Repository navigation
fix(deps): bump npm and rust dependencies - #33
Merged
Merged
Conversation
Refresh every Cargo.lock and take the semver-major bumps that compile: oxc 0.136 -> 0.154, rusqlite 0.32 -> 0.40, zip 2 -> 9, sort-package-json 0.0.12 -> 1, prek-identify 0.3 -> 0.5, fancy-regex 0.18 -> 0.19, ctor 0.2 -> 1. Adapt to the API changes: ParserReturn::fatal_error replaces panicked, SortOptions is now non-exhaustive (builder methods), ZipFile::name() is fallible (use name_raw), and #[ctor] requires the explicit `unsafe` marker. codspeed-criterion-compat stays on 4.x to match the pinned cargo-codspeed and CodSpeed action. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Bump the pnpm catalogs and workspace manifests, including the packem 4,
@visulima/{fs,path,find-cache-dir,colorize,boxen} majors, happy-dom 21,
cssnano 9, @eslint/css 2 and eslint-plugin-zod 5.
Drop the @napi-rs/cli pin: 3.10.x distributes the .node artifacts into the
npm/<platform> packages again and the secret-scanner tests pass on it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Contributor
|
Thank you for following the naming conventions! 🙏 |
github-actions
Bot
added
package: vis
package: tui
package: secret-scanner
package: task-runner
package: vis-mcp
package: dashboard
size:XXL
zip 9 pulls in zlib-rs and rusqlite 0.40 pulls in foldhash, both Zlib licensed. Zlib is a permissive OSI-approved license, comparable to the others on the allow list. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Merging this PR will degrade performance by 18.77%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ❌ | transform 256 colors through protanopia |
126.5 µs | 622.1 µs | -79.66% |
| ❌ |
storeAction (1MB payload) |
41.6 ms | 145.3 ms | -71.36% |
| ❌ | monotonic span cursor |
45.9 µs | 123.9 µs | -62.99% |
| ❌ | getSpan() per char (linear scan) |
774.2 µs | 1,861.2 µs | -58.4% |
| ❌ | getSpan() per char (linear scan) |
4.7 ms | 11.2 ms | -57.48% |
| ❌ | monotonic span cursor |
26.2 µs | 58.5 µs | -55.16% |
| ❌ | 200 tasks (5×40) |
2.6 ms | 5.2 ms | -49.28% |
| ❌ | simple tree |
329.4 µs | 556.5 µs | -40.82% |
| ❌ |
JS hashFile (our SHA-256 fallback) |
4.6 s | 7.5 s | -38.17% |
| ❌ |
incremental hasher (warm cache) |
4.8 s | 7.8 s | -38.12% |
| ❌ |
JS hashFile (our SHA-256 fallback) |
595.8 ms | 956.6 ms | -37.72% |
| ❌ |
incremental hasher (warm cache) |
639.1 ms | 1,023.4 ms | -37.55% |
| ❌ | 200 tasks |
625.2 µs | 1,000.4 µs | -37.5% |
| ❌ | acyclic 200 tasks (no cycle) |
309 µs | 489.2 µs | -36.84% |
| ❌ |
incremental hasher (warm cache) |
23.2 ms | 34.6 ms | -33.07% |
| ❌ |
JS hashFile (our SHA-256 fallback) |
18.9 ms | 27.9 ms | -32.39% |
| ❌ |
hash all 10 tasks (sequential) |
18.3 ms | 26.5 ms | -31.08% |
| ❌ | previous · per-package variant set rebuild |
1.8 s | 2.6 s | -30.32% |
| ❌ |
complex tree |
995 µs | 1,346.9 µs | -26.12% |
| ❌ |
simple tree |
624.8 µs | 840.5 µs | -25.66% |
| ... | ... | ... | ... | ... |
ℹ️ Only the first 20 benchmarks are displayed. Go to the app to view all benchmarks.
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing t3/finish-dep-bump-rust-deps (17a5a9a) with main (c71b539)
@visulima/tui
@visulima/secret-scanner
@visulima/task-runner
@visulima/task-runner-client
@visulima/vis
@visulima/vis-mcp
@visulima/tui-binding-darwin-arm64
@visulima/tui-binding-darwin-x64
@visulima/tui-binding-linux-arm64-gnu
@visulima/tui-binding-linux-arm64-musl
@visulima/tui-binding-linux-x64-gnu
@visulima/tui-binding-linux-x64-musl
@visulima/tui-binding-win32-arm64-msvc
@visulima/tui-binding-win32-x64-msvc
@visulima/secret-scanner-binding-darwin-arm64
@visulima/secret-scanner-binding-darwin-x64
@visulima/secret-scanner-binding-linux-arm64-gnu
@visulima/secret-scanner-binding-linux-arm64-musl
@visulima/secret-scanner-binding-linux-x64-gnu
@visulima/secret-scanner-binding-linux-x64-musl
@visulima/secret-scanner-binding-win32-arm64-msvc
@visulima/secret-scanner-binding-win32-x64-msvc
@visulima/task-runner-binding-darwin-arm64
@visulima/task-runner-binding-darwin-x64
@visulima/task-runner-binding-linux-arm64-gnu
@visulima/task-runner-binding-linux-arm64-musl
@visulima/task-runner-binding-linux-x64-gnu
@visulima/task-runner-binding-linux-x64-musl
@visulima/task-runner-binding-win32-arm64-msvc
@visulima/task-runner-binding-win32-x64-msvc
@visulima/vis-binding-darwin-arm64
@visulima/vis-binding-darwin-x64
@visulima/vis-binding-linux-arm64-gnu
@visulima/vis-binding-linux-arm64-musl
@visulima/vis-binding-linux-x64-gnu
@visulima/vis-binding-linux-x64-musl
@visulima/vis-binding-win32-arm64-msvc
@visulima/vis-binding-win32-x64-msvc
commit: |
…export vitest 5 drops the top-level `bench` export in favour of a `bench` test fixture, so every __bench__ file fails with "bench is not a function" under the CodSpeed runner. Keep vitest, @vitest/coverage-v8 and @vitest/ui on 4.1.11; the CodSpeed plugin 6.x supports vitest 4. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
prisis
changed the title
Contributor
prisis
pushed a commit
that referenced
this pull request
Oct 17, 2026
## @visulima/secret-scanner [2.0.3](https://github.com/visulima/vis/compare/@visulima/secret-scanner@2.0.2...@visulima/secret-scanner@2.0.3) (2026-10-17) ### Bug Fixes * **deps:** bump npm and rust dependencies ([#33](#33)) ([bb0d78e](bb0d78e))
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
@visulima/{fs,path,find-cache-dir,colorize,boxen}majors, happy-dom 21, cssnano 9,@eslint/css2, eslint-plugin-zod 5, …).@napi-rs/clipin dropped (3.7.2 → 3.10.8). Verifiednapi artifactsdistributes.nodefiles intonpm/<platform>/and secret-scanner tests pass.Cargo.locks refreshed; majors taken: oxc 0.154, rusqlite 0.40, zip 9, sort-package-json 1, prek-identify 0.5, fancy-regex 0.19, ctor 1, with the small API adaptations they need.codspeed-criterion-compatintentionally stays on 4.x (CI pinscargo-codspeed ^4and CodSpeed action v4).Two commits, so either half can be reverted on its own.
Verification (local, darwin-arm64)
nx affected -t build lint:types lint:eslint: green.tag.gpgsignis set (git tagneeds a message).FORCE_COLOR=1, identical tomain(no TTY in the harness); not caused by this PR.cargo check/testpass on all four native workspaces. Pre-existing clippy lints on the floating stable toolchain are untouched.Not verified
Rust majors were only built and tested on darwin-arm64. Watch the Build Native job: rusqlite's bundled SQLite through the cross toolchain is the most likely break.
🤖 Generated with Claude Code