fix(diaporeia): align cargo_metadata to 0.23 and hoist it to the workspace - #6980
Open
forkwright wants to merge 2 commits into
Open
fix(diaporeia): align cargo_metadata to 0.23 and hoist it to the workspace#6980forkwright wants to merge 2 commits into
forkwright wants to merge 2 commits into
Conversation
added 2 commits
August 24, 2026 14:25
…space
The aletheia workspace disagreed with itself: diaporeia pinned cargo_metadata
0.18 while gnosis pinned 0.23, five minor releases apart, both declared
per-crate. Bringing diaporeia forward fixes the instance; hoisting the
dependency to [workspace.dependencies] and having both crates inherit it is
what stops the pair diverging again.
The version gap was not free. cargo_metadata 0.19 changed Package::name from
String to a PackageName newtype, which implements Display, AsRef<str> and
Deref but deliberately not Into<String>. diaporeia keys two HashMap<String, _>
off that field, so `package.name.clone()` no longer type-checks where a String
is required. Both sites now use `.to_string()`, which goes through Display.
The two `format!("... {}", package.name)` sites need no change -- Display
already covers them -- and the `.clone()` remaining at repomix.rs:304 is on a
`&String` taken out of name_by_id, not on the newtype.
NOT VERIFIED BY A COMPILER HERE. The reasoning is from reading cargo_metadata's
actual newtype definition rather than from guessing at the version number, but
that is still reading. aletheia is public and its CI minutes are free, and this
box is a 15 W laptop that thermally shuts down under a workspace check; the
runner is the right place to judge this, not a local build that would cost the
machine.
The preceding commit moved diaporeia from cargo_metadata 0.18 to the workspace's 0.23 and left Cargo.lock untouched, so `cargo check --workspace --all-targets --features test-core --locked` -- which fork-portability-check runs -- refused before compiling anything. The lock now resolves cargo_metadata 0.23.1, and --locked passes. Third time today a dependency PR has carried a manifest change without its lockfile: harmonia's base64 bump, aletheia's per-directory prometheus-client siblings, and this. The shape is always the same -- the manifest edit is the visible work and the lock is a generated file nobody looks at, so the omission survives review and surfaces as a --locked refusal that names no dependency at all. Re-resolved rather than pinned, so cargo picks what the manifest actually permits instead of what one machine happened to have.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The aletheia workspace disagreed with itself: diaporeia pinned cargo_metadata
0.18 while gnosis pinned 0.23, five minor releases apart, both declared
per-crate. Bringing diaporeia forward fixes the instance; hoisting the
dependency to [workspace.dependencies] and having both crates inherit it is
what stops the pair diverging again.
The version gap was not free. cargo_metadata 0.19 changed Package::name from
String to a PackageName newtype, which implements Display, AsRef and
Deref but deliberately not Into. diaporeia keys two HashMap<String, _>
off that field, so
package.name.clone()no longer type-checks where a Stringis required. Both sites now use
.to_string(), which goes through Display.The two
format!("... {}", package.name)sites need no change -- Displayalready covers them -- and the
.clone()remaining at repomix.rs:304 is on a&Stringtaken out of name_by_id, not on the newtype.NOT VERIFIED BY A COMPILER HERE. The reasoning is from reading cargo_metadata's
actual newtype definition rather than from guessing at the version number, but
that is still reading. aletheia is public and its CI minutes are free, and this
box is a 15 W laptop that thermally shuts down under a workspace check; the
runner is the right place to judge this, not a local build that would cost the
machine.