chore(deps): bump uuid from 1.26.0 to 1.26.1 in /src-tauri - #336
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 640375e680
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| [[package]] | ||
| name = "uuid" | ||
| version = "1.26.0" | ||
| version = "1.26.1" |
There was a problem hiding this comment.
Updating this locked package to 1.26.1 without regenerating THIRD_PARTY_LICENSES_RUST.txt leaves both inventory entries at uuid 1.26.0. The CI command node scripts/check-dependency-inventory.mjs --rust derives uuid 1.26.1 from this lockfile and treats its absence from the report as fatal, so this commit cannot pass the Rust dependency-inventory check and would ship a notice naming the wrong dependency version. Regenerate and commit the Rust license report alongside the lockfile change.
AGENTS.md reference: AGENTS.md:L9-L11
Useful? React with 👍 / 👎.
Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.26.0 to 1.26.1. - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.26.0...v1.26.1) --- updated-dependencies: - dependency-name: uuid dependency-version: 1.26.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
640375e to
727b35e
Compare
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
|
Superseded by #386, which consolidates this bump with the other seven Dependabot PRs into a single change. Consolidating means the license regeneration and the compatibility-surface reseal happen once rather than eight times — and each of these PRs would have gone stale the moment any other landed, since they all touch pinned files. The same version bump is carried in #386 with no change to what is being updated. Closing as superseded, not rejected. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
* chore(deps): consolidate Dependabot bumps #336-343 Replaces 8 separate Dependabot PRs with one reviewed, resealed branch. Rust (src-tauri/Cargo.lock, via `cargo update --precise`): - uuid 1.26.0 -> 1.26.1 - reqwest 0.13.4 -> 0.13.5 (pulls in base64 0.23.1 alongside the existing 0.22.1, expected) rustls stays at 0.23.45, the patched version for RUSTSEC-2026-0285 (affected range 0.23.13-0.23.44); confirmed unchanged after the update. Frontend (package.json / pnpm-lock.yaml): - react ^19.2.8 -> ^19.3.0 - react-dom ^19.2.8 -> ^19.3.0 - lucide-react ^1.41.0 -> ^1.44.0 (resolves to 1.46.0) - @types/react ^19.2.18 -> ^19.3.0 - @types/react-dom ^19.2.7 -> ^19.3.0 - vite ^8.2.2 -> ^8.3.0 jsdom deliberately left at ^28.1.0. jsdom 30 requires Node `^22.22.2 || ^24.15.0 || >=26.0.0`, which falls outside this repo's declared `"node": ">=22.12 <25"` engines range. Issue #348 holds this pending an owner decision and explicitly says no successor PR should be created for it. GitHub Actions (SHA-pinned, comment corrected where wrong): - taiki-e/install-action -> v2.87.10 (3 occurrences: ci.yml x2, dependency-security.yml x1) - pnpm/action-setup -> v6.1.0 (4 occurrences: ci.yml x2, dependency-security.yml x1, release-mcpb-preview.yml x1) - actions/configure-pages -> v6.0.0 (deploy-install-page.yml) - actions/deploy-pages -> v5.0.1 (deploy-install-page.yml; the prior "# v4.0.5" comment was wrong, SHA decdde0ac... is tag v4.0.4) Regenerated THIRD_PARTY_LICENSES_RUST.txt via scripts/generate-rust-licenses.mjs, and hand-updated the frontend THIRD_PARTY_LICENSES.txt version headers (lucide-react, react/ react-dom/scheduler) to match the new lockfile so check-dependency-inventory.mjs (run through `pnpm run license:all`) is consistent again. Resealed the compatibility surface with bridge-tally-compatibility's rehash-surface / seal-surface / repoint-matrix, all run from tools/: rehash-surface reported 5 changed pinned files (ci.yml, dependency-security.yml, package.json, pnpm-lock.yaml, src-tauri/Cargo.lock, matching exactly what was hand-edited or regenerated as a direct consequence), then confirmed rehash_surface_changed:0 on a second pass. Frontend suite (`pnpm test`: node --test + vitest + playwright) is green: 147 + 113 + 10 tests passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore(deps): raise Node floor to 24 LTS and unblock jsdom 30 Node v24 "Krypton" is now Active LTS (latest 24.21.0, confirmed against nodejs.org/dist/index.json); v22 "Jod" is the previous LTS line and v26 is Current, not LTS. This resolves issue #348 by choosing path 2: raise the supported Node floor rather than holding jsdom back. - .node-version: 24.18.0 -> 24.21.0 (latest Active LTS patch) - package.json engines.node: ">=22.12 <25" -> ">=24.15.0 <25". The floor moves to the Node 24 LTS line, and 24.15.0 specifically is jsdom 30's minimum within that line, so the declared contract and the dependency's real requirement agree. Not pinned to the exact latest patch (24.21.0) so contributors on any earlier 24.x aren't rejected for no reason. - jsdom: ^28.1.0 -> ^30.0.1 (permitted by the raised floor; requires ^22.22.2 || ^24.15.0 || >=26.0.0 per its own package metadata) - pnpm-lock.yaml regenerated via `pnpm install` - README.md and docs/release-process.md: updated the "22 or 24" Node contract language to the new 24.x-only floor for consistency with package metadata and CI (workflows already follow via node-version-file: .node-version, no change needed there) - docs/tally/compatibility/compatibility-surface.json and compatibility-matrix.json: resealed via tools/bridge-tally-compatibility (rehash-surface -> seal-surface -> repoint-matrix -> rehash-surface, confirmed rehash_surface_changed:0) since package.json and pnpm-lock.yaml are pinned in the surface Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: t <dev@example.invalid> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
1 participant
Bumps uuid from 1.26.0 to 1.26.1.
Release notes
Sourced from uuid's releases.
Commits
9f92712Merge pull request #910 from uuid-rs/cargo/v1.26.1d4df8f0prepare for 1.26.1 release5613f23Merge pull request #909 from uuid-rs/fix/ts-conversion-overflowfda00ebdon't panic in overflowing Timestamp to SystemTime conversionc82e88cMerge pull request #907 from lenamonj/v7-counter-placementac065a6Align the counter diagram34ec102Seat the v7 counter below the version nibble