build(deps): bump the cargo-deps group across 1 directory with 11 updates - #561
Conversation
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Aug 10, 2026 9:05a.m. | Review ↗ |
| Python | |
Aug 10, 2026 9:05a.m. | Review ↗ |
| Rust | |
Aug 10, 2026 9:05a.m. | Review ↗ |
| Shell | |
Aug 10, 2026 9:05a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Up to standards ✅🟢 Issues
|
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Graphify review — findings
I can't summarize this pull request meaningfully. The only file changed is cli/Cargo.lock, and it's shown as a binary diff, so the actual content of the change isn't visible in this diff. Based on what's shown: - This PR modifies cli/Cargo.lock (the Rust dependency lockfile). - Since the diff is rendered as binary rather than text, the specific dependency additions, removals, or version changes aren't displayed here. To review this properly, you'd want to view the lockfile changes as text (e.g., regenerate the diff without binary treatment) to see which dependencies were affected.
No blocking issues surfaced.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 0 functions depend on the 0 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 0 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
d-oit
changed the title
…11 updates Bumps the cargo-deps group with 11 updates in the /cli directory: | Package | From | To | | --- | --- | --- | | [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.6` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.19` | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.103` | `1.0.104` | | [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` | | [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` | | [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.1` | | [toml](https://github.com/toml-rs/toml) | `1.1.2+spec-1.1.0` | `1.1.4+spec-1.1.0` | | [async-trait](https://github.com/dtolnay/async-trait) | `0.1.89` | `0.1.91` | | [regex](https://github.com/rust-lang/regex) | `1.13.0` | `1.13.1` | | [futures](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.33` | | [blake3](https://github.com/BLAKE3-team/BLAKE3) | `1.8.5` | `1.8.6` | Updates `clap` from 4.6.1 to 4.6.6 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.6) Updates `thiserror` from 2.0.18 to 2.0.19 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@2.0.18...2.0.19) Updates `anyhow` from 1.0.103 to 1.0.104 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](dtolnay/anyhow@1.0.103...1.0.104) Updates `serde` from 1.0.228 to 1.0.229 - [Release notes](https://github.com/serde-rs/serde/releases) - [Commits](serde-rs/serde@v1.0.228...v1.0.229) Updates `serde_json` from 1.0.150 to 1.0.151 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.150...v1.0.151) Updates `tokio` from 1.52.3 to 1.53.1 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.1) Updates `toml` from 1.1.2+spec-1.1.0 to 1.1.4+spec-1.1.0 - [Commits](toml-rs/toml@toml-v1.1.2...toml-v1.1.4) Updates `async-trait` from 0.1.89 to 0.1.91 - [Release notes](https://github.com/dtolnay/async-trait/releases) - [Commits](dtolnay/async-trait@0.1.89...0.1.91) Updates `regex` from 1.13.0 to 1.13.1 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](rust-lang/regex@1.13.0...1.13.1) Updates `futures` from 0.3.32 to 0.3.33 - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md) - [Commits](rust-lang/futures-rs@0.3.32...0.3.33) Updates `blake3` from 1.8.5 to 1.8.6 - [Release notes](https://github.com/BLAKE3-team/BLAKE3/releases) - [Commits](BLAKE3-team/BLAKE3@1.8.5...1.8.6) --- updated-dependencies: - dependency-name: clap dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: thiserror dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: anyhow dependency-version: 1.0.104 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: serde dependency-version: 1.0.229 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: serde_json dependency-version: 1.0.151 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: tokio dependency-version: 1.53.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-deps - dependency-name: toml dependency-version: 1.1.4+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: async-trait dependency-version: 0.1.91 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: regex dependency-version: 1.13.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: futures dependency-version: 0.3.33 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps - dependency-name: blake3 dependency-version: 1.8.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-deps ... Signed-off-by: dependabot[bot] <support@github.com>
db19de0 to
f4fdcc8
Compare
1 participant
Summary
Bump the cargo-deps group in /cli (11 updates from dependabot): clap 4.6.6, tokio 1.52.3 -> 1.53.1, regex 1.13.1 (fixes unsound match-offset bug), futures 0.3.33 (two soundness fixes), thiserror, anyhow, serde, serde_json, async-trait, toml 1.1.4, blake3 1.8.6. All patch/minor, no Cargo.toml or MSRV/API change.
Testing
Rust CLI, Lint (cli/ui), Unit Tests (cli/ui), Quality Gate, cargo-deny all green.