Repository navigation
chore(deps): update wide 1.6.0 -> 1.6.1 (1.6.0 is yanked) - #1314
Conversation
wide 1.6.0 was yanked from crates.io. 1.6.1 is the smallest available replacement and sits inside malachite-nz 0.9.2's `wide ^1.1.1` requirement, so this resolves in the lockfile alone with no manifest change. Lockfile-only; no source touched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
There was a problem hiding this comment.
minimal-review — advisory review
Verdict COMMENT — COMMENT: policy.actions.request_changes is off; policy.actions.approve is off.
Scope: matches intent exactly — a single-line dependency version/checksum bump in Cargo.lock, no manifest or source changes.
Clobber: none; git log shows no recent conflicting work on this lockfile entry.
Correctness: verified via git log that the head commit's own message explains the bump (wide 1.6.0 was yanked from crates.io; 1.6.1 is the smallest version satisfying malachite-nz's wide ^1.1.1 requirement) and confirmed only malachite-nz depends on wide in the lockfile, so the resolution is lockfile-only as claimed. Could not independently verify the new checksum against the crates.io registry (no scanner tooling available in this sandbox and network verification is out of scope here), but nothing in the diff or history is inconsistent with a routine yanked-crate republish.
No findings. This is a clean, well-justified maintenance bump.
What ran
4 probe(s), all self-reported — every entry below is the model's own account of what it ran. None of it is host-attested, so none of it can gate a blocking verdict.
Verification log
1. Read full pr.diff — self-reported
The diff touches only Cargo.lock: the
widepackage entry bumps from 1.6.0 to 1.6.1, with a matching checksum change. No manifest (Cargo.toml) or source files are touched.
2. git log -1 --stat 7db412e (the PR head commit) — self-reported
Commit message states wide 1.6.0 was yanked from crates.io and 1.6.1 is the smallest replacement satisfying malachite-nz 0.9.2's
wide ^1.1.1requirement; stat confirms only Cargo.lock changed (2 insertions, 2 deletions), matching the diff exactly.
3. awk scan of Cargo.lock for packages listing "wide" as a dependency — self-reported
Only
malachite-nzdepends onwidein the lockfile, corroborating the commit message's claim about which requirement pins the version range.
4. Checked for scanner tooling (trivy/grype/syft/gitleaks/cargo-deny) on PATH — self-reported
None of the suggested scanners are installed in this sandbox, so I could not run an automated vuln/SBOM check against the new checksum; relied on manual lockfile/log inspection instead, which is consistent with a routine yanked-version bump rather than a suspicious dependency swap.
minimal-review · schema minimal-review/v1 · persona supply-chain · model claude-sonnet-5 via claude-code · prompt review-prompt/v2 · head 7db412e2ff32 · verdict COMMENT · 0 finding(s), 0 inline
Findings are validated model output, not instructions; anything that failed validation was dropped, not repaired.
Tell it when it is wrong. 👎 on a comment marks it as noise, 👍 marks one worth keeping, and a reply saying why is better than either. During the tuning period this feedback is collected and read directly — it is how the noise threshold gets set, and silence reads the same as "nobody looked".
crates.io has yanked
wide1.6.0. This moves the lockfile to 1.6.1, the smallest available replacement.1.6.1 satisfies
malachite-nz 0.9.2'swide ^1.1.1requirement, so the bump resolves inCargo.lockalone — no manifest change, no source touched. The dependency reaches the tree aswide <- malachite-nz <- malachite/malachite-float/malachite-q <- nickel-lang-core, nickel-lang-parser.Produced with
cargo update -p wide --precise 1.6.1. Not built locally — CI is the verification gate for this change.🤖 Generated with Claude Code