chore(deps): cargo update — safe compatible bumps - #907
Merged
Conversation
Applies the semver-compatible bumps available within the version ranges already declared in Cargo.toml: aws-lc-rs/aws-lc-sys/aws-lc-fips-sys, rustls/webpki-roots, serde/serde_core/serde_derive, syn/quote/proc-macro2, office_oxide 0.1.6 -> 0.1.7, taffy, thiserror, uuid, regex/regex-automata, zerocopy, wasm-bindgen family, and others. Two items #793 flagged were investigated and deliberately left alone, same as previous attempts: - tract-onnx 0.22 -> 0.23: still declined. 0.23 pulls in dyn-eq 0.1.3 (MPL-2.0), which fails `cargo deny --all-features check licenses` against this project's locked no-copyleft policy (deny.toml, v0.3.35 PLAN-1) -- same reason PR #638 was declined. Confirmed still true by running the check with the bump applied. - ort 2.0.0-rc.11 -> rc.12: still declined. rc.12's `ep::vitis` module references an `OrtApi` field gated behind the `api-18` feature, which isn't enabled under this crate's `load-dynamic`-only feature set -- an upstream compile bug, not something to route around by pulling in a higher API level blind (that changes the ABI expected from the dynamically-loaded onnxruntime.so at runtime). Same root cause as PR #496's decline; no newer ort release has landed since. Everything else in #793's original cargo-outdated report (der, pkcs8, signature, spki, rand, digest, sha2, prost, itertools, etc.) is transitive -- pulled in by tract-onnx/ort's own Cargo.toml, not ours to pin directly. Verified: cargo check (default, ocr, ocr-tract, fips+icc, rendering features), cargo test --lib (5750 passed), cargo deny --all-features check (advisories/bans/licenses/sources all ok). Closes #793
This was referenced Jul 21, 2026
yfedoseev
added a commit
that referenced
this pull request
Jul 22, 2026
…python) (#931) * chore(deps): combined dependabot roundup Folds the still-needed dependabot bumps into one PR (the serial ones all touch shared files — Cargo.lock, release.yml, pyproject.toml — so merging them individually would conflict-churn). Supersedes #915-#924, #927, #928, #930; #925/#926/#929 already landed via #907 and were closed. Rust crates: clap 4.6.2->4.6.3, libc 0.2.186->0.2.188 (cargo update) CI actions: actions/checkout 7.0.0->7.0.1, actions/setup-node 6.4.0->7.0.0, github/codeql-action/init 4.37.0->4.37.1, sbt/setup-sbt 1.5.0->1.5.2, softprops/action-gh-release 3.0.1->3.0.2 Go module: ebitengine/purego 0.10.1->0.10.2 Python deps: torch >=2.13.0, transformers >=5.14.1, pdfplumber >=0.11.10, sec-edgar-downloader >=5.1.0, ty >=0.0.61 (pyproject + scripts reqs) Claude-Session: https://claude.ai/code/session_01VfT1dvLWaMNh4SpaXV8kcp * fix(deps): drop py3.9-incompatible python bumps, fix codeql action SHA CI surfaced two real failures in the roundup: 1. uv resolution failed for Python 3.9 (project supports >=3.9). Every python dependency bump in the roundup targets a release that dropped py3.9: pdfplumber 0.11.10 (via pdfminer-six 20260107), torch 2.13.0, transformers 5.14.1, sec-edgar-downloader 5.1.0 — all require >=3.10. Reverted all python bumps (pyproject + scripts reqs) to main's values; the roundup now carries only the safe Rust-crate / CI-action / Go bumps. The python bumps need a separate decision (they force dropping py3.9 support) and are out of scope for a routine roundup. 2. CodeQL failed: 'Loaded a configuration file for version 4.37.1, but running version 4.37.0' — dependabot only bumped codeql-action/init to 4.37.1, leaving codeql-action/analyze at 4.37.0 (codeql-action is a monorepo; all sub-actions must share the release SHA). Pinned analyze to init's 4.37.1 SHA. Verified locally: uv lock resolves, cargo fmt --check clean. Claude-Session: https://claude.ai/code/session_01VfT1dvLWaMNh4SpaXV8kcp * fix(deps): propagate purego 0.10.2 to all go example modules Go Bindings CI failed: 'go: updates to go.mod needed; go mod tidy'. Dependabot #930 bumped only go/go.mod+go.sum to purego 0.10.2, but the ~22 examples/go/* modules each have their own go.mod/go.sum pinning purego 0.10.1 (indirect, via the replace on the go binding). Ran go mod tidy in every example module so their go.sum carries the 0.10.2 hash. Claude-Session: https://claude.ai/code/session_01VfT1dvLWaMNh4SpaXV8kcp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses the remaining triage from #793 (the maintainer's own comment on that issue notes the dependabot-flagged crates were handled separately in #835, and the
cargo-outdatedlist here still needed manual review).cargo update, picking up every bump that's semver-compatible within the ranges already declared inCargo.toml— aws-lc-rs/aws-lc-sys/aws-lc-fips-sys, rustls/webpki-roots, serde family, syn/quote/proc-macro2,office_oxide0.1.6 → 0.1.7, taffy, thiserror, uuid, regex/regex-automata, zerocopy, the wasm-bindgen family, and others.dyn-eq 0.1.3(MPL-2.0), which failscargo deny --all-features check licensesagainst this project's locked no-copyleft policy (deny.toml, v0.3.35 PLAN-1) — same reason PR chore(deps): bump tract-onnx from 0.22.1 to 0.23.0 #638 was declined. Reconfirmed by actually applying the bump and running the check.ep::vitismodule references anOrtApifield gated behind theapi-18feature, which isn't enabled under this crate'sload-dynamic-only feature set — an upstreamort/ort-syscompile bug (confirmed by actually applying the bump and hitting the sameE0609PR chore(deps): bump ort from 2.0.0-rc.11 to 2.0.0-rc.12 #496 hit). Not routing around it by pulling in a higher API level blind, since that changes the ABI expected from the dynamically-loadedonnxruntime.soat runtime. No newerortrelease has landed since rc.12 (2026-03).cargo-outdatedreport (der, pkcs8, signature, spki, rand, digest, sha2, prost, itertools, etc.) is transitive — pulled in bytract-onnx's/ort's ownCargo.toml, not ours to pin directly.Test plan
cargo check -p pdf_oxide --lib(default features)cargo check -p pdf_oxide --lib --features ocr(ort)cargo check -p pdf_oxide --lib --features ocr-tract(tract-onnx)cargo check -p pdf_oxide --lib --no-default-features --features fips,icccargo check -p pdf_oxide --lib --features renderingcargo test -p pdf_oxide --lib— 5750 passed, 0 failedcargo deny --all-features check— advisories/bans/licenses/sources all okCloses #793