diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..db15849 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,27 @@ +# Weekly version updates, grouped into one PR per ecosystem. Security +# updates come separately and right away (Settings → Advanced Security → +# Dependabot security updates). CI runs on every PR, including the MSRV +# build, which catches an update that needs a newer Rust than rust-version. +version: 2 +updates: + - package-ecosystem: cargo + directory: / + schedule: + interval: weekly + commit-message: + prefix: chore + groups: + cargo-minor: + update-types: [minor, patch] + + # Actions stay pinned to a commit SHA; Dependabot bumps the SHA and the + # version comment together. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + commit-message: + prefix: chore + groups: + actions: + patterns: ['*'] diff --git a/CHANGELOG.md b/CHANGELOG.md index dfec28a..2078d24 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ All notable changes to plugii are documented here. The format is based on ## [Unreleased] +### Changed + +- Updated dependencies, among them ureq 3.5 and rustls-webpki 0.103.16. + ## [0.1.0] - 2026-10-17 The first release: a rewrite of the `usb-ports` shell script as a Rust CLI diff --git a/Cargo.lock b/Cargo.lock index 361afec..f8f3316 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -228,9 +228,9 @@ dependencies = [ [[package]] name = "cc" -version = "1.8.0" +version = "1.10.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6651c9ed80effdc7db0ff72512157f901af5e3549e341e24b1dd4887d836d838" +checksum = "86e055fa6e3e40ad6187ba25b6855eeb635d5271f8e0f0e1e9a5826b8d75bea0" dependencies = [ "find-msvc-tools", "shlex", @@ -385,9 +385,9 @@ dependencies = [ [[package]] name = "crc32fast" -version = "1.5.2" +version = "1.5.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78" +checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055" dependencies = [ "cfg-if", ] @@ -609,9 +609,9 @@ dependencies = [ [[package]] name = "find-msvc-tools" -version = "0.1.14" +version = "0.1.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484" +checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48" [[package]] name = "finl_unicode" @@ -882,9 +882,9 @@ checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb" [[package]] name = "libc" -version = "0.2.190" +version = "0.2.191" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78" +checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a" [[package]] name = "libm" @@ -1084,9 +1084,9 @@ dependencies = [ [[package]] name = "num_threads" -version = "0.1.7" +version = "0.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9" +checksum = "cabcc654086861f9e1bc5115258de62ef92c79b20f4615a1b0cc57c4e82027d4" dependencies = [ "libc", ] @@ -1547,9 +1547,9 @@ checksum = "323c417e1d9665a65b263ec744ba09030cfb277e9daa0b018a4ab62e57bc8189" [[package]] name = "roxmltree" -version = "0.21.1" +version = "0.21.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1964b10c76125c36f8afe190065a4bf9a87bf324842c05701330bba9f1cacbb" +checksum = "9da7f59328b09405b181fee1018925fad50f157afb43c0c0f5c522c256dd5907" dependencies = [ "memchr", ] @@ -1608,9 +1608,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -1767,9 +1767,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5" [[package]] name = "smallvec" -version = "1.16.3" +version = "1.16.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b" +checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8" [[package]] name = "stacker" @@ -2117,9 +2117,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" [[package]] name = "ureq" -version = "3.4.2" +version = "3.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc" +checksum = "cde93ff05758a36a851a398a772b0b79a82fbe3c186a46f2696baaeaf84c966b" dependencies = [ "base64 0.23.1", "flate2", @@ -2134,9 +2134,9 @@ dependencies = [ [[package]] name = "ureq-proto" -version = "0.6.4" +version = "0.6.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be" +checksum = "841583fc36089d7d59419568ae157f43a5a03a2e5a81ba87c77d1596ef46e922" dependencies = [ "base64 0.23.1", "http", @@ -2158,9 +2158,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" [[package]] name = "uuid" -version = "1.28.0" +version = "1.26.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7cc1186384beb7dd8eedea376413fd654937285ea6c9cfbb928dc3043ea4b606" +checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce" dependencies = [ "atomic", "getrandom 0.4.3", @@ -2251,9 +2251,9 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171" dependencies = [ "rustls-pki-types", ] diff --git a/docs/RELEASE.md b/docs/RELEASE.md index 91a378d..6652a84 100644 --- a/docs/RELEASE.md +++ b/docs/RELEASE.md @@ -75,6 +75,27 @@ Before or right after pushing the tag, in the repository's 3. **Enforce HTTPS**, once GitHub has issued the certificate (the box is greyed out until then, sometimes for a few minutes). +## Dependency updates + +Dependabot (`.github/dependabot.yml`) opens a grouped PR per week for cargo +and for the pinned GitHub Actions, plus a PR right away for any crate with +a security advisory. CI runs on each; merge when it's green. The MSRV job +fails an update that needs a newer Rust than `rust-version`: close it, or +raise `rust-version` on purpose. + +Merging doesn't release anything. The binaries are statically linked, so +an update only reaches users with the next release: + +- **Security fix in a crate the binary uses** (check `cargo tree -i + -e normal`): cut a patch release soon, with a `### Security` + entry in CHANGELOG.md naming the advisory. +- **Routine bumps, dev-dependencies, Actions:** no release of their own; + they ship with the next one. A one-line `### Changed` entry + ("Updated dependencies") is enough. + +`mise run outdated` shows what's pending, including major versions that +Dependabot proposes on their own (they're outside the group). + ## Later: crates.io Not part of a release yet. `cargo install --locked plugii` would then work