From 279b87005139edc6384345df971ffd73ce48bbab Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 02:52:24 +0000 Subject: [PATCH 1/2] build(deps): bump the cargo group across 1 directory with 11 updates Bumps the cargo group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `3.2.0` | `3.5.1` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.2` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.20` | `2.0.21` | | [duckdb](https://github.com/duckdb/duckdb-rs) | `1.10505.0` | `1.10506.0` | | [crossbeam-channel](https://github.com/crossbeam-rs/crossbeam) | `0.5.16` | `0.5.17` | | [fancy-regex](https://github.com/fancy-regex/fancy-regex) | `0.19.0` | `0.19.2` | | [toml](https://github.com/toml-rs/toml) | `1.1.5+spec-1.1.0` | `1.1.8+spec-1.1.0` | | [clap](https://github.com/clap-rs/clap) | `4.6.6` | `4.6.7` | | [clap_complete](https://github.com/clap-rs/clap) | `4.6.9` | `4.6.11` | | [crossbeam](https://github.com/crossbeam-rs/crossbeam) | `0.8.4` | `0.8.5` | | [insta](https://github.com/mitsuhiko/insta) | `1.48.0` | `1.49.0` | Updates `rmcp` from 3.2.0 to 3.5.1 - [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml) - [Commits](https://github.com/modelcontextprotocol/rust-sdk/compare/rmcp-v3.2.0...rmcp-v3.5.1) Updates `tokio` from 1.53.1 to 1.53.2 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.53.1...tokio-1.53.2) Updates `thiserror` from 2.0.20 to 2.0.21 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](https://github.com/dtolnay/thiserror/compare/2.0.20...2.0.21) Updates `duckdb` from 1.10505.0 to 1.10506.0 - [Release notes](https://github.com/duckdb/duckdb-rs/releases) - [Commits](https://github.com/duckdb/duckdb-rs/compare/v1.10505.0...v1.10506.0) Updates `crossbeam-channel` from 0.5.16 to 0.5.17 - [Release notes](https://github.com/crossbeam-rs/crossbeam/releases) - [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/main/CHANGELOG.md) - [Commits](https://github.com/crossbeam-rs/crossbeam/compare/crossbeam-channel-0.5.16...crossbeam-channel-0.5.17) Updates `fancy-regex` from 0.19.0 to 0.19.2 - [Release notes](https://github.com/fancy-regex/fancy-regex/releases) - [Changelog](https://github.com/fancy-regex/fancy-regex/blob/main/CHANGELOG.md) - [Commits](https://github.com/fancy-regex/fancy-regex/compare/0.19.0...0.19.2) Updates `toml` from 1.1.5+spec-1.1.0 to 1.1.8+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/toml-v1.1.5...toml-v1.1.8) Updates `clap` from 4.6.6 to 4.6.7 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.6...clap_complete-v4.6.7) Updates `clap_complete` from 4.6.9 to 4.6.11 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.9...clap_complete-v4.6.11) Updates `crossbeam` from 0.8.4 to 0.8.5 - [Release notes](https://github.com/crossbeam-rs/crossbeam/releases) - [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/main/CHANGELOG.md) - [Commits](https://github.com/crossbeam-rs/crossbeam/compare/crossbeam-0.8.4...crossbeam-0.8.5) Updates `insta` from 1.48.0 to 1.49.0 - [Release notes](https://github.com/mitsuhiko/insta/releases) - [Changelog](https://github.com/mitsuhiko/insta/blob/master/CHANGELOG.md) - [Commits](https://github.com/mitsuhiko/insta/compare/1.48.0...1.49.0) --- updated-dependencies: - dependency-name: rmcp dependency-version: 3.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: tokio dependency-version: 1.53.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: thiserror dependency-version: 2.0.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: duckdb dependency-version: 1.10506.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: crossbeam-channel dependency-version: 0.5.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: fancy-regex dependency-version: 0.19.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: toml dependency-version: 1.1.8+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: clap dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: clap_complete dependency-version: 4.6.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: crossbeam dependency-version: 0.8.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: insta dependency-version: 1.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo ... Signed-off-by: dependabot[bot] --- Cargo.lock | 80 +++++++++++++++++----------------- crates/codelore-lib/Cargo.toml | 2 +- 2 files changed, 41 insertions(+), 41 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 7833d7a1..38dd934c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -510,9 +510,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.6.6" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca" +checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946" dependencies = [ "clap_builder", "clap_derive", @@ -520,9 +520,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.6.6" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889" +checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d" dependencies = [ "anstream", "anstyle", @@ -532,18 +532,18 @@ dependencies = [ [[package]] name = "clap_complete" -version = "4.6.9" +version = "4.6.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3be2ad0423bdbbb0e25bc89add796f3559706d4a95e1bc98e4d9662a957b6a19" +checksum = "037e2a1a92236d0aff7e845093f64661d6df4c02c9fcc61a60e9e1d736fa392f" dependencies = [ "clap", ] [[package]] name = "clap_derive" -version = "4.6.4" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061" +checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0" dependencies = [ "heck", "proc-macro2", @@ -812,9 +812,9 @@ dependencies = [ [[package]] name = "crossbeam" -version = "0.8.4" +version = "0.8.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1137cd7e7fc0fb5d3c5a8678be38ec56e819125d8d7907411fe24ccb943faca8" +checksum = "e71406cd8807725f7ac2f999a4cdd32e98f829fdf65f528343cebf945e41df1e" dependencies = [ "crossbeam-channel", "crossbeam-deque", @@ -825,9 +825,9 @@ dependencies = [ [[package]] name = "crossbeam-channel" -version = "0.5.16" +version = "0.5.17" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e" +checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1" dependencies = [ "crossbeam-utils", ] @@ -1129,9 +1129,9 @@ dependencies = [ [[package]] name = "duckdb" -version = "1.10505.0" +version = "1.10506.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "970e05eedd3f55c435194d9104f90a9b4a79a80d6e73251bc9ff43e178130c4e" +checksum = "e3472b9152d879c5534353b20854e43525b2c78b2dbba156711e9939d30278b4" dependencies = [ "arrow", "cast", @@ -1207,9 +1207,9 @@ checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a" [[package]] name = "fancy-regex" -version = "0.19.0" +version = "0.19.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "476de73bddf2ef8490aa4ee8f1cf40b430bf1d56c48c22080e5186952cd580e6" +checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912" dependencies = [ "bit-set", "regex-automata", @@ -2709,9 +2709,9 @@ dependencies = [ [[package]] name = "insta" -version = "1.48.0" +version = "1.49.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82" +checksum = "b67d3d2e287e4b86c10b3f3b641033d1f89b74bdb39d05f34952e2b9a6fe21cd" dependencies = [ "console", "once_cell", @@ -2897,9 +2897,9 @@ checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66" [[package]] name = "libduckdb-sys" -version = "1.10505.0" +version = "1.10506.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6cb514dab5e271e849235c1cb98bd65a2ae107fbd619a6740219319c54a71d95" +checksum = "0aac3459f2f7f0221d5be9114fa77ff5877040c8de456d3b986a680579fe202b" dependencies = [ "cc", "flate2", @@ -3502,9 +3502,9 @@ dependencies = [ [[package]] name = "rmcp" -version = "3.2.0" +version = "3.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42b6914fac0be956fe704a38239c3f44a9f841d1b06a5713d2f638065593f5b5" +checksum = "ab5023804cbe0304cbe06197ac16e645a0a0d0ffa2953bf735c15c2fa0213350" dependencies = [ "base64 0.23.0", "chrono", @@ -3525,9 +3525,9 @@ dependencies = [ [[package]] name = "rmcp-macros" -version = "3.2.0" +version = "3.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cdf1c49bd4d52014b94db0877410db273c2008f01628b0252a2e9460ad9b7fda" +checksum = "a1da498700030856ba63114bceefa30ba21f5e278cb975e5b9de3529fe842b40" dependencies = [ "darling 0.24.0", "proc-macro2", @@ -3713,9 +3713,9 @@ dependencies = [ [[package]] name = "serde_spanned" -version = "1.1.1" +version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26" +checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c" dependencies = [ "serde_core", ] @@ -3941,18 +3941,18 @@ checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683" [[package]] name = "thiserror" -version = "2.0.20" +version = "2.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f" +checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e" dependencies = [ "thiserror-impl", ] [[package]] name = "thiserror-impl" -version = "2.0.20" +version = "2.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af" +checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", @@ -4044,9 +4044,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.1" +version = "1.53.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e" dependencies = [ "bytes", "pin-project-lite", @@ -4079,9 +4079,9 @@ dependencies = [ [[package]] name = "toml" -version = "1.1.5+spec-1.1.0" +version = "1.1.8+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12c0ba9680044b4ce98d391a62094047eada0d64860b80166c39f4a6b5640785" +checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d" dependencies = [ "indexmap", "serde_core", @@ -4094,27 +4094,27 @@ dependencies = [ [[package]] name = "toml_datetime" -version = "1.1.1+spec-1.1.0" +version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7" +checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053" dependencies = [ "serde_core", ] [[package]] name = "toml_parser" -version = "1.1.3+spec-1.1.0" +version = "1.1.5+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56" +checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c" dependencies = [ "winnow", ] [[package]] name = "toml_writer" -version = "1.1.2+spec-1.1.0" +version = "1.1.3+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2" +checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770" [[package]] name = "tracing" diff --git a/crates/codelore-lib/Cargo.toml b/crates/codelore-lib/Cargo.toml index 48c7e1b2..ad8d4ad9 100644 --- a/crates/codelore-lib/Cargo.toml +++ b/crates/codelore-lib/Cargo.toml @@ -58,7 +58,7 @@ serde_json = { version = "1", features = ["float_roundtrip"] } thiserror = "2" gix = { version = "0.87", features = ["max-performance", "blob-diff"] } tempfile = { version = "3", optional = true } -duckdb = { version = "=1.10505.0", features = ["bundled"] } +duckdb = { version = "=1.10506.0", features = ["bundled"] } crossbeam-channel = "0.5" codelore-rca = { path = "../codelore-rca", version = "0.30.0" } # RFC 3986 §4.1 percent-encoding for SARIF artifactLocation.uri values. From 884a806fa846dec241192bf48da77f89de2fccb0 Mon Sep 17 00:00:00 2001 From: Emre Camdere Date: Fri, 16 Oct 2026 20:17:40 +0200 Subject: [PATCH 2/2] fix(provenance): record the DuckDB version this bump actually links The cargo group moves `duckdb` from 1.10505.0 to 1.10506.0, but `provenance::DUCKDB_VERSION` still named the old release, so every provenance sidecar and the `--version` banner would have reported an engine the binary no longer contains. `dep_versions_drift_test` exists to catch exactly that, and it failed the test job on Linux and macOS; it is the only failing test of the 1880 that ran there. No other site pins the version: the manifest pin moved with the bump, every runtime consumer reads this constant, and no snapshot or golden output stores it. Claude-Session: https://claude.ai/code/session_01LRZ8yoFPCFgfZ8raBUeDeP --- crates/codelore-lib/src/provenance/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/codelore-lib/src/provenance/mod.rs b/crates/codelore-lib/src/provenance/mod.rs index afd974a8..f74caca5 100644 --- a/crates/codelore-lib/src/provenance/mod.rs +++ b/crates/codelore-lib/src/provenance/mod.rs @@ -11,7 +11,7 @@ use serde::Serialize; /// which fails CI if these constants and `Cargo.lock` drift apart. pub const GIX_VERSION: &str = "0.87.1"; /// Pinned `DuckDB` version — same drift guard applies. -pub const DUCKDB_VERSION: &str = "1.10505.0"; +pub const DUCKDB_VERSION: &str = "1.10506.0"; /// Explicit schema version for the provenance manifest format. Bumped /// whenever a field is renamed, removed, or its semantic meaning