Bump clap from 4.6.6 to 4.6.7

[dependabot]

Bumps clap from 4.6.6 to 4.6.7.

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d5d6e8c6-3de1-46bd-9d6f-e66a9be2470d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gcomte]

Automatic maintenance needs attention for 67ca9884034108fbd78b17a130d9184ca2c913fc.

The automatic repair limit was reached. The current failure needs maintainer attention.

No successful completion is being claimed.

[gcomte]

CI repair — commit 7324854d97446b23ebf061c73c72ff68028a0cb1

Fixed the pre-existing security audit failure by updating only rustls 0.23.44 → 0.23.45 in Cargo.lock. Preserved the clap update. Audit, formatting, build, all 60 tests, and Clippy now pass. Ready for controller validation and publication.

Findings:

• Both supplied head and master CI logs report RUSTSEC-2026-0285; the comparison base contains the same vulnerable rustls version. This is not a clap regression.
• RustSec and upstream release notes confirm the fix: https://rustsec.org/advisories/RUSTSEC-2026-0285 and https://github.com/rustls/rustls/releases/tag/v/0.23.45.
• Verified the published crate checksum and Rust 1.71 minimum, compatible with the project's Rust 1.95 minimum. Security review found no additional concerns.
• Final inspection confirms only the rustls version and checksum changed; no staged changes or untracked files remain.

Validation (independent execution):

• cargo fmt --check --all: exit 0
• cargo build --locked: exit 0
• cargo test --locked --bins: exit 0
• cargo test --locked --test '*' -- --include-ignored: exit 0
• cargo clippy --locked --all-targets -- -D warnings: exit 0
• cargo audit: exit 0

[gcomte]

Independent review — commit 7324854d97446b23ebf061c73c72ff68028a0cb1

Reviewed head 7324854 against the supplied base. No actionable issues found. The clap update requires no CLI migration and remains compatible with the declared Rust minimum. The additional rustls 0.23.45 update fixes the base’s reproduced RUSTSEC-2026-0285 failure. All six configured checks passed, including 60 tests and live ticker requests. Workspace unchanged; no correction needed. Subagent creation was unavailable, so review was completed locally.

Validation (independent execution):

• cargo fmt --check --all: exit 0
• cargo build --locked: exit 0
• cargo test --locked --bins: exit 0
• cargo test --locked --test '*' -- --include-ignored: exit 0
• cargo clippy --locked --all-targets -- -D warnings: exit 0
• cargo audit: exit 0

[gcomte]

Independent Codex review and CI both passed for 7324854d97446b23ebf061c73c72ff68028a0cb1. This PR is ready for maintainer review and merging.