo group with 5 updates:
0.7.60.7.70.2.90.2.100.9.60.13.01.2.191.2.200.2.90.2.10Updates
winnowfrom 0.7.6 to 0.7.7Changelog
Sourced from winnow's changelog.
Commits
bb0cea3chore: Releasec887eeedocs: Update changelog296323dMerge pull request #774 from tianyuanhao/inner-most491ebfcfix(stream): Make raw() inner-most3752dafMerge pull request #767 from dqkqd/fix-ndjson-link358080ddocs(topic): Fixed link ndjson2566343Merge pull request #766 from epage/clippy886a29dstyle: Help catch 'alloc' mistakes03e4fc3style: Make clippy happyUpdates
jifffrom 0.2.9 to 0.2.10Changelog
Sourced from jiff's changelog.
Commits
75ed28e0.2.10ad13537strtime: fix parsing for Tuesday13bd8abdoc: fix typoUpdates
pulldown-cmarkfrom 0.9.6 to 0.13.0Release notes
Sourced from pulldown-cmark's releases.
... (truncated)
Commits
f17d98achore: bump version to 0.13.047f60dechore: cargo update and bump version to 0.12.3e42259fMerge pull request #1018 from notriddle/deflist-lazy052c635Merge pull request #1017 from notriddle/master0ede612Prevent definition list defs from interrupting non-paragraphs2c16b4eFix tasklist parsing bugsc59ff54Merge pull request #1015 from notriddle/tight-paragraph4409722Use an explicit node for tight paragraphs4564d43Merge pull request #1010 from ModProg/document-events62cae02fix metadatablock doc commentUpdates
ccfrom 1.2.19 to 1.2.20Release notes
Sourced from cc's releases.
Changelog
Sourced from cc's changelog.
Commits
1dd0989chore: release v1.2.20 (#1462)828dd19Regenerate target info (#1461)5da0787Update rusqlite requirement from 0.34.0 to 0.35.0 (#1460)9fb0d0bFix parser.rs on latest rustc nightly (#1459)Updates
jiff-staticfrom 0.2.9 to 0.2.10Changelog
Sourced from jiff-static's changelog.
Commits
75ed28e0.2.10ad13537strtime: fix parsing for Tuesday13bd8abdoc: fix typoDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions