From 7b8c43e378353a955df81b0a690190a09e79efa2 Mon Sep 17 00:00:00 2001
From: Ken Tobias <634380+l1a@users.noreply.github.com>
Date: Fri, 18 Sep 2026 21:59:02 -0700
Subject: [PATCH] Bump toml to 1.1.6 (consolidate #251)

Rolls Dependabot #251 onto a gated branch so the version bump, NOTES
entry and man-page regeneration it skips are done. Lockfile-only: the
"1.1" caret spec already admits 1.1.6, and nothing else moves.

The only code change in 1.1.6 is an ownership refactor in
de/parser/document.rs::finish_table, which toml::from_str reaches for
every table header. Both of its branches were exercised live against a
throwaway config: a [custom_theme] table applies, and a duplicated
header still reports the correct span.

Assisted-By: Claude Opus 5
---
 Cargo.lock   |  6 +++---
 Cargo.toml   |  2 +-
 NOTES.md     | 30 +++++++++++++++++++++++++++++-
 docs/retch.1 |  2 +-
 4 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 17bf472..6434e2f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1564,7 +1564,7 @@ checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "retch-cli"
-version = "0.17.15"
+version = "0.17.16"
 dependencies = [
  "anyhow",
  "base64",
@@ -1874,9 +1874,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "1.1.5+spec-1.1.0"
+version = "1.1.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12c0ba9680044b4ce98d391a62094047eada0d64860b80166c39f4a6b5640785"
+checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
 dependencies = [
  "indexmap",
  "serde_core",
diff --git a/Cargo.toml b/Cargo.toml
index 0f4d1dc..6b97fe4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,7 +6,7 @@ members = [
 
 [package]
 name = "retch-cli"
-version = "0.17.15"
+version = "0.17.16"
 edition = "2021"
 authors = ["Ken Tobias"]
 description = "A fast, feature-rich system information fetcher written in Rust (similar to fastfetch or neofetch)"
diff --git a/NOTES.md b/NOTES.md
index f0dfaab..235fa29 100644
--- a/NOTES.md
+++ b/NOTES.md
@@ -121,7 +121,35 @@ The `retch-sysinfo` crate can be used independently as a library for cross-platf
 
 ---
 
-## Current State (v0.17.15)
+## Current State (v0.17.16)
+- **v0.17.16 - `toml` 1.1.5 -> 1.1.6 (consolidated Dependabot #251)** (chore; no runtime
+  behaviour change). Rolls Dependabot's PR onto a gated branch so the release hygiene it
+  bypasses - version bump, NOTES entry, man regen - is actually done, following the
+  standing pattern (#167/v0.6.3 through #228/v0.11.8).
+  - **Lockfile-only.** The spec is `"1.1"` and a caret range already admits 1.1.6, so neither
+    manifest widens. The `Cargo.lock` diff is exactly the `toml` entry plus the `retch-cli`
+    version, with **no transitive movement** - `toml_parser`, `serde_core` and `indexmap` stay
+    put, and 1.1.6's own manifest differs from 1.1.5's only in its version line (MSRV still
+    1.85).
+  - **Unlike v0.11.4's `toml` 1.1.5, this one IS reachable, and that was established from the
+    source.** Both `.crate` files were downloaded (sha256 matching the lockfile checksums) and
+    compared file by file: the whole code change is one function,
+    `src/de/parser/document.rs::finish_table`, which `toml::from_str` runs for every
+    `[table]` / `[[array]]` header - and retch's single call site is `toml::from_str` in
+    `src/config.rs`. The change is an ownership refactor only: the header key is **moved**
+    into the parent table instead of cloned, and `key_span` is computed before that move
+    rather than inside the duplicate-key error branch. Same insertions, same error, same span.
+  - **Both branches of that function were exercised live on the 1.1.6 build**, against a
+    throwaway `XDG_CONFIG_HOME` rather than the user's config (which has no table headers, so
+    it would not reach the changed code at all): a `[custom_theme]` table with
+    `label_color = "#ff0000"` renders the label as `ESC[38;2;255;0;0m`, and a duplicated
+    `[custom_theme]` header fails with `duplicate key` pointed at **line 4, column 2** - the
+    moved `key_span`, still correct.
+  - The upstream commit list names allocation reductions in `toml_edit` parsing and display;
+    **`toml_edit` is not in retch's graph**, so only the `document.rs` hunk reaches us.
+  - `retch-cli` -> `0.17.16`; `retch-sysinfo` unchanged at `0.1.76` (it does not depend on
+    `toml`). Patch bump.
+
 - **v0.17.15 - the one attribution bullet this repo was missing** (`AGENTS.md`). Documentation
   only; no code change.
   - This repo already carried three of the four attribution sub-bullets, and `etr` and
diff --git a/docs/retch.1 b/docs/retch.1
index 4b4b360..a783006 100644
--- a/docs/retch.1
+++ b/docs/retch.1
@@ -1,4 +1,4 @@
-.TH "RETCH" "1" "September 2026" "retch 0.17.15" "System Information Fetcher"
+.TH "RETCH" "1" "September 2026" "retch 0.17.16" "System Information Fetcher"
 
 .SH "NAME"
 .PP