chore(deps): bump flate2, quick-xml, jsonschema (minor/patch) - #1834
Merged
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
All reviewed changes have no unresolved issues.
Pull request overview
Updates Rust dependencies and migrates the JUnit parser to quick-xml 0.42’s string-based APIs.
Changes:
- Bumps flate2, quick-xml, jsonschema, and transitive dependencies.
- Updates JUnit tag, attribute, text, CDATA, and entity handling.
- Refreshes the lockfile.
File summaries
| File | Description |
|---|---|
crates/mergify-ci/src/junit_process/junit.rs |
Migrates parser logic to string-based quick-xml APIs. |
Cargo.toml |
Updates workspace dependency constraints. |
Cargo.lock |
Records resolved dependency upgrades. |
Review details
- Files reviewed: 2/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Merge Protections🟢 All 6 merge protections satisfied — ready to merge. Show 6 satisfied protections🟢 🤖 Continuous Integration
🟢 👀 Review Requirements
🟢 Enforce conventional commitMake sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 🔎 Reviews
🟢 📕 PR description
🟢 🚦 Auto-queueWhen all merge protections are satisfied, this pull request will be queued automatically. |
flate2 1.1.9 -> 1.1.10, quick-xml 0.41 -> 0.42, jsonschema 0.49 -> 0.55. Supersedes renovate's #1792, which never got past `renovate/artifacts`: the bot regenerates Cargo.lock itself and couldn't, so every downstream job (rust, MSRV, cargo-deny, wheels, smoke tests, ci-gate) was red for want of a lockfile, not a real break in the bump. quick-xml 0.42 replaces its whole byte-oriented name/text API with `&str` (`QName` is now `QName<'a>(pub &'a str)`, and `BytesText` / `BytesCData` / `BytesRef` all implement `AsRef<str>` instead of `AsRef<[u8]>`), since the crate only ever accepted UTF-8 XML anyway. Update the JUnit parser's `local_name()` and every attribute/tag match in junit.rs from byte-string patterns to string patterns to match. jsonschema 0.49 -> 0.55 is six minor versions of a pre-1.0 crate; read the crate's changelog end to end rather than trusting a clean compile. The one behavior-relevant note (0.52.0: with `default-features = false`, `idn-hostname`/`idn-email` need the new `idna` feature or they're unknown formats) doesn't apply here — the Mergify config schema's own `format` keywords (`date-time`, `duration`, `regex`, `simple-template`, `template`) are all custom or already outside that set, so they were unknown formats (silently accepted) before this bump too. No code changes needed for `mergify-config`'s `validate_against_schema`, which only uses `options().build()` / `iter_errors()` / `instance_path()` — none of which changed shape across the six releases. Cargo.lock's other moves (jsonschema-regex, jsonschema-value, referencing pinned in lockstep with jsonschema; fraction and num-bigint pulled in by jsonschema's own updated deps; miniz_oxide and an inactive optional zlib-rs pulled in by flate2) are all forced by these three bumps, not separate dependency moves. Verified locally against the exact CI steps: `cargo fmt --all --check`, `cargo clippy --workspace --all-targets --all-features --locked -- -D warnings`, `cargo test --workspace --all-features --locked` (668 passed), `cargo build --workspace --all-features --locked`, all green. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Change-Id: I34925c0376293e993db7b1048faa55005f3d1b9e
jd
force-pushed
the
devs/jd/jd/land-cargo-minor-patch-bumps/bump-flate2-quick-xml-jsonschema-minor-patch--34925c03
branch
from
September 16, 2026 16:16
2135318 to
05a2648
Compare
Member
Author
Revision history
|
Member
Author
|
Rebased onto main to pick up rustls 0.23.45 (came in with #1833), which clears the RUSTSEC-2026-0285 advisory that was failing |
kozlek
approved these changes
Sep 17, 2026
AlexandreGaubert
approved these changes
Sep 18, 2026
Contributor
Merge Queue Status
This pull request spent 8 minutes 30 seconds in the queue, including 7 minutes 59 seconds running CI. Required conditions to merge
|
40 tasks
mergify
Bot
deleted the
devs/jd/jd/land-cargo-minor-patch-bumps/bump-flate2-quick-xml-jsonschema-minor-patch--34925c03
branch
September 18, 2026 09:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
flate2 1.1.9 -> 1.1.10, quick-xml 0.41 -> 0.42, jsonschema 0.49 -> 0.55.
Supersedes renovate's #1792, which never got past
renovate/artifacts:the bot regenerates Cargo.lock itself and couldn't, so every downstream
job (rust, MSRV, cargo-deny, wheels, smoke tests, ci-gate) was red for
want of a lockfile, not a real break in the bump.
quick-xml 0.42 replaces its whole byte-oriented name/text API with
&str(QNameis nowQName<'a>(pub &'a str), andBytesText/BytesCData/BytesRefall implementAsRef<str>instead ofAsRef<[u8]>), since the crate only ever accepted UTF-8 XML anyway.Update the JUnit parser's
local_name()and every attribute/tag matchin junit.rs from byte-string patterns to string patterns to match.
jsonschema 0.49 -> 0.55 is six minor versions of a pre-1.0 crate; read
the crate's changelog end to end rather than trusting a clean compile.
The one behavior-relevant note (0.52.0: with
default-features = false,idn-hostname/idn-emailneed the newidnafeature or they'reunknown formats) doesn't apply here — the Mergify config schema's own
formatkeywords (date-time,duration,regex,simple-template,template) are all custom or already outside that set, so they wereunknown formats (silently accepted) before this bump too. No code
changes needed for
mergify-config'svalidate_against_schema, whichonly uses
options().build()/iter_errors()/instance_path()—none of which changed shape across the six releases.
Cargo.lock's other moves (jsonschema-regex, jsonschema-value,
referencing pinned in lockstep with jsonschema; fraction and
num-bigint pulled in by jsonschema's own updated deps; miniz_oxide and
an inactive optional zlib-rs pulled in by flate2) are all forced by
these three bumps, not separate dependency moves.
Verified locally against the exact CI steps:
cargo fmt --all --check,cargo clippy --workspace --all-targets --all-features --locked -- -D warnings,cargo test --workspace --all-features --locked(668passed),
cargo build --workspace --all-features --locked, all green.Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com