From 87391120147ade4c64aa535cdadc61e8cd535f0c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 22:03:45 +0000 Subject: [PATCH 1/3] build(deps): bump the cargo group with 5 updates Bumps the cargo group with 5 updates: | Package | From | To | | --- | --- | --- | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [gix-imara-diff](https://github.com/GitoxideLabs/gitoxide) | `0.3.0` | `0.3.1` | | [napi](https://github.com/napi-rs/napi-rs) | `3.14.0` | `3.14.2` | | [napi-derive](https://github.com/napi-rs/napi-rs) | `3.6.10` | `3.6.12` | | [zip](https://github.com/zip-rs/zip2) | `8.6.0` | `9.0.1` | Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.151...v1.0.154) Updates `gix-imara-diff` from 0.3.0 to 0.3.1 - [Release notes](https://github.com/GitoxideLabs/gitoxide/releases) - [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md) - [Commits](https://github.com/GitoxideLabs/gitoxide/compare/gix-imara-diff-v0.3.0...gix-imara-diff-v0.3.1) Updates `napi` from 3.14.0 to 3.14.2 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/napi-v3.14.0...napi-v3.14.2) Updates `napi-derive` from 3.6.10 to 3.6.12 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/napi-derive-v3.6.10...napi-derive-v3.6.12) Updates `zip` from 8.6.0 to 9.0.1 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/compare/v8.6.0...v9.0.1) --- updated-dependencies: - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: gix-imara-diff dependency-version: 0.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: napi dependency-version: 3.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: napi-derive dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: zip dependency-version: 9.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo ... Signed-off-by: dependabot[bot] --- Cargo.lock | 41 ++++++++++++++++++++++------------ clang-tools-manager/Cargo.toml | 2 +- 2 files changed, 28 insertions(+), 15 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 119d873b..3e09e0f1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -904,9 +904,9 @@ dependencies = [ [[package]] name = "gix-imara-diff" -version = "0.3.0" +version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "305657ad44356151d73c145f567c25b24fdf2466bfb3e90727e1d5461a4e9748" +checksum = "1c48eccd894bd15555b0346470e63491ded94aefe76b3fcb1052084b5a393238" dependencies = [ "bstr", "hashbrown 0.17.1", @@ -1500,9 +1500,9 @@ dependencies = [ [[package]] name = "napi" -version = "3.14.0" +version = "3.14.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "15301c22171e8397a7b17beb3c75bf486bf67ca3bdad8ea347835b770df61969" +checksum = "a4e2cf85c02d9b057898c485b824c3c416b65193689e2b7f517efc94b86ed24c" dependencies = [ "bitflags", "ctor", @@ -1523,29 +1523,29 @@ checksum = "b899b545d3aa6dca985939059f258c5488d34e4ecf39c274e20009748f4b846d" [[package]] name = "napi-derive" -version = "3.6.10" +version = "3.6.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d11174f7507d7f6cdd69874f541eff194e81c95652b775e69036bcf8d5b7a805" +checksum = "92cec6048ac04041ac8055bdce1ec4f353416cd443ba9222bf73af790c3d4495" dependencies = [ "convert_case", "ctor", "napi-derive-backend", "proc-macro2", "quote", - "syn 2.0.117", + "syn 3.0.3", ] [[package]] name = "napi-derive-backend" -version = "6.1.4" +version = "6.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fd6856fe1686867da90ed0dc292d7c0c87a695eb7c578b913360f33619ee01e3" +checksum = "fae2444f4ba7333754bb73414ff8059dec2cb23b83a95bd1a0bf08169eed1be0" dependencies = [ "convert_case", "proc-macro2", "quote", "semver", - "syn 2.0.117", + "syn 3.0.3", ] [[package]] @@ -1557,6 +1557,18 @@ dependencies = [ "libloading", ] +[[package]] +name = "nix" +version = "0.31.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d" +dependencies = [ + "bitflags", + "cfg-if", + "cfg_aliases", + "libc", +] + [[package]] name = "nohash-hasher" version = "0.2.0" @@ -2293,9 +2305,9 @@ dependencies = [ [[package]] name = "serde_json" -version = "1.0.151" +version = "1.0.154" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14" +checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6" dependencies = [ "itoa", "memchr", @@ -3299,14 +3311,15 @@ dependencies = [ [[package]] name = "zip" -version = "8.6.0" +version = "9.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" +checksum = "e49ade69c4434c55dd651d36fe05f38e0578db948b773cbc01c48c4b5e560692" dependencies = [ "crc32fast", "flate2", "indexmap", "memchr", + "nix", "typed-path", "zopfli", ] diff --git a/clang-tools-manager/Cargo.toml b/clang-tools-manager/Cargo.toml index 4de24a46..f8e890aa 100644 --- a/clang-tools-manager/Cargo.toml +++ b/clang-tools-manager/Cargo.toml @@ -38,7 +38,7 @@ thiserror = { workspace = true } tokio = { workspace = true, features = ["macros"], optional = true } url = "2.5.8" which = "8.0.2" -zip = { version = "8.6.0", default-features = false, features = ["deflate"] } +zip = { version = "9.0.1", default-features = false, features = ["deflate"] } [dev-dependencies] mockito = { workspace = true } From d22dfe187966280cadbf0c6db26122479d567a9b Mon Sep 17 00:00:00 2001 From: Brendan <2bndy5@gmail.com> Date: Sun, 18 Oct 2026 18:13:25 -0700 Subject: [PATCH 2/3] use safer function to get file name/path from archive Part of the breaking changes in the zip lib. --- clang-tools-manager/src/downloader/pypi.rs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/clang-tools-manager/src/downloader/pypi.rs b/clang-tools-manager/src/downloader/pypi.rs index a92c77ce..4714290b 100644 --- a/clang-tools-manager/src/downloader/pypi.rs +++ b/clang-tools-manager/src/downloader/pypi.rs @@ -8,7 +8,7 @@ use std::{ fs, io::{Read, Write}, num::NonZero, - path::PathBuf, + path::{Path, PathBuf}, process::Command, str::FromStr, time::Duration, @@ -556,7 +556,10 @@ impl PyPiDownloader { ); for i in 0..archive.len() { let mut file = archive.by_index(i)?; - if file.name() == expected_zip_path { + if file + .enclosed_name() + .is_some_and(|n| n == Path::new(&expected_zip_path)) + { if extracted_bin.exists() { let meta = fs::metadata(extracted_bin)?; if meta.len() == file.size() { From 34bb3c39d69d9c0e1108cb88fb0e6e092e9d83a0 Mon Sep 17 00:00:00 2001 From: Brendan <2bndy5@gmail.com> Date: Sun, 18 Oct 2026 18:27:25 -0700 Subject: [PATCH 3/3] update corresponding Cargo.toml manifests I have no idea why dependabot keeps skipping these files --- Cargo.lock | 4 ++-- Cargo.toml | 4 ++-- bindings/node/Cargo.toml | 4 ++-- cpp-linter/Cargo.toml | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3e09e0f1..5181ebb0 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2563,9 +2563,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.2" +version = "1.53.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" +checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e" dependencies = [ "bytes", "libc", diff --git a/Cargo.toml b/Cargo.toml index 1bb9f4ca..dde7091c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -31,6 +31,6 @@ reqwest = { version = "0.13.4", default-features = false, features = ["http2", " thiserror = "2.0.18" semver = "1.0.28" serde = { version = "1.0.228", features = ["derive"] } -serde_json = "1.0.150" +serde_json = "1.0.154" tempfile = "3.27.0" -tokio = "1.52.3" +tokio = "1.53.3" diff --git a/bindings/node/Cargo.toml b/bindings/node/Cargo.toml index ba10563b..864754a9 100644 --- a/bindings/node/Cargo.toml +++ b/bindings/node/Cargo.toml @@ -17,8 +17,8 @@ bench = false [dependencies] # Default enable napi4 feature, see https://nodejs.org/api/n-api.html#node-api-version-matrix -napi = { version = "3.9.0", default-features = false, features = ["napi4", "async"] } -napi-derive = "3.5.6" +napi = { version = "3.14.2", default-features = false, features = ["napi4", "async"] } +napi-derive = "3.6.12" cpp-linter = { path = "../../cpp-linter", features = ["bin"] } anyhow = { workspace = true } diff --git a/cpp-linter/Cargo.toml b/cpp-linter/Cargo.toml index 4b537559..16161f8b 100644 --- a/cpp-linter/Cargo.toml +++ b/cpp-linter/Cargo.toml @@ -22,7 +22,7 @@ clap = { workspace = true, optional = true } colored = { workspace = true } fast-glob = "1.0.1" futures = "0.3.32" -gix-imara-diff = { version = "0.3.0", features = ["unified_diff"] } +gix-imara-diff = { version = "0.3.1", features = ["unified_diff"] } log = { workspace = true } regex = { workspace = true } reqwest = { workspace = true }