Skip to content

chore(deps): Bump the cargo-minor-patch group across 1 directory with 9 updates - #920

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-patch-7983a9e702
Open

chore(deps): Bump the cargo-minor-patch group across 1 directory with 9 updates#920
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-patch-7983a9e702

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo-minor-patch group with 9 updates in the / directory:

Package From To
aws-lc-rs 1.18.0 1.18.1
hickory-resolver 0.26.1 0.26.2
napi 3.12.1 3.12.2
pg_query 6.1.1 6.2.0
rhai 1.25.1 1.26.0
tokio-rustls 0.26.4 0.26.5
tower-http 0.7.0 0.7.1
uuid 1.24.1 1.26.0
oxjsonld 0.2.5 0.2.6

Updates aws-lc-rs from 1.18.0 to 1.18.1

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.1

What's Changed

  • Add ECDSA P-256 SHA-1 ASN.1 signature verification by @​assafvayner in aws/aws-lc-rs#1214
    • Adds ECDSA_P256_SHA1_ASN1 for verifying ASN.1 DER-encoded ECDSA P-256 signatures over SHA-1, so applications can verify legacy signatures such as CloudFront signed URLs using ECDSA P-256 with the default SHA-1 hash.
    • SHA-1 remains available for legacy verification only. This release does not add a corresponding signing algorithm.
  • Tighten AEAD, cipher IV, HKDF, ECDH, and RSA API contracts by @​justsmth in aws/aws-lc-rs#1215
    • In-place AEAD sealing now verifies that Extend produced exactly enough space for the plaintext and authentication tag before passing the buffer to AWS-LC. Non-conforming custom buffers now return Err(Unspecified).
    • Streaming cipher constructors now reject missing or mismatched IV contexts, matching the validation already performed by the one-shot APIs.
    • Salt::from(Okm) now uses the output algorithm selected by the Okm, rather than the algorithm from the source PRK.
    • ECDH shared-secret storage is now zeroized on fallible derive paths.
    • RSA verify_digest_sig now requires the supplied digest to match the digest configured by RsaParameters, for both parsed and unparsed public keys.
    • Valid inputs are unaffected. Calls using inconsistent algorithms, IV contexts, or custom AEAD buffers now fail closed with Err(Unspecified).

Upstream AWS-LC

  • aws-lc-sys v0.45.0 aligns with AWS-LC v5.7.0 (previously v5.5.0). See also the release notes for v5.6.0.
    • v5.7.0 corrects EVP_DecryptUpdate for padded block ciphers so it modifies only the output range reported through out_len. aws-lc-rs now includes canary-based regression coverage around the documented minimum output-buffer sizes.
  • aws-lc-fips-sys v0.14.2 moves to AWS-LC FIPS v4.2.0.
    • Includes the equivalent EVP_DecryptUpdate correction for FIPS builds.
    • Restores FIPS builds with Clang 20 and newer.
    • Removes the FIPS compiler wrapper's dependency on /usr/bin/env, fixing builds in Nix and similar sandboxed environments.

Build Improvements

  • Export cargo:root metadata when linking against a system-installed AWS-LC by @​weihanglo in aws/aws-lc-rs#1208
    • The system-library path now exposes the installation prefix through DEP_AWS_LC_*_ROOT, consistently with the CC and CMake builders, so downstream build scripts can rely on the metadata regardless of how AWS-LC was built.
  • Fix -Wa,--debug-prefix-map handling with Clang and LTO by @​justsmth in aws/aws-lc-rs#1212
    • Fixes Clang builds when CFLAGS contains -flto or -flto=thin. The assembler-specific flag is now used only with GCC; Clang's integrated assembler uses -ffile-prefix-map directly.
  • Filter raw target-triple CFLAGS spellings when compiling jitterentropy by @​justsmth in aws/aws-lc-rs#1207
    • Prevents inherited optimization flags from overriding jitterentropy's required -O0, including when environment variables are set by a parent process using raw or legacy-normalized target triples.

Issues Being Closed

Other Merged PRs

... (truncated)

Commits
  • 22e629d Prepare v1.18.1 (#1224)
  • c4fde5c Prepare aws-lc-fips-sys v0.14.2 (#1221)
  • 7943223 Prepare aws-lc-sys v0.45.0 (#1220)
  • 8ea2229 fix: tighten AEAD, cipher IV, and digest API contracts (#1215)
  • bcca4d1 Add ECDSA P-256 SHA-1 ASN.1 verification algorithm (#1214)
  • 32338a5 fix(builder): filter the raw-triple CFLAGS spelling for jitterentropy (#1207)
  • af422bd Fix -Wa,--debug-prefix-map probe (#1212)
  • 749b26f ci: replace removed llvm-devel-lite package in FreeBSD jobs (#1213)
  • 36c7a68 fix(publish): verify packaged crate with cargo build, not cargo test (#1201)
  • c71ab00 fix: address clippy::assert_is_empty lints in ECB cipher modes (#1210)
  • Additional commits viewable in compare view

Updates hickory-resolver from 0.26.1 to 0.26.2

Release notes

Sourced from hickory-resolver's releases.

v0.26.2

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

Special thanks go out to @​qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @​ATinyShoe, @​kirk-baird, @​thesmartshadow, @​BeaCox, @​jpds, @​N0zoM1z0, and @​JasonPap for reporting vulnerabilities as well.

If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @​djc for commercial support.

What's Changed

... (truncated)

Commits
  • 48323ef Bump version to 0.26.2
  • ccd6952 Only follow one CNAME record from each response
  • c04ad2b Better distinguish NODATA response and wildcards
  • 64b4291 Add test for bogus wildcard expansion
  • 478998b proto: constrain peer-controlled allocation sizes
  • 8392769 resolver: avoid caching empty nameserver pools
  • e2d21d8 Replace use of SOA name with NSEC3 record parents
  • 84fa8ab Check for correct zone name in covering NSEC3s too
  • 09803ba Look for correct zone name in matching NSEC3s
  • 26f45d3 Rename Nsec3RecordPair to Nsec3RecordInfo
  • Additional commits viewable in compare view

Updates napi from 3.12.1 to 3.12.2

Release notes

Sourced from napi's releases.

napi-v3.12.2

Fixed

  • (napi) memory safety in PromiseRaw callbacks and AbortSignal conversion (#3458)
Commits
  • 444bf29 chore(napi): release v3.12.2 (#3459)
  • 2ffb055 fix(napi): memory safety in PromiseRaw callbacks and AbortSignal conversion (...
  • 511ead2 chore(deps): update dependency oxc-parser to ^0.146.0 (#3457)
  • 220b402 chore(deps): update dependency oxc-parser to ^0.145.0 (#3456)
  • 70c1493 chore(release): publish
  • aeba312 fix(cli): compatible with emnapi v1 & v2 (#3454)
  • d532909 chore(deps): update dependency oxc-parser to ^0.144.0 (#3453)
  • b8ba732 fix(deps): update emnapi to v2.0.0-alpha.4 (#3451)
  • 06349eb chore(deps): update cross-platform-actions/action action to v1.4.0 (#3452)
  • a5b5f27 chore(release): publish
  • Additional commits viewable in compare view

Updates pg_query from 6.1.1 to 6.2.0

Changelog

Sourced from pg_query's changelog.

6.2.0 2026-07-29

  • Upgrade to libpg_query 17-6.2.2
  • Add pg_query::summary function
    • This uses the new pg_query_summary C function that significantly improves performance when you need metadata (like a list of referenced tables) but don't need the full parse tree.
  • NodeEnum: Improve performance when iterating over parse tree using nodes and nodes_mut
  • Fix build caching issues in build.rs script
Commits

Updates rhai from 1.25.1 to 1.26.0

Release notes

Sourced from rhai's releases.

Version 1.26.0

This is a significant release.

The major change in this version is the addition of the experimental Rhai Grain bytecodes VM for faster evaluation of scripts under resource constraints.

This is experimental and gated under the grain feature flag.

Rhai Grain VM

Bugs found in the process

Since the Rhai Grain VM must run a script exactly the same as the standard AST interpreter, a number of bugs have been uncovered that are now fixed.

Bug fixes

Enhancements

Changelog

Sourced from rhai's changelog.

Version 1.26.0

The major change in this version is the addition of the experimental Rhai Grain bytecodes compiler and VM for fast evaluation of scripts.

This is a work-in-progress and is not yet fully integrated into the main Engine API.

It is gated under the grain feature flag.

Rhai Grain VM

Bugs found in the process

Since the Rhai Grain VM must run a script exactly the same as the standard AST interpreter, a number of bugs have been uncovered that are now fixed.

Bug fixes

Enhancements

Commits

Updates tokio-rustls from 0.26.4 to 0.26.5

Release notes

Sourced from tokio-rustls's releases.

0.26.5

What's Changed

Commits
  • f8832d2 Bump version to 0.26.5
  • c0fad2f return more data at once from TlsStream::poll_read (#198)
  • edc7306 build(deps): bump futures-util from 0.3.33 to 0.3.34
  • baeadaa build(deps): bump rcgen from 0.14.8 to 0.14.9
  • 1e138ad build(deps): bump taiki-e/cache-cargo-install-action from 3.0.7 to 3.0.8
  • b4ecff6 build(deps): bump taiki-e/cache-cargo-install-action from 3 to 3.0.7
  • f47a689 build(deps): bump rustls from 0.23.42 to 0.23.43
  • e25578e build(deps): bump tokio from 1.53.0 to 1.53.1
  • d2a6d98 server: add rustdoc hinting towards timeout wrapping
  • c2e9b4a client: add rustdoc hinting towards timeout wrapping
  • Additional commits viewable in compare view

Updates tower-http from 0.7.0 to 0.7.1

Release notes

Sourced from tower-http's releases.

tower-http-0.7.1

Added

  • fs: add ServeDir::redirect_to_trailing_slash() to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)
  • fs: add ignore_multi_range_requests() to ServeDir and ServeFile, serving the full representation when a request asks for multiple byte ranges. The existing 416 Range Not Satisfiable response remains the default (#727)
  • request-id: the constructors and accessors on the request-id layers, services, and RequestId are now const fn, so they can be used in const context (#716)

Changed

  • fs: the minimum http-range-header requirement is now 0.4.2 (#661)

Fixed

  • behavioral change: fs: make ServeDir::try_call propagate expected filesystem I/O errors when no fallback is configured, as documented, instead of converting them to 404 Not Found responses (#718)
  • decompression: don't end the body when a data frame with no remaining bytes arrives after the decompressor reports end-of-stream. Trailers following such a frame were dropped and could not be recovered (#722)
  • decompression: return a body error when a data frame with remaining bytes arrives after the decompressor reports end-of-stream, rather than silently truncating. This regressed in 0.7.0 (#712)
  • fs: multipart range requests are now rejected before range validation, so they consistently return 416 Range Not Satisfiable with a Cannot serve multipart range requests body instead of a generic unsatisfiable-range response (#661)
  • fs: range error responses no longer carry representation headers such as Content-Type and Content-Encoding (#727)
  • set-header: SetMultipleResponseHeadersLayer and SetMultipleResponseHeader are now Clone regardless of the response body type, matching the fix applied to the request-side types in 0.7.0 (#714)

#661: tower-rs/tower-http#661 #712: tower-rs/tower-http#712 #714: tower-rs/tower-http#714 #716: tower-rs/tower-http#716 #718: tower-rs/tower-http#718 #722: tower-rs/tower-http#722 #727: tower-rs/tower-http#727 #728: tower-rs/tower-http#728

All the changes

... (truncated)

Commits
  • c941451 chore(release): prepare 0.7.1 (#729)
  • 9697702 chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (#730)
  • e2582e2 Allow ignoring multi-range requests (#727)
  • 888f7fe feat(services): configure directory redirects (#728)
  • 5ad7654 chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (#726)
  • d154adb fix: reject multipart ranges before validation (#661)
  • d9e5c8a ci: Update to cargo-check-external-types 0.5.0 (#724)
  • 90c072b Propagate ServeDir::try_call I/O errors (#718)
  • 860922e fix(decompression): don't end the body on an empty data frame (#722)
  • 8532252 docs(example)/custom future with multiple bodies (#711)
  • Additional commits viewable in compare view

Updates uuid from 1.24.1 to 1.26.0

Release notes

Sourced from uuid's releases.

v1.26.0

What's Changed

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

Commits
  • cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
  • 34e4f49 don't test macros under miri
  • d9e7242 update nightly used for miri
  • ec16819 prepare for 1.26.0 release
  • 162cd20 Merge pull request #904 from ChrisJr404/v7-additional-precision-bits
  • 97eceff Add ContextV7::with_additional_precision_bits for microsecond clocks
  • 302e0bf Merge pull request #903 from uuid-rs/cargo/1.25.0
  • b7ccde8 prepare for 1.25.0 release
  • c62dffb Merge pull request #902 from ChrisJr404/serde-bytes-module
  • 8c198b2 Add a serde::bytes module that encodes as a byte string
  • See full diff in compare view

Updates oxjsonld from 0.2.5 to 0.2.6

Changelog

Sourced from oxjsonld's changelog.

[Unreleased]

Added

  • sparopt: GraphPattern::join_order_variables, exposing the join / variable-elimination order chosen by Optimizer::optimize_graph_pattern for consumption by external execution engines (e.g. worst-case-optimal join executors).

Fixed

  • SPARQL: avoid counting shared triples multiple times when merging default graphs with FROM, USING, or the union-default-graph option. RocksDB-backed stores use their ordered indexes to perform this merge without retaining all matched triples.

[0.5.7] - 2026-04-19

Changed

  • JSON-LD: Fixes conflicts between @type and @language in property-scoped contexts.
  • Bump RocksDB to 11.0.4

[0.5.6] - 2026-03-14

Changed

  • SPARQL: DESCRIBE: do not describe values of blank node "variables".
  • SPARQL: Fixes some bug in the parser related to spacing.
  • SPARQL: Fixes evaluation of SERVICE clauses with unsupported custom functions.
  • JSON-LD: fixes serialization of relative IRIs looking like keywords.
  • RocksDB: reduce the number of copies in read operations.

[0.5.5] - 2026-02-14

Added

  • JSON-LD: JSON-LD 1.1 is now implemented and enabled by default.
  • JavaScript: the parse method that allows to parse a RDF file from a buffer, an iterator of buffers or and async iterator of buffers (including streams).
  • oxrdf: the Dataset.quads_for_pattern method allowing to iterate only on quads matching a given pattern.
  • oxjsonld: The JsonLdParser.with_processing_mode method to select the JSON-LD 1.0 or 1.1 processing mode.

Changed

  • RocksDB fixes a panic when ulimit -n is set to a very large number.

[0.5.4] - 2026-01-24

Added

  • RDF/XML: support of the current 1.2 draft behind the rdf-12 cargo feature (directional language strings and triple terms).
  • RDFC 1.0 canonicalization algorithm on the Graph and Dataset containers.

Changed

  • oxrdf: the default Unstable canonicalization algorithm has been changed for a variant of RDFC 1.0. It seems much faster in a lot of cases.
  • HTTP: always set sd:endpoint in the served service description (the value is guessed from the incoming request values).
  • spareval: make QueryTripleIter::new public.
  • JSON-LD: lots of internal changes in preparation of JSON-LD 1.1 support (might affect some edge cases of 1.0 parsing).

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the cargo-minor-patch group across 1 directory with…
88070f0 
… 9 updates

Bumps the cargo-minor-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aws-lc-rs](https://github.com/aws/aws-lc-rs) | `1.18.0` | `1.18.1` |
| [hickory-resolver](https://github.com/hickory-dns/hickory-dns) | `0.26.1` | `0.26.2` |
| [napi](https://github.com/napi-rs/napi-rs) | `3.12.1` | `3.12.2` |
| [pg_query](https://github.com/pganalyze/pg_query.rs) | `6.1.1` | `6.2.0` |
| [rhai](https://github.com/rhaiscript/rhai) | `1.25.1` | `1.26.0` |
| [tokio-rustls](https://github.com/rustls/tokio-rustls) | `0.26.4` | `0.26.5` |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.7.0` | `0.7.1` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.24.1` | `1.26.0` |
| [oxjsonld](https://github.com/oxigraph/oxigraph) | `0.2.5` | `0.2.6` |



Updates `aws-lc-rs` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/aws/aws-lc-rs/releases)
- [Commits](aws/aws-lc-rs@v1.18.0...v1.18.1)

Updates `hickory-resolver` from 0.26.1 to 0.26.2
- [Release notes](https://github.com/hickory-dns/hickory-dns/releases)
- [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md)
- [Commits](hickory-dns/hickory-dns@v0.26.1...v0.26.2)

Updates `napi` from 3.12.1 to 3.12.2
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](napi-rs/napi-rs@napi-v3.12.1...napi-v3.12.2)

Updates `pg_query` from 6.1.1 to 6.2.0
- [Changelog](https://github.com/pganalyze/pg_query.rs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pganalyze/pg_query.rs/commits/v6.2.0)

Updates `rhai` from 1.25.1 to 1.26.0
- [Release notes](https://github.com/rhaiscript/rhai/releases)
- [Changelog](https://github.com/rhaiscript/rhai/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rhaiscript/rhai/commits/v1.26.0)

Updates `tokio-rustls` from 0.26.4 to 0.26.5
- [Release notes](https://github.com/rustls/tokio-rustls/releases)
- [Commits](rustls/tokio-rustls@v/0.26.4...v/0.26.5)

Updates `tower-http` from 0.7.0 to 0.7.1
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.7.0...tower-http-0.7.1)

Updates `uuid` from 1.24.1 to 1.26.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.24.1...v1.26.0)

Updates `oxjsonld` from 0.2.5 to 0.2.6
- [Release notes](https://github.com/oxigraph/oxigraph/releases)
- [Changelog](https://github.com/oxigraph/oxigraph/blob/main/CHANGELOG.md)
- [Commits](https://github.com/oxigraph/oxigraph/commits)

---
updated-dependencies:
- dependency-name: aws-lc-rs
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: hickory-resolver
  dependency-version: 0.26.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: napi
  dependency-version: 3.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: pg_query
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: rhai
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: tokio-rustls
  dependency-version: 0.26.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: tower-http
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: uuid
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: oxjsonld
  dependency-version: 0.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Rust implementation work. labels Sep 7, 2026
@dependabot
dependabot Bot requested a review from jeremi as a code owner September 7, 2026 17:30
@dependabot dependabot Bot added rust Rust implementation work. dependencies Pull requests that update a dependency file labels Sep 7, 2026
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Sep 7, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 88070f035d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.toml
rcgen = { version = "0.13", default-features = false, features = ["ring", "zeroize"] }
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "rustls-tls-native-roots"] }
rhai = { version = "=1.25.1", features = ["sync", "serde"] }
rhai = { version = "=1.26.0", features = ["sync", "serde"] }

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep Rhai at the version frozen by the Evidence contract

This changes the interpreter to 1.26.0 while products/evidence/contracts/rhai-abi.yaml:170 still freezes the ABI to Rhai 1.25.1 and registry-evidence/src/rhai_runtime.rs:1574 reviews scripts according to 1.25.1 tokenization. Version 1.26 includes semantic changes to optimization, switch ranges, shared-value matching, and curried function calls, so scripts exercising those cases can now produce different assertions despite remaining labeled as the frozen ABI; Base Registry Engine likewise continues emitting rhaiVersion: 1.25.1 from change_request.rs:64. Keep the dependency pinned or update and revalidate every versioned contract, reviewer, and emitted version marker together.

AGENTS.md reference: AGENTS.md:L180-L181

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@jeremi jeremi Awaiting requested review from jeremi jeremi is a code owner

At least 0 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Rust implementation work.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants