Skip to content

deps: refresh dependencies (2026-10-20) - #1683

Merged
dekobon merged 11 commits into
mainfrom
deps/refresh-2026-10-20
Oct 21, 2026
Merged

dekobon merged 11 commits into
mainfrom
deps/refresh-2026-10-20

Conversation

@dekobon

@dekobon dekobon commented Oct 21, 2026

Copy link
Copy Markdown
Owner

Updates the workspace's dependencies to their newest appropriate versions. Dependabot already opens semver-compatible bumps every week and ignores semver-major ones. This PR covers what it can't: a full lockfile refresh, =-pinned and 0.x-minor manifest bumps, the Python lock, and three grammar pins.

rust-version stays at 1.94: every new release's MSRV is at or below it.

Commits

Commit Change
deps: refresh Cargo.lock Plain cargo update, 110 packages (actix-web 4.17, tokio 1.54, …)
deps: refresh excluded-crate lockfiles enums, fuzz and the five vendored grammars
deps(py): bump pyo3 to 0.30.1 Drops skip_from_py_object, which is now the default and deprecated
deps: bump gix to 0.89 The only substantive port; see below
deps(dev): bump jsonschema to 0.59, quick-xml to 0.42 quick-xml yields element names as str, so the checkstyle validators drop their UTF-8 decode steps
deps(py): upgrade uv.lock Regenerates the requirements exports; ruff 0.16.10, with the ruff-pre-commit rev moved with it
chore(pre-commit): bump taskcluster_yml_validator v0.0.13
deps(php): bump tree-sitter-php to 0.25.1 Four constructs the old grammar parsed as ERROR now parse; two move metrics
deps(groovy): bump dekobon-tree-sitter-groovy to 0.3.0 Grammar unchanged; parser.c differs only in its embedded version
deps(irules): bump tree-sitter-irules to 0.2.0 Same as groovy

gix 0.89

gix 0.88 replaced its per-call error enums with one erased gix::Error that carries a recovery class.

  • vcs: gix-blame intermittent object-lookup failure on pathologically repetitive files #579 retry. The retry used to match the typed "an existing object was reported missing" variants, which no longer exist. It now retries any NotFound-classified error, which also covers a genuinely absent object and a path absent at the ref. Those deterministic misses now cost two extra bounded attempts. Two tests pin gix's classification using real errors, not hand-built ones:
    • real find_commit failures: absent, wrong kind, unclassified;
    • a real blame_file miss whose NotFound sits under gix-blame's unclassified wrapper message, which is the race's own shape.
  • Not-a-repository detection. It downcasts to the still-typed gix::discover::upwards::Error, so the variant set is unchanged. Neutralising the downcast fails six "outside a repo" tests across lib, CLI and web.
  • Tree-diff visitors now go through a small diff_visitor adapter. The history.rs / jit.rs hunks are re-indentation only under git diff -w.
  • Baseline. The .bca-baseline.toml change is a rename only: two closures' line-keyed names moved, and their values are unchanged.

PHP grammar: metric changes

Both are fixes, and each has a regression test. On the same input, the 0.24.2 binary scored differently:

  • A function after use \Foo\{Bar, Baz}; was swallowed by error recovery. Every following function scored nom 0; they're now counted.
  • private(set) on a promoted constructor parameter billed private and set as operands. It now scores like the same modifier on a property declaration.

No corpus snapshot moved for any of the three grammar bumps, so there is no big-code-analysis-output submodule change.

Deferred

Verification

  • make pre-commit: BCA_GATE: pass.
  • make fuzz-check, make check-test-lang-gates-compare COMPARE_REF=origin/main, make py-stubtest, and the example notebook run against the new examples.txt (pillow 13) all pass.

PyO3 0.30 makes the Clone-derived FromPyObject opt-in, so the
explicit skip_from_py_object on AnalysisFailure is now a deprecated
no-op and is removed. Options keeps its from_py_object opt-in.
gix 0.88 replaced its per-call error enums with one erased gix::Error
carrying a recovery class. Three call sites relied on the typed forms:

- The #579 retry predicates matched the FindExistingObject /
  FindExistingIter / NotFound variants. Those no longer exist, so one
  is_transient_object_miss now retries any NotFound-classified error.
  A genuinely absent object or a path missing at the ref now spends
  the two retries before failing; each fails at its first lookup.
  The test now drives real find_commit failures, so gix's own
  classification of each shape is pinned too.
- map_discover_error downcasts to gix::discover::upwards::Error, which
  is still typed inside the tree, keeping the exact variant set.
- Tree-diff visitors must return gix::Result; diff_visitor adapts the
  existing crate-Error closures.

Also follows try_from_bstr -> from_bstr and a fallible is_shallow.
The baseline refresh is the two visitor closures' line-keyed names.
quick-xml 0.42 yields element names and attribute values as str, so
the checkstyle validators drop their now-unreachable UTF-8 decode
steps and compare against str literals.
Re-exports requirements/dev.txt and examples.txt from the upgraded
lock and moves the ruff-pre-commit rev to v0.16.10 with it, as the
ruff lockstep gate requires.
@dekobon dekobon added the dependencies Pull requests that update a dependency file label Oct 21, 2026
The pin moves in lockstep in Cargo.toml and enums/Cargo.toml, and the
regenerated Php enum gains ArgumentPlaceholder (partial function
application), renumbering every id after it.

Four constructs the old grammar parsed as ERROR now parse. Two of
them move metrics, and each gets a regression test that fails under
0.24.2:

- `use \Foo\{…};` with a leading backslash had swallowed the
  following function into recovery, so it scored nom 0.
- `private(set)` on a promoted parameter billed `private` and `set`
  as operands; it now scores like the same modifier on a property.

clone-with-arguments and `f(?, 2)` score as before. No corpus
snapshot moved. The version-citing comments in loc.rs and nexits.rs
were re-verified with bca dump against 0.25.1 before being updated.
The release changes no grammar: grammar.js, grammar.json,
node-types.json and scanner.c are byte-identical to 0.2.2, and
parser.c differs only in its embedded version. The regenerated enum
is unchanged and no snapshot moves. The two comments describing the
currently pinned parse of a `final` local now cite 0.3.0.
As with groovy 0.3.0, the release changes no grammar: grammar.js,
grammar.json, node-types.json and scanner.c are byte-identical to
0.1.1, and parser.c differs only in its embedded version. 0.2.0 still
requires tree-sitter-language ^0.1.7, so the caret-range rationale in
AGENTS.md and the vendored manifests holds; their citations now name
0.2.0.
@codecov

codecov Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.29126% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.27%. Comparing base (1149499) to head (801cc77).

Files with missing lines Patch % Lines
src/vcs/git/jit.rs 84.61% 0 Missing and 4 partials ⚠️
src/vcs/git/history.rs 86.36% 0 Missing and 3 partials ⚠️
src/vcs/git/repo.rs 88.88% 0 Missing and 3 partials ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #1683      +/-   ##
==========================================
+ Coverage   98.26%   98.27%   +0.01%     
==========================================
  Files         371      371              
  Lines      108453   108482      +29     
  Branches   108018   108047      +29     
==========================================
+ Hits       106566   106612      +46     
+ Misses       1211     1204       -7     
+ Partials      676      666      -10     
Flag Coverage Δ
python 100.00% <ø> (ø)
rust 98.26% <90.29%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
big-code-analysis-ast/src/langs.rs 95.26% <ø> (ø)
...ig-code-analysis-ast/src/languages/language_php.rs 99.77% <100.00%> (+<0.01%) ⬆️
src/metrics/abc.rs 99.73% <ø> (ø)
src/metrics/abc/groovy.rs 97.56% <ø> (ø)
src/metrics/halstead.rs 99.24% <100.00%> (+<0.01%) ⬆️
src/metrics/loc.rs 99.80% <ø> (ø)
src/metrics/nexits.rs 100.00% <ø> (ø)
src/metrics/nom.rs 99.76% <100.00%> (+<0.01%) ⬆️
src/vcs/git/blame.rs 84.96% <100.00%> (-0.28%) ⬇️
src/vcs/git/mod.rs 94.64% <100.00%> (+4.44%) ⬆️
... and 3 more
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@dekobon
dekobon force-pushed the deps/refresh-2026-10-20 branch from d4cdcd7 to f0708ce Compare October 21, 2026 03:26
The gix 0.89 port re-indented the three tree-diff visitors, which put
their long-standing coverage gaps into the patch.

Two JIT arms had no test at all; perturbing either now fails exactly
its new test:
- the rename arm, which is how a moved file keeps its prior history;
- the binary-blob skip.

A tree naming an unwritten blob makes `change.diff()` fail on demand,
and each visitor must surface that as Error::Diff: target
enumeration, the history walk and the scored commit. The fixture file
is `.rs` on purpose. A `.txt` falls outside the default metrics scope
and is skipped unread, which let the enumeration test pass on the
walk's failure instead.
@dekobon
dekobon merged commit f92ddf0 into main Oct 21, 2026
64 checks passed
@dekobon
dekobon deleted the deps/refresh-2026-10-20 branch October 21, 2026 04:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant